380 K263SCH1 REDACTED 2 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK ------------------------------x 3 UNITED STATES OF AMERICA, 4 v. 1 5 JOSHUA ADAM SCHULTE, 6 7 S2 17 Cr. 548 (PAC) Defendant. Trial ------------------------------x New York, N.Y. February 6, 2020 9:00 a.m. 8 9 Before: 10 HON. PAUL A. CROTTY, 11 District Judge and a jury 12 13 14 15 16 17 18 19 20 APPEARANCES GEOFFREY S. BERMAN United States Attorney for the Southern District of New York BY: MATTHEW J. LAROCHE SIDHARDHA KAMARAJU DAVID W. DENTON JR. Assistant United States Attorneys SABRINA P. SHROFF JAMES M. BRANDEN Attorneys for Defendant -andDAVID E. PATTON Federal Defenders of New York, Inc. BY: EDWARD S. ZAS Assistant Federal Defender 21 Also Present: 22 23 24 Colleen Geier Morgan Hurst, Paralegal Specialists Achal Fernando-Peiris John Lee, Paralegals Daniel Hartenstine Daniella Medel, CISOs, Department of Justice 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 381 K263SHC1 1 (In open court; jury not present) 2 THE COURT: 3 THE DEPUTY CLERK: 4 THE COURT: 5 MR. BRANDEN: 6 The jurors aren't here yet. We're missing one. Bring Mr. Schulte out. Is he here? He is present, Judge, I've asked for him to be presented. 7 (Defendant present) 8 THE COURT: While we're waiting for the jury to 9 arrive, can we discuss Mr. Schulte's letter of January 17, the 10 government's response of the 24th, and the Federal Defenders' 11 response of January 27. 12 raised yesterday and asked me to take a look at, which I've 13 done. This is the material that Mr. Zas I understand Mr. Schulte's request. 14 What's the government's response? 15 MR. LAROCHE: Our position remains, your Honor, that 16 the defense is able to conduct an investigation, that they can 17 do so with the names they've been provided. 18 cannot do is connect their affiliation to the agency in 19 circumstances where that affiliation is classified. 20 THE COURT: 21 MR. LAROCHE: But what they What does that mean? So, for example, they can't Google 22 someone by putting in that person's name and CIA officer. 23 That's classified information. 24 25 THE COURT: Can they put in their home address, for example? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 382 K263SHC1 1 MR. LAROCHE: 2 THE COURT: 3 MR. LAROCHE: 4 MR. ZAS: Yes. They could identify them by home address. They could, your Honor. Your Honor, the problem is the government 5 has refused to give us the home addresses of any of these 6 witnesses, they are redacted on all of these 302 reports that 7 we've gotten. 8 problem. 9 addresses, because we've had to keep it all in the SCIF. 10 We haven't had them. That's been part of the It's as if we were never given the names or the We're totally blind here. We're only relying on what 11 the government told us. We are on day three of the trial, and 12 we have not had what the Sixth Amendment gives Mr. Schulte, 13 which is the chance to investigate before you come to trial. 14 That's why we were pushing it. 15 MR. LAROCHE: Your Honor, it is not our practice in 16 any case to provide witness addresses to the defense. 17 putting that aside, the -- 18 19 20 21 THE COURT: It is in all the arrest records in which you produce. MR. LAROCHE: THE COURT: 23 MR. LAROCHE: 25 If there are arrest records, but there are no arrest records. 22 24 But It's in the pretrial services reports. There are no pretrial services reports related to any of our witnesses. THE COURT: I understand that, but, I mean, normally, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 383 K263SHC1 1 in a normal case, the defendant has access to identifying 2 information for all the witnesses. 3 MR. LAROCHE: They've had identifying information as 4 to all of our witnesses since we produced 302s in December of 5 2018. 6 until a week before trial. 7 August of 2019. 8 week before trial. 9 They've decided not to raise this issue, your Honor, They still have not raised this issue until a We're not objecting to them being able to conduct an 10 investigation. 11 and they failed until now. 12 They've had our witness list since But they've had ample time to raise this issue, THE COURT: How can they conduct an investigation if 13 they don't know where the person is located that they want to 14 investigate? 15 16 MR. LAROCHE: They've known a plethora of information about these people based on what we've disclosed to them. 17 THE COURT: Tell me again what you have disclosed. 18 MR. LAROCHE: We've disclosed all witness interviews 19 with anyone that's been interviewed in connection with this 20 investigation. 21 To the extent that there is anything in the security files of 22 these witnesses that is subject to disclosure, we've disclosed 23 that as well. 24 25 That includes all 302s all of our witnesses. MR. ZAS: remarkable things. Your Honor, Mr. Laroche said a number of That it is the government's practice not to SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 384 K263SHC1 Smith v. Illinois holds, 1 divulge home addresses of witnesses. 2 it's the holding of the case that the defense is entitled to 3 the names and addresses of a witness. We're not doing what defendants sometimes do which is 4 5 trying to air it in open court. 6 we can do the investigation. 7 We're just trying to get it so I personally, as soon as Mr. Hartenstine told me for 8 the first time that I could investigate these witnesses, so 9 long as I didn't specifically tie it to the CIA, I personally 10 immediately typed in the name, for example, of this witness, 11 whose initials are 12 and thousands of Americans have. 13 absolutely nothing. 14 put it in an address, I don't know where he lives. 15 refused. 16 . It is a name that probably thousands I Googled him. I got 10,000 I got . I couldn't They Now they're telling us in the middle of trial that 17 somehow we've waived this issue. 18 issue; this is a trial issue. 19 shadows to us. 20 given us. 21 gave us, we're supposed to have our investigator finding who 22 these people are. 23 are completely blind. 24 Ms. Shroff is almost done with her cross. 25 This is not a discovery It's outrageous. These are We have relied on only what the government has The cases hold we don't have to rely on what they Talk to a neighbor. Talk to a friend. We And how can I investigate this witness, MR. HARTENSTINE: I'd like to remind the parties SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 385 K263SHC1 1 quickly this is not a closed courtroom or a venue for 2 classified discussion. 3 4 MR. ZAS: I don't think I mentioned anything classified. 5 THE COURT: 6 MR. ZAS: 7 THE COURT: 8 MR. ZAS: 9 THE COURT: The passion -You mentioned a name. I'm sorry? 10 MR. ZAS: 11 THE COURT: 12 MR. ZAS: 13 You did. You mentioned a name. I just mentioned the initials. You mentioned the name. It was a total slip. I apologize, your Honor. 14 THE COURT: All right. 15 MR. ZAS: 16 suggesting it is our fault. 17 these rules. 18 who say that this is classified. 19 Court doesn't have the power to make it unclassified. 20 government says they have to go back to the CIA. 21 the CIA did. 22 eventually, Judge, to say do something. Just one additional point. Mr. Laroche is This is something that came from The CIA is the equity holder. They are the ones The government has said the We had no power to fix it. Even the This is what We had to go to you 23 So now Mr. Laroche is saying it's our fault. 24 it is our fault due to the government's conduct, the important 25 point is Mr. Schulte was supposed to get effective SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 But if 386 K263SHC1 1 representation. I'm telling you as an officer of the court, 2 not only was our investigation not reasonable, it was nothing. 3 I could only talk to Ms. Shroff and members of the cleared team 4 in the SCIF. 5 Constitution guarantees. That's the investigation. 6 THE COURT: 7 MR. ZAS: 8 THE COURT: 9 10 Right. I'm sorry. Thank you. Thank you. Mr. Laroche, if you want to submit anything further, I'll give you a decision tomorrow morning. 11 MR. LAROCHE: 12 THE COURT: 13 MR. LAROCHE: 14 That's not what the Thank you, your Honor. Is the jury here? Your Honor, may we raise one other issue? 15 THE COURT: Yes. 16 MR. LAROCHE: Ms. Shroff has been, I believe intends 17 to introduce the task force report which has been the subject 18 of some litigation among the parties. 19 made a ruling as to portions of that report that may come in. 20 And I know the Court has We just want to flag for the Court, and we are not 21 objecting to her cross-examining anybody about the report. 22 to the extent Ms. Shroff does go down that path, we think that 23 opens the door to have some of our witnesses testify as to what 24 some of the assessments in the report are based on. 25 clear, some of the assessments in the report are based on an SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 But To be 387 K263SHC1 1 assessment that he was the one responsible for stealing the 2 materials. 3 So for example, some of the assessments are the amount 4 of materials that were potentially taken from the agency. 5 expect that there would be testimony that that is based on an 6 assessment of how much information that Mr. Schulte had access 7 to. 8 wants to suggest that this report has some value to it, we 9 should be able to elicit from our witnesses what the basis for 10 We So we flagged that, because to the extent the defense those assessments are. 11 THE COURT: Has that been disclosed in the report? 12 MS. SHROFF: 13 MR. LAROCHE: No. The report very clearly refers to a CIA 14 employee. 15 introduce that report, we would elicit who that CIA employee is 16 based on. 17 things that happened with respect -- 18 19 20 My point is simply that to the extent they want to And some of the things in the report are based on THE COURT: This is information you haven't previously disclosed? MR. LAROCHE: We haven't. 21 intention of relying on it. 22 THE COURT: 23 MS. SHROFF: 24 THE COURT: 25 MS. SHROFF: All right. Because we have no Is the jury here, David? May I just respond? Yes. So, I want to understand something. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 They 388 K263SHC1 1 have known since our CIPA notice that we intend to rely on this 2 document. 3 repeatedly, that this entire document should be produced to us 4 so that we can properly assess how to use it at trial. 5 government fought and fought and fought us at every step over 6 every word, over every number, and gave us a miniscule amount 7 of information. 8 We have repeatedly briefed for this Court, The We litigated this matter months ago. Now, in the middle of a cross is when Mr. Laroche 9 stands up and heeds a warning, gives a warning telling me that 10 if I rely on or introduce or publish to the jury this document, 11 they will then rely on parts of the document that remain 12 redacted now. 13 MR. LAROCHE: 14 MS. SHROFF: That's not what I said. That is exactly what he said. 15 Mr. Schulte's name does not appear at all in that, in the 16 unredacted portion of the report that I have. 17 mentioned once. 18 His name is not Not once. It is very difficult to try this case. It is very 19 difficult to try the case when I've told this Court repeatedly 20 we are not ready. 21 of a cross, a cross we were not even anticipating having to do 22 now until last week, because last week the government gave us a 23 list of witnesses that do not correspond to the list of 24 witnesses they are now calling this week. 25 is a witness I'm utterly unprepared to cross, because he was And then to have this come up in the middle Their next witness SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 389 K263SHC1 1 changed at the last minute from an FBI agent. 2 THE COURT: 3 THE DEPUTY CLERK: 4 THE COURT: 5 MS. SHROFF: 6 Yes, Judge. Call the jury in. What am I supposed to do about the report? 7 8 Is the jury here? THE COURT: You should do what you want to do, Ms. Shroff. 9 MS. SHROFF: I don't have the unredacted report, your 10 Honor. If Mr. Laroche is going to be able to elicit 11 information about that report, we should get an unredacted copy 12 of it. 13 portions of a report that I have not seen. Mr. Laroche cannot possibly be allowed to rely on 14 THE COURT: Mr. Laroche, what about that? 15 MR. LAROCHE: My point had nothing do with the 16 redacted portions. 17 that are being relied on by the defense to make points on 18 cross-examination. 19 related to the unredacted portions. 20 21 My point had to do with the assessments I have no intention of eliciting anything MS. SHROFF: That is unredacted. Could the Court just take a look at the document, please. 22 THE COURT: 23 MS. SHROFF: 24 THE COURT: 25 MS. SHROFF: This is what, the task force report? Yes, please. This Exhibit Number 1? Well, it was originally Exhibit Number 1. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 390 K263SHC1 1 I think it is now renumbered as 500. 2 MR. LAROCHE: 3 MS. SHROFF: 4 THE COURT: 5 MS. SHROFF: 6 7 8 9 It's 5001. Could you just take a look at the report. Yes. If the Court just could take a look at the -THE COURT: Just a minute, please. All right, Ms. Shroff. MS. SHROFF: So, I just ask you to take a look and 10 note here that the one references that the "CIA assessed that 11 in the spring of 2016, a CIA employee stole at least --" 12 THE COURT: 13 MS. SHROFF: 14 Which says "we assess that." 15 THE COURT: 16 MS. SHROFF: 17 THE COURT: 19 MS. SHROFF: Yes, all right. So that is the only line which references Yes. Right? The next page talks about the system failures and the weaknesses in the system. 21 THE COURT: 22 MS. SHROFF: 23 I'm reading from the executive summary. that a CIA employee stole. 18 20 Where are you reading from? Yes. The next page is redacted but for a paragraph. 24 THE COURT: 25 MS. SHROFF: The wake-up call. Right. The wake-up call. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 The next 391 K263SHC1 1 paragraph talks about recommendations. 2 THE COURT: 3 MS. SHROFF: Yes. The next -- I mean, let me just be clear 4 so the record is clear. 5 seven. 6 THE COURT: 7 MS. SHROFF: 8 Yes. Then the next page produced to us is page 12. 9 THE COURT: 10 MS. SHROFF: 11 But, page seven, it jumps to page Yes. Which is redacted almost entirely but for a paragraph that says "Recommendation A5." 12 THE COURT: Correct. 13 MS. SHROFF: Right. This talks about nothing on the 14 basis for which these assessments are made. 15 the fact that the CIA concluded Mr. Schulte or a single person 16 was responsible for this. 17 fully on the first paragraph about what the WikiLeaks 18 disclosure shows. 19 THE COURT: 20 MS. SHROFF: 21 It doesn't rely on The next page focuses clearly and What page is this? They then jump to 14. They would not give us 13. 22 THE COURT: 23 MS. SHROFF: 24 section. 25 that's page 45. Yes. So then they have a recommendation The next page talks about data in Confluence and So the government has pages 14 to 44, I mean SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 392 K263SHC1 1 15 to 44. I have no idea what's written on them. 2 THE COURT: 3 MS. SHROFF: All right. This paragraph deals with data in 4 Confluence, and of course there is the beautiful page 46 that 5 has only two lines and completely redacted after that. 6 this is what it says: 7 about the scope and timing of the loss, in part because we 8 lacked effective monitoring and auditing of this mission 9 system." And "We are making educated assumptions Then it jumps from 46 to 49. 10 THE COURT: 11 MS. SHROFF: Okay. What's the point here, Ms. Shroff? My point is this. Look, they knew 12 yesterday that I was going to rely on this document. They 13 could have brought, they could have flagged this yesterday 14 evening. 15 THE COURT: Mr. Laroche, what are you going to do? 16 MS. SHROFF: Why am I waiting until the Court is 17 18 19 20 seated for me to be told this by the government? THE COURT: All right. Mr. Laroche, what are you proposing to do? MR. LAROCHE: I'm simply flagging the fact that we 21 would potentially ask a witness with knowledge of this report 22 what these assessments were based on. 23 one of the report. 24 THE COURT: 25 MR. LAROCHE: So for example, on page Is this the witness on the stand? No, this is not the witness on the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 393 K263SHC1 1 stand. This.witness I expect would say he's never seen this 2 document. 3 I've never shown him this document. 4 I had no intention of showing him this document. My point is simply, to the extent the defense wants to 5 rely on assessments that are in the unredacted portions of the 6 report to support their defense, that the government should be 7 entitled to call a witness with knowledge of the matter who 8 would say what those assessments were based on. 9 So, for example, on the first page, in the second 10 paragraph, "We assess that in the spring of 2016, a CIA 11 employee stole at least 180 gigabytes to as much as 34 12 terabytes of information." 13 with knowledge of the matter to talk about what that assessment 14 is based on. 15 MS. SHROFF: We may potentially call a witness Okay. What is that assessment based on? 16 Can they make a disclosure now so I can make an informed 17 decision? 18 MR. LAROCHE: My point simply is that we will make 19 those disclosures to the extent we decide to call such a 20 witness. 21 and relying on this report, it may open the door to that. 22 That's all, that's the only reason I'm flagging it. 23 But that by pursuing this line of cross-examination, MS. SHROFF: Right. And the normal trial, I wouldn't 24 have to worry about some prosecutor standing up and flagging 25 something when I'm in the middle of a cross, because I would SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 394 K263SHC1 1 have the basis on which a report is written. 2 wrote the report. 3 I would know who You know how many times we have asked the United 4 States attorney's office who wrote this report? 5 compiled, who compiled it, when was it compiled, what did it 6 rely on? We received nothing. 7 THE COURT: 8 rule on this later. 9 How was it We're keeping the jury waiting now. Call the jury. Mr. Weber. (Continued on next page) 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I'll 395 K263SCH1 Weber - Cross 1 (In open court; jury present) 2 THE COURT: Good morning. Let me just ask the jury 3 before we get started this morning, did you follow my 4 instructions not to discuss the case and not to do any 5 research? Thank you very much. All right. 6 Is the witness available? 7 MR. LAROCHE: 8 THE COURT: 9 Mr. Weber, let me remind you, you're still under oath. 10 THE WITNESS: 11 THE COURT: 12 Yes, your Honor. Yes, your Honor. Ms. Shroff. JEREMY WEBER, 13 CROSS-EXAMINATION 14 BY MS. SHROFF: 15 Q. Good morning, Mr. Weber. 16 A. Good morning. 17 Q. Mr. Weber, all told, how many years have you known 18 Mr. Schulte? 19 A. I think it was about six, five or six years. 20 Q. And in the five or six years that you knew Mr. Schulte, it 21 was all through your affiliation with him at the CIA; is that 22 correct? 23 A. We occasionally would hang out outside of work. 24 Q. No, what I meant is, you'd never met him before he started 25 work at the CIA, correct? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 396 K263SCH1 Weber - Cross 1 A. That is correct. 2 Q. And while you and he worked at the CIA together, you worked 3 in the same physical location, correct? 4 A. That is correct. 5 Q. And would it be fair to say that at no time in those six 6 years did you ever see Mr. Schulte leave the CIA with anything 7 physical? 8 A. Can you say the last part again? 9 THE COURT: 10 MS. SHROFF: 11 Could you speak into the microphone? I thought I was. I'm sorry. Am I not? Is that better? 12 THE COURT: That's better. Thank you. 13 Q. You never saw him leave with a computer, correct? 14 A. That is correct. 15 Q. Never saw him leave with a hard drive, correct? 16 A. That is correct. 17 Q. And you never saw him leave with anything that concerned 18 you to call security, correct? 19 A. That is correct. 20 Q. Now, you reminded me yesterday, you have been at the CIA 21 for almost 10 years; am I right? 22 A. That's correct. 23 Q. And in those 10 years, have you seen other people leave the 24 CIA building with computers? 25 A. For official purposes, yes. But never for unofficial SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 397 K263SCH1 Weber - Cross 1 reasons. 2 Q. How would you know if they were official reasons? 3 A. That's a good point. 4 was for official reasons. 5 Q. 6 the compound, and leave, correct? 7 A. Usually the computer would be locked up. 8 Q. Again, you don't know, right? 9 A. The -- 10 Q. It's just a simple question. 11 A. No. 12 Q. Just an assumption you're making here because you are a CIA 13 employee, correct? 14 A. Locked bags are pretty obvious when they're locked. 15 Q. You couldn't see inside a locked bag, right? 16 A. No. 17 Q. Right. 18 computer, correct? 19 A. Yes. 20 Q. It could be a locked bag with a hard disc that had 21 everything on it, correct? 22 A. Yes. 23 Q. In fact, a locked bag would be the best way to take 24 something that's unlocked, correct? 25 A. Right. I don't know, I wouldn't know if it So you've seen people carry a computer, walk across Do you know? So it could be a locked bag with an unlocked Possibly. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 398 K263SCH1 Weber - Cross 1 Q. Do you know somebody named Justin Nichols, by the way? 2 A. Justin Nichols, yes. 3 Q. Do you recall a time when Justin Nichols was just rolling a 4 computer along the CIA open compound? 5 A. No. 6 Q. You don't, okay. 7 Let me talk about the physical space at the CIA. You 8 testified yesterday that you work in what is called a vault? 9 A. Yes. 10 Q. When you say a vault, it's just a room, right? 11 A. We would often be referring to what's referred to as a 12 SCIF. 13 Q. 14 the same thing 10 different ways or one thing in a more 15 complicated way. 16 A. That's not correct. 17 Q. You don't badge in? 18 A. You badge in to a SCIF, correct. 19 Q. So let's just stick to the room. 20 A. Yes. 21 Q. It's a wide-open area, correct? 22 A. Yes. 23 Q. It has cubicles, correct? 24 A. Yes. 25 Q. It has offices, correct? Right. But, the CIA does a lot of things, as you said, the But it's just a room like any other room? You badge in, correct? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 399 K263SCH1 Weber - Cross 1 A. Yes. 2 Q. And much like any other offices, the cubicles tend to be in 3 the middle, and the offices tend to be around the perimeter, 4 correct? 5 A. Yes. 6 Q. And the only thing that makes it all this special is 7 because it's called a SCIF, meaning that's where the CIA keeps 8 documents that it considers classified, correct? 9 A. That is not correct. 10 Q. What's not correct about that? 11 A. I don't know the specific details, but SCIFs have 12 significant security features. 13 Q. Like what? 14 A. I don't know the details. 15 Q. So all you know is you badge in and you go in, correct? 16 A. I -- I know that I have looked for other areas that my 17 branch could do work. 18 facilities we have looked at have not been approved by 19 security. 20 Q. 21 to work is just a large room with cubicles and offices, 22 correct? 23 A. No. 24 Q. Let's keep going with this no. 25 computers do you have? Okay. And the facilities, some of the But basically, at the end of the day, where you go On your desk, how many SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 400 K263SCH1 Weber - Cross 1 A. At the time? 2 Q. Sure. 3 A. I believe I had two computers. 4 Q. Okay. 5 A. Three. 6 Q. Three? 7 A. Yes. 8 Q. Tell us what they are. 9 A. So, one was a machine for DevLAN. One was for internet 10 research. And the other was for corporate e-mail. 11 Q. So, are these three in proximity to each other? 12 A. Yes. 13 Q. And you used to sit in a cubicle, correct? 14 A. Correct. 15 Q. And you already testified to this, but just because it's a 16 new day and I haven't gotten much sleep, you, Amol, and 17 Mr. Schulte sat basically close to each other, right? 18 A. That is correct. 19 Q. So you had three computers, right? 20 A. Yes. 21 Q. How many did Mr. Schulte have? 22 A. I believe he had three as well. 23 a secondary location. 24 Q. Okay. 25 A. I believe he had three. Plus an additional one in And how about Amol? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 401 K263SCH1 Weber - Cross 1 Q. So right in that cubicle that's three plus three plus 2 three, that's nine, correct? 3 A. Yes. 4 Q. Each one of those nine had at least one that had internet 5 access? 6 A. Yes. 7 Q. You and Mr. Laroche talked a great deal about these 8 computers being air gapped. 9 correct? One of them had internet access, 10 A. Yes. 11 Q. That sat right next to DevLAN, correct? 12 A. It would have sat in the same cubicle, but there are rules 13 that couldn't -- 14 Q. 15 question. 16 A. Understood. 17 Q. There's a computer, right? 18 A. Yes. 19 Q. In your cubicle? 20 A. Yes. 21 Q. Has internet access, right? 22 A. Yes. 23 Q. Okay. 24 correct? 25 A. I didn't ask you anything about rules. Just stick to my It will go a lot faster. You can sit at the computer to do internet access, Yes. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 402 K263SCH1 Weber - Cross 1 Q. Swivel your chair? 2 A. Yes. 3 Q. You get on to the classified computer? 4 A. Yes. 5 Q. Right? 6 A. Yes. 7 Q. Swivel back, yes? 8 A. Yes. 9 Q. Go to the internet? 10 A. Yes. 11 Q. Right? 12 A. Yes. 13 Q. Go to the unclassified computer, correct? 14 A. Yes. 15 Q. And all three in your cubicle? 16 A. Correct. 17 Q. Right. 18 to do all kinds of things, correct? 19 A. Correct. 20 Q. You testified that DevLAN is air gapped, right? 21 A. Yes. 22 Q. That means it can't access the internet? 23 A. Yes. 24 Q. Let's see if I can figure this out for you. 25 connected to the internet by an internet cable from the back, Do your classified work, correct? Swivel right. Right? And all three have wires connecting to allow them SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 You're 403 K263SCH1 Weber - Cross 1 correct? 2 A. Yes. 3 Q. You take out the internet cable from the back, and you plug 4 that internet cable into your DevLAN computer, and DevLAN has 5 internet, correct? 6 A. I don't know, actually. 7 Q. You worked at the CIA for 10 years? 8 A. Yes. 9 Q. This is simple, right? 10 A. There are security -- 11 Q. No, no, I didn't ask you that. 12 security forbade you to do it. 13 rules that forbid you to do it. 14 done. 15 A. 16 answer would be no. 17 set up. 18 Q. Fair enough. 19 A. That's correct. 20 Q. You do know there is an internet cable, right? 21 A. Yes. 22 Q. And you know that that cable can be plugged into the DevLAN 23 machine, correct? 24 A. Yes. 25 Q. Okay. If I can do it, you can do it. I didn't ask you if I'm not asking if there are I'm simply asking if it can be That's it. I don't know. If I had set up the internet network, the I don't know how the internet network was You didn't set up the internet network? And if you plug in an internet cable, from the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 404 K263SCH1 Weber - Cross 1 internet, into the DevLAN machine, DevLAN has cable -- I mean, 2 internet, correct? 3 A. No. 4 Q. You never tried it? 5 A. No. 6 Q. You remember a contractor doing that and getting into 7 trouble at the CIA? 8 A. No, I do not. 9 Q. Do you know what an ethernet cable is? 10 A. Yes, I do. 11 Q. What is that? 12 A. Ethernet is networking technology. 13 Q. What does that mean, it's network and technology? 14 A. The internet cable that you've been referencing, that would 15 probably been an ethernet cable. 16 Q. Did the CIA have ethernet cables on its internet computer? 17 A. I don't remember. 18 Q. You don't remember? 19 A. No. 20 Q. Do you know how the CIA got internet? 21 A. No. 22 Q. All told, how many employees had internet at the CIA? 23 A. At CIA, I have no idea. 24 Q. How about in your group? 25 A. In my group, I don't know. The division, if you go to SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 405 K263SCH1 Weber - Cross 1 that, almost every developer in the division had internet. 2 Q. How many developers? 3 A. The division had about 100 developers. 4 Q. It's fair to say, right, Mr. Weber, that there are no 5 cameras on you when you're working in your vault? 6 A. I don't know that. 7 Q. You don't know if the CIA has cameras watching its 8 employees? 9 A. No. 10 Q. Do you know if the CIA records you while you're at work? 11 A. I know of specific instances where I've been recorded. 12 I don't know if there have been instances where I am not aware 13 of. 14 Q. 15 or monitoring of its employees? 16 A. I have no idea. 17 Q. You don't know one way or another? 18 A. No. 19 Q. So you have no way of knowing that if somebody did in fact 20 take the ethernet cable and plug it into DevLAN, whether or not 21 there would be somebody monitoring them. 22 right? 23 A. I have no idea. 24 Q. Okay. 25 correct? But So you think it's possible that the CIA has video recording You just don't know, You talked a little bit about what DevLAN is, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 406 K263SCH1 Weber - Cross 1 A. Yes. 2 Q. And you mentioned DevLAN stands for development local area 3 network; is that right? 4 A. Yes. 5 Q. And this is in 2015 and 2016, right? 6 A. Yes. 7 Q. And during that time, even though it was called DevLAN, 8 DevLAN was not a local area network, right? 9 A. I would consider it a local area network. 10 Q. You would? 11 A. Yes. 12 Q. You wouldn't consider it a WAN instead of a LAN? 13 A. No, I would not. 14 Q. You would not consider it a wide area network? 15 A. No, I would not. 16 Q. Why not? 17 A. I, to me, the definition of a WAN is connection to a 18 network that you do not control. 19 network. 20 Q. That's what you would consider a WAN? 21 A. Yes. 22 Q. So, you would not consider, that means that if you -- you 23 controlled the network, it's always a LAN? 24 A. 25 split the hairs of this. "You" being the owners of the I -- I am not that much of a network engineer to be able to But I would consider it, yes. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 407 K263SCH1 Weber - Cross 1 Q. So then nobody ever has a WAN, because everybody controls 2 their own network, right? 3 else -- 4 I mean, it's not like somebody Does that make sense what I'm asking you? 5 A. The best example I can give is at home, the WAN on my home 6 network is the internet. 7 Q. 8 thing as a WAN, because you're putting the WAN on the same 9 level as the internet, right? Well, I mean, by that definition, then there is no such 10 Let me make this easier for you. Who had access to 11 DevLAN other than the on-site location? 12 A. The two foreign offices. 13 Q. Where were the foreign offices, generally speaking? 14 Foreign Office East and Foreign Office West, right? 15 A. Yes. 16 Q. That's quite a distance from your physical location in the 17 Washington, D.C. Metropolitan area, correct? 18 A. Yes. 19 Q. And who maintained their access, by the way? 20 A. I don't know. 21 Q. You don't know at all, right? 22 A. No. 23 Q. You don't know how many system administrators Foreign 24 Office East had? 25 A. No. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 408 K263SCH1 Weber - Cross 1 Q. 2 East had access to DevLAN? 3 A. No. 4 Q. You don't know how many employees are in the Foreign Office 5 East, correct? 6 A. Correct. 7 Q. In fact, you know nothing about Foreign Office East, 8 correct? 9 A. Correct. 10 Q. All you know is that it's connected to DevLAN, correct? 11 A. Yes. 12 Q. And you do not even know how that connection works, right? 13 A. Correct. 14 Q. You don't know how many people have access to it, correct? 15 A. Correct. 16 Q. You don't know what kind of employees there are, correct? 17 A. Correct. 18 Q. You don't know if the CIA in the Foreign Office East 19 employs only Americans or if it employs Americans and 20 foreigners; you just don't know, right? 21 A. The agency does not employ foreigners. 22 Q. The agency does not employ foreigners? 23 A. No. 24 Q. So there is one thing you know. 25 You don't know how many employees in the Foreign Office Great. Do you know anything else about the persons who work SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 409 K263SCH1 Weber - Cross 1 in the Foreign Office East? 2 A. No. 3 Q. Okay. 4 connects all the way to DevLAN, DevLAN is still a local area 5 network? 6 A. Yes. 7 Q. Okay. 8 office connects to DevLAN, do you know if it is a direct 9 connect? But, you think that even though Foreign Office East By the way, let me ask you this. When the foreign 10 A. No. 11 Q. You don't know, or, no, it's not a direct connect? 12 A. I don't know, sorry. 13 Q. You don't know? 14 A. Correct. 15 Q. And in your definition, if a foreign office is connecting 16 to another office, even if it's not a direct connect, it's 17 still not a WAN, correct? 18 A. Correct. 19 Q. And if it connects through intermediaries, it's still not a 20 WAN, correct? 21 A. Correct. 22 Q. In your definition, the only thing that makes for a WAN is 23 the internet? 24 A. 25 is still a LAN. It's broader than that. But, in the scenario you described SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 410 K263SCH1 Okay. Weber - Cross 1 Q. Now, when Mr. Laroche was asking you direct 2 questions, remember he talked to you a lot about the latency of 3 access from the foreign office to the Altabackup on site, 4 right? 5 A. Sorry, the latency of the -- 6 Q. The access time? 7 A. From the foreign office to -- we spoke specifically about 8 DevLAN, not -- 9 Q. Let's just stick to DevLAN. 10 A. Okay. 11 Q. You remember that testimony? 12 A. Yes. 13 Q. And you said that it took a long time, correct? 14 A. Yes. 15 Q. And you said that based on what experience? 16 A. From complaints that Frank and Patrick made to me. 17 Q. Right. 18 A. That's correct. 19 Q. Just complaints from what Frank and Patrick made to you? 20 A. Yes. 21 Q. You did nothing about those complaints, right? 22 A. I informed ISB and asked them to try and fix it, but 23 nothing beyond that. 24 Q. 25 connect? But that's it, right? You told ISB to fix what, the length of time it took to SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 411 K263SCH1 Weber - Cross 1 A. It was the speed of the connection. 2 Q. Right. 3 connection, right? 4 A. No, I did not. 5 Q. You didn't follow up with ISB? 6 A. No. 7 Q. But you're like a semi boss, right? 8 A. No. 9 Q. Oh. And you made sure ISB addressed the speed of So, when you complained to ISB, what is ISB's 10 obligation to you to follow through? 11 A. There was no obligation. 12 Q. So you can tell ISB to do nothing, and ISB doesn't have to 13 listen to you at all? 14 A. 15 under their purview. 16 Q. Right. 17 A. Correct. 18 Q. And they received your complaint, correct? 19 A. Yes. 20 Q. And ISB is there to fix the problem, correct? 21 A. I don't know. 22 Q. You just left your compatriots in Foreign Office East or 23 Foreign Office West hanging? 24 A. Yes. 25 Q. You never followed up? This is just somebody informing ISB of a problem that was But you are the one informing them, right? I didn't follow up. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 412 K263SCH1 Weber - Cross 1 MR. LAROCHE: 2 THE COURT: Objection. Overruled. 3 Q. What time frame was this in? 4 A. I don't remember. 5 Q. Was it 2015? 6 A. Probably around then. 7 Q. So you just don't know what the latency was in 2016, 8 correct? 9 A. No, I don't. 10 Q. For all you know, ISB improved it and you just don't know, 11 correct? 12 A. No, I've heard -- 13 Q. No, no, I didn't ask if you heard. 14 up and know. 15 A. Frank and Patrick -- 16 Q. I didn't ask you about Frank and Patrick. Do you know? 17 MR. LAROCHE: 18 THE COURT: 19 I asked if you followed Objection. He's answering the question. You can't interrupt him. You can move to strike. 20 MS. SHROFF: 21 Q. 22 the problem? I move to strike. The question is did ISB ever inform you that they had fixed 23 MR. LAROCHE: 24 THE COURT: 25 MS. SHROFF: That was not question she asked. It was a new question. I changed my mind. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 413 K263SCH1 1 Weber - Cross THE COURT: New question. 2 A. No, ISB never informed me they had fixed the problem. 3 Q. They didn't inform you that they did not fix the problem, 4 correct? 5 A. That is also correct. 6 Q. By the way, how many system administrators are there in 7 Foreign Office East? 8 A. I don't know. 9 Q. How about in Foreign Office West? 10 A. I don't know. 11 Q. You did not monitor their access of DevLAN, correct? 12 A. No, I did not. 13 Q. You don't know who monitors their access of DevLAN, 14 correct? 15 A. Correct. 16 Q. And that goes for Foreign Office East, correct? 17 A. Correct. 18 Q. And that also goes for Foreign Office West, correct? 19 A. Correct. 20 Q. Now, you testified yesterday that, according to you, DevLAN 21 was secure enough, correct? 22 A. Yes. 23 Q. And it is now, let's just move forward to 2016 or let's go 24 to 2017 at the CIA, okay? 25 A. Yes. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 414 K263SCH1 Weber - Cross 1 Q. Does the CIA use DevLAN in 2017? 2 A. No, it does not. 3 Q. 2018? 4 A. No, it does not. 5 Q. And when they moved off of DevLAN in 2017 and 2018, do you 6 think the CIA was concerned with its lack of security? 7 A. I'm sorry. 8 Q. Sure. 9 lack of security on DevLAN when it moved off of DevLAN in Could you repeat -- Do you think that the CIA was concerned with the 10 2016/'17? 11 A. 12 of what practices were in place. 13 Q. 14 maybe I'll try and be more clear. I believe in a situation like this, there would be a review You know, I'm going to really try and have you see if -- 15 Let's try it again. Do you know? 16 A. No. 17 Q. Okay. 18 job title, sir? 19 A. 20 Towards the end of 2016, I was a branch chief. 21 Q. 22 right? 23 A. That is correct. 24 Q. So, as the branch chief, did you know that the CIA 25 considered DevLAN an insecure system? Do you know -- by the way, in 2016, what was your The beginning of 2016, I would still have been a developer. Okay. And you were a branch chief by the end of 2016, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 415 K263SCH1 Weber - Cross 1 A. No. 2 Q. Did you know that the CIA considered that the DevLAN system 3 as it existed in 2016 was not secure? 4 A. No. 5 Q. Did you know that the CIA considered the lack of monitoring 6 problematic on DevLAN? 7 A. No. 8 Q. Did you know that the CIA considered not having log review 9 problematic on DevLAN? 10 A. No. 11 Q. Did you know that the CIA had problems that DevLAN allowed 12 for shared passwords? 13 A. No. 14 Q. Did you know that the CIA had concerns about developers 15 working on a system and creating both protection tools and 16 malware on the same platform? 17 A. No. 18 Q. You did not know that? 19 A. I don't know of any protection tools that we were creating. 20 Q. You don't know of CIA creating any protection tools at all? 21 A. Not on DevLAN. 22 Q. Not on DevLAN? 23 A. No. 24 Q. You ever heard the phrase "the wild wild west" while you 25 were working at the CIA? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 416 K263SCH1 Weber - Cross 1 A. Yes. 2 Q. And tell us, please, in what context, tell the jury, if you 3 would, in what context you heard that phrase. 4 By the way, do you need some water? 5 A. I have some, thank you. 6 Q. Okay. 7 A. The DevLAN allowed for the connection of exemplar machines. 8 We never knew what these exemplar machines would be, because 9 our adversaries can use all manners of equipment. So, from a 10 security plan, you could not write a security plan that said 11 these are the types of pieces of equipment that can be 12 connected to DevLAN and these aren't. 13 said, we weren't in control of what our adversary decides to 14 put on their networks. 15 Q. Okay. 16 A. The fact that there was no, like, there was no definition 17 of these types of devices are allowed and these types aren't. 18 Q. On DevLAN? 19 A. On DevLAN. 20 Q. So let's talk about that. 21 adversaries -- these are foreign government, right? 22 A. Yes. 23 Q. And you are following -- what did you call them? 24 systems? 25 A. Because of the, like I But how does that get to wild wild west? Which are these foreign Exemplars. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Exemplar 417 K263SCH1 Weber - Cross 1 Q. Could you explain that? 2 A. As much as I would love to be able to access and test 3 against the exact device we were going to deploy against, an 4 exemplar device would be our best -- our best attempt to get 5 either identical hardware, or close enough hardware so that we 6 could try and create a capability against it. 7 Q. 8 just take a foreign nation. 9 Okay. Okay. Because I don't know what that is. So let me see if I understand this correctly. Let's I'm just going to pick my own. Pakistan. 10 A. Okay. 11 Q. And Pakistan has this hardware or whatever it is that the 12 CIA wants to crack. 13 A. Correct. 14 Q. So, somebody places an order, one of your customers. 15 Generally that's COG, correct? 16 A. Sometimes COG, sometimes us. 17 Q. Okay. 18 Right? 19 A. Yes. 20 Q. So you take what it is that they want to crack into that 21 Pakistan has, correct? 22 A. Correct. 23 Q. You don't have what Pakistan has, so you make it and call 24 it an exemplar, right? 25 A. Correct? So let's just say it's COG. COG places an order. That's the exemplar? We buy. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 418 K263SCH1 Weber - Cross 1 Q. You buy it? 2 A. Yes. 3 Q. You buy it and then you put it on DevLAN, correct? 4 A. Correct. 5 Q. Then you load it up, the thing you want to crack, correct? 6 A. Correct. 7 Q. And then the people who are working on DevLAN then start to 8 see if they can write some kind of malware that will crack what 9 Pakistan has? 10 A. Correct. 11 Q. Right. 12 see what Pakistan has, and see if we can steal what Pakistan 13 has and bring it back here, correct? 14 A. Correct. 15 Q. And it's about fair to say Pakistan is doing the same thing 16 to us, just to even it out here? 17 A. It's fair to say. 18 Q. Okay. 19 correct? 20 A. Correct. 21 Q. And that is why DevLAN is called the wild wild west, 22 because anything could happen on DevLAN, correct? 23 A. Any piece of equipment could be found on DevLAN. 24 Q. Exactly. 25 A. Correct. And that allows us, meaning America, to then go and So, basically, that's what is loaded up on DevLAN, Any equipment could be found on DevLAN, right? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 419 K263SCH1 Weber - Cross 1 Q. With every insertion of equipment comes insecurity, 2 correct? 3 A. I would -- 4 Q. That's basic, right? 5 A. I would say that's unfair. 6 Q. Really? 7 A. Yes. 8 Q. The more stuff you put in, the more insecure a system 9 becomes, right? 10 A. The devices that were plugged in were paid very close 11 attention to. 12 Q. Undoubtedly the CIA pays very close attention. 13 14 We are working on them. MR. LAROCHE: Objection, your Honor. I know. She's not testifying. 15 THE COURT: 16 MS. SHROFF: Those remarks are stricken. Okay. 17 Q. It's fair to say, right, that the more you put into a 18 system, the more the risk of insecurity, right? 19 A. That's fair. 20 Q. That is fair. 21 I'm glad. So let's just stick to this. The people that are 22 developing these programs, they're developing malware, right? 23 A. Yes. 24 Q. Okay. 25 exactly is this malware? And I know you explained this before, but what Just a way to crack into something SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 420 K263SCH1 Weber - Cross 1 else, right? 2 A. 3 is programs that are created to do things that the system -- 4 the system owners would not intend for it to do. 5 Q. You mean the target system owners do not intend? 6 A. Correct. 7 Q. Okay. 8 plugged into DevLAN, right? 9 A. Yes. 10 Q. You also heard the phrase called "dirty network," by the 11 way? 12 A. Yes. 13 Q. What is a dirty network? 14 A. Dirty network is a network that has, it has all sorts of 15 information on it. 16 created by the owners of that network. 17 Q. 18 dirty network, right? 19 A. Yes, correct. 20 Q. And that was a phrase commonly used at the CIA, that DevLAN 21 was a dirty network, right? 22 A. Correct. 23 Q. In fact, there was a lot of talk about how this dirty 24 network should be addressed, correct? 25 Malware, the best, like, the simplest definition is malware Okay. So, when these, these new systems or hardwares are And it's not, it's not information solely And it's fair to say DevLAN was referred to as the I'm not talking about from Mr. Schulte, mind you. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I'm 421 K263SCH1 Weber - Cross 1 just talking about generally, because I'm asking about your 2 general knowledge about the CIA system. 3 A. I don't know any conversations about that. 4 Q. You don't recall any such conversations? 5 A. No. 6 Q. Is it fair to say, sir, that on the DevLAN system, there 7 was a lot of sharing amongst developers, coders, of code 8 itself? 9 A. Yes. 10 Q. And this code that they shared was malware code, correct? 11 A. Typically, yes. 12 Q. Right. 13 right? 14 A. Yes. 15 Q. And 100 developers could be sharing malware code with each 16 other at any given time, correct? 17 A. Yes. 18 Q. And they also shared with each other information about the 19 malware code, right? 20 A. Yes. 21 Q. And that was also shared on DevLAN, correct? 22 A. Correct. 23 Q. And as part of the development, you developed hacking 24 tools, correct? 25 A. And so, you said there were about 100 developers, Correct. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 422 K263SCH1 Weber - Cross 1 Q. And this process of development, it crossed more than one 2 group within -- more than one group within a division, correct? 3 Do I have your nomenclature correctly? 4 A. You're backwards. 5 Q. It was shared with more than one division in the group? 6 A. The group is higher than the division. 7 sometimes shared across divisions. 8 Q. 9 divisions, correct? So, help me out here. I'm sorry. So it would be There's at least five 10 A. No. You're talking about the branches now. 11 Q. Okay. 12 A. Correct. 13 Q. Did branches all share this information also? 14 A. Some of the branches had different focuses. 15 unlikely for some of the branches to share with each other. 16 Other branches, yes. 17 Q. 18 correct? 19 A. Yes. 20 Q. And then it was shared at a level above branches, correct? 21 A. It would be shared like in between the branch. 22 Q. In between branches? 23 A. Yes. 24 Q. And it was definitively shared with the customer, correct? 25 A. The final product, yes. Okay. Five branches? So it would be So the some of the branches shared with each other, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 423 K263SCH1 Weber - Cross 1 Q. Right. And then if the final product was sent to the 2 customer, the customer then had what is called a trial run? 3 Did they have like a trial run to make sure it worked? 4 A. They -- they would often do testing of their own, yes. 5 Q. And they would test out the hacking tool, correct, make 6 sure it was to their liking, like any normal customer, correct? 7 A. I would hope so, but I don't know. 8 Q. Okay. 9 had glitches in it or they had problems in it, they would come Fair enough. And then, after they tried it, if they 10 back to the developer and say, hey, fix this glitch? 11 A. Yes. 12 Q. Okay. 13 little complicated for my head. 14 the DevLAN system, correct? 15 A. Sorry. 16 Q. The talking back and forth. 17 having trouble with this tool, can you fix this, can you fix 18 that; that went back and forth, right? 19 A. Not on DevLAN though. 20 Q. Okay. 21 A. So, that conversation would usually be in person, talking 22 to each other. 23 Q. Would it not be on Jira? 24 A. Very few people in COG actually utilized Jira. 25 likely not. We'll get to that a little bit later because it's a But that was also routine on The which -- which portion are you talking about? You sent me this tool, I'm On what server would that be? Or more often on our corporate network. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 So, most 424 K263SCH1 Weber - Cross 1 Q. But it was on -- that's what Jira was there for. 2 he get to Jira in a minute. 3 now. 4 But I'll Let's stick to where I am right So the DevLAN system itself, it was called the wild 5 wild west and also called the dirty network, correct? 6 A. Those are two terms that were applied to it, yes. 7 Q. Those terms were applied during 2015, correct? 8 A. Yes. 9 Q. 2016, correct? 10 A. Yes. 11 Q. 2017, until DevLAN was gone from the CIA, correct? 12 A. Yes. 13 Q. Now, let's shift gears just a little bit off of DevLAN and 14 talk about your relationship with Mr. Schulte here. 15 A. Okay. 16 Q. There was a time, and you testified to this on direct, 17 right, that you had, you had as you put it, you had lost 18 positive feelings towards Mr. Schulte. 19 A. That is correct. 20 Q. And when there was a fight between Mr. Schulte and Amol, 21 you felt or you championed Amol; is that fair to say? 22 A. I was on Amol's side for the legal proceedings, yes. 23 Q. Well, not just for the legal proceedings, right? 24 just on Amol's side. 25 MR. LAROCHE: Is that fair to say? It's okay. Objection, your Honor. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 You were 425 K263SCH1 1 2 Weber - Cross THE COURT: Q. Overruled sustained. Were you not on Amol's side? 3 THE COURT: "It's okay." 4 MS. SHROFF: I'm sorry. 5 THE COURT: 6 I take that back. Your comments that you make in response to the questions. 7 MS. SHROFF: I didn't realize I made it, your Honor. 8 Q. Go ahead, sir. You were on Amol's side, right? 9 A. I was mostly on Amol's side. I do not think that Amol was 10 at zero fault. 11 Q. 12 Okay. 13 A. 14 into arguments with Josh. 15 situations. 16 been more professional as well. 17 Q. Well, Amol liked to troll people, no? 18 A. Sorry. 19 Q. Sure. 20 A. Yes. 21 Q. I mean, tell the jury so you and I have the same 22 understanding of "troll." 23 A. Amol would poke fun at people, but in a good nature. 24 Q. Kind of in like a non-abrasive way, right? 25 somebody, but you're kind of sticking it to them, right? Oh. I'm sorry. I was confused after the direct yesterday. So you did not think now that Amol was at zero fault. Amol should have, he should not have had, you know, got He should have just walked away from But, along those lines. I think Amol could have Can you repeat the question? Amol liked to troll people, right? What does troll mean? Poke fun of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 426 K263SCH1 Weber - Cross 1 That's trolling? 2 A. Like I said, it was in good nature. 3 Q. You thought it was in good nature, right? 4 A. Yes. 5 Q. That was your personal subjective opinion, right? 6 A. Yes. 7 Q. You were not the recipient of being called a bald asshole, 8 right? 9 A. Correct. 10 Q. Right. 11 might not appear as good natured trolling to someone else, 12 correct? 13 A. Correct. 14 Q. And Mr. Amol's trolling took many forms, correct? 15 A. Correct. 16 Q. He would send out e-mails in the morning trolling people? 17 A. Not regularly. 18 Q. I don't know what "regularly" is at the CIA. 19 sent out e-mails, right? 20 least favorite things. 21 would be par, number three would be Schulte, number four would 22 be Schulte, and number five would also perhaps be Schulte? 23 A. I don't remember an e-mail like this. 24 Q. You don't remember e-mails like that? 25 A. I -- So, what appeared to you as good natured trolling But certainly He would send out e-mails like Amol's Number one would be Schulte, number two SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 427 K263SCH1 Weber - Cross 1 Q. Fair enough. Amol regularly mocked Mr. Schulte; is that 2 fair to say? 3 A. No. 4 Q. He didn't tell Mr. Schulte you're going to fail? 5 A. Sorry? 6 Q. You are going to fail? 7 A. I don't remember that specific comment. 8 Q. Do you remember a comment that he made that he said you 9 just suck at being a coder? 10 A. Not that specific comment. 11 Q. How about not that specific, but a comment close enough? 12 A. It would not surprise me that he said something like that, 13 no. 14 Q. 15 something unfortunate happening in his life, and Amol saying, 16 well, I hope it does happen that way? 17 A. No. 18 Q. Do you recall Amol ever telling Mr. Schulte I hope nothing 19 works out for you? 20 A. No. 21 Q. I'm not talking just my specific words, right, because I 22 wasn't there. 23 you never heard him say any such thing? 24 A. 25 recall anything like that. Okay. Do you remember a time when Mr. Schulte talked about But comments to that effect. Your testimony is I don't know what this is referencing and it -- I don't SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 428 K263SCH1 Weber - Cross 1 Q. Okay. 2 A. Amol -- Amol worked on a project with me that I was a lead 3 on, but I was never Amol's official boss, no. 4 Q. 5 correct? 6 A. In a specific project, correct. 7 Q. And on that specific project, you and Amol got along, 8 correct? 9 A. Yes. 10 Q. You like him, right? 11 A. Yes. 12 Q. And he liked you? 13 A. I would like to think so, but I don't know. 14 Q. Right. 15 correct? 16 A. Yes. 17 Q. And in February of 2016, when Amol and Mr. Schulte got into 18 a fight, you had a predisposition that Amol would be right, 19 correct? 20 A. No. 21 Q. So you had no predisposition, but you felt strongly at the 22 conclusion of the events that Amol was right? 23 A. Yes. 24 Q. And then there came a time when Mr. Schulte decided that he 25 was going to go to court because of the fight with Amol, Right. Now, you were never Amol's boss, correct? So you were the lead and Amol worked with you, You gave him directions, he followed directions, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 429 K263SCH1 Weber - Cross 1 correct? 2 A. Yes. 3 Q. And he went to a county court, correct? 4 A. I believe so, a court of some type. 5 Q. And he filed a request for a protective order. 6 aware of that? 7 A. Yes. 8 Q. And the judge granted the protective order, correct? 9 A. Yes. 10 Q. Were you in court that day, by the way? 11 A. No, I was not. 12 Q. You didn't go? 13 A. No. 14 Q. You just offered to go? 15 A. When Amol appealed the court order, that is when I went to 16 court with him. 17 Q. 18 you didn't go, correct? 19 A. Correct. 20 Q. And when Amol appealed and the judge dismissed it because 21 Mr. Schulte had filed the complaint in the wrong county, you 22 were there, correct? 23 A. That is correct. 24 Q. Right. 25 Loudoun County when in fact he should have -- I've never been Okay. Were you So, when the initial protective order was granted And the judge dismissed it because he filed it in SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 430 K263SCH1 Weber - Cross 1 to Virginia, but in some other county in Virginia, correct? 2 A. That is correct. 3 Q. You did go, though, to court, to support Amol, correct? 4 A. I went there to tell the portion of the story that I knew. 5 Q. Well, yeah, but your portion of the story supported Amol, 6 correct? 7 A. That's correct. 8 Q. So you went there to support Amol? 9 A. That's fair. 10 Q. You were aware, right, that Mr. Schulte also filed an EEO 11 complaint? 12 A. Eventually I was made aware of that, yes. 13 Q. Yeah. 14 A. Equal employment opportunity. 15 sure that everybody has -- has an equal chance at a job or 16 whatever. 17 somebody is interfering with equal employment options. 18 Q. Okay. 19 A. Yes. 20 Q. And then Amol filed one against Mr. Schulte, correct? 21 A. I don't recall, no. 22 Q. You don't recall that? 23 A. I don't remember that, no. 24 Q. You don't recall Amol filing an EEO complaint against 25 Mr. Schulte? So, can you just tell us, what is an EEO complaint? It's an office that makes So an EEO complaint is a complaint saying that So, Mr. Schulte filed one against Mr. Amol, correct? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 431 K263SCH1 Weber - Cross 1 A. No. 2 Q. And is it your testimony today that you never learned that 3 the EEO complaint Amol filed was dismissed? 4 A. I don't remember an EEO complaint from Amol. 5 Q. You don't recall Amol ever telling you that his harassment 6 complaint against Mr. Schulte was dismissed? 7 A. His harass -- no. 8 Q. By the way, you're still friends with Amol now, right? 9 A. I -- I wouldn't consider him a friend. I occasionally run 10 into him. But over the past years I think I've seen him once 11 or twice. 12 Q. Right. 13 A. He -- he went to a new office. 14 Q. Right. 15 A. So. 16 Q. And he no longer codes, right? 17 A. I don't know what his current job duties are. 18 Q. Do you know if he is a developer anymore? 19 A. No, I don't. 20 Q. Now, just going back to the same time period, 2016 to 2017. 21 Right. 22 atmosphere in your group, correct? 23 A. From 2016 to 2017, yes. 24 Q. I got it wrong again, it's a group, right? 25 A. It goes group is the -- And that's because he moved, correct? You testified yesterday that you had a collegial The division? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 432 K263SCH1 Weber - Cross 1 Q. Your division? 2 A. Division is the one I'm most comfortable answering to. 3 Q. So within your division, that's what you testified, right? 4 A. Yes. 5 Q. And it's fair to say that people play pranks on each other 6 in that division? 7 A. Yes. 8 Q. In fact, Mr. Schulte here logged on to your DevLAN on 9 March 2 of 2016, and used your DevLAN machine to send out a 10 message to everyone in your name, correct? 11 A. He did not log on to my machine. 12 Q. You left it open? 13 A. Yes. 14 Q. So, he just, your machine was open, he walked on to it, and 15 sent an e-mail pre -- is it an e-mail or is it a chat? 16 A. 17 was. 18 Q. So, he sent it out in your name, correct? 19 A. Correct. 20 Q. And he sent an e-mail saying "I am an asshole" or something 21 like that? 22 A. Something like that. 23 Q. Everybody thought you sent it, correct? 24 A. No. 25 Q. Everybody knew it was a prank, right? It was either an e-mail or chat; I can't remember what it Nobody would have thought that. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 433 K263SCH1 Weber - Cross 1 A. Everybody would have known what would have happened, yes. 2 Q. He never denied sending that prank, right? 3 A. No. 4 Q. And in all the time that he played all these pranks, he 5 never really denied ever doing them, right? 6 A. No. 7 Q. He used your unlocked machine to do that. 8 A. Correct. 9 Q. Others used his unlocked machine to do it, because he was Correct? 10 notorious for not locking his computer, correct? 11 A. I wouldn't say he was notorious for it. 12 Q. Really? 13 interviewed by the FBI? 14 A. I don't remember. 15 Q. You don't remember the FBI asking you specifically about 16 this March 2, 2016, IRC chat at 4:16:18 p.m., and you telling 17 them in response that not only did Josh not deny it, he himself 18 was the subject of these pranks because he was, quote, 19 notorious for leaving his machine on? 20 A. I don't remember making that statement. 21 Q. Okay. Is that not the word you used when you were 22 MS. SHROFF: 23 THE COURT: 24 MS. SHROFF: 25 Could I just have a minute, your Honor? You may. May I just have a second with the government? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 434 K263SCH1 Weber - Cross 1 THE COURT: 2 (Counsel conferring) 3 MS. SHROFF: Yes. I'm having trouble finding the document 4 but I'll come back to it. 5 Q. 6 for not locking his computer? 7 A. 8 unlocked. 9 was. Is it your testimony that Mr. Schulte was in fact notorious I remember several occasions where he left his computer It's been a few years; I don't remember how often it 10 Q. 11 many chats you had about how he should be better at the CIA? 12 A. Possibly, I don't remember. 13 Q. You don't remember admonishing him about locking his 14 computer which is a security issue? 15 A. No. 16 Q. Now, aside from this collegial environment, there was also 17 a lot of name calling, right, within your division? 18 A. I wouldn't say it was a lot, no. 19 Q. Who was metal mouth? 20 A. It would have been Michael. 21 Q. Who called him metal mouth, by the way? 22 A. I don't remember. 23 Q. You don't remember Amol calling him metal mouth? 24 A. It could have been him, I don't remember. Well, you admonished him about it, right? In one of the 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 435 K26Wsch2 Weber - Cross 1 BY MS. SHROFF: 2 Q. 3 metal mouth, right? 4 A. That would have been why he was called metal mouth. 5 Q. But you, sitting here today, don't remember Amol calling 6 him metal mouth? 7 A. 8 that. 9 Q. 10 And that's because a grown man had braces, he called him I remember the name. I don't remember who was calling him Let me just switch gears for a minute. OK? There came a time when the situation between Amol and 11 Mr. Schulte led to Mr. Schulte and Amol being physically 12 separated, correct? 13 A. That's correct. 14 Q. And Amol was moved to one place and Mr. Schulte to another, 15 correct? 16 A. That is correct. 17 Q. They were now in different divisions, correct? 18 A. Different -- 19 Q. Huh? 20 A. Different branches, same division still. 21 Q. OK. 22 A. That's correct. 23 Q. And where was Amol sent? 24 A. He was also moved out of OSB into MDB. 25 Q. Into what? And Mr. Schulte was moved out of OSB, is that right? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 436 K26Wsch2 1 A. MDB. 2 Q. MBB? 3 A. MDB. 4 Q. MDB. 5 Weber - Cross OK. And you testified yesterday, right, that because 6 Mr. Schulte was being moved out of OSB, you decided that you 7 were going to knock off his privileges to the OSB libraries -- 8 A. That's not correct. 9 Q. -- right? 10 That's not correct? 11 A. No. 12 Q. OK. 13 A. I -- I was not the one that decided this. 14 was the policy. 15 Q. OK. 16 A. It was my decision to follow the directions that I had been 17 given, yes. 18 Q. By the policy? 19 A. Yes. 20 Q. So is this a written policy? 21 A. No. 22 Q. It's not a written policy? 23 A. Not that I'm aware of. 24 Q. Tell us about this policy that you have, because it's not a 25 written policy, so I'm confused about the policy. This was -- this It was your decision to implement the policy, correct? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 437 K26Wsch2 Weber - Cross 1 A. The policy is the branches, the branches are in control of 2 their own projects and that when you go to a different branch, 3 you no longer need access to those old projects. 4 Q. 5 you assume was in place, correct? 6 A. No, it's not correct. 7 Q. How is it not correct? 8 A. There had been other, there had been other, similar 9 situations in the past where we followed the same rules. OK. So there's no written policy; this is just a policy 10 Q. Right. 11 A. Yes, but there might have also been conversations with my 12 leadership regarding it as well. 13 Q. 14 been, but let's stick to what was. 15 policy on this, correct? 16 A. Correct. 17 Q. This is a policy that you thought existed, correct? 18 A. Correct. 19 Q. And you implemented the policy, correct? 20 A. Correct. 21 So you assumed it was a policy, correct? There might have been? MS. SHROFF: 22 minute, your Honor? 23 Q. I understand that there might have So there's no written Oh, actually, could I just go back for a Let me just show you 3507-39. 24 MS. SHROFF: 25 THE COURT: I should have asked, your Honor. Yes. All right. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 438 K26Wsch2 Weber - Cross 1 MS. SHROFF: I apologize. 2 THE COURT: 3 What's the question? All right. 4 BY MS. SHROFF: 5 Q. 6 FBI that Mr. Schulte was notorious for leaving his computer 7 unlocked? 8 A. Does that refresh your recollection, sir, that you told the Yes, it does. 9 MS. SHROFF: Thank you. 10 May I, your Honor? 11 THE COURT: Yes, you may. 12 BY MS. SHROFF: 13 Q. 14 that the CIA has a set of written policies about many things? 15 A. Yes. 16 Q. And when Mr. Schulte was moved out of OSB, you went into 17 the OSB libraries and removed his admin access, correct? 18 A. Yes. 19 Q. OK. 20 say -- and you correct me if I'm wrong. 21 do that for a living -- what you did is basically, you took 22 away Mr. Schulte's ability to merge a code into the master 23 branch within the OSB libraries? 24 A. That's correct. 25 Q. And these OSB libraries, it's basically like a library on a OK. So going back to this OSB libraries, is it fair to say Yeah, that's correct. Just so that the jury understands what I was trying to OK? Because I don't SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 439 K26Wsch2 Weber - Cross 1 computer, right? 2 A. Yes. 3 Q. OK. 4 you don't want to keep reinventing the wheel, so you put all 5 this information there and people can access it and work on it, 6 correct? 7 A. Correct. 8 Q. And when this library started, it was started by 9 essentially three people, although you do not agree that it was So you have all of these different pieces of code and 10 Mr. Schulte's idea? 11 A. I -- 12 Q. You testified to that? 13 A. I agree. 14 Q. OK. 15 Mr. Schulte's idea, correct? 16 A. That's correct. 17 Q. But you do agree that the three of you basically 18 jump-started it? 19 A. Correct. 20 Q. Correct? 21 A. That is correct. 22 Q. OK. 23 A. Correct. 24 Q. And I forget the third person's name. 25 A. Frank. Yes, that's correct. So you don't believe the OSB libraries was So it's you, right, Mr. Schulte? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 440 K26Wsch2 1 Q. 2 only three of you could merge the code into the master and 3 develop, right? 4 A. That's correct. 5 Q. Now, do you remember when it is that you removed his admin 6 privileges? 7 A. 8 9 OK. Weber - Cross So these OSB libraries, anybody could access it, but No, not the specific date. I'm sorry. Are you talking to the libraries or the bigger thing that I testified to? 10 Q. No, no. I'm just talking about the libraries right now. 11 A. I don't remember the specific date. 12 Q. OK. 13 because he was leaving OSB, right? 14 A. That's -- that was the main reason, yes. 15 Q. That wasn't really the reason why, right? 16 A. The -- no. 17 Q. Yesterday you said there was only one reason, right; 18 yesterday, when Mr. Laroche was asking you about all these OSB 19 libraries, you didn't say there was a main reason and a 20 sub-reason and a quasi reason? 21 A. 22 longer in OSB. 23 Q. 24 the main reason or some other reason? 25 A. And you testified on direct that you did this only It was the main reason. There were -- The reason I did it, I took the action is because he was no OK. So is it now your testimony that it's the only reason, I would say it is the only reason. There were people that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 441 K26Wsch2 Weber - Cross 1 were happy that his accesses were removed, though. 2 Q. We're not talking about any people, just you. 3 A. Right. 4 Q. You can only testify about what you know. 5 A. I know that there was another person that was happy to have 6 his accesses removed. 7 Q. 8 Your testimony is that the main reason is you -- is it your 9 main reason or the only reason? No doubt, but let's just stick to your testimony today. That's all my question was. 10 A. The only reason. 11 Q. OK. 12 access to OSB libraries, Mr. Schulte came to talk to you about 13 it, right? 14 A. Yes. 15 Q. And when he came to talk to you about it, he told you -- 16 well, first he just asked you, right, why his admin privileges 17 were gone? 18 A. Yes. 19 Q. And it's fair to say that when he was allowed to have admin 20 privileges, you yourself were annoyed with the way he executed 21 those privileges, right? 22 A. 23 he was doing good work with the libraries. 24 Q. Really? 25 A. Yes. And you remember that when you took off his admin I'm sure I was annoyed on occasion, but for the most part, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 442 K26Wsch2 Weber - Cross 1 Q. You didn't write complaining emails about how he was 2 creating more work for Frank by not following the pull-request 3 methodology? 4 A. 5 like I said, for the most part, he did a great job with the 6 work. 7 Q. 8 frustrated by Mr. Schulte's failure to comply with the rules of 9 loading the code onto the master and develop branches of the Yes, I remember complaining about that, but it was not -- But occasionally he would frustrate Frank or myself. It is your testimony, sitting here today, that you were not 10 OSB libraries? 11 A. 12 so I would not be frustrated specifically. 13 Q. 14 saying that Mr. Schulte's failure to follow the rules was an 15 additional reason why you took off his admin access to OSB 16 libraries, correct; that's your testimony today? 17 A. 18 would have said something like that to argue against giving him 19 access to it again. 20 Q. 21 to give him back his privileges, and then you argued against 22 it? 23 A. I wasn't using the libraries all that often at that point, So you did not send emails after the fact to your superiors I don't remember sending something like that. I see. I probably So your testimony is that somebody then asked you I don't -- 24 MR. LAROCHE: 25 THE COURT: Objection. Misstates his testimony. Overruled. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 443 K26Wsch2 Weber - Cross 1 MS. SHROFF: 2 THE COURT: 3 Can you answer the question? 4 THE WITNESS: 5 THE COURT: 6 It was a question. Overruled. Can you repeat the question? I'm sorry. We'll have the reporter read the question back. 7 We're going to have the question read back. 8 MS. SHROFF: 9 (Record read) OK. Thank you. 10 A. I don't remember being asked to give back privileges to 11 Josh at any point for the libraries. 12 Q. 13 to you, right? 14 A. Yes. 15 Q. You told him, and correct me if I'm wrong. 16 that you're not in OSB libraries anymore so I took off your 17 privileges, is that correct? 18 A. You're not in OSB anymore. 19 Q. You're not in OSB anymore so I took off your privileges; 20 that's what you told him? 21 A. That's correct. 22 Q. Your testimony, sitting here today, is you did not tell him 23 that Sean told me you could do this; that's your testimony? 24 A. I had a conversation with Sean -- 25 Q. That's not my what I asked you. OK. So you took off his admin privileges, he came to talk You told him SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 444 K26Wsch2 Weber - Cross 1 A. I don't remember exactly what I told him, no. 2 Q. You don't remember, sitting here today, telling Mr. Schulte 3 that his boss -- 4 Sean was his boss, right? 5 A. Yes. 6 Q. Your boss? 7 A. Yes. 8 Q. -- that your and his boss had told you to take away his 9 administrative access to the OSB libraries? 10 A. I don't remember using Sean's name. I didn't often invoke 11 leadership to justify -- 12 Q. I'm sorry? 13 A. I didn't invoke leadership's name to justify a company 14 decision often, so -- 15 Q. 16 policy and told him to comply, correct? 17 A. 18 disagreed. 19 Q. 20 were justifying your actions, all you -- according to you 21 today -- all you told him was you're no longer in OSB so I took 22 you off; that's your testimony? 23 A. I don't remember what I told him. 24 Q. You don't remember what you told him? 25 A. No, I do not. So your testimony is that you simply relied on an unwritten I told him that he could take it up with Sean if he OK, but that wasn't my question. My question was, when you SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 445 K26Wsch2 Weber - Cross 1 Q. Let me ask you something, Mr. Weber. Taking away 2 someone's -- you were in the marines, right? 3 A. That's correct. 4 Q. And you're used to having a lockstep chain of command, 5 correct? 6 A. Correct. 7 Q. Your supervisor tells you something, you comply, correct? 8 A. Correct. 9 Q. And if somebody who is your equal and not your supervisor 10 tells you something, you don't have to comply, right; that's 11 the marines? 12 A. That's not quite accurate. 13 Q. Really? 14 A. No. 15 Q. In the marines you have to obey somebody who is just 16 standing right next to you? 17 A. 18 you an order, you would probably assume that they had orders on 19 that. 20 Q. 21 what you're saying? 22 while you unilaterally took off his access and did not tell 23 him; you wanted him to assume that; that was your thinking? 24 A. 25 projects anymore so it was a nonissue. You would -- if somebody was of equal rank to you and gave You'd probably assume that they had ordered on that, that's So you wanted to probably assume something I didn't think -- I didn't think he would be accessing the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 446 K26Wsch2 Weber - Cross 1 Q. Well, you didn't think that, right, but you took away an 2 equal's access and did not tell him? 3 A. I would not consider him an equal at that point. 4 Q. Well, you were not his boss, right? 5 A. No. 6 Q. You couldn't fire him, right? 7 A. No. 8 Q. You couldn't move him to another group, division, branch, 9 anywhere, correct? Right? 10 A. Correct. 11 Q. You couldn't even tell him what kind of pants to wear, 12 right? 13 A. Correct. 14 Q. OK. 15 A. Correct. 16 Q. So you wanted him to assume that if you told him something 17 he should then assume that it came to you from his superior 18 and, therefore, he should follow what you're saying; that was 19 your assumption? 20 A. 21 mentioning. 22 Q. 23 removed, right? 24 A. Correct. 25 Q. And you testified on direct, did you not, that there was So you were not his boss, right? I don't recall this conversation that you're, like, OK. So Mr. Schulte comes to ask you about his access being SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 447 K26Wsch2 Weber - Cross 1 nothing untoward about his tone or the way he asked the 2 question, right? 3 A. Yes, correct. 4 Q. He asked you the question, right? 5 A. Correct. 6 Q. And you answered him? 7 A. Yes. 8 Q. And then he left? 9 A. No, I don't believe that was the case. 10 Q. He stayed in the office? 11 A. He went to talk to Sean. 12 Q. Right. 13 sorry. 14 A. Yes, he left me. 15 Q. OK. 16 A. Correct. 17 Q. And after he left your office, it is your testimony that he 18 went and talked to Sean, correct? 19 A. That is correct. 20 Q. And at that time, Sean had not told you to take away his 21 privileges, right? 22 A. I don't remember. 23 Q. Well, you just said before that the reason you took away 24 his access was because he was no longer in OSB and you were 25 following the unwritten policy, right? Then he left the office, is what I meant. I'm He left you, right? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 448 K26Wsch2 Weber - Cross 1 A. That's what I remember doing. 2 Q. Right. 3 A. I don't remember if Sean told me to also follow that 4 policy. 5 Q. 6 policy? 7 A. No. 8 Q. I see. 9 You don't remember if Sean, your boss, told you to follow Sean never asked you to do anything with OSB libraries, 10 correct, when Josh and Amol were leaving? 11 A. I don't remember. 12 Q. So you don't remember if Sean told you, but you do remember 13 doing the access removal? 14 A. Yes. 15 Q. OK. 16 A. I do remember that, and I remember specific guidance on 17 other projects. 18 Q. I'm not asking about any other projects, sir. 19 A. All I'm saying is -- 20 21 MS. SHROFF: A. Your Honor -- -- the guidance might have came at the same time. 22 MS. SHROFF: Your Honor -- 23 THE COURT: 24 Just listen to the question and answer the question. 25 THE WITNESS: OK. We'll strike out the last portion. I apologize, your Honor. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 449 K26Wsch2 Weber - Cross 1 BY MS. SHROFF: 2 Q. 3 working on Shattered Assurance? 4 A. Not initially. 5 Q. You don't know what he was working on because he was no 6 longer in your group, right, or in your division, whatever it 7 is? 8 A. He was no longer in my branch. 9 Q. Right. Now, when Mr. Schulte moved out of OSB, right, he was still Is that correct? He was no longer in your branch, so you didn't know 10 what he was working on, right? 11 A. That's not correct. 12 Q. How would you know what he was working on? 13 A. Because I was told to reassign the Brutal Kangaroo project, 14 which Shattered Assurance was part to, to another developer in 15 OSB. 16 Q. 17 Shattered Assurance, right? 18 A. But Shattered Assurance was within Brutal Kangaroo. 19 Q. So your testimony is -- I want to make sure I understand 20 you correctly; all right -- Shattered Assurance is within 21 Brutal Kangaroo? 22 A. That's correct. 23 Q. It's part and parcel of the same thing? 24 A. It's a component of Brutal Kangaroo. 25 Q. Right. Right. Reassign, according to you, Brutal Kangaroo but not So it's part and parcel. You just said Shattered SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 450 K26Wsch2 Weber - Cross 1 Assurance is part of Brutal Kangaroo, correct? 2 A. Correct. 3 Q. OK. 4 back to the OSB libraries. 5 A. OK. 6 Q. After Mr. Schulte went to talk to Sean, he came back to 7 you, correct? 8 A. That is correct. 9 Q. And according to your direct testimony, he told you, right, I'm going to leave that there, and I'm going to go OK? 10 that Sean had told him he could have his access, administrative 11 access back? 12 A. That's -- something along those lines, correct. 13 Q. And in the -- when he came and told you that, it was your 14 testimony that he was lying to you, correct? 15 A. 16 Sean. 17 Q. 18 Correct? I wouldn't say he was lying. He might have misunderstood Well, let's talk about that. Sean didn't like to tell people directly anything, correct? 19 A. I wouldn't say that, no. That's not correct. 20 Q. Really? 21 A. No. 22 Q. He didn't hem and haw because he didn't ever want to take a 23 position as a boss? 24 A. No. 25 Q. Do you recall a time when Josh Schulte and Michael got into SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 451 K26Wsch2 Weber - Cross 1 a rolling fight, physical fight, and Sean never brought that to 2 the attention of his supervisor? 3 A. I don't know what Sean's actions were. 4 Q. Well, in fact, you do know about them, because you 5 complained about them, right? 6 A. I don't think I did. 7 Q. You don't remember expressing a concern that Sean really 8 should have discussed all of these matters with his superior? 9 You don't remember expressing that concern? 10 A. I might have expressed a concern like that. 11 if Sean did or not. 12 Q. 13 with these issues, correct? 14 A. 15 think it would raise to the level of concern. 16 Q. OK. 17 A. It might have been a comment I made, but I very much liked 18 Sean as a boss, and I thought he was a great boss. 19 Q. 20 very much like a person who has a limitation. 21 you is, in your opinion, isn't it true, Mr. Weber, that Sean 22 did not like to directly take a position? 23 A. No. 24 Q. So your testimony is you think Sean was clear with 25 Mr. Schulte and Mr. Schulte just came and lied to you? OK. I don't know But you had a concern that Sean did not like to deal Possibly. I don't know. So -- concern would be -- I don't What would it raise to? There's no doubt that you very much like Sean. You can My question to SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 452 K26Wsch2 Weber - Cross 1 A. I don't know. 2 Q. In fact, you know that's not true, right; you know that 3 Sean waffled on what he told Mr. Schulte? 4 A. No, I don't know that either. 5 Q. You don't know that? 6 A. No. 7 Q. OK. 8 just testified you don't think Mr. Schulte lied, but 9 nevertheless, he told you Sean said give me my permissions So Mr. Schulte came back to you, and even though you 10 back, is that right? 11 A. That's correct. 12 Q. And you said that -- what did you say in reply to him, by 13 the way? 14 A. 15 talk to Sean to make sure that I understood what Sean wanted. 16 Q. OK. 17 A. It was along the lines of, You might as well give me -- 18 give me the access; I'm going to get it one way or another. 19 Q. One way or another? 20 A. Yes. 21 Q. Well, that's not what Mr. Schulte said to you, right? 22 A. I -- it was years ago. 23 language. 24 Q. 25 I don't recall specifically, but I told him that I would And what did Mr. Schulte say back to you? I don't remember the exact Let me see if I can refresh your recollection here. I highlighted it for you. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 453 K26Wsch2 Weber - Cross 1 A. Yes. 2 Q. By the way, yesterday you said that you took his words to 3 mean a threat, right? 4 A. Yes. 5 Q. OK. Let's see what he said to you. 6 MR. LAROCHE: 7 MS. SHROFF: 8 He said he couldn't recall. I gave him a document to refresh his recollection. 9 10 Objection, your Honor. THE COURT: You have to ask him if it refreshes his recollection. 11 MS. SHROFF: OK. 12 A. This is -- I still don't remember the conversation 13 verbatim, but this is a closer, a closer time to when it 14 happened. 15 Q. Right. 16 A. I don't recall the specific verbiage, so -- 17 Q. I know you don't recall. 18 that piece of paper, your statement to the FBI, refreshes your 19 recollection of what Mr. Schulte said to you far, far closer to 20 the date when Mr. Schulte actually did say it to you. 21 A. This -- yes. 22 Q. Great. 23 back then that Mr. Schulte said to you? 24 A. 25 will eventually get access back to the libraries and that So it refreshes your recollection, right? So now tell me. That's why I'm asking you whether What is it that you told the FBI "Schulte then finished the conversation by stating that he SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 454 K26Wsch2 Weber - Cross 1 access should just be enabled now." 2 Q. And what was your perception of that statement back then? 3 A. I took this statement as him just saying that he was going 4 to win the argument and I shouldn't bother pushing back. 5 he departed, I discussed -- 6 Q. OK. 7 A. OK. 8 Q. So back then you didn't perceive it as a threat, correct? 9 A. I -- I still think I would have seen that as a threat that That's fine. Thank you. 10 he was going to continue doing what he was doing. 11 Q. You still think that now? 12 A. Yes. 13 to steal information or anything. 14 Q. 15 only asking about the OSB libraries, sir -- 16 A. Yes. 17 Q. -- OK? 18 After I never thought this was a threat that he was going Oh, that I know for sure. All right. That's not what I'm asking. I'm So your testimony now is that on direct you 19 thought it was a threat, even though the words were completely 20 different, correct? 21 A. Yes. 22 Q. He never said one way or another, which does sound like a 23 threat, right? 24 A. I don't remember the specific verbiage. 25 Q. Well, you were very specific yesterday when you were SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 455 K26Wsch2 Weber - Cross 1 answering these questions on direct; no? 2 A. 3 caveated -- 4 Q. I'm sorry. 5 A. Sorry. I don't remember. 6 I feel like I also would have I can't hear you at all. I feel like I would have also mentioned that I don't 7 remember; it's been a while. 8 Q. 9 OK. It has been a while. But fair to say -- May I just have that document back? 10 A. Yes. 11 Q. So the text portion that you read -- right? 12 A. Yes. 13 Q. -- you recognize that to be part of a text that you sent in 14 an email, correct? 15 A. 16 outside of what was highlighted. 17 18 Oh, I'm sorry. I didn't actually look at the content MS. SHROFF: The government would prefer I use their exhibit number, your Honor, 1062. 19 THE COURT: 20 MS. SHROFF: 21 MR. LAROCHE: 22 MS. SHROFF: 23 see into the screen. 24 THE COURT: 25 MS. SHROFF: Government Exhibit 1062. Are you offering it in evidence? I think it is in evidence, your Honor. It is in evidence. My problem is, Judge, I'm too short to Well, we can't do much about that. I know. It's my mother's fault. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 456 K26Wsch2 Weber - Cross 1 OK. If you could pull up the part where it reads: 2 "Schulte then finished the conversation by stating 3 that he will eventually get access back to the libraries and 4 that access should just be enabled now." 5 6 Right? And then it says, "I took this statement as him just saying" -- 7 (Counsel conferred) 8 MS. SHROFF: 9 (Counsel conferred) It's OK. You've interrupted me already. 10 Q. -- "to win the argument and I shouldn't bother pushing 11 back," right? 12 A. That's correct. 13 Q. OK. 14 any statement that you perceived there to be a threat of him 15 getting OSB libraries back, right? 16 A. That's correct. 17 Q. OK. 18 this back one way or another, right? 19 A. That's correct. 20 Q. And you didn't say at any point to Mr. Schulte Sean told me 21 to do this to you in the first meeting that you had with him, 22 correct? 23 A. Do you mind if I read -- 24 Q. This is not going to help you. 25 for sure, but your first meeting is not reflected here. So when this language was written, you didn't put in And you didn't say anything about he was going to get This doesn't -- you can, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 457 K26Wsch2 1 A. OK. Weber - Cross I don't remember the last portion. 2 MS. SHROFF: 3 OK. Fair enough. You can take that down. 4 Q. Now, Mr. Schulte went and talked to Sean, correct? 5 A. Correct. 6 Q. And then you talked to Sean, correct? 7 A. Correct. 8 Q. And then you told Sean about how you didn't want him in the 9 OSB libraries anyway because he did not do the pull-and-review 10 process properly and created more work for other people who 11 were working on the OSB libraries? 12 A. I might have used that language. 13 Q. Well, that's how you felt, right? 14 A. Sorry? 15 Q. That is how you felt, right? 16 A. It would have been -- if it was an argument to give Josh 17 access back, I would have used that as a reason not to allow 18 it. 19 Q. OK. 20 A. I don't remember. 21 Q. You didn't tell him, Hey, if Sean even wants to give it 22 back to you, I'm going to advocate against it because I don't 23 like the way you're running my libraries, right? 24 A. 25 correct. I don't know. But you didn't tell him that, right? I wouldn't have had a conversation like that, that's SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 458 K26Wsch2 Weber - Cross 1 Q. Right. 2 invention, right? 3 A. Yes. 4 Q. OK. 5 it was introduced into evidence yesterday, where he called the 6 OSB libraries his idea -- 7 And you thought that the libraries were your And when Mr. Schulte sent the follow-up email, I think MS. SHROFF: Can somebody pull that email up. 8 Q. -- you disagreed with his characterization of the OSB 9 libraries being his idea, right? 10 A. That's correct. 11 Q. But you never told him that, right? 12 A. I don't -- I don't think I would have, no. 13 Q. Well, it's in an email chain, right; you can reply and say 14 I don't agree, I think this was my idea? 15 MS. SHROFF: 16 Thank you, Mr. Laroche. 17 THE WITNESS: 18 MS. SHROFF: 19 up. 20 Q. OK. 21 A. No, I do not. 1061. Sorry. Sure. Can you repeat the question? Let's just see if we can pull it I'm sorry. Do you see it? 22 MS. SHROFF: Oh, can he see it, please. 23 Does the jury have it? 24 THE WITNESS: 25 MS. SHROFF: I have it now. OK. Sorry. How about the jurors? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 459 K26Wsch2 1 Weber - Cross OK. 2 Q. So you're on this email chain, right? 3 A. Yes, I am. 4 Q. OK. 5 A. That's correct. 6 Q. He says: 7 A. That's correct. 8 Q. And then he makes a reference that says that Sean is moving 9 out of that job, is that right? He doesn't leave you off of it, right? "Hey guys. Thanks for the email." Correct? 10 A. That's correct. 11 Q. And somebody else is going to take Sean's job, correct? 12 A. That is correct. 13 Q. And I'm going to come back to this, but you applied for 14 Sean's job, correct. 15 A. No, I never applied for Sean's job. 16 Q. You didn't apply? 17 A. I applied for a different job, yes. 18 Q. OK. 19 You applied for a different job? We'll get back to that later. And then he says: "I have talked with Anthony and Sean," 20 correct? 21 A. Yes. 22 Q. "A bit about working on transitioning some of my old 23 projects but haven't specifically talked about the OSB 24 libraries until now," right? 25 A. That is correct. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 460 K26Wsch2 OK. Weber - Cross 1 Q. And then he says: "Since the OSB libraries" -- thank 2 you -- "were initially my idea that stemmed from Brutal 3 Kangaroo and I've spent a lot of time and effort managing and 4 helping administer them, I'd like to stay on along with Frank 5 Stedman and Jeremy Weber and help with administering them." 6 Correct? 7 A. Correct. 8 Q. OK. 9 OSB libraries were initially my idea," your testimony is, So let's just take that sentence for a minute, "as the 10 according to your direct, that that is incorrect? 11 A. 12 statement. 13 Q. OK. 14 A. Yes. 15 Q. OK. 16 Kangaroo" clause, "and I spent a lot of time and effort 17 managing and helping administer them; is that a true statement, 18 or that's a false statement also, according to you? 19 A. 20 them," that is a true statement. 21 Q. 22 true statement, right? 23 A. Yes. 24 Q. And also according to you it was a true statement that he 25 didn't really follow the rules you wanted him to follow while That is -- that is correct that that's an incorrect Sorry. You thought it was your idea? And how about the next sentence after the "Brutal The "I spent a lot of time helping and managing administer OK. So on April 14, 2016, according to you, that was a SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 461 K26Wsch2 Weber - Cross 1 helping to manage and administer the OSB libraries? 2 A. He mostly followed the rules. 3 Q. He mostly followed the rules? 4 A. Yes. 5 Q. But he didn't follow them enough that it irked you? 6 A. It would occasionally annoy me. 7 Q. And then he said I'd like to stay on along with Mr. Stedman 8 and Mr. Weber, correct? 9 A. Correct. 10 Q. And help administer them? 11 A. Correct. 12 Q. And you didn't want that? 13 A. I didn't think that he should be part of the OSB libraries, 14 no. 15 Q. OK. 16 A. Yes. 17 Q. You wanted him out? 18 A. Correct. 19 Q. And then he says, "especially considering that the goal is 20 to move this to AED and allow Kevin to administer them," right? 21 A. That's correct. 22 Q. So they were going to be moved from division? 23 A. Branch to division. 24 Q. Branch to division, correct? 25 A. That's correct. So you didn't want that, right? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 462 K26Wsch2 Weber - Cross 1 Q. AED is division? 2 A. Yes. 3 Q. And it was going to be moved from branch to division so as 4 to make it accessible to more branches? 5 A. That was our goal, yes. 6 Q. Right. 7 going to be in a different place than OSB? 8 wanted to expand the use of the OSB libraries, right? 9 A. That's correct. 10 Q. Seems like a reasonable request, correct? 11 A. It could be, yes. 12 Q. OK. 13 He says, "I feel my intimate knowledge with the libraries would 14 be beneficial to the process," correct? 15 A. Correct. 16 Q. True statement, right? 17 A. Yes. 18 Q. "I feel I should still have sufficient time to help with 19 the libraries." 20 A. Yes. 21 Q. "And it would help propagate the libraries by having people 22 on other branches working together on them." 23 would you say? 24 A. Yes. 25 Q. "I think these libraries would be an excellent source of So for him it made sense, right, because now he's Right? And you And then he tells you, in an explanation, as to why. Nice of him, right? Collaborative, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 463 K26Wsch2 Weber - Cross 1 cross-branch collaboration within the division"? 2 A. That -- yes. 3 Q. Nice, collegial sentiment, right? 4 A. Yes. 5 Q. OK. 6 to continue my active role with the libraries," correct? 7 A. Yes. 8 Q. He included you on the email chain? 9 A. Yes. 10 Q. Do you reply? 11 A. I believe so. 12 Q. No. 13 you if you replied toe him, Mr. Schulte, the sender of the 14 email. 15 A. 16 responded to this email. 17 Q. What would you have said; no, thanks? 18 A. I would have said that, and I believe I referenced this 19 later, this was something for Kevin to decide when AED -- when 20 he took him over as a division-wide project, and -- 21 Q. Right, right. 22 A. -- until it was decided that this would actually be a 23 thing, and there were a lot of steps that we had to consider 24 before making it, they were still OSB's -- they were still 25 OSB's code and directly affected OSB's work. "So if OSB and RDB would be OK with this, I would like I -- Do you reply to him? I believe I did. Not to the others; I'm asking I don't remember specifically if I SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 464 K26Wsch2 Weber - Cross 1 Q. But you didn't reply to the issues he raises in the email, 2 right? 3 these are OSB libraries, you're going to stay out, if Kevin 4 decides to locate you join, Kevin will decide that. 5 your response, right? 6 A. MR. LAROCHE: Honor. Objection. MS. SHROFF: 10 MR. LAROCHE: OK. He sends an email first, so we should go 11 through the email correctly. 12 MS. SHROFF: Q. Misstates the document, your The response -- 9 13 That's I -- 7 8 You basically tell him in your email response that OK. I show you 3507-50. 14 THE COURT: Do you have a question now, Ms. Shroff? 15 MS. SHROFF: Yes, your Honor. 16 Q. Does that refresh your recollection as to your response? 17 A. So, this -- 18 Q. You know what? 19 Government Exhibit 1062, if you want, if that's easier, and 20 it's the last page. 21 Why don't you take a look at your Is this the reply that you sent? 22 question because -- 23 THE COURT: 24 MS. SHROFF: 25 That way you can pull it up on the screen. I'm asking you the Is this in evidence? It's the same document, your Honor. I'm just trying to make it easier so we don't use a 3500 document. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 465 K26Wsch2 Weber - Cross 1 THE COURT: It's in evidence. 2 MR. LAROCHE: 3 THE COURT: Yes. Thank you. 4 A. So, I recall sending this email. 5 before or after the email we've been talking about. 6 Q. 7 asking if this is the reply. 8 A. 9 this was something that I sent to him and he replied to me or Well, you tell me. I don't know if this was You said you email-replied, so I'm There's no time information on this email. I don't know if 10 if he sent it to me and I replied to him. 11 Q. 12 this is the situation." 13 A. Yes. 14 Q. Right? 15 A. This is definitely an email that I sent. 16 Q. Right. 17 situation with Sean, correct? 18 A. That is correct. 19 Q. Right. 20 A. I -- 21 Q. And you discussed the situation with Sean, but you cut him 22 out of the discussion, correct? 23 A. That's correct. 24 Q. Right. 25 A. I wouldn't say I cut him out. Well, it says: "Josh, I discussed things with Sean and But it must have been after you discussed the You went to Sean, you cut him out, right? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 466 K26Wsch2 Weber - Cross 1 Q. Well, you could have just said, Hey, let's go talk to Sean 2 together, right? 3 A. He didn't ask to go talk to Sean together. 4 Q. No, no. 5 A. No, I would not say I was superior to him. 6 Q. Well, you said he wasn't your equal but you weren't his 7 boss, so you thought of yourself above his pay grade? 8 A. No. 9 Q. Right, but when you took away his access before, you But you said you're the superior to him, right? I thought of him outside of my branch at this point. 10 testified that, as the person who had your job, you could tell 11 him what to do, right? 12 A. No. 13 Q. OK. 14 Let's put it aside. Go back to the email. You don't say to Josh one way or another let's go talk 15 to Sean together, right? 16 A. That's -- 17 Q. Fair to say? 18 A. Correct. 19 Q. And you go talk to Sean, correct? 20 A. That's correct. 21 Q. And then you invoke Sean in your email, correct? 22 A. That's correct. 23 Q. You don't tell Sean to send him the email because Sean is 24 his boss, correct? 25 A. I believe Sean asked me to send this email. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 467 K26Wsch2 Weber - Cross 1 Q. 2 just stick to what you remember. 3 You believe? Let's put aside all of your beliefs. Let's You don't have Sean send the email, correct? 4 A. No. 5 Q. OK. 6 A. Sean did not send this email. 7 Q. And you sent an email saying -- let's see what you say -- 8 "I discussed things with Sean and this is the situation," 9 right? 10 A. Yes. 11 Q. "In the short time OSB libraries remain an OSB project"? 12 A. Yes. 13 Q. Right. 14 A. Correct. 15 Q. "You are free to contribute to the libraries, creating a 16 branch and following the pull-request model that's in place," 17 correct? 18 A. Correct. 19 Q. "We are hoping to move the libraries to Kevin's authority," 20 right? 21 A. Correct. 22 Q. "Make them officially an AED-level resource," right? 23 A. Correct. 24 Q. OK. 25 direct authority for the two long-lived branches, then," you "And under Frank Stedman and my guidance," correct? "When Kevin takes over and if he desires you to have SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 468 K26Wsch2 Weber - Cross 1 say "we" -- we, not he; we -- "will give you commit access to 2 Master and Develop," correct? 3 A. Correct. 4 Q. But according to your rule, by the time it gets to AED, 5 it's no longer OSB libraries, right? 6 A. That would be a fair statement. 7 Q. Right. 8 A. Possibly. 9 Q. Why? You would be out of it, right? It would be up to Kevin. You said there's an unwritten policy; once you're out 10 of OSB, you're out of OSB. 11 A. AED encompasses OSB. 12 Q. OK. 13 A. He was in RDB, which also would have been encompassed in 14 AED. 15 Q. 16 right? 17 A. Correct. 18 Q. Right. 19 because he was leaving OSB libraries, he was not part of the 20 "we"; is that your testimony? 21 A. The -- at the time of this email, yes. 22 Q. Oh, OK. 23 to Master and Develop," basically you've elevated yourself to 24 Kevin's position? 25 A. And where was he going? Right. No. So you would all be encompassed under the same AED, But it would be OK for you to say "we" here, but When you say, "then we will give you commit access I am referring -- the "we" I'm referring to is me and SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 469 K26Wsch2 Weber - Cross 1 Frank, who were controlling the libraries at that point. 2 Q. 3 paragraph. 4 Frank and what you and Frank are going to do, right? 5 A. Yes. 6 Q. You and Frank don't run AED, right? 7 A. That's correct. 8 Q. Who is going to run AED? 9 A. Who's going to run AED? 10 Q. Yeah. 11 A. Kevin was not running AED. 12 Q. No. 13 going to make this decision, right? 14 A. Yes. 15 Q. OK. 16 you commit access and develop; you say "we"? 17 A. 18 makes this decision. 19 Q. 20 you to have direct authority over the two long-lived branches, 21 then we will give you commit access to Master and Develop." 22 You're still leaving yourself in the loop to give him access to 23 Master and Develop, right? 24 A. This would have been an administrative action. 25 Q. Whatever it is, you say "we." But you're not. No. No. You're saying when -- this is a whole new Look at the email. There's a break between you and Kevin, right? Whatever decision, it was going to be Kevin who was So you don't say then it will be up to Kevin to give I actually specifically say if he wants -- if Kevin You say, "when Kevin takes over and if he desires for You're part of the "we"? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 470 K26Wsch2 Weber - Cross 1 A. Yes. 2 Q. OK. 3 are then going to be, at least the plan is, at an AED level, 4 correct? 5 A. That's correct. 6 Q. By the way, do they ever make it to the AED level? 7 A. No, they did not. 8 Q. They never make it there, right? 9 A. That's correct. 10 Q. They never progressed to being an interbranch library 11 accessible to all, correct? 12 A. Some of the branches leverage -- 13 Q. No, no. 14 A. It was not to the division that we had, no. 15 Q. It was not what? And you agree with me, right, that the OSB libraries Just yes or no. 16 THE COURT: Division. 17 THE WITNESS: Division. 18 Q. It never made it to AED? 19 A. No. 20 21 22 23 MS. SHROFF: Is this a good time to take our break, your Honor. THE COURT: Yes. We'll take our midmorning recess. We'll resume at 11:15. 24 (Jury not present) 25 THE COURT: See you in 15 minutes. (Recess) SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 471 K263sch3 Weber - Cross 1 (In open court; jury not present) 2 THE COURT: 3 MS. SHROFF: 4 THE COURT: 5 MS. SHROFF: I'm sorry? 6 THE COURT: I said okay. 7 MS. SHROFF: Oh, okay. 8 THE COURT: 9 MR. LAROCHE: 10 Ms. Shroff, how much longer do you have? At least an hour. Okay. Thank you. Where's our witness? We'll get him, your Honor. (Continued on next page) 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 472 K263sch3 1 Weber - Cross (Jury present) 2 BY MS. SHROFF: 3 Q. It is still morning. 4 A. Good morning. 5 Q. Mr. Weber, you testified on cross just now that you don't 6 think you applied for Sean's job, correct? 7 A. I did not apply for Sean's job. 8 Q. Is it fair to say that you were actually thinking about 9 applying for Sean's job? Good morning again, Mr. Weber. 10 A. Yes, that is correct. 11 Q. And you thought about applying for Sean's job, this was 12 about April of 2016, right? 13 A. That is also correct. 14 Q. And that's early on in April, April 7 or 8, about early 15 part of April that you were thinking of applying for it, 16 correct? 17 A. That's correct. 18 Q. And one of the things that got into the way of you getting 19 Sean's job was the CIA has this rule that you have to go to 20 more than one division before you can move up to that level; is 21 that one of the things? 22 A. No, that is not correct. 23 Q. Okay. 24 than one division or branch or group? 25 A. Do you not have to do a three-year rotation in more No. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 473 K263sch3 No. Weber - Cross 1 Q. Okay. And is it fair to say that one of the reasons 2 you ended up not getting a promotion during that year was the 3 stupidity, quote unquote, between Amol and Mr. Schulte? 4 A. No, I don't think that's fair. 5 Q. You don't think that's correct? 6 A. No. 7 Q. You don't remember sending an e-mail saying that the 8 stupidity between Amol and Schulte did not help? 9 A. I -- I sent that e-mail probably. But, I do not -- I was 10 talked to and that was not -- I got career guidance, and that 11 did not -- it was not involving that. 12 Q. Okay. 13 A. No. 14 Q. Who did you get career guidance from? 15 A. Karen and Anthony. 16 Q. So, Anthony is above Sean, correct? 17 A. That's correct. 18 Q. So you wanted to apply for a promotion, you decided to get 19 career guidance, you went to Anthony, and Anthony told you this 20 wasn't the right time? 21 A. No. 22 Q. Okay. 23 A. Karen felt that the position I was interested in would not 24 be the right career move for me. 25 Q. So, you got career guidance from Sean, correct? Karen, I talked to Karen first. Okay. What did Karen say? And what was the right career move for you? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 474 K263sch3 Weber - Cross 1 A. I -- in hindsight, I am much happier in my current branch. 2 Q. I should have been more clear. 3 right career move for you? 4 A. 5 direction I should go. 6 a good move for me. 7 Q. 8 you were talked out of it and you didn't apply, correct? 9 A. That is correct. 10 Q. Let me go back to you and Mr. Schulte. 11 you knew Mr. Schulte, did he ever talk to you about WikiLeaks? 12 A. I don't believe so, no. 13 Q. You don't remember him ever discussing leakers with you? 14 A. I, I do remember talking about leakers. 15 Q. Okay. 16 A. There was discussion around Snowden. 17 Q. Okay. 18 A. Schulte felt that Snowden was a -- had betrayed his 19 country. 20 Q. 21 everything. 22 A. 23 be executed for sure. 24 he did express his typical strong opinions. 25 Q. What did she think was the Sorry about that. She, she, I don't know if she gave me any advice on the Okay. Just she felt that chief of OSB was not So you wanted to apply for chief of OSB, but then Over the time that What do you recall? And? That doesn't, you know, he seems to have strong opinions on You sure he didn't say more? He probably would have call him a traitor. Right. Said he should I don't remember specific verbiage, but Then he had those same opinions about Chelsea SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 475 K263sch3 Weber - Cross 1 Manning, correct? 2 A. 3 Manning. 4 Q. 5 that he strongly believed in the mission of the CIA, correct? 6 A. Yes. 7 Q. And he strongly believed that you should do nothing against 8 America, correct? 9 A. Yes. 10 Q. And he thought Snowden should be executed, correct? 11 A. I believe I recall specifically him saying that. 12 Q. Now, let me move gears completely and talk to you about 13 Government Exhibit 1251. Possibly. I don't remember conversations about Chelsea And when he was talking about Snowden, it was clear to you 14 Okay. Now, did you participate in putting this together? 15 A. No, I didn't. 16 Q. Okay. 17 A. Yes. 18 Q. And you reviewed it with Mr. Laroche? 19 A. Yes. 20 Q. And did you review it for accuracy, by the way, or not? 21 you just took it as it was given to you? 22 A. 23 diagram. 24 Q. 25 change? So, you were shown this document, correct? Or I did give some advice on some of the -- some of the Okay. After you gave advice, did the diagram change or not SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 476 K263sch3 Weber - Cross 1 A. It changed. 2 Q. It did change, right? 3 A. Yes. 4 Q. Sitting here today, do you recall what you told them to 5 change? 6 A. Yes. 7 Q. Could you tell us? 8 A. Yes. 9 Q. Sure. 10 A. There was, in these two areas -- 11 Q. Right. 12 A. -- there was a different picture for what they referred to 13 as a one-way throw. 14 there, and I felt that was inaccurate. 15 Q. So are these firewalls? 16 A. I believe so, yes. 17 Q. So, I don't know what a one-way throw is, but let's go with 18 the easy one because it's accurate. 19 A. In this diagram, yes. 20 Q. Okay. 21 A. A firewall controls access on the network. 22 Q. So, according to this photo, right, COG cannot turn left 23 and go to DevLAN that way? 24 A. I -- I don't know how the firewalls were set up. 25 Q. No, no, I'm just asking you according to your and The -- can I circle on this? I knew there was not a one-way throw It's a firewall, correct? And what is a firewall? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 477 K263sch3 Weber - Cross 1 Mr. Laroche's diagram here. Is that correct? 2 A. 3 between. 4 Q. 5 firewalls, correct? 6 A. That is correct. 7 Q. In fact, you don't even know if they, if anybody can bypass 8 a firewall, correct? 9 A. Correct. 10 Q. And would it be fair to say that the CIA does employ people 11 who are smart enough to bypass a firewall, or is that giving 12 them too much credit? 13 A. That is a fair statement. 14 Q. Okay. 15 wrong, please correct me. The diagram just talks about there being access controls in I don't know how that system was set up, no. Okay. 16 So you don't know if these firewalls truly work as So, I'm going to do this slowly, okay. If I'm You start at the top of the exhibit, correct, and we 17 start with the COG network. Correct? 18 A. Yes. 19 Q. And COG stands for Computer Operations Group; is that 20 right? 21 A. Yes, that is correct. 22 Q. And am I correct that COG is like the customer? 23 fact when you were testifying, you called it the customer? 24 A. Yes, they were, they were our primary customer. 25 Q. Okay. That in That's a little confusing to me, I have to honestly SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 478 K263sch3 Weber - Cross 1 tell you. Because it's odd that the customer is within the 2 agent. 3 are saying the customer is in-house? 4 A. That's why we're told to refer to them as mission partners. 5 Q. Mission partners. 6 A. Yes. 7 Q. So, you're all in one mission, which is to hack some 8 foreign country, and you want to all be together and be 9 partnershipped? Normally you think of a customer as outside, but you 10 A. Yes. 11 Q. So COG is the one that wants the tool. 12 A. Yes. 13 Q. And they're going to eventually deploy that tool, correct? 14 A. Yes. 15 Q. The deployment of that tool can be in more than one way, 16 right? 17 A. Not typically, no. 18 Q. Well, I mean, it could be a physical deployment, meaning 19 like somebody's going to get a tool like a thumb drive or hard 20 drive and go insert it into the consulate while they're in 21 Pakistan, let's say. 22 A. Yes, that's -- 23 Q. One way, right? 24 A. Yes. 25 Q. And another way is just to do it over the internet or not Correct? Right? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 479 K263sch3 Weber - Cross 1 with any physical access, correct? 2 A. Yes, but it would be different tools to do that. 3 Q. Right. 4 of tools. 5 A. Yes. 6 Q. So, COG is like a customer, right? 7 A. Yes. 8 Q. They place the order? 9 A. Yes. 10 Q. The order goes to EDG, correct? 11 A. Yes. 12 Q. EDG is like the manufacturer? 13 A. Yes. 14 Q. They build the thing for COG? 15 A. Yes. 16 Q. COG decides whether the thing is working or not and talks 17 to EDG if there are problems? 18 A. Yes. 19 Q. So once EDG has built -- where is EDG on the diagram or is 20 it just not there? 21 A. This diagram is the networks, not the org chart. 22 Q. Right. 23 to develop the tool, right? 24 A. EDG worked on the blue portion of this diagram. 25 Q. Great. Of course. You're just developing different types So that's just a group that works on this network Okay. So once EDG is done building the tool, they SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 480 K263sch3 Weber - Cross 1 send it to COG. Do I have that right? 2 A. Yes. 3 Q. Right? 4 A. Yes. 5 Q. And COG is the entity that -- the division under COG that's 6 going to use the tool, correct? 7 A. Sorry. 8 Q. Somebody in COG is going to use the tool? 9 A. Yes. 10 Q. Do I have that right? 11 A. Yes. 12 Q. And if they, before they use their tool, they make sure it 13 works. 14 A. Hopefully. 15 Q. Okay. 16 feature on the tool, COG logs into Jira, which is that pretty 17 little sphere at the bottom, right? 18 ticket about the problem they're experiencing, correct? 19 A. We wanted it to be that way. 20 Q. I was just asking -- 21 A. There was maybe one or two projects that actually had that. 22 But for the most part, COG would use a different process. 23 was not widely adopted. 24 Q. 25 chart. Could you say the first part again? They test the tool, right? And if there is a problem with the tool, or a And creates or requests a There was maybe -- I am just following your chart here. Jira You have Jira on the Right? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 481 K263sch3 Weber - Cross 1 A. Yes. 2 Q. COG sends the ticket to Jira? 3 A. Yes, that is one way they could do it. 4 Q. And just so the jury also understands, because I had a hard 5 time understanding it. 6 say you have a problem, Verizon opens a ticket and keep track 7 of all your complaints about your problem? 8 A. Basically. 9 Q. Jira is just like a web server, right? 10 A. Yes. 11 Q. Anybody can have Jira. 12 Defenders? 13 A. Yes. 14 Q. And there could be Jira at, let's say, the District Court, 15 right? 16 A. Yes. 17 Q. Just a way to keep track of all your problems on a tool? 18 A. Yes. 19 Q. So, what Jira allows -- and that's connected to Hickok here 20 on your diagram, correct? 21 A. Yes. 22 Q. What Jira allows you to do is it allows EDG and folks in 23 EDG to keep track of the tickets that COG is sending their way, 24 correct? 25 A. Basically when you call Verizon and you There can be a Jira at Federal Yes. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 482 K263sch3 Weber - Cross 1 Q. So, EDG can receive the information from COG? 2 A. Yes. 3 Q. And work on whatever it is that they want to be done better 4 on the tool? 5 A. Yes. 6 Q. Okay. 7 there introduces a vulnerability into the system, right? 8 A. Any technology introduces vulnerabilities. 9 Q. Right. According to you, is it fair to say that having Jira And the vulnerability here is, that COG, which is 10 up there, can access Jira through Hickok. 11 A. That's not a vulnerability. 12 Q. Say it again? 13 A. That's not a vulnerability. 14 Q. I didn't ask you if it was a vulnerability. 15 should -- it was a separate question. 16 question. 17 Maybe I That was the next COG can access Jira through Hickok, correct? 18 A. Yes. 19 Q. And Hickok is like a bridge, right? 20 A. Yes. 21 Q. Now, it's called a bridge network because a DevLAN user can 22 also access Jira through Hickok, right? 23 A. Yes. 24 Q. And we need that, or you need that, or the CIA needs that, 25 because it's important for the DevLAN user, which includes EDG, Like a bridge network? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 483 K263sch3 Weber - Cross 1 because they're the ones that have to work on answering the 2 ticket, or the request, that comes from COG. 3 A. Yes. 4 Q. So, in that sense, COG, and the folks in COG, and the folks 5 who are in DevLAN, are both sharing Jira. 6 A. Yes. 7 Q. Assume for a moment that somebody in COG is a bad actor, 8 correct? 9 A. Yes. 10 Q. For whatever reason, they want to access an EDG tool. 11 Right? 12 A. Yes. 13 Q. They want to walk off with an EDG tool, right? 14 A. Yes. 15 Q. They could malware into Jira, infect Jira, which would then 16 infect any visitor from DevLAN that also comes to Jira? 17 A. It is technically possible. 18 Q. Okay. 19 you tell me if it's technically possible, according to you. 20 Rogue. Well, this case is all about the technology. So, By doing that, Jira can be infected, malware can 21 infect Jira, that would in fact infect DevLAN. Correct? 22 A. That's not really a correct statement. 23 Q. Well, a user from DevLAN goes to Jira, correct? 24 A. Yes. 25 Q. User from COG goes to Jira, correct? No. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 484 K263sch3 Weber - Cross 1 A. Yes. 2 Q. If I were in COG and I wanted to mess with DevLAN, I could 3 by infecting Jira, so when a DevLAN user visits it is also 4 infected, and takes the infection back to DevLAN. 5 A. I am following now. 6 Q. Okay. 7 full of smart hackers, would not know, correct? 8 A. There is a possibility they would not know. 9 Q. And the COG user would or could gain control of DevLAN that That is a technical possibility, yes. The DevLAN user who is infected, because the CIA's 10 way, correct? 11 A. They would have access to DevLAN that way. 12 Q. Okay. 13 COG user can infect Jira, infect DevLAN, and have access to 14 DevLAN, right? 15 A. That's technically possible. 16 Q. And through DevLAN, can access Confluence, correct? 17 A. Potentially. 18 Q. What do you mean, "potentially"? 19 A. This is a very oversimplified and unrealistic scenario. 20 Q. You can tell Mr. Laroche all about that, because I'm sure 21 he will explore the unrealistic scenario with you in great 22 detail. 23 A. Understood. 24 Q. My question to you right now is that way COG can access 25 Confluence through DevLAN, correct? So, I just want to make sure I understand this. The Of course. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 485 K263sch3 Weber - Cross 1 A. There is a possibility. 2 Q. Right. 3 A. Yes. 4 Q. And how many people in COG? 5 A. I don't know that number. 6 Q. Okay. 7 or whatever it is? 8 A. I actually don't know that either. 9 Q. You testified on direct, did you not, that you had asked And also access Stash, correct? How many divisions under COG, or branches or leaves 10 Mr. Schulte to mount the backups, correct? 11 A. Yes. 12 Q. You directed him to do that? 13 A. I believe so. 14 Q. Can anyone run the command or a command to mount the 15 backup? 16 A. In what scenario? 17 Q. What do you mean in what scenario? 18 else, they can go mount the backup, right? 19 A. 20 Stash server. 21 Q. Right? 22 A. Then yes. 23 Q. They can mount the backup, right? 24 A. Yes. 25 Q. How many people had that access? I'm sorry. If you told somebody If they had access to the -- the Confluence or Bamboo or SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 486 K263sch3 Weber - Cross 1 A. I believe it was just me and Josh. 2 Q. Back then or forever? 3 A. Back then, at the time. 4 Q. Back then. 5 A. Yes. 6 Q. That's what your recollection is? 7 A. Yes. 8 Q. Can any server mount the backup? 9 A. I don't know. 10 Q. You don't know if any server can mount the backup? 11 A. I didn't set up the way the backup was controlled. 12 know, I don't know what access controls they had on it. 13 Q. 14 Mr. Laroche was showing you this diagram, correct? 15 A. 16 products. 17 greater DevLAN system. 18 Q. 19 backups? 20 A. Yes, I do. 21 Q. You do think there are restrictions? 22 A. Yes. 23 Q. What are the restrictions? 24 A. I have no idea what they are. 25 Q. But you just believe that there are? I don't But you testified about all kinds of access control when I can talk to the access controls in the Atlassian Okay. I don't know about the access controls about the Do you think that there is any restriction on the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 487 K263sch3 Weber - Cross 1 A. I do. 2 Q. You do? 3 A. Yes. 4 Q. You don't know, but you believe there are? 5 A. Yes. 6 Q. Okay. 7 on the Atlassian backup from something called Doxygen? 8 A. There was a mount for Doxygen. 9 Q. You know of the mount, right? 10 A. No, I don't. 11 Q. You don't know of the mount? 12 A. No. 13 Q. Oh. 14 A. I know that we use Doxygen. 15 connected to the Altabackup. 16 Q. You didn't know it was connected to the Altabackup? 17 A. No. 18 Q. You didn't know that Doxygen was connected to the 19 Altabackup. 20 connected to the Altabackup, that would bypass all access 21 controls? 22 A. It wouldn't bypass all access controls. 23 Q. You sure? 24 A. I don't know what access controls would have been in place. 25 Q. So you don't know what access control would be in place, And did you know, by any chance, if there is a mount I thought it sounded like you knew. I didn't know that it was But did you know that if Doxygen was in fact SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 488 K263sch3 Weber - Cross 1 you don't know about Doxygen, but you do know they couldn't 2 bypass. 3 I withdraw the question. That's okay. There came a time, right, and you testified to this, 4 that you learned about the WikiLeaks disclosure, correct? 5 A. Yes. 6 Q. And the disclosures were called Vault 7 and Vault 8. 7 that right? 8 A. Yes. 9 Q. Nobody at the CIA ever called anything Vault 7, right? 10 A. Not to my knowledge. 11 Q. Nobody ever called it Vault 8, correct? 12 A. Correct. 13 Q. And those were just words that were made up by somebody 14 outside of the CIA? 15 A. I assume. 16 Q. And you testified, did you not, that you were part of an 17 assessment team? 18 A. Yes. 19 Q. As part of that assessment team, there were people that 20 were under you in the assessment team? 21 A. Yes. 22 Q. And do you remember how many people were under your team on 23 your assessment team? 24 A. 25 each branch. I believe it was around 10. Is It was one or two people from SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 489 K263sch3 Weber - Cross 1 Q. One or two people from each branch? 2 A. Yes. 3 Q. You testified that you were trying to assess, correct me if 4 I'm wrong, you were trying to assess what tools were released. 5 Is that fair to say? 6 A. That was a portion of what we were trying to assess. 7 Q. There came a time that you were given a key to use as part 8 of your assessment of which tools were released and what harm 9 that could cause. 10 Correct? Do you remember that? 11 A. A key? 12 Q. Yes. 13 A. Like, one of the other teams made an assessment that sounds 14 like that. 15 Q. So you remember you were given a key? 16 A. I remember the key. 17 I was probably given that, yes. MS. SHROFF: 18 Q. I'm sorry. 19 you were testifying. 20 A. 21 describing. 22 Q. I shouldn't have spoken to the government while Is there any chance I could see what we're -- Sure, sure. MS. SHROFF: 24 THE COURT: A. You remember the key? I remember something that sounds like what you're 23 25 3507-01. Yes. May I just approach, your Honor? Yes. I -SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 490 K263sch3 Weber - Cross 1 MS. SHROFF: 2 THE COURT: 3507-01, page 4. The witness has answered yes, Ms. Shroff. 3 Q. You remember the key, right? 4 A. Yes. 5 Q. Okay. 6 assessment? 7 A. 8 this key. 9 Q. And did you consult with that key while doing your Yes, I believe I actually was the one that came up with Okay. And you were given a list of hundreds of tools that 10 were in use at that time, right? 11 A. 12 of the tools. 13 that generated it. 14 Q. I don't remember -- I remember giving, being given a list I don't remember what, like, what that list was Can you take a look at the document I have given you? 15 MS. SHROFF: 16 I have the secondary version. 17 Q. 18 document refreshes your recollection as to the number of tools. 19 Take a look. I could put it on computer if you want. Could you take a look and see if that (Pause) 20 A. Do you mind if I look at the other pages on this? 21 Q. No, no. 22 its entirety. Take your time. 23 (Pause) 24 THE COURT: 25 You can review the document in Can you identify what the document is, Ms. Shroff? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 491 K263sch3 Weber - Cross 1 MS. SHROFF: 2 THE COURT: 3 MS. SHROFF: 4 THE COURT: 5 MS. SHROFF: 6 THE COURT: 7 (Counsel conferring) 8 THE COURT: 9 MR. LAROCHE: 10 11 Sure. It's 3507-01. Thank you. The government has a copy. All right, Ms. Shroff. Your Honor, may we just have a minute? You've taken a minute already. What is the problem? Your Honor, may we approach at the sidebar, please. (Continued on next page) 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 492 K263sch3 Weber - Cross 1 (At the sidebar) 2 MS. SHROFF: Your Honor, I used this document, 3 3507-01, because there was no ruling on how I would open the 4 door through the WikiLeaks report. 5 that, as part of the assessment conducted of the loss or the 6 damage, there were X number, let's make up a number. 7 tools in use. 8 him that there were 1,000 tools in use because that information 9 is classified. Right. That that was the number back then in 2016 that was determined to be in use. 11 were in use -- 12 THE COURT: 13 100, more than 500? 15 16 17 18 1,000 The government says that I cannot tell 10 14 The 3500 that I had says So if I can't talk about how many Can she use a number, like say more than MR. LAROCHE: I think more than 500 is fine. The reason I raised -MS. SHROFF: I can say more than 700. I'll say more than 700. The point I was trying to make is, that he conducted 19 an assessment, and by his own assessment, out of the -- out of 20 the hundreds of tools that were in use, right, only 91 tools 21 were thought to be tools that a competent researcher could find 22 based on information in the release that revealed a tool or 23 source code. 24 of tools. 25 was a subset, the number of which he does not know, of those That the number was 91 compared to the hundreds And, of those 91, according to this witness, there SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 493 K263sch3 Weber - Cross 1 tools that were going to be retired, and had other issues, so 2 that their disclosure had no impact anyway or lesser impact. 3 And, he told the FBI -- 4 THE COURT: What do you want to ask him? 5 MS. SHROFF: 6 ask about the number of tools. I want to ask him all of this. 7 THE COURT: 8 MR. LAROCHE: 9 10 11 12 13 14 15 I want to And you're objecting to the specific -Just the big number. I don't disagree with that line of cross. THE COURT: Why don't you say it's more than 500. A smaller subset. MS. SHROFF: As long as he can't argue it is a bigger subset then. MR. BRANDEN: Can she use a fraction? That the 91 is one in seven? 16 MS. SHROFF: I'm just going to use 500. 17 (Continued on next page) 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 494 K263sch3 1 Weber - Cross (In open court) 2 BY MS. SHROFF: 3 Q. You have it there, Mr. Weber? 4 A. Yes, I do. 5 Q. So, according to you, right, there were far more, there 6 were more than seven -- more than 500 tools in use at that 7 time, correct? 8 A. Yes. 9 Q. Okay. And you were part of the team that was conducting 10 this, quote unquote, damage assessment, correct? 11 A. The initial damage assessment, yes. 12 Q. Right. 13 larger number, 500, that 91 tools were such that a competent 14 security researcher could research and find the leaks, right? 15 A. That's correct. 16 Q. Only 91? 17 A. Yes. 18 Q. Okay. 19 assessment, a subset of the 91, right, you didn't mention how 20 many of the 91, were tools that were about to be retired by the 21 CIA anyway. 22 A. Yes. 23 Q. And then you told the FBI, did you not, that in your damage 24 assessment, there were also a subset of tools that were on 25 WikiLeaks that had issues with the tools, and the CIA would And you determined, did you not, that out of that And then you told the FBI, did you not, that in your Correct? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 495 K263sch3 Weber - Cross 1 never use them anyway, correct? 2 A. Possibly. 3 Q. Review all you want. 4 Do you mind if I review? (Pause) 5 A. Sorry. 6 sounds like a correct statement, though. 7 Q. 8 at the bottom, it might help you out. 9 four of four. Okay. I don't see that in the document. It is -- that If you could just look at the last page, all the way The last paragraph on 10 A. Yes, I see that. 11 Q. Okay. 12 more? 13 A. 14 reference to tools that had a problem. 15 Q. 16 other issues"? 17 A. Oh. 18 Q. That's okay. 19 would have a problem, right? 20 A. Yes. 21 Q. Okay. 22 told the FBI the wrong thing, okay, that these tools or at 23 least the CIA plans for its tools to have a shelf life or a use 24 life of approximately six months. 25 A. And then -- did I cut you off or did you want to say I was just saying in that paragraph, I don't see a "Or had other issues." Yes, I do. Do you see that phrase, "or had I'm sorry. So you see that that sounds like tools that And then you told the FBI, and correct me if you That's a fair statement. There's no math behind it, but SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 496 K263sch3 Weber - Cross 1 that's -- that's my opinion. 2 Q. 3 these tools would eventually be found out anyway, based on the 4 nature of computer security, correct? 5 A. Yes. 6 Q. Okay. 7 WikiLeaks disclosure, you also were of the impression, were you 8 not, that the WikiLeaks disclosure landed with a thud. Okay. 9 I think that's correct. And you thought, and it was your opinion also, that And when you were doing damage assessment of this Does that ring a bell for you? 10 A. Yes, it does. 11 Q. Okay. 12 A. The media did not express significant interest in the 13 disclosure. 14 Q. 15 correct? 16 A. That is correct. 17 Q. You thought it wasn't that big a deal, because people 18 expect that of the CIA anyway, right? 19 A. I don't feel that's a correct statement. 20 Q. Okay. What do you mean by it landed with a thud? And the media didn't seem to care that much about it, 21 Let me just grab your statement here. Do you recall telling them that it landed with a thud 22 because that's what they expect the CIA to be doing anyway, and 23 it wasn't like it was used against Americans; do you remember 24 that? 25 A. Yes, I remember, I probably made a statement like that, and SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 497 K263sch3 Weber - Cross 1 it was my opinion that that was what the media's perception 2 was. 3 Q. 4 WikiLeaks story added nothing, because -- or didn't add much, 5 because people expect the CIA to develop tools like those in 6 the WikiLeaks release, correct? 7 A. I possibly said something like that, yes. 8 Q. Okay. Okay. 9 You told the FBI that, in your opinion, the And you also told -- I'm going to withdraw that. When you talked to the FBI about this, right, this was 10 in 2017, correct? 11 A. 12 I talked. 13 Q. 14 that the CIA's tools have a shelf life of six months, right? 15 A. Yes. 16 Q. And the release by WikiLeaks was more than a year from the 17 day that the information, at least according to these 18 prosecutors, the information was taken, correct? 19 A. Yes. 20 Q. Now, we talked a little bit about backups, but I wanted to 21 ask you one quick question. 22 Confluence can be copied using a vSphere or a vCenter? 23 A. Yes. 24 Q. And you told that to the FBI, did you not, in one of your 25 interviews? That probably is right. Okay. I don't remember the dates of when Would you agree with me, sir, that you did tell them Is it correct to say that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 498 K263sch3 Weber - Cross 1 A. Possibly. I'm not -- I know that we had problems with some 2 of the migration at one point, so, I'm not a strong vSphere 3 vCenter -- like, I'm not that knowledgeable of the technology. 4 Q. 5 right, that Confluence could be copied through a vSphere? 6 A. Yes. 7 Q. Or a vCenter? 8 A. Yes. 9 Q. Now, when you looked at the information in the actual That's fine. Would you agree with me that I'm correct, 10 WikiLeaks release, right? 11 A. Yes. 12 Q. Were you one of the people that sat and did a comparison? 13 A. Yes, I was. 14 Q. Okay. 15 A. The -- 16 Q. If you remember. 17 A. Initially, literal printout was put in front of me. 18 then later, another, another group within the center was tasked 19 with downloading from the internet and then providing that to 20 us. 21 Q. 22 being given a copy of any type of damage assessment report? 23 A. 24 report is. 25 don't know if I ever saw, like, a final report or something, if By the way, how did you get the WikiLeaks release? And While you were at the CIA in 2016 and 2017, do you recall Yes, probably. Like, it depends what your definition of I had access to and saw the assessment data. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I 499 K263sch3 Weber - Cross 1 that's what you're referencing. 2 Q. 3 is a spill or a leak? 4 A. I don't know. 5 Q. You don't know? 6 A. No. 7 Q. There came a time in November of 2016 when Mr. Schulte left 8 the CIA, correct? 9 A. Yes. 10 Q. And at that time, after he left, you looked at his 11 computers, correct? 12 A. I don't believe so, no. 13 Q. You don't recall being asked to look at his computer, 14 Mr. Schulte's computers? 15 A. No, I don't. 16 Q. Okay. Does the CIA do a damage assessment report every time there Let me see if I can help you out. 17 THE COURT: 18 MS. SHROFF: 19 promptly forgot. What are you showing him? I gave the number to Mr. Laroche and I I'm sorry. 20 THE COURT: 21 MS. SHROFF: 22 Do you know? Just for the record. Oh. I'm showing him 3507-513, and I'm showing him specifically page 15 of 27. 23 THE COURT: Thank you, your Honor. Okay, Ms. Shroff. 24 Q. Does that refresh your recollection? 25 A. I don't recall what I was reviewing. I think this might SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 500 K263sch3 Weber - Cross 1 have just been log files that I was given. 2 what I used to generate this information. 3 Q. 4 right? 5 A. 6 were log files of the Atlassian products. And it sounds like 7 here I had access to some other log files. I don't remember 8 what those were. 9 Q. Okay. I don't remember But you looked at his log files, you remember, I looked at log files. Fair enough. The ones I specifically remember It's been a long time. But you remember 10 looking at Mr. Schulte's log files, correct? 11 A. I remember looking at log files for the Atlassian products. 12 Q. Then you wrote an e-mail about your review of them, right? 13 A. Yes. 14 Q. You sent the e-mail on November 10, and then you sent the 15 e-mail to Anthony -- I can never pronounce -- Leonis. 16 right? 17 A. Yes. 18 Q. And to David, correct? 19 A. Yes. 20 Q. And you said that you had looked through the logs, right? 21 A. Yes. 22 Q. And that there were four machines authenticated against it, 23 correct? 24 A. Yes. 25 Q. And then you listed the four machines, correct? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Is that 501 K263sch3 Weber - Cross 1 A. Yes. 2 Q. And then you said you saw nothing worrisome or suspicious 3 about it, correct? 4 A. Yes. 5 Q. And then you sent that e-mail, correct? 6 A. Yes. 7 Q. Now, let me just ask you. 8 classification, quote, unclassified? 9 A. Yes. 10 Q. Is it fair to say that you are the one who decides how to 11 classify your own e-mails? 12 A. No. 13 Q. Oh. 14 A. We, we are given specific guidance on what is classified 15 and what isn't. 16 Q. 17 right? 18 A. 19 classification manual that we are given. 20 Q. 21 onboard you, they give you a little training on classification, 22 correct? 23 A. Yes. 24 Q. How long is that training, like a week, two weeks? 25 A. A day at most. You see how it says So when you write e-mail, what happens? Right. We follow that guidance. You have follow the guidance, but you decide, I decide what information is in there, based on the Okay. So, when you start work at the CIA, before they SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 502 K263sch3 Weber - Cross 1 Q. A day, right? 2 A. Yes. 3 Q. Then they give you like a little guide, correct? 4 A. Yes. 5 Q. And then you decide whether you're sending the e-mail with 6 a notation that says classified, unclassified, secret/noforn, 7 secret, top secret, right? 8 A. Yes. 9 Q. Okay. 10 I just want to make sure I understood the process. You can take that down. 11 Now, you also testified yesterday, did you not, about 12 Exhibit 801. And that's, you said you recognized Mr. Schulte's 13 handwriting. Right? 14 A. Yes. 15 Q. And this is a document that's titled "malware of the mind." 16 Right? 17 A. Yes. 18 Q. Okay. 19 A. Yes. 20 Q. Transcripts page five. 21 complaint page 59. 22 Right? 23 A. Yes. 24 Q. You with me? 25 A. Yes. And it says introduction, page one? The search warrant page 43. The Ethics and logical look at the charges 87. Tyranny, conspiracy, and conclusion, right? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 503 K263sch3 1 Q. 2 down. Weber - Cross Okay. 3 Now, you were asked to read -- you can take that You were asked to read a portion of that book or 4 article or whatever it is that the government claims it is, 5 right? 6 A. Yes. 7 Q. And you authenticated Mr. Schulte's handwriting, correct? 8 A. Yes. 9 Q. And you said you were sure that was Mr. Schulte's 10 handwriting, because you'd had trouble reading it before? 11 A. Yes. 12 Q. And I can empathize. 13 then you said you read a subparagraph that you considered trade 14 craft, is that right? 15 A. Yes. 16 Q. And trade craft is just training, right? 17 A. Can you repeat that last word? 18 Q. Trade craft is just another way of saying training, right? 19 A. It goes beyond that, but -- 20 Q. Tell me how it goes beyond. 21 A. Trade craft is, we're trained on trade craft. 22 craft is best practices, tools, techniques. 23 gamut. 24 Q. 25 called trade craft? It's not the easiest to read. And Did I have the right terminology? And trade It covers the So it's training on a bunch of different topics and that's SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 504 K263sch3 Weber - Cross 1 A. Okay, yes. 2 Q. Right. 3 you read, right? 4 A. Yes. 5 Q. And I'm going to have Mr. Lee over there help me bring it 6 up. 7 A. Yes. 8 Q. Okay. Okay. So, and you said that whatever it is that Was not anything you would ever talk about in public? By the way, do you by any chance -- 9 MR. LAROCHE: May I have just one moment? 10 MS. SHROFF: 11 (Counsel conferring) 12 MS. SHROFF: Sure. I'm trying to address Mr. Laroche's 13 concern but I don't think, I don't think you're right. 14 okay, Mr. Laroche? 15 MR. LAROCHE: Yes. 16 MS. SHROFF: Great. Is that Thanks. 17 Q. Mr. Weber, do you by any chance know if Vault 7 and Vault 8 18 is still up on the internet right now? 19 A. I don't know, actually. 20 Q. You don't know, right? 21 A. No. 22 Q. And just for a moment assume it's on the internet. 23 makes it up on the internet for how long? 24 A. 25 internet forever. That Usually when something is on the internet, it's on the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 505 K263sch3 Weber - Cross 1 Q. So it's been up there for at least two years, right? 2 A. Yes. 3 Q. And can I go back to the exhibit. 4 you recognize about the exhibit is the handwriting, right? 5 A. 6 referenced as well. 7 Q. 8 you recognize the handwriting, right? 9 A. Yes. 10 Q. You wouldn't have to read the techniques. 11 say that's Josh Schulte's handwriting? 12 A. You testified that all Yes, and I recognize the techniques that is being Okay. Well, we'll get to the techniques in a minute. But You would just Okay. 13 MS. SHROFF: Can I have it up? 14 Q. And you don't know when this document was written, correct? 15 A. No, I do not know. 16 Q. You don't know what year it was written. 17 A. That is also correct. 18 Q. So if you don't know what year, you don't know what month 19 or what day, correct? 20 A. That's correct. 21 Q. Now, you testified -- could I have the language that the 22 government had him read up. 23 highlight that section for you, okay. 24 A. Yes. 25 Q. Okay. Let me just see if we can This one. Is it fair to say that after you leave the CIA, you SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 506 K263sch3 Weber - Cross 1 are allowed, if you go through certain protocols, to tell 2 people you worked at the CIA once in your life? 3 A. I believe so, yes. 4 Q. In fact, you have colleagues, right, that are now in 5 private practice or running their own boutiques, and they say 6 on their bio page "I used to work for CIA." 7 A. 8 protection of my identity. 9 Q. I tend not to engage with people that leave the CIA for Well, you described yesterday your daily job, right, for us 10 at the CIA? 11 A. Yes. 12 Q. You said you go to the office 9 to 5? 13 A. Yes. 14 Q. Some days you work later? 15 A. Yes. 16 Q. You work in the D.C. area? 17 A. Yes. 18 Q. You live around that area? 19 MR. LAROCHE: 20 MS. SHROFF: 21 THE COURT: Objection, your Honor. He opened the door. Overruled. 22 Q. Right? 23 A. Yes. 24 Q. That's where you work, right? 25 A. Yes. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 507 K263sch3 Weber - Cross 1 Q. Washington, D.C.? 2 A. Yes. 3 Q. Capital of the nation? 4 A. Yes. 5 Q. You go home? 6 A. Yes. 7 Q. You use the car or the subway? 8 A. I use a car. 9 Q. Excellent. 10 A. Yes. 11 Q. And how long have you been doing that? 12 A. For about 10 years now. 13 Q. Getting back to this. 14 at the CIA," and he talks to you about data hiding and crypto, 15 correct? 16 A. Yes. 17 Q. Okay. 18 A. Steganography would be a subset of data hiding. 19 Q. That is like something that people have been doing since 20 what, 2003 at least, correct? 21 A. Yes. 22 Q. And it's taught at a course at Columbia University that you 23 can hide data and crypto, correct? 24 A. 25 like that. Then you come back to work, same car, correct? "Do you know what my specialty was Is that just a different word for steganography? I wouldn't know who was first to, like, publish something But -SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 508 K263sch3 Weber - Cross 1 Q. But there are articles upon articles, right? 2 A. Yes. 3 Q. About this, right? 4 A. Yes. 5 Q. This is nothing new. 6 conceal data in a custom designed file system, correct? 7 A. Yes. 8 Q. And they put that file system in a slack space, correct? 9 A. I'm sure it is not a unique technique. 10 Q. Exactly. 11 A. I don't know that. 12 Q. Well, you should check. 13 People design and write software to Apple phone does it, right? They definitely do it, I checked. But moving on, it says "or hidden partitions." Isn't 14 slack space just hidden partition? 15 A. 16 definitions. 17 Q. 18 essentially it is just space, right? 19 A. It's different definitions of different types of spaces. 20 Q. Okay. 21 A. No. 22 Q. Okay. 23 either, right? 24 A. No. 25 Q. "I split data across files and file systems to conceal the No. There are two different, those are two different Okay. Slack space is a little bit more highfalutin, but But again, nothing unique here, right? "I disguised data." Nothing unique about that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 509 K263sch3 Weber - Cross 1 crypto." 2 A. No. 3 Q. Exactly. 4 read his handwriting, you're right, "and could never detect 5 random or pseudorandom data indicative of potential crypto." 6 Nothing unique about it? "I had analysis tools that and could --" I can't All of it very normal, taught by professors in 7 colleges, NYU, Fordham, CUNY; wherever you want to go, right? 8 A. Yes. 9 Q. Now, it's no secret that he designed and wrote his own 10 crypto. In fact, he talked to you about his own crypto a 11 million times and you were fed up with that conversation, 12 right? 13 A. Yes. 14 Q. And then he says, you know, he calls some forensic 15 examiners buffoons, correct? 16 A. Yes. 17 Q. I'm sure there is a forensic examiner out there who is a 18 buffoon, but let's move to the next one. 19 MR. LAROCHE: 20 MS. SHROFF: 21 THE COURT: Objection, your Honor. Sorry. I withdraw it. The jury will ignore that remark. 22 Q. And "the FBI then to have custom software that doesn't fit 23 into their two-week class where they become forensic experts." 24 There is nothing classified about that statement, right? 25 A. No. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 510 K263sch3 Weber - Cross 1 Q. Nothing trade crafty about it? 2 A. No. 3 Q. Okay. 4 to do with it, but let's just finish. 5 expert in data hiding," right? 6 A. Yes, he states that. 7 Q. Would it surprise you to know that a simple Google search 8 of data hiding would tell you every single thing that is noted 9 here? 10 A. And then the rest of it really doesn't have anything "Make no mistake, I'm an No, it would not surprise me. 11 MS. SHROFF: You can take that down. 12 Q. You testified about folks engaging in malware, correct? 13 A. Yes. 14 Q. And you would agree that there are other foreign nations 15 and foreign powers that engage in malware, correct? 16 A. Yes. 17 Q. Everybody is in the business of making malware. 18 people in the business of making malware? 19 A. 20 significant number. 21 Q. 22 same thing, correct? 23 A. Yes. 24 Q. Just like we design thumb drives, let's pick three 25 countries. A lot of I don't know the amount of people, but, there is a Right. So, just as we do, other countries engage in the France, Iran, and Portugal also design thumb drive SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 511 K263sch3 Weber - Cross 1 tools, correct? 2 A. I haven't seen any reports that would show that. 3 Q. I'm really not asking for reports, I am just asking you if 4 you agree with me that foreign nations also create such thumb 5 drives? 6 A. Foreign nations, probably, yes. 7 Q. And just like we recruit people to access other countries' 8 computers, other countries recruit people to access our 9 computers, correct? 10 A. Yes. 11 Q. So, just like our agencies want to uphold the Constitution 12 and design these tools to infect the computer systems of other 13 countries, other countries are equally invested in upholding 14 their Constitution, and infecting our computer systems with the 15 same thumb drives and malware, correct? 16 A. I would assume. 17 Q. Let me ask you something. 18 called Operation Buckshot Yankee? 19 A. No, I don't believe I have. 20 Q. You don't, you don't as a CIA employee, you never heard 21 that it was an investigation into Russia for designing thumb 22 drive tools that were eventually used against the U.S.? 23 A. No, I did not hear of that. 24 Q. Okay. 25 for your testimony here today, correct? You ever heard of something Now, Mr. Weber, is it fair to say that you prepared SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 512 K263sch3 Weber - Cross 1 A. Yes. 2 Q. And before you testified here today, were you ever told 3 that Mr. Schulte's defense team wanted to talk to you? 4 A. 5 me that you guys were reaching out specifically to talk to me 6 outside of that subpoena. 7 Q. 8 either by e-mail, in person, or by any other means, that 9 Mr. Schulte's lawyers just wanted to sit down and talk to you, I received a subpoena. But I was never -- nobody ever told So outside of the subpoena, you never had a reach out, 10 just like you had sat down and talked to these individuals? 11 A. I don't believe so, no. 12 Q. You met with each one of these prosecutors, correct? 13 A. I don't know if I talked to all of them, but, yes. 14 Q. You've talked to them somewhere between 11 and 15 times? 15 A. I have no idea what the number was. 16 Q. March 22, 2017, March 27, April 5, May 8th, May 22, 17 June 1st, August 31. 18 A. Okay. 19 Q. Do you have any idea how many hours you spent with them in 20 2017? 21 A. No, I don't. 22 Q. 2018, you met with them on January 12, June 1st, June 11, 23 August 6, November 12, December 12, Any idea how many hours you 24 spent with them? 25 MR. LAROCHE: This was all in 2017. Objection. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 513 K263sch3 1 A. Weber - Cross No. 2 THE COURT: Overruled. 3 Q. Then you met with them in January. 4 A. Yes. 5 Q. January 14, January 21, and January 29. 6 A. Possibly, yes. 7 Q. No idea how many hours you spent with them? 8 A. No. 9 Q. How many hours did you spend with me? 10 A. Zero. 11 Q. Mr. Zas? 12 A. Zero. 13 Q. Mr. Branden? 14 A. Zero. 15 Q. And your testimony today is nobody told you that lawyers 16 from the Schulte defense team wanted to talk to you until we 17 served you with a subpoena? 18 A. Yes. 19 Q. Well, you've testified, so you can disregard that subpoena 20 that we served on you. 21 A. Thank you. Correct? That was going to be one of my questions. 22 MS. SHROFF: 23 THE COURT: 24 MR. LAROCHE: 25 Correct? I have nothing further. Mr. Laroche. Thank you, your Honor. REDIRECT EXAMINATION SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 514 K263sch3 Weber - Redirect 1 BY MR. LAROCHE: 2 Q. 3 Ms. Shroff left off which was Government Exhibit 801. 4 exhibit, if we can zoom back in on the paragraph we were just 5 talking about. Mr. Weber, I want to start I think essentially where 6 On that You were asked a number of questions about whether 7 these techniques generally are in the public domain. That they 8 are techniques that are known in the public. 9 A. Yes. 10 Q. Yesterday you testified that you as a CIA officer had never 11 talked about these types of techniques publicly. 12 A. Yes. 13 Q. Why as a CIA officer had you never talked about these types 14 of techniques publicly? 15 A. 16 to attribution to the CIA. 17 Q. 18 the CIA's use of these techniques? 19 A. No, I haven't. 20 Q. Would that be problematic? 21 A. Yes, it would. 22 Q. Why? 23 A. The, again, the -- if malware was captured on a target 24 system, and that adversary knew that they had been hacked, 25 confirming that you used a technique like that might lead them Because tying these techniques to CIA operations can lead Have you ever read a statement by a CIA officer confirming SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 515 K263sch3 1 Weber - Redirect to understanding that they had been hacked by the CIA. 2 MR. LAROCHE: Thank you. We can pull that down. 3 Q. You were also asked about log files that you reviewed 4 around the time that the defendant resigned from the agency. 5 Do you remember that? 6 A. Yes. 7 Q. That was in late 2016 that you reviewed those log files? 8 A. Yes. 9 Q. I believe you testified on cross-examination that you 10 believed those log files were from the Atlassian services? 11 A. Those are the ones that I remember reviewing. 12 Q. So we showed you some log files yesterday. 13 correct? 14 A. Yes. 15 Q. If we can just pull up one of those log files. 16 start with 1202-18. 17 Isn't that We can Do you recall testifying about this yesterday? 18 A. Yes. 19 Q. Do you recall that this was one of the log files that was 20 taken from the defendant's DevLAN computer? 21 A. Yes. 22 Q. In late 2016, was this one of the log files that you 23 reviewed from the DevLAN -- from the government -- from the 24 Atlassian log files? 25 A. What was the date you asked again? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 516 K263sch3 Weber - Redirect 1 Q. In late 2016, when the defendant had resigned or around 2 that time, was this one of the log files that you reviewed from 3 the Atlassian services? 4 A. No, it was not. 5 Q. If we can zoom in on the top three lines again, please. 6 Just starting on the third line at the bottom right. 7 a reference to osb.devlan.net. 8 where this log file is reflecting activity? 9 A. On the ESXi server owned by OSB. 10 Q. Can you remind us what date these activities occurred? 11 A. April 20, 2016. 12 Q. What was the activity that was reflected on the defendant's 13 DevLAN computer? 14 A. Reverting to a snapshot. 15 Q. Had you viewed this log file at or around the time of the 16 defendant's resignation, what, if any, steps would you have 17 taken as a result? 18 A. I would have reported this. 19 Q. Why? 20 A. This is very suspicious that he would take an action like 21 this. 22 Q. Can you focus again -- why is it suspicious? 23 A. He had no administrative role in this, and there was no 24 reason that he should revert to a snapshot. 25 Q. There is Do you have an understanding of Can you remind us of the time of day that this occurred. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 517 K263sch3 Weber - Redirect 1 A. This would have occurred at 5:35 p.m. 2 Q. We can pull that down. 3 Exhibit 1207-27. 4 Can we please publish Government Do you recall yesterday that I asked you a series of 5 questions about this log file? 6 A. Yes. 7 Q. Can you remind us again where this log file came from? 8 A. From the Altabackup. 9 Q. Was this one of the log files that you reviewed at or 10 around the time the defendant resigned? 11 A. No, it was not. 12 13 MR. LAROCHE: sticker and on those rows. 14 15 MS. SHROFF: a log file. 16 17 We can zoom in on the government exhibit Your Honor, I don't think this exhibit is It's beyond the cross. MR. LAROCHE: They asked him questions about things he reviewed related to defendant's devices. 18 THE COURT: Objection is overruled. 19 Q. Can you focus again on the March 3, 2016, backup. 20 A. Yes. 21 Q. I think you testified yesterday that one of the columns in 22 the middle showed date accessed? 23 A. Yes. 24 Q. Can you tell us what the date accessed is for the March 3, 25 2016, backup. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 518 K263sch3 Weber - Redirect 1 A. April 20, 2016. 2 Q. What types of activities would update the date accessed 3 field? 4 A. Reading the file or copying the file. 5 Q. Had you viewed this file at or around the time of the 6 defendant's resignation, what, if any, steps would you have 7 taken? 8 9 MS. SHROFF: Your Honor, it's hypothetical. What he would have done is immaterial to this jury. 10 THE COURT: Overruled. 11 What would you have done? 12 THE WITNESS: I would have reported this to leadership 13 immediately. 14 Q. Why? 15 A. Because this was showing somebody accessing data, and it 16 would have been unusual. 17 MR. LAROCHE: We can pull that down. 18 Q. 19 assessment of the leak and the potential harm that was caused. 20 Do you remember that? 21 A. Yes. 22 Q. You were asked a series of questions about tools that might 23 have been retired after the leak. 24 A. 25 You were asked a series of questions about the damage Do you remember that? Yes. MS. SHROFF: Objection. That was not the question I SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 519 K263sch3 1 Weber - Redirect asked. 2 THE COURT: Overruled. 3 Q. When a tool is retired, at what point does the CIA issue a 4 press release that they are retiring the tool? 5 MS. SHROFF: 6 THE COURT: Objection. It's not. It's beyond the scope. Objection is overruled. 7 A. We would never do that. 8 Q. Why not? 9 A. Because even though a tool was no longer used, there was -- 10 it was most likely used in an operation, and it might have been 11 caught in that operation. 12 CIA tool would lead to attribution to CIA operations. 13 Q. In what ways would that be problematic? 14 A. It would be problematic for our diplomatic mission, any 15 engagement with that country. 16 that they were targets of the CIA. 17 Q. 18 relating to it landing as a thud in the media. 19 A. Yes. 20 Q. Did the leak land as a thud for your work? 21 A. No, it did not. 22 Q. Why not? 23 A. It was extremely damaging. 24 a lot of energy to assessing the damage, it caused us to have 25 to rewrite a significant number of tools, and it also led us to So again, disclosing that that was a They would not be happy to know You were also asked about a series of statements you made It caused not only us to devote SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 520 K263sch3 Weber - Redirect 1 have to review a significant number of operations to understand 2 what our risk exposure was. 3 MR. LAROCHE: Can we please publish Government Exhibit 4 1251 again. 5 Q. 6 questions about Jira. 7 A. Yes. 8 Q. And malware related to Jira. 9 A. Yes. 10 Q. At one point, she cut you off when you said something was 11 unrealistic. 12 A. Yes. 13 Q. She was correct to say I would ask you about it. 14 Ms. Shroff on cross-examination asked you a series of Why do you think her scenario was unrealistic? 15 A. 16 compromising a significant number of disparate technologies. 17 You have web services, you have different types of host OS, 18 possibly firewalls in the way. 19 for each one of those situations, and that would involve -- 20 these, these are in the realm of possible, but when the CIA 21 does something like this, this is many, many developers and 22 many, many operators doing something like that. 23 The scenario that she talked about would have involved You would need a tool, specific (Continued on next page) 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 521 K26Wsch4 Weber - Redirect 1 BY MR. LAROCHE: 2 Q. 3 EDG? 4 A. No. 5 Q. Ms. Shroff also asked you about the backups. 6 that? 7 A. Yes. 8 Q. And how the backups were set up. 9 A. Yes. 10 Q. And she asked you about the mount points, right? 11 A. Yes. 12 Q. And how the mount points were set up. 13 where were the mount points for the Altabackup set up? 14 A. 15 Bamboo or inside, like, the physical server that Stash was 16 running. 17 Q. And who had access to those mount points? 18 A. It would have been Josh and myself. 19 Q. And why only you and Josh would have had access to those 20 mount points? 21 A. 22 those machines. 23 Q. And what credentials are you referring to? 24 A. The SSH keys. 25 Q. What types of SSH keys? And are you aware of any such tool that was developed in Do you recall Do you remember that? Can you remind us, Inside the virtual machine that was running Confluence or We were the only ones that had the credentials to log in to SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 522 K26Wsch4 Weber - Redirect 1 A. It would be an SSH key for Confluence and SSH key for 2 Bamboo. 3 Q. Are they Atlassian-level administrative privileges? 4 A. No. 5 Q. What are they? 6 A. These would have been privileged to the host OS that was 7 running the Atlassian products. 8 Q. And who had those keys? 9 A. Josh and myself. 10 Q. Could regular users access those mount points? 11 A. No. 12 Q. How do you know that? 13 A. You would need to log in to the host OS to be able to do 14 that, and only Josh and I could log in to those. 15 Q. 16 happened with the privileges on OSB libraries. 17 that? 18 A. Yes. 19 Q. I want to try to walk through step by step what happened 20 there. 21 thought you and Mr. Schulte at the time were equals. 22 remember that? 23 A. Yes. 24 Q. And you said you didn't think you were? 25 A. No. They were specifically set up for logging in to those. Now, you were asked a series of questions about what Do you remember One of the first things you were asked is whether you SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Do you 523 K26Wsch4 Weber - Redirect 1 Q. Can you just explain what you meant by that? 2 A. So, Mr. Schulte was -- I had more experience than 3 Mr. Schulte, and in this scenario, it was comparing apples and 4 oranges. 5 role in RDB. 6 Q. Why not? 7 A. Well, because there wasn't really any significant overlap 8 in the projects between OSB and RDB. 9 We were talking about my role in OSB and then his There was no real comparison there. MR. LAROCHE: Ms. Hurst, you can take that down. 10 Q. Let's talk about what happened with OSB libraries. Ms. 11 Shroff asked you a series of questions related to the timing of 12 when things happened? 13 A. Yes. 14 Q. When did you change the defendant's privileges to OSB 15 libraries? 16 A. I believe it was shortly after him departing OSB. 17 Q. And why did you do that? 18 A. It would have been because he was departing OSB and he no 19 longer needed access to OSB projects. 20 Q. 21 you about that? 22 A. Yes. 23 Q. Do you remember Ms. Shroff asking you a series of questions 24 about what happened during that interaction? 25 A. Now, did there come a time when the defendant approached Yes. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 524 K26Wsch4 Weber - Redirect 1 Q. What do you recall the defendant saying to you when he 2 approached you? 3 A. 4 statement that I had written, so -- 5 Q. 6 after he talked to you, talked to Sean, correct? 7 A. Yes. 8 Q. And then he came back and talked to you? 9 A. Yes, that's correct. 10 Q. And the statement Ms. Shroff was showing you was related to 11 when he came back, right? 12 A. I recall him wanting access back to it, and then I saw the And so I think one of the things you said was that he, Yes. 13 MR. LAROCHE: Let me show you an email, Government 14 Exhibit 1062. Actually, I'm sorry. Government Exhibit 1061. 15 If we can go to the last page. 16 to where we're at. 17 Q. What time was this email sent? 18 A. This would have been at 3:30 p.m. 19 Q. OK. 20 A. Yes, correct. 21 Q. I believe it's on the previous page, at the bottom; it 22 shows your name? 23 A. Yes. 24 Q. So at this point you'd spoken to Sean, is that right? 25 A. Yes, that's correct. I just want to try to orient us And this is the email you sent, correct? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 525 K26Wsch4 Weber - Redirect 1 Q. And this was after Mr. Schulte had made the statements to 2 you about "I'm going to get my accesses back"? 3 A. Yes. 4 Q. So after Mr. Schulte made this statement that -- he said I 5 was going to get my accesses back; Ms. Shroff asked you a lot 6 of questions -- you sent this email, is that correct? 7 A. Yes. 8 Q. Who is on this email? 9 A. It's Sean, Anthony, Richard and Frank. 10 Q. And just remind us, at the time, what position did Sean 11 have? 12 A. He was my branch chief. 13 Q. What position did Anthony have? 14 A. He was my deputy division chief. 15 Q. And why did you send this email? 16 A. I was instructed to. 17 Q. By who? 18 A. By Sean. 19 Q. You had already spoken to Sean about the privileges issue? 20 A. Yes. 21 Q. And Sean told you to send this email? 22 A. Yes. 23 Q. Can you summarize what you say in this email? 24 A. I am giving very specific guidance on what Josh's role was 25 supposed to be in the libraries at that time. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 526 K26Wsch4 Weber - Redirect 1 Q. And what was his role supposed to be? 2 A. He was supposed to be a contributor like anybody else in 3 the division but not have direct access to the Master and 4 Develop branches. 5 Q. 6 Sean? 7 A. And these were instructions you gave at the direction of Yes. 8 9 MR. LAROCHE: Q. Let's go to the next email. This is the response that you were asked about earlier, 10 isn't that correct? 11 A. Yes. 12 Q. And Ms. Shroff was asking you whether you sent that first 13 email after this or vice versa, is that right? 14 A. Yes. 15 Q. Does looking at these two emails in order refresh your 16 recollection about which one came first? 17 A. Yes, it does. 18 Q. Which one came first? 19 A. My email came first. 20 Q. OK. 21 that? 22 A. Yes. 23 Q. And what time is it? 24 A. It is at 3:39 p.m. 25 Q. Now, Ms. Shroff went through this email with you. So Mr. Schulte responds. Do you see the timing on SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Do you 527 K26Wsch4 Weber - Redirect 1 recall that? 2 A. Yes. 3 Q. But I think you testified yesterday that you did something 4 after this email? 5 A. Yes. 6 Q. What did you do? 7 A. I checked the log files of the OSB libraries. 8 Q. Why did you check the log files of OSB libraries after 9 seeing this email? 10 A. I didn't trust Josh to play by the rules. 11 Q. So you send this email, you check the logs files, what do 12 you see? 13 A. 14 permissions on the OSB libraries to what he wanted and not what 15 was described in the email. 16 Q. 17 first email, is that right? 18 A. Yes. 19 Q. Telling him how his permissions had changed? 20 A. Yes. 21 Q. Is that right? 22 A. Yes. 23 Q. And it came after the two conversations you had with him 24 before that about his privileges changing, is that right? 25 A. I see that after he sent this email he modified his So the modification came after you had sent the email, that Yes. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 528 K26Wsch4 1 Weber - Redirect MR. LAROCHE: Let's go to 1062, another email Ms. 2 Shroff showed you. 3 Q. 4 what, if any, steps did you take? 5 A. I reported it to leadership. 6 Q. And who did you report it to? 7 A. Sean, and then I was directed to go talk to Anthony. 8 Q. And did you end up emailing Anthony? 9 A. I believe so, yes. Now, after you found out that he changed his privileges, 10 MR. LAROCHE: Let's look at the second-to-last page of 11 this email string. Stop right there. OK. Let's zoom in on 12 the to-from here. 13 Q. Who sent this email? 14 A. I did. 15 Q. And what time did you send it? 16 A. April 14 at 4:40 p.m. 17 Q. So this is after of the email we just looked at with 18 Mr. Schulte, is that right? 19 A. Yes. 20 Q. And this is after you had determined that he changed his 21 privileges? 22 A. Yes. 23 Q. And who did you copy on this email? 24 A. There was nobody copied, but there was multiple people on 25 the "to" line. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 529 K26Wsch4 1 Q. 2 Weber - Redirect Thank you. Who was in the "to" line? 3 A. Anthony, Sean and Richard. 4 Q. OK. 5 A. Yes. 6 And the subject is OSB libraries? MR. LAROCHE: Why don't we zoom out again and then 7 zoom in on what you said to Anthony. 8 Q. Can you read that, please? 9 A. "Anthony, we have a situation with the libraries and the 10 Atlassian products in general. After we talked with Josh, and 11 I sent the email saying that he doesn't have direct access to 12 our two main branches, he went and modified the permissions to 13 the project to return his previous rights. 14 this because he is one of the Atlassian administrators, and I 15 think we need to remove him from this group. 16 situation further, but this act has shown he believes that 17 access controls shouldn't apply to him." 18 Q. 19 need to remove him from this group." 20 A. This would have been the Atlassian administrators group. 21 Q. Why do you think you needed to remove him from that group? 22 A. He can no longer be trusted with the administrative 23 privileges. 24 Q. 25 to you? He was able to do I can explain the One of the things you said in this email is "I think we What group is that? And what about what he did with OSB libraries showed that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 530 K26Wsch4 Weber - Redirect 1 A. He ignored the direction of leadership and set the 2 permissions that he wanted to have versus doing what he was 3 told. 4 MR. LAROCHE: Let's look at the next email in this 5 chain. 6 Q. Who sent this? 7 A. Anthony did. 8 Q. And when did he send this? 9 A. April 15 at 7:29 a.m. 10 Q. And he sent it back to you, Sean and Richard, is that 11 right? 12 A. 13 Just zoom in on who sent this email in response. Yes. MR. LAROCHE: Let's look what he said to you. 14 Q. Can you summarize what he's asking you in this email? 15 A. So, he's asking for a few points of clarification: 16 the libraries were owned by OSB, what Josh's permissions were, 17 and how I spoke to Josh about this. 18 1, if And then he explains that -- that there's two scenarios in 19 his mind: One scenario where Josh was being denied access to 20 the OSB libraries and being able to use them, and the other 21 scenario is if he changed his permissions to enable him to be 22 able to administer the libraries. 23 Q. Which scenario happened? 24 A. The second. 25 Q. Did you respond to this email? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 531 K26Wsch4 Weber - Redirect 1 A. I would have followed up. 2 or sitting down and talking to him. 3 MR. LAROCHE: I don't know if it was via email Let's take a look on this exhibit. 4 we go to the next email. 5 Q. Who sent this email? 6 A. I did. 7 Q. When? 8 A. April 15 at 12:12 p.m. 9 Q. Did you respond to Anthony here? 10 A. Yes. 11 Q. And Sean and Richard? 12 A. Yes. 13 MR. LAROCHE: Can Just zoom in on the to-from here. Let's look at the substance of this 14 email. 15 Q. 16 the first sentence at the top. 17 A. 18 classification on this email should be bumped up to secret." 19 Q. Do you have on understanding of what you mean by that? 20 A. Yes. 21 Q. What do you mean? 22 A. I believe the original email would have been unclassified, 23 something like that. 24 information in it but didn't appropriately mark the document. 25 Q. Now, first, can we just start at the top here, just read "Sorry for the spam. Because of the below, the I responded to it with classified Did you reclassify it? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 532 K26Wsch4 Weber - Redirect 1 A. Yes. 2 Q. Let's look at this first paragraph that appears on the 3 screen. 4 paragraph? 5 A. 6 they were meant to do. 7 Q. So responding to one of Anthony's questions, is that right? 8 A. Yes. Could you just summarize what you're saying in this So, I am explaining why we created the libraries and what 9 MR. LAROCHE: Let's go to the next page, please. Just 10 zoom in the "we had three goals." 11 Q. Summarize what those three goals were. 12 A. We wanted to make sure that developers had code that they 13 could trust to use in tools that they were going to deploy; we 14 wanted to have a process in which all developers could 15 contribute; and we wanted a means for us to track what code was 16 being used and where. 17 MR. LAROCHE: 18 Then just zoom in on those bullets at the bottom. Let's zoom out again. 19 Starting right there, yes. 20 Q. 21 buffers, data transfers, execution vectors, and it goes down? 22 A. Yes. 23 Q. What are those? 24 A. Those are -- I've said that we do eight things. 25 essentially those eight things. Do you see there's a series of bullets that start CoreLib, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 These are 533 K26Wsch4 Weber - Redirect 1 Q. Are these parts of the libraries? 2 A. Yes, they are. 3 Q. And just generally speaking, in what way are they parts of 4 the libraries? 5 A. 6 needed to use data transfer in the tool that you created, you 7 would use that library. 8 Q. 9 Anthony, is that right? They're individual components of the libraries, so if you So at this point you're still explaining the libraries to 10 A. Yes, that's correct. 11 Q. In response to his question? 12 A. Yes. 13 MR. LAROCHE: Let's go to the next page, please. 14 Let's just zoom in on "hopefully that is enough background" and 15 then down through -- yes. 16 Q. 17 please? 18 A. 19 a desire to make them an AED and have begun talking with Kevin 20 to see if we can transfer ownership to him so that it can be an 21 AED-level product. 22 use the libraries as they desire. 23 is the keys to Develop and Master." 24 Q. At this point who is controlling OSB libraries? 25 A. OSB. Right there is fine. Why don't you start with No. 1. Can you read No. 1, "The libraries are currently an OSB-owned product. We have However, anyone is free to contribute and The only thing OSB controls SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 534 K26Wsch4 Weber - Redirect 1 Q. And in particular, within OSB, who had direct control? 2 A. I believe at this point it would have been myself, Frank 3 and Matt. 4 Q. Let's read the second paragraph. 5 A. "Josh used to have the ability to merge items into Develop 6 and Master. 7 making more work for Frank pretty often due to this disregard 8 to the pull-request model. 9 admin changes and not new code. He didn't always follow the process and ended up His defense was always they were I want to make clear that we 10 did not limit his ability to contribute to the libraries. That 11 is still something he can do. 12 ability to merge changes into the long-lived branches, thus 13 removing his ability to control what goes into the official 14 versions." 15 Q. 16 libraries"? 17 A. 18 division could follow a process to add -- add new techniques 19 and code to the libraries. 20 Q. So in what way did his privileges change? 21 A. It was the final step of that process. 22 changed, after it is reviewed, one of the project leads would 23 just check to make sure all of the steps had been followed and 24 would literally click a button in the Atlassian page to say 25 merge. All we did was remove his What did you mean "his ability to contribute to the We had designed the libraries such that anybody in the After the code is SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 535 K26Wsch4 1 Weber - Redirect MR. LAROCHE: OK. If we can zoom in on just paragraph 2 3. 3 Q. Why don't we start with the first two sentences, please. 4 A. "Josh and I did have a conversation yesterday (14 April 5 2016). 6 permissions to merge into long-lived branches and wanted to 7 know why this was the case and whose decision it had been. 8 informed him that this was a decision that Sean had made, and 9 that I agreed with the decision." He came up after finding that he no longer had I 10 Q. Does this refresh your recollection as to who made the 11 decision as to his privileges? 12 A. Yes, it does. 13 Q. Who made that decision? 14 A. Sean. 15 Q. Can you read the next sentence, please? 16 A. "I stated that since Josh was no longer a member of OSB and 17 since the libraries were still an OSB project, he should not 18 have the authority to merge into the long-lived branches." 19 Q. And the next sentence, please. 20 A. "He disagreed with this answer and stated that when he 21 agreed to move to RBD that it was with the understanding that 22 he would keep all his projects." 23 Q. And next the few sentences, please. 24 A. "In his view, the libraries were his idea, that he should 25 remain in charge of them. I informed him that my understanding SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 536 K26Wsch4 Weber - Redirect 1 of the situation was different and he could talk to Sean about 2 it, which he did." 3 Q. 4 defendant about OSB libraries that day? 5 A. Yes. 6 Q. And then after this you went and talked to Sean, is that 7 right? 8 A. Yes. 9 Q. Let's continue with this paragraph that starts "after a Now, was this the first conversation you had with the 10 long discussion." 11 A. 12 and said that Sean stated that it was OK for him to have admin 13 access to the libraries and that I should re-enable his access, 14 to which I replied that I would discuss with Sean. 15 then finished the conversation by stating that he will 16 eventually get access back to the libraries and that access 17 should just be enabled now." 18 Q. You can keep going. 19 A. "I took this statement as him just saying that he was going 20 win the argument and I shouldn't bother pushing back. 21 departed, I discussed things with Sean, where it was confirmed 22 that the OK to give admin access to Schulte was not a thing and 23 that I should email Schulte the specifics of his role (see the 24 email sent last night). 25 reading his response, I took a look at audit logs and the "After a long discussion with Sean, he returned to my desk Schulte After he Following sending the email and SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 537 K26Wsch4 Weber - Redirect 1 libraries themselves." 2 Q. 3 We'll stop there. You can stop there, Mr. Weber. The previous sentence says, "I discussed things with Sean, 4 where it was confirmed that the OK to give admin access to 5 Schulte was not a thing." 6 A. 7 access and I should not re-enable it. 8 Q. 9 specifics of his role." What did you mean by not a thing? Sean told me that Josh was not supposed to have admin And then after that, you said "I should email Schulte the Did you do that? 10 A. Yes, I did. 11 Q. Was that the email we looked at as the previous exhibit? 12 A. Yes, it was. 13 Q. And then after that, you said you looked at the audit logs, 14 is that right? 15 A. Yes. 16 Q. What, if anything, did those audit logs show? 17 A. Those audit logs showed that following Schulte's emailed 18 response, he went and re-enabled his admin access to the 19 libraries. 20 MR. LAROCHE: If we can just zoom out and then go to 21 the next page. 22 Q. 23 finish reading this part of the paragraph? 24 A. 25 after sending a response to my email detailing his This is a continuation of the last page. Can you just "His direct write access to Master and Develop shortly SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 538 K26Wsch4 Weber - Redirect 1 responsibilities. Again, the only reason to have access to 2 Master and Develop is to control what is able to be merged into 3 the libraries. 4 limits the ability to contribute to or use the libraries." 5 Q. 6 to any program without explicit authorization? 7 A. No, I have not. 8 Q. Are you aware of any employee ever at the CIA taking such 9 action? Not having access to these branches in no way Have you ever given yourself back administrative privileges 10 A. No, I'm not. 11 Q. Is that type of action problematic for your line of work? 12 A. Yes, it is. 13 Q. Why? 14 A. Because it shows that you cannot be trusted to follow the 15 rules and should not have access to classified information. 16 MR. LAROCHE: You can pull that down. 17 Q. Yesterday, and today a little bit, you were asked some 18 questions about auditing on the system? 19 A. Yes. 20 Q. Are you aware of any time where auditing was increased on 21 DevLAN? 22 A. Yes. 23 Q. When, approximately, did that happen? 24 A. It would have happened shortly after this email chain. 25 Q. And why was auditing increased? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 539 K26Wsch4 Weber - Redirect 1 A. We wanted to have a better understanding of who was 2 accessing what within the Atlassian products. 3 Q. Was it in response to any specific activities? 4 A. I don't know specifically, but I would assume it was in 5 response to this. 6 7 MS. SHROFF: Honor. 8 9 Objection as to his assumptions, your THE COURT: Strike the answer. BY MR. LAROCHE: 10 Q. 11 issues with some of the foreign offices? 12 A. Yes. 13 Q. And Ms. Shroff cut you off during one of your answers? 14 A. Yes. 15 Q. What were you trying to say then? 16 A. The -- I never followed up with ISB, but Frank and 17 Patrick -- they, to this date even, continue to complain about 18 the transfer speeds out there. 19 Q. What do you mean by transfer speeds? 20 A. The -- 21 22 Remember when you and Ms. Shroff were talking about latency MS. SHROFF: Objection to the hearsay, your Honor. He has no personal knowledge. 23 THE COURT: Overruled. 24 A. The speed at which the developers in Foreign Office East 25 and Foreign Office West could download data that was stored in SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 540 K26Wsch4 Weber - Redirect 1 the WMA area. 2 Q. 3 existence? 4 A. Yes. 5 Q. You were asked a number of questions about DevLAN being a 6 dirty network -- 7 A. Yes. 8 Q. Do remember that? 9 Does that include the DevLAN network when it was in And also being the wild Wild West? 10 A. Yes. 11 Q. Can you explain to us again what you mean by dirty network? 12 A. So, DevLAN -- we would -- we would occasionally repurpose 13 malware or we would have collection from target networks on 14 DevLAN. 15 you -- you took precautions to understand that you couldn't 16 trust, like, the files that were on there. 17 Q. And why did you need those files on your computer? 18 A. To enable our operations. 19 Q. And what do you mean by that? 20 A. It could be targeting information. 21 said, techniques that we were going to reuse. 22 Q. 23 on your network? 24 A. No. 25 Q. And Ms. Shroff asked you about whether that created a We couldn't trust what was in that, in that data, so It could be, like I Everything. Were you able to do your work without those types of things SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 541 K26Wsch4 Weber - Redirect 1 security vulnerability for your network? 2 A. Yes. 3 Q. Are you familiar with the term "insider threat"? 4 A. Yes. 5 Q. What does that term generally refer to? 6 A. An insider threat would be a trusted individual that has 7 access to your company or network that is no longer behaving in 8 the company's best interests. 9 Q. Would security vulnerabilities be made worse if you had an 10 insider threat? 11 A. Yes. 12 Q. Why? 13 A. Because the insider threat might leverage those 14 vulnerabilities. 15 Q. 16 Josh and their issues at the agency. 17 A. Yes. 18 Q. And one of the things that you were asked about was 19 supporting, I think, supporting Amol at a legal proceeding? 20 A. Yes. 21 Q. What legal proceeding were you referring to there? 22 A. Amol was -- sorry. 23 fighting back against the restraining order, and so I was there 24 to testify. 25 Q. You were also asked a series of questions about Amol and Do you remember that? I don't know the right word. And why were you there to testify? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 He was 542 K26Wsch4 Weber - Redirect 1 A. The same, like, Josh made statements about what Amol did; I 2 did not believe those statements and I was there to testify 3 into that. 4 Q. Did you have to testify at that proceeding? 5 A. No, I did not. 6 Q. Do you know what happened? 7 A. The restraining order was withdrawn because of the 8 jurisdiction -- a jurisdiction issue. 9 what happened after that. And then I don't know 10 Q. Now, the fight between Amol and the defendant, did that 11 have anything to do with security issues on DevLAN? 12 A. No. 13 Q. Did it have anything to do with the Altabackups? 14 A. No. 15 Q. Was the fight about WikiLeaks? 16 A. No. 17 Q. Was the fight about stealing information from DevLAN? 18 A. No. 19 Q. Was the fight about any national security issues? 20 A. No. 21 Q. Was it about your mission at EDG? 22 A. No. 23 Q. Was it about how best to serve that mission? 24 A. Maybe a little bit, but not specifically. 25 Q. In what way? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 543 K26Wsch4 Weber - Redirect 1 A. Again, a lot of Amol's complaints towards Josh was that he 2 could be a better employee, better support the mission through, 3 you know being just a better person to work with, but it wasn't 4 necessarily -- it wasn't necessarily about, like, a specific, 5 like, thing. 6 Q. 7 with you about Edward Snowden? 8 A. Yes. 9 Q. Who was Edward Snowden? 10 A. He was an NSA employee. 11 Q. And now we just talked about the OSB libraries issue that 12 happened in April 2016? 13 A. Yes. 14 Q. Did those conversations happen before that or after that? 15 A. I don't remember the timing of Snowden. 16 before because after those emails I wasn't talking to Schulte 17 anymore. 18 Q. 19 before the OSB libraries situation? 20 A. And you were asked about conversations that Mr. Schulte had It would have been So the conversations about Snowden would have happened Yes. 21 MR. LAROCHE: Could we bring up Government Exhibit 22 809, please. 23 Q. Do you remember looking at this document yesterday? 24 A. Yes. 25 Q. And this contains the defendant's handwriting, is that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 544 K26Wsch4 1 correct? 2 A. Weber - Redirect Yes. 3 MR. LAROCHE: Let's go to page 11 of that document and 4 just focus on the top quarter of that page. 5 Q. 6 then there's some text? 7 A. Yes. 8 Q. Can you read that? 9 A. Hashtag "top secret." 10 Q. And then just below that, there's an arrow. 11 that? 12 A. Do you see, on the top right there, there's a hashtag and Do you see Can you just read what is next to that arrow? "Or dump the secrets here." 13 14 Hashtag "fuck your top secret." MR. LAROCHE: Let's go to page 12, please, the next page. 15 Sorry. One more page, please. And then let's focus, 16 first, on the below paragraph, the lower paragraph. 17 Q. Is this the defendant's handwriting? 18 A. Yes, I believe it is. 19 Q. Can you please read what the defendant wrote here? 20 A. "This is a huge wake-up call to U.S. intelligence officers. 21 The Constitution you fight to defend will be" -- 22 MS. SHROFF: Denied. 23 A. -- "denied to you if, God forbid, you are ever accused of a 24 crime. 25 have any allegiance towards your government or associates, If your government has no allegiance in you, why do you SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 545 K26Wsch4 1 Weber - Redirect provided info to the NYT." 2 MR. LAROCHE: Can we go up to the next, to the top of 3 this page, please. 4 Q. Again, is this the defendant's handwriting? 5 A. Yes. 6 Q. Can you please read what the defendant wrote? 7 A. "Your service in" -- defense, maybe, "in" -- I don't 8 recognize that word -- "security investigations and pristine 9 criminal history can't even get you bail. As Joshua Schulte 10 has said, you are denied a presumption of innocence. 11 you do your country's dirty work, but when you -- when your 12 country accuses you of a crime, you are arrested and presumed 13 guilty. 14 Send all of your secrets here: 15 And" -- I don't -- "and" something, "your service. MR. LAROCHE: 17 THE COURT: 19 WikiLeaks." And then I don't recognize the last word. 16 18 Ironic, No further questions. All right. Thank you. We'll take our luncheon break now and resume at 1:30. (Continued on next page) 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 546 K26Wsch4 1 (Jury not present) 2 MS. SHROFF: Your Honor, I know it was the Court's 3 ruling yesterday that it is the Court's practice to not allow 4 any recross. 5 THE COURT: 6 MS. SHROFF: 7 Given the fact that Mr. Laroche covered new material during his -- 8 9 Yes. THE COURT: Tell me what the new material is, Ms. Shroff. 10 MS. SHROFF: 11 THE COURT: 12 MS. SHROFF: 13 not covered with the witness. 14 15 I'm sorry? Tell me what the new material is. He covered new email material that I had The witness is still in the box, but I don't mind speaking in his presence. It's fine. 16 THE COURT: Why don't we excuse the witness. 17 MS. SHROFF: 18 THE COURT: 19 (Witness not present) 20 THE COURT: 21 MS. SHROFF: OK. Mr. Laroche. All right. He also covered new portions of the MCC 22 notebook, and we think it would be proper recross. 23 wanted a ruling from the Court so I don't violate any 24 procedures. 25 I just Also, the Court still hasn't ruled on the WikiLeaks SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 547 K26Wsch4 1 2 task force argument that we made in the morning. THE COURT: Yes. I think I gave Mr. Laroche until 3 close of business today to respond. 4 tomorrow. I'll rule on that 5 MS. SHROFF: 6 THE COURT: 7 Mr. Laroche, what do you say about recross? 8 MR. LAROCHE: 9 addressed on cross. OK. The WikiLeaks. I addressed issues that were directly The exhibits we looked at were exhibits 10 that Ms. Shroff selectively showed him. 11 him all portions of the exhibit. 12 Exhibit 1062, she didn't show his actual statements; I did. 13 She simply didn't show For example, Government With respect to the last document I showed, that was 14 in direct response to what was clearly a cross-examination 15 point that Mr. Schulte does not like leakers, and I just simply 16 showed a portion of his notebook where he said send your 17 secrets to WikiLeaks. 18 cross-examination topics. 19 MS. SHROFF: So it's a direct response to her That's true. 20 but it's new material. 21 new text. 22 THE COURT: It is in direct response, He covered new ground. He introduced I think I'll adhere to my practice: 23 direct, cross, redirect. The redirect was very limited and 24 didn't open up new territory, so I deny your application, Ms. 25 Shroff, to do more recross. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 548 1 MS. SHROFF: 2 THE COURT: 3 MR. LAROCHE: 4 THE COURT: 5 MR. LAROCHE: 6 THE COURT: 7 (Luncheon recess) OK. That means we need a witness. He will be ready, your Honor. Thank you. You're welcome. See you at 1:30. 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 549 K26Wsch4 Leonis - Direct 1 AFTERNOON SESSION 2 1:40 p.m. 3 THE COURT: Please be seated. 4 Are we all set to proceed? 5 MR. KAMARAJU: 6 THE COURT: 7 (Jury present) 8 THE COURT: 9 Are you examining, Mr. Kamaraju? 11 THE COURT: 14 Call in the jury. Please be seated. MR. KAMARAJU: 13 Yes, I believe so, your Honor. All right. 10 12 Is everybody here? Yes, your Honor. Would you call your next witness, please, Mr. Kamaraju. MR. KAMARAJU: The government calls Anthony Leonis. ANTHONY LEONIS, 15 called as a witness by the government, 16 having been duly sworn, testified as follows: 17 THE COURT: 18 THE WITNESS: 19 THE COURT: 20 right up to the microphone. 21 All right. 22 MR. KAMARAJU: 23 THE COURT: 24 DIRECT EXAMINATION 25 BY MR. KAMARAJU: Please sit down. Thank you. Make yourself comfortable. Mr. Kamaraju. Thank you, your Honor. You're welcome. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Pull yourself 550 K26Wsch4 Leonis - Direct 1 Q. Good afternoon, Mr. Leonis. 2 A. Good afternoon. 3 Q. Are you employed, sir? 4 A. Yes. 5 Q. Where do you currently work? 6 A. For the CIA. 7 Q. I'd like to direct your attention to the summer of 2015. 8 Were you employed by the CIA at that time? 9 A. Yes, I was. 10 Q. Were you working in any particular part of the agency then? 11 A. Yes. 12 Q. What part of the agency were you working for in the summer 13 of 2015? 14 A. 15 Cyber Intelligence. 16 Q. 17 working in any group? 18 A. Yes. 19 Q. What was that group called? 20 A. That was the Engineering Development Group. 21 Q. Is that sometimes referred to as EDG? 22 A. EDG. 23 Q. Generally speaking, was what EDG's function? 24 A. EDG's job was to build tools and capabilities to collect 25 foreign intelligence. I was working in an organization called the Center for And within the Center for Cyber Intelligence, were you SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 551 K26Wsch4 Leonis - Direct 1 Q. 2 entities did EDG target? 3 A. Computer systems, things of that nature. 4 Q. Were those computer systems used, for example, by foreign 5 actors? 6 A. Foreign actors, correct. 7 Q. Now, I'd like you to take a look around the courtroom. 8 you see anyone with whom you worked at EDG? 9 A. Yes. 10 Q. Could you describe them by where they're sitting? 11 A. They're in the second table, third in from this side. 12 Q. And could you describe him generally by an article of 13 clothing? 14 A. 15 head. 16 And without getting into any specifics, what types of Do I can't really see his clothing, but he's got a shaved MR. KAMARAJU: Your Honor, the government would ask 17 that the record reflect that the witness has identified the 18 defendant. 19 THE COURT: Yes. 20 MR. KAMARAJU: Thank you. 21 Q. In the summer of 2015, were you working within any 22 particular group in EDG? 23 A. I was working in RDB. 24 Q. And what's RDB? 25 A. RDB is the Remote Development Branch. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 552 K26Wsch4 Leonis - Direct 1 Q. And what was your position at that time with RDB? 2 A. I was the branch chief. 3 Q. What were your responsibilities as branch chief? 4 A. So last of my responsibilities as branch chief was, my job 5 was to make sure that everybody had what they needed to do 6 their job. 7 worked for me, and those developers woo build the tools. 8 branch chief, my goal was to make sure that they had whatever 9 they needed: whether it was computers; whether it was Right? There were a number of developers that So as 10 requirements, working with the operations folks; making sure 11 that for staff officers, that I would do their performance 12 reviews. 13 Q. 14 something called DevLAN? 15 A. Yes, sir. 16 Q. What's DevLAN? 17 A. DevLAN was the network that the developers used to actually 18 build tools for the mission. 19 Q. And was DevLAN a classified computer network? 20 A. Yes, it was. 21 Q. Did it hold top secret information? 22 A. It did. 23 Q. Now, did everyone who worked at CCI have access to DevLAN? 24 A. No, they did not. 25 Q. While you worked at EDG, did you have access to DevLAN? You know, just generally taking care of the branch. Now, you mentioned developers. Are you familiar with SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 553 K26Wsch4 Leonis - Direct 1 A. I did, actually. 2 Q. How would you typically access DevLAN? 3 A. So, usually you had a computer at your desk and it had -- 4 it was connected directly to it. 5 multiple computers actually connected to the network, but I 6 only had one because of what I was using it for. 7 Q. 8 correct? 9 A. That's correct. 10 Q. Were you also an administrator for DevLAN? 11 A. No. 12 Q. Are you a tech guy? 13 A. I know enough about technology, but I wouldn't put myself 14 in that kind of a role. 15 Q. 16 for DevLAN in 2015? 17 A. Yes, there were. 18 Q. Which employees were those? 19 A. So, there was a branch called ISB -- it was in another 20 division -- and their job was to administer the network itself. 21 Q. 22 were administrators for DevLAN? 23 A. 24 we had a code database or code repository on the network. 25 was called the Atlassian tool suite, and there were a number -- Some developers actually had In 2015, you mentioned that you were a supervisor, is that Were there any EDG employees who served as administrators In addition to ISB, were there any other EDG employees that Yeah. So, in addition to ISB, who -- they ran the network, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 It 554 K26Wsch4 Leonis - Direct 1 there were some developers that actually were managing that. 2 Q. Why were those developers administering Atlassian? 3 A. So, around that time, our ISB group, the branch that was in 4 charge of managing the network, they were undermanned, and so a 5 number of developers had an idea to use the Atlassian tool 6 suite to actually be used as a code repository. 7 developers -- Josh, Jeremy and Patrick, those three developers 8 actually were managing that on behalf of the division. 9 MR. KAMARAJU: 10 And so the Thank you. Now, Ms. Hurst, could we please publish Government 11 Exhibit 1011 that's already in evidence. 12 could go to the first page, please. 13 Q. Do you see where the email is signed Elliot? 14 A. Yes. 15 Q. Do you know who Elliot is? 16 A. Elliot was a member of my branch. 17 MR. LAROCHE: All right. If we If we could just go back to the previous 18 page for a second, and down at the bottom. 19 Q. 20 sent? 21 A. It was Thursday, July 16, 2015. 22 Q. Do you see who it was sent to? 23 A. Yeah. 24 Q. Were you copied on this email? 25 A. I was cc'd. Could you tell us the date and time that this email was It was sent to ISB. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 555 K26Wsch4 Leonis - Direct 1 Q. Was there a reason why you were cc'd on this? 2 A. Yeah. 3 make sure that ISB knew that this wasn't just like any request, 4 hey, I'd like to do this; it was a request with management's 5 backing. 6 Q. Do you see in the subject line where it says Stash repo? 7 A. Yeah. 8 Q. What's your understanding of that? 9 A. So, Panda's the tool name, and what Elliot was asking for I was the branch chief, so I think Elliot wanted to 10 was to get access to that tool repository, the Panda tool 11 repository. 12 Q. All right. 13 A. Sure. 14 Q. Now, who is this email from? 15 A. It's also from Elliot. 16 Q. And what's the date of this email? 17 A. It's Tuesday, July 21, 2015. 18 Q. And who did Elliot send this email to? 19 A. He sent the email to Jeremy and Josh. 20 Q. And were you copied on this one also? 21 A. I was. 22 Q. Do you see where Elliot writes, "After talking with ISB, 23 the admin password to Stash was changed so they no longer have 24 access"? 25 Let's take a look at the email up above. MS. SHROFF: Objection. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 556 K26Wsch4 Leonis - Direct 1 A. Yes, I do. 2 Q. What did you understand him to be saying there? 3 A. Essentially they were saying -- ISB was saying that they 4 couldn't make the change to that specific repo, so they needed 5 some help. 6 Q. 7 access to the Panda repo? 8 A. Yes. 9 Q. How do you know that? 10 A. Because the email on top says -- was sent from Josh to 11 Elliot and Jeremy and myself and says, "Elliot now has access 12 to Panda." 13 Q. 14 ISB that the request had management backing, is that right? 15 A. Uh-huh. 16 Q. Why is that important? 17 A. For some tools -- Panda, maybe some others -- those tools 18 were special tools, or specialty tools, and so they weren't 19 just generally available to anybody on the team, on the 20 development team or any other division or parts of the 21 division, so he wanted to make sure that when he was asking ISB 22 that they knew that this was -- this was actually a request 23 that was legitimate. 24 Q. 25 EDG was developing, were they classified? Looking at this email chain, was anyone able to get Elliot Josh was able to do that. You mentioned that Elliot cc'd you so that it was clear to And you made a reference to special tools. The tools that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 557 K26Wsch4 Leonis - Direct 1 A. Yes, they were. 2 Q. Now, I want to direct your attention to March of 2016. 3 A. OK. 4 Q. Were you still chief of RDB at that time? 5 A. I was. 6 MR. KAMARAJU: 7 Exhibit 89, please. 8 Q. 9 responsibilities? Ms. Hurst, could we pull up Government Did there come a time when you were given additional 10 A. Yes. 11 Q. Could you explain what additional responsibilities you were 12 given at that time? 13 A. 14 the Applied Engineering Division, AED, that I was interested in 15 taking on more responsibility. 16 the deputy division chief was going to leave AED and I said, 17 Hey, if that happens, that would be something I'd be interested 18 in. 19 a new job. 20 transferred to a new job, and I was made the acting division 21 chief, the acting deputy division chief, while still serving as 22 the branch chief at that time. 23 Q. 24 positions were you filling in RDB? 25 A. Yeah. So, in 2016, beginning of 2016, I told the chief of So there was possibility that So in March 2016, the deputy division chief took on, took Shortly thereafter, the division chief also was Let's be clear. In March of 2016, how many different I was filling two -- two acting roles and the branch chief SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 558 K26Wsch4 Leonis - Direct 1 role, so I had three. 2 Q. 3 2016? 4 A. 5 Operations Support Branch, OSB. 6 Q. What is OSB? 7 A. It's a branch that built quick-reaction tools. 8 tools that when the operator said, Hey, we need a capability 9 for some -- some operation, they would go there first, and that Now, where within EDG did the defendant work in March of At the beginning of 2016 -- or March of 2016, the Those were 10 branch was really good at taking ideas and prototypes and 11 turning them into tools that could be used in the mission, very 12 quickly. 13 Q. And how was OSB different than RDB? 14 A. So, RDB was more focused on strategic tools, longer-term 15 tools. 16 it was more focused on doing more longer-term efforts, bigger 17 efforts, complex efforts. 18 Q. 19 defendant? 20 A. Yes. 21 Q. Could you describe those interactions, generally? 22 A. So, when I became a branch chief of RDB, that was my first 23 real supervisory role, and the branch chief of our, of OSB, his 24 name was Sean. 25 frequently go up to his office. While the branch could do quick-reaction capabilities, Now, before March of 2016, had you ever interacted with the Sean's this really good guy. We'd talk. I would He kind of took me SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 559 K26Wsch4 Leonis - Direct 1 under his wing a little bit, showed me how to write performance 2 reports and things of that nature. 3 over the years, I would go up to that branch and, you know, 4 look for him. 5 So there'd be, you know, Many times he wasn't in his office. He was actually 6 sitting at the end of the row in front of his office, and at 7 the end of that row, Jeremy and Josh were in that general area, 8 and it -- you know, it was just normal conversations. 9 know, nothing complicated or anything. You Just good 10 conversations. 11 Q. 12 culture of OSB? 13 A. 14 mean, they were always trying to -- they would have times where 15 they had, you know, some breaks and then they had times where 16 they were working hard on stuff. 17 more-junior developers in the branch, but they seemed to get 18 along really well, and Sean was a good -- good branch chief. 19 Q. 20 is that right? 21 A. Uh-huh. 22 Q. How did the seniority compare to the seniority level at 23 RDB? 24 A. 25 I just think over time, you know, some people moved throughout During those visits, were you able to observe sort of the Yeah. I mean, it was -- since they had a lot of QRCs, I And so it was -- it had And you mentioned they had more-junior developers in OSB, SO, RDB had a lot of more-senior developers, and you know, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 560 K26Wsch4 Leonis - Direct 1 the division. In fact, you know, right around that time, there 2 was a developer from OSB -- his name was Duane -- and he 3 actually moved down to RDB to work on some more strategic 4 projects. 5 Q. 6 duties at the division level -- 7 A. Yup. 8 Q. -- were you the defendant's supervisor? 9 A. No, I was not. 10 Q. After you assumed those responsibilities, did you fall into 11 his supervisory chain? 12 A. Yeah, I did. 13 Q. And when that happened, did you receive any information 14 about the defendant? 15 A. 16 between an individual named Amol and Josh, and it had something 17 to do outside of work, or -- 18 Q. Well, what was your understanding of what the issue was? 19 A. I thought it was -- I seem to remember it was a restraining 20 order of some sort. 21 Q. 22 the -- 23 A. No. 24 Q. -- restraining order was? 25 A. No, I did not. Before March of 2016, when you assumed the additional Very briefly, I was told that there was some sort of issue And did you have any understanding what the basis for SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 561 K26Wsch4 Leonis - Direct 1 Q. How did you learn about it? 2 A. I was told by the chief of division at the time, or who was 3 leaving. 4 Q. 5 issue? 6 A. 7 responsibilities, Mike, who was the deputy group chief, he kind 8 of took me under his wing and really kind of helped me, walked 9 me through that, because I was balancing a lot of roles at the And did you talk to anybody else at that time about this Yeah. So, as I was taking on those additional 10 same time. 11 Q. Generally speaking, who did you meet with about the issue? 12 A. So, I recall at one point I had to go to this meeting in 13 the CCI front office, and there were a lot of senior people 14 there. 15 lot of listening. 16 deputy chief of the center was there. 17 was there. 18 recall those names, but -- 19 Q. 20 before, right? 21 A. Correct. 22 Q. Prior to the meeting you just described, had you ever had 23 such a high-level meeting about a personnel dispute? 24 A. No. 25 Q. Was there something about this situation that made it I was the most junior person in the room, so I did a And the chief of the center was there. Mike was there. Security was there. There were some others. The HR I don't Now, before this incident, you had been a supervisor SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 562 K26Wsch4 Leonis - Direct 1 unusual? 2 A. 3 the two developers and it involved outside stuff, it -- it was 4 at a different level. 5 Well, since it involved something that had to do between I also remember, I think, the threat management unit for 6 the organization was called in to address it as well, so it 7 was -- it was a pretty serious matter. 8 Q. 9 attended? Was any action taken as a result of the meetings you 10 A. Yeah. So, later in -- at the end of 2016 -- or March of 11 2016, it was decided by management that Josh would be moved to 12 RDB and Amol would be moved to MDB. 13 was kind of get them out of the environment that they were in, 14 get them back to work, doing things that they could do to 15 contribute. 16 because the skill sets Josh had were congruent to what they 17 were doing in RDB at some level. 18 to work in MDB. 19 Q. 20 important? 21 A. 22 highly skilled developers, you want to get them actually back 23 to work and contributing to the mission. 24 were moved to different seats in their branch, and so the fact 25 of the matter was, management thought, Hey, let's make sure The idea was -- there, it Management believed that RDB was a good place And Amol could use his skills You mentioned getting back to work quickly. Why was that You know, I think it's really important that when you have So, originally they SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 563 K26Wsch4 Leonis - Direct 1 that we can, you know, change the atmosphere, kind of give them 2 a reboot and help them get back to work so they can contribute. 3 MR. KAMARAJU: Ms. Hurst, could we publish Government 4 Exhibit 1046, which is in evidence. 5 the last -- there we go. 6 Q. 7 24, 2016? 8 A. Yeah. 9 Q. Who sent this email? 10 A. Debra. 11 Q. Who's Debra? 12 A. Debra was the chief of the division at the time. 13 Q. Are you on this email? 14 A. No, I was not. 15 Q. Had you assumed your additional responsibilities at this 16 point? 17 A. Not -- not at that point. 18 Q. Who was this email sent to? 19 A. It was sent to Amol and Josh, and Debra cc'd herself. 20 Q. And can you just read the first line of her email? 21 A. Sure. 22 assigned cubicle." 23 And let's scroll down to Now, do you see an email at the bottom there, dated March It says, "As discussed please move to your newly (Continued on next page) 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 564 K263SCH5 Leonis - Direct 1 Q. What do you understand that to be a reference to? 2 A. So, they had desks that were near one another, and Debra 3 was basically saying, hey, we've discussed you're going to move 4 to a new cubicle. 5 Q. 6 OSB? 7 A. At this point, were they both still supposed to be within Yeah, those cubicles were still in OSB. 8 9 MR. KAMARAJU: the chain, please. We can move up to the next e-mail in Thank you. Maybe let's get the preview. 10 So let's start with the date and time. 11 Q. Who sent this e-mail? 12 A. I did. 13 Q. When did you send it? 14 A. Tuesday, March 29, 2016. 15 Q. Who did you send it to? 16 A. I sent it to Amol and Josh, and cc'd a number of people. 17 Q. People that you cc, where do they work? 18 A. So, first two were HR related. 19 John and Bonnie were, you know chief, deputy chief of the 20 center. 21 Then myself, Debra, the outgoing division chief, and Sean the 22 branch chief of OSB. 23 Q. 24 for an e-mail you would send to two developers? 25 A. Dana was security. Then Karen and Mike were the chief and deputy chief of EDG. Now, are all those people on the typical distribution list No. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 565 K263SCH5 Leonis - Direct 1 Q. Was there a reason you included them on this e-mail? 2 A. Yeah, because there was a big meeting about it. 3 Q. Do you see where you say "After further consultations with 4 HR, security and the CCI front office"? 5 A. Correct. 6 Q. Who were you referring to there? 7 A. That's the meeting I was just talking about. 8 big meeting about, you know, Josh and Amol, and how to kind of 9 get them back, back integrated into the workforce. There was a So that's 10 what I'm referencing. 11 Q. 12 immediately, Tuesday, 29 March 2016 the following adjustments 13 are being made"? 14 A. Yes. 15 Q. Why did you want the move to be effective immediately? 16 A. That was what management had decided. 17 Q. Was there a reason for that decision? 18 A. Yeah, it was just to not let this linger any longer. 19 get people moved, get them back to work, get them working. 20 Q. What were the adjustments that you were referring to? 21 A. So, it was decided that Josh would move to RDB, and that 22 Amol would move to MDB. 23 Q. 24 serving as branch chief of RDB? 25 A. Do you see in the e-mail where you say, "Effective At the time you sent this e-mail, were you still also I was. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Like, 566 K263SCH5 Leonis - Direct 1 Q. Can we take a look at the next e-mail, please. Who sent 2 this e-mail? 3 A. Josh did. 4 Q. When did he send it? 5 A. Tuesday, March 29, at 1:12 p.m. 6 Q. Who did he send it to? 7 A. He sent it to me. 8 Q. And who was on the copy line? 9 A. Pretty much everybody but Amol that was on the previous 10 e-mail. 11 Q. I'd like you to just read what he wrote, please. 12 A. Okay. 13 from my current branch is for reporting to security an incident 14 in which my life was threatened and/or for submitting a 15 protective order against Amol." 16 Q. 17 reporting? 18 A. No. 19 Q. Why did you move him? 20 A. As I've said, it was to get him back integrated in so he 21 could use his skills to develop tools for the mission. 22 Q. Was he the only one that was moved out of OSB? 23 A. No. 24 Q. Can we keep going up. 25 A. It's also an e-mail. "I just want to confirm this punishment of removal Was reassigning the defendant to RDB a punishment for No, it was not. What's this? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 567 K263SCH5 Leonis - Direct 1 Q. Who sent this one? 2 A. Josh did. 3 Q. Was this sent on the same day as the e-mail we just looked 4 at? 5 A. I believe so. 6 Q. Who did he send this one to? 7 A. Basically the same list of people. 8 Q. Do you see where he says, "I was told that there would be 9 no written response to my e-mail"? 10 A. Yup. 11 Q. Do you have any recollection of discussing with the 12 defendant whether there would be a written response? 13 A. I really don't remember that, that part of it. 14 Q. And do you see where he says, "So I'm proceeding with my 15 move, assuming it is directly due to my security report"? 16 A. Yes. 17 Q. I believe you testified before your understanding was there 18 was some sort of restraining order in place, correct? 19 A. Yeah. 20 Q. Was there any connection between this move and his security 21 report? 22 A. I don't know. 23 Q. Do you see where he says, "However, I'll be leaving early 24 today and will be unable to complete my move by the time I 25 leave." SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 568 K263SCH5 Leonis - Direct 1 A. Yes. 2 Q. Did he ever ultimately move to RDB? 3 A. Yes, he did. 4 Q. Once he moved to RDB, was he under your supervision for a 5 time? 6 A. 7 Duane as the acting chief as well. 8 Q. 9 they typically retain access to the projects that they were Yeah, and I also with all those acting roles I assigned When a developer is moved from one branch to another, do 10 working on in their old branch? 11 A. Not all of them, no. 12 Q. Is there a practice in place with respect to that? 13 A. I mean, as people leave branches, typically there is a 14 reconsideration of what tools they need access to. 15 were working on something and they wanted to continue that 16 work, so they would keep working on that thing. 17 they -- if they had no need, they would be removed from 18 accessing certain tools. 19 Q. Within each branch, who owned the projects themselves? 20 A. I mean, developers did for the most part. 21 Q. Who made the decision as to whether, for example, somebody 22 would keep their access to a project when they were moved? 23 A. 24 disagreements, those disagreements could be resolved by 25 management. Some of it was developer based. Maybe they Otherwise, if And when there were SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 569 K263SCH5 Leonis - Direct 1 Q. 2 you have any discussions with him about projects that he would 3 maintain? 4 A. 5 called Shattered Assurance, and it was related to something 6 that he had built or was going to build. 7 tool that was a thumb drive based tool as I understood it. 8 Q. Was that called Nader? 9 A. I believe so, yeah. 10 Q. During that conversation, did a project called OSB 11 libraries come up? 12 A. It came up later. 13 Q. So at that time, did you talk about whether he could 14 keep -- 15 A. No, I don't believe it came up at that time. 16 Q. What's your understanding of what OSB libraries is? 17 A. So, OSB libraries is a -- it is a code repository that OSB 18 created. 19 they built a library that had a bunch of code building blocks, 20 kind of like Legos. 21 you're trying to build a toy, you want to have Lego building 22 blocks. 23 At the time that the defendant moved from OSB to RDB, did Yeah, there were discussions. I recall two tools, one was And there was another Since they were doing a lot of quick reaction tools, If you're trying to build something, In their case, they wanted to have these libraries 24 where they could pull code quickly to put them together to 25 build a quick prototype. It was accessible to the entire SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 570 K263SCH5 Leonis - Direct 1 branch, as I understood it. 2 take code away. 3 And you could add to it, you can But the whole idea was that developers could use it to 4 help them get the job done quicker. 5 Q. 6 over the defendant's access to OSB libraries? 7 A. Did there come a time when you became aware of a dispute Yes. 8 9 MR. KAMARAJU: Let's publish Government Exhibit 1061. We've looked at this e-mail before. If we can go to the bottom 10 e-mail, please. 11 Q. What's the date of this e-mail? 12 A. It's Thursday, April 14, 2016. 13 Q. What time was it sent? 14 A. 3:30 p.m. 15 Q. I think we actually need to go to the page before to see 16 who sent it. 17 18 Who is Jeremy Weber? A. Jeremy was one of the developers in OSB. 19 MR. KAMARAJU: Now, Ms. Hurst, we can go back, thanks. 20 Q. Who did Mr. Weber send this e-mail to? 21 A. It was sent to Josh and then there were a number of people 22 cc'd. 23 Q. Do you see Sean cc'd on this? 24 A. Hmm-hmm. 25 Q. Who's Sean? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 571 K263SCH5 Leonis - Direct 1 A. Sean was, at that time, the current chief of OSB. 2 Q. Do you see Richard cc'd on this? 3 A. Correct. 4 Q. Who is Richard? 5 A. Richard was going to be the acting chief of OSB because 6 Sean was leaving the group. 7 Q. You're also cc'd on this? 8 A. I'm cc'd as well. 9 Q. Do you know why you were cc'd on this? 10 A. I think for two roles. 11 because I was the branch chief of RDB at that time. 12 Q. 13 with Sean and this is the situation"? 14 A. Yes. 15 Q. And then he goes on to describe, I guess, the situation, 16 correct? 17 A. Correct. 18 Q. What's your understanding of his description there? 19 A. So, my understanding, and just reading it too, essentially, 20 the OSB libraries, they were an OSB project. 21 wanted to maintain control of that project. 22 the branch's project, they wanted to maintain control of it and 23 make sure whatever got added to it, they agreed with. 24 was going to be removed, they agreed with. 25 One, as in my acting role, but also Do you see where Mr. Weber says, "Josh, I discussed this But, and OSB So, since it was Whatever Second, they said that Josh was able to continue to SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 572 K263SCH5 Leonis - Direct 1 contribute to those libraries and pull from it. 2 hindered necessarily from adding code to it or removing code 3 from it. 4 So, he wasn't He -- Jeremy also references something we were 5 thinking about at that time, which was there are a number of 6 code libraries in other branches, so the idea was maybe we can 7 take all those code libraries from branches and move them up to 8 the division level, and everybody can have access to them so 9 everybody could gain benefits from being able to prototype 10 things quickly, etc. 11 And then he talks about Kevin here. About if Kevin 12 decides something, then he will make that determination. 13 Q. 14 changes"? 15 A. Yeah. 16 Q. "You must follow pull request model"? 17 A. Yeah. 18 Q. What do you understand by that phrase? 19 A. So, not -- I'm not a developer very familiar with the 20 Atlassian tool suite. 21 Josh could pull code from it, but if he wanted to put code back 22 into it, Frank and Jeremy had to agree that that code would be 23 merged into the OSB library. 24 Q. When you first saw this e-mail, were you concerned by it? 25 A. No. Do you see the last line, "Until something officially But my high-level understanding is that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 573 K263SCH5 Leonis - Direct 1 Q. Why not? 2 A. It's just a conversation about, hey, you know, these are 3 the things that you are going to take with you, and these are 4 the things that you're not. 5 Q. 6 e-mail? 7 A. Josh did. 8 Q. When did he send it? 9 A. Thursday, April 14, 2016, at 3:39 p.m. 10 Q. Is that about nine minutes after the last e-mail we just 11 looked at? 12 A. I can't see it, but -- 13 Q. We can take a look. 14 A. He sent it to approximately the same group of people. 15 Kevin was added. 16 Q. 17 Anthony and Sean a bit about working on transitioning some of 18 my old projects"? 19 A. Yeah. 20 Q. He goes on to say, "But I haven't specifically talked about 21 the OSB libraries until now." 22 Let's move up to the next e-mail, please. Who sent this Who did he send this e-mail to? And Do you see where the defendant says, "I've talked with What did you understand him to be saying there? 23 A. So we had talked about some of the processes he was going 24 to take with him to RDB, and I guess this one hadn't come up at 25 that point. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 574 K263SCH5 Leonis - Direct 1 Q. And moving on to the next paragraph. What's your 2 understanding of what the defendant was saying there? 3 A. 4 admin that library, have control over what got added to it, 5 what remained in it. 6 stay, be one of the admins alongside of Frank and Jeremy who 7 were in OSB. 8 were going to get moved to the division level, he thought it 9 would be helpful that he could help with that process as well. Since he developed it, he really wanted to continue to So, he, you know, and then he wanted to So, and then, you know, since these libraries 10 Q. Then the last line, could you read the last line, please. 11 A. Sure. 12 like to continue my active role with the libraries." 13 Q. What did you understand him to be saying there? 14 A. So, if basically, the way I understood it to be, was if OSB 15 management and RDB management were okay with him being an 16 admin, he wanted to continue to be an admin. 17 Q. So at this time, who was OSB management? 18 A. It was Sean particularly. 19 Q. And who was RDB management? 20 A. I was. 21 Q. When you saw this e-mail, did it cause any concern for you? 22 A. No. 23 Q. Why not? 24 A. It was a request. 25 libraries as well. "So, if OSB and RDB would be okay with this, I would He's asking if he can manage these Or these code libraries. It is a SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 575 K263SCH5 Leonis - Direct 1 reasonable request. 2 Q. 3 e-mail? 4 A. I did. 5 Q. When did you send it? 6 A. I sent it on Thursday, April 14, 2016, at 3:59 p.m. 7 Q. Who did you send it to? 8 A. So, I sent it to the same group of people in the previous 9 e-mail, and I added a few other people. Can we go to the next one up. All right. Who sent this 10 Q. Do you see JoJo there? 11 A. Correct. 12 Q. Who is JoJo? 13 A. So JoJo was a SETA. 14 resource that the division brought in to help them with a 15 number of division-level projects. 16 the division level, so at that time he was working for me. 17 we wanted him to take over, you know, a few things, one of 18 which was an AED level code library. 19 Q. 20 referring to? 21 A. 22 like OSB library, there were a few other libraries from other 23 branches, up to the division level, so that everybody could 24 take advantage of them. 25 Q. He was basically an engineering So, JoJo was working for And When you say the AED level code library, what are you So what we wanted to do was pull all those code libraries, Do you see where you write, "One of JoJo's major tasks is SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 576 K263SCH5 Leonis - Direct 1 to make each branch's library a corporate resource"? 2 A. Yeah. 3 Q. So all branches contribute and all branches can pull? 4 A. Yeah. 5 Q. What did you mean by that? 6 A. Precisely, I wanted -- so, in this case, let's just use 7 OSB, I wanted to take the OSB libraries, bring them up to 8 division level, and JoJo would admin it. 9 would go into it, he'd have vied a role in that. So, whatever changes But then 10 everybody could use what was in the OSB libraries. 11 weren't branch specific at that point if we made that change. 12 Q. 13 administering the AED libraries? 14 A. JoJo. 15 Q. So would the defendant administer the libraries at that 16 point? 17 A. That wasn't the plan. 18 Q. So, is there anywhere in this e-mail where you acceded to 19 the defendant's request to continue to administer the OSB 20 libraries? 21 A. 22 They So if this change went into effect, who would be No. MR. KAMARAJU: Ms. Hurst, can we please pull up 23 Government Exhibit 1062 which is in evidence alongside this 24 e-mail, and turn to page 10 of 1062, please. 25 blow up the top there. If we can just SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 577 K263SCH5 Leonis - Direct 1 Q. The e-mail on the right, what's the date and time of that? 2 A. It's Thursday, April 14, 2016, at 4:40 p.m. 3 Q. Approximately how long is that after you sent your e-mail 4 about the AED libraries? 5 A. Just over 50 minutes, it looks like. 6 Q. And who sent this e-mail? 7 A. Jeremy did. 8 Q. Who did he send it to? 9 A. He sent it to myself, Sean, and Richard. 10 Q. Did he send it to the defendant? 11 A. He did not. 12 Q. What's the subject of the e-mail? 13 A. OSB libraries. 14 Q. Do you see where he says, "We have a situation with the 15 libraries and the Atlassian products in general"? 16 A. Yes. 17 Q. What did you understand him to be referring to there? 18 A. So the libraries were the OSB libraries. 19 products in general was the Atlassian tool suite. 20 Q. Could you read the next sentence, please. 21 A. Sure. 22 saying that he doesn't have direct access to our two main 23 branches, he went and modified the permissions to the project 24 to return his previous rights." 25 Q. And the Atlassian "After we talked with Josh, and I sent the e-mail So, in your 3:59 p.m. e-mail, did you give the defendant SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 578 K263SCH5 Leonis - Direct 1 permission to modify the permissions to the OSB libraries and 2 return his previous rights? 3 A. No, I did not. 4 Q. Did you ever do that at any point on April 14? 5 A. No. 6 Q. Could you read the last line of Mr. Weber's e-mail. 7 A. Sure. 8 has shown he believes access controls shouldn't apply to him." 9 Q. What did you understand that to mean? 10 A. So, what Jeremy was saying was that -- so an administrator 11 has a very specific role. 12 people's ability to gain access to different parts of the 13 system, right. 14 charge of maintaining that code library, that code database. 15 "I can explain the situation further, but this act And their role is to facilitate And as we mentioned, the developers were put in So, in this case, since Josh had the ability to, as an 16 administrator, to administer any changes to the Atlassian tool 17 suite, he also had the ability to give himself controls or make 18 changes to any code library inside of that, including the OSB 19 libraries. 20 So what Jeremy was saying is that he was very 21 concerned that in this specific case, Josh was told you're not 22 going to have admin rights to that OSB libraries. 23 those privileges to that specific library was removed, he went 24 back into the system using his privileges on the bigger system, 25 and said, I'm -- and made himself an admin on that code SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 And when 579 K263SCH5 Leonis - Direct 1 library. 2 suite to make a change to the smaller tool suite. 3 Q. 4 concerned when you read Jeremy's e-mail? 5 A. 6 that's a pretty big -- that's a pretty big accusation. 7 kind -- I remember that time, because I had essentially been in 8 that role for about two and a half weeks. 9 e-mail like this, you're, you know, that's a pretty big, that's 10 So he used his admin privileges for the bigger tool You just testified that Jeremy was concerned. Were you Yeah, I was -- so, when you receive an e-mail like that, And I So, when you get an a pretty big deal. 11 So, my first reaction was, you know, pause. I really 12 want to make sure that there wasn't a misunderstanding. Right. 13 Because, people say things, people do things. 14 say and do things that aren't the same. 15 people see people do something and they misinterpret it. 16 really wanted to make sure I understood what was -- what was 17 really going on there. 18 actually really happened. 19 Q. 20 that? 21 A. 22 goes through a security process. 23 to determine if you can have access to sensitive information. 24 It's to understand whether you can be trusted to have accesses 25 to that information. Sometimes they This is -- sometimes And I What did Jeremy actually -- what You said this was a big accusation. What did you mean by So, in our -- in our business, everybody that works with us And that process is designed That when it's given to you, or you have SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 580 K263SCH5 Leonis - Direct 1 access to it, that you're going to use it in an appropriate 2 manner. 3 trust. 4 people that you're -- that you trust, because they're doing 5 things on behalf of everybody else. 6 Right. So this accusation is essentially an accusation about This admin position is something that you give to It's mission above self. That's part of our ethos. 7 So, in this specific case, I was really concerned, 8 because it's not just a -- it's not just a -- let's say a 9 whoops, if you will. There is a bigger accusation behind it, 10 which is, and it kind of goes to the bottom sentence, where 11 Jeremy's alluding to the effect that, you know, Josh can't be 12 trusted with this responsibility that he was given. 13 my perspective, that's not something you throw around very 14 lightly. 15 further, I really wanted to understand the situation. 16 Q. 17 Mr. Weber's e-mail? 18 A. 19 And from And I really wanted to understand before going any So, what, if anything, did you do after receiving I sent him back an e-mail with a bunch of questions. MR. KAMARAJU: Could we scroll up to the next e-mail, 20 please, Ms. Hurst. And we can take 1061 down now. 21 Q. Is this the e-mail you were just referring to? 22 A. Yes, it is. 23 Q. What's the date and time on this e-mail? 24 A. So it's Friday, April 15, 2016, at 7:29 in the morning. 25 Q. You testified you were seeking information. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 What 581 K263SCH5 Leonis - Direct 1 information were you seeking from Mr. Weber? 2 A. I'm sorry, can you say that again? 3 Q. What was the information you were seeking? 4 A. So the information that I wanted to get from everybody 5 involved was I wanted to make sure that, again, it wasn't just 6 like a subtle disagreement or just a mistake or something like 7 that. 8 this: So I asked three questions. 9 First was, okay. The three questions were This library, these OSB libraries, 10 is that just something that only the branch can use? 11 just specific to the branch or is it something that other 12 people can use? 13 Two, what were Josh's permissions? Is it And you know, was 14 this -- the change that was made, was it made as a result of 15 something where he, he was told he had access and it was 16 removed? 17 we previously talked about? 18 wanting further control, i.e., did he reassert his admin rights 19 on that library. 20 Like completely removed so he couldn't contribute as Or is this a case of somebody And then, three, I noted that he, he spoke to Josh 21 about it, and I wanted to know was it in person or was it via 22 e-mail. 23 it. 24 I really wanted to understand what was said. 25 be missed in verbal communication, and I just really want to Because, you know, if it was an e-mail, I could see Right. Hey, send me the e-mail. But if it was in person, Because a lot can SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 582 K263SCH5 Leonis - Direct 1 understand what was -- what was -- what happened from his 2 perspective. 3 Q. 4 the OSB libraries were entirely an OSB owned product? 5 A. 6 you're not in OSB, does that mean you can't provide input to 7 it? 8 in OSB you can provide input to it. 9 moved to RDB, and the previous e-mails you saw he wanted to 10 have access to the library, I wanted to make sure that there 11 was some congruence there. 12 still contribute, and all of a sudden you can't contribute, 13 well, that need to be rectified. 14 Q. So, do you see the line that starts "my concern here." 15 A. Yes. 16 Q. Could you just read that for us, please. 17 A. "My concern here is that if Josh wants to use the libraries 18 and no longer has access to them, that's one thing." 19 Q. What do you go on to say? 20 A. "On the other hand, if he changed his permissions to enable 21 him to administer the libraries, that's another." 22 Q. What's the distinction you're drawing there? 23 A. So again, we previously said in the e-mails below, hey, 24 Josh, you can have access to the libraries and you can keep 25 contributing. So, focusing on question one. Why did you want to know if Well, because, you know, and I say it right after that, if Or is this one of those things where you, if you're only Right. Because since Josh was If we had been saying, hey, you can So, if the change was made where that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 583 K263SCH5 Leonis - Direct 1 permissions were removed, like completely removed, I wanted to 2 understand that, because, you know, not saying it's okay, I 3 just, I understand maybe there was a mistake and he was just 4 trying to rectify it, right. 5 But on the other hand, if he used his admin 6 permissions to go and re-enable himself admin permissions after 7 he was told he couldn't, well, that was in violation of what we 8 had told him he could do. 9 Q. So, that was a problem. Do you see where you write "But in this matter I urge 10 caution"? 11 A. Yes. 12 Q. What did you mean there? 13 A. Well, it is a pretty heavy accusation. 14 thing that, there are policies, our organization has policies 15 about this very issue. 16 to gain control over things that they're not supposed to have 17 access to. 18 This is the kind of People using admin controls, you know, And so, when somebody's making an accusation like 19 that, it has far, far reaching, it could have far reaching, it 20 could create far reaching problems. 21 just a mistake, I didn't want people jumping to the conclusion 22 that -- that's a bridge too far. 23 problem, let's fix the mistake. 24 25 And if it genuinely was Right. Let's deal with the But if this was a matter where somebody really was actually using their admin controls to re-enable something they SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 584 K263SCH5 Leonis - Direct 1 were told not to, that had to be addressed. 2 Q. 3 looking for? 4 A. Yes. 5 Q. Can we scroll up to the next e-mail, please. 6 one. 7 A. It's from Jeremy. 8 Q. When did he send it? 9 A. He sent it on Friday, April 15, 2016, 12:12 p.m. 10 Q. Who did he send it to? 11 A. He sent it to myself, Sean, and Richard. 12 Q. Is this the response you were referring to before? 13 A. Yes. 14 Q. So, let's just start with where he writes "first." 15 see where he says, "This is an undertaking I started two years 16 ago because OSB, specifically myself, Frank Stedman, Matt and 17 Schulte, felt that it was fighting a losing battle in regards 18 to QRCs"? 19 A. Yes. 20 Q. What did you understand that to mean? 21 A. So that gets back to the branch, and specifically those 22 four developers decided that they needed to build a code 23 library to address this issue that they were having with QRCs, 24 they weren't able to turn QRCs fast enough. 25 reaction capability. Did Mr. Weber ever give you the information you were Let's start at the top. That's a long Who is this from? Do you QRCs, quick If you can't react quickly, that's kind SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 585 K263SCH5 Leonis - Direct 1 of a problem. 2 themselves that they could help themselves react quickly. 3 Q. 4 top there where he writes "we had three goals"? 5 A. Yes. 6 Q. What did you understand the three goals to be? 7 A. So, three goals, essentially, the first part is use the 8 libraries to put together tools quickly that could be ready to 9 go and meet a majority of the operational requirements. 10 that way, when a requirement came to them, hey, we have 11 something we can pull from, maybe we can put something together 12 really quick. 13 track. 14 So they were trying to build a tool for Could we go to the next page, please. Do you see at the So, This looks just about right, we are on the right Then a process where people could, you know, 15 contribute and learn. 16 world changes and there are software updates to systems up 17 there or new capabilities were required, you have to be able to 18 update those libraries, so you've got to put new code building 19 blocks in the libraries. 20 where they could add code back in and make sure that that code 21 was also good and ready to go for future requirements. 22 So, that's important, because as the So they wanted to have a process And then the last was to make sure that they had a 23 means to track what code was being used, where. 24 because if you're using these libraries, that could potentially 25 have ramifications if you are using the same code everywhere. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 And that's 586 K263SCH5 Leonis - Direct 1 You want to make sure you know where that code's being used, so 2 you just understand the ramifications. 3 Q. 4 third numbered paragraph there? 5 A. Yes. 6 Q. The one that starts "Josh and I did have a conversation 7 yesterday"? 8 A. Yes. 9 Q. Was this in response to the question you asked? 10 A. That was in response to the third question. 11 Q. What did you understand Mr. Weber to be saying here? 12 A. So, he admitted to having a verbal conversation. 13 guess Josh came up to visit them asking why he didn't have the 14 ability to merge code in to the libraries. 15 saying that Sean decided that Josh's admin privileges on that 16 project, OSB libraries, were to be removed. 17 providing that as reference. 18 Q. 19 conversation that struck you in particular? 20 A. Yes. 21 Q. What was that? 22 A. So there was a quote close to the bottom here on the 23 screen, where Josh basically said, or Jeremy said that Josh 24 said that Josh stated he will get access back to the libraries, 25 and that access should just be enabled now. Can we move on to the next page, please. Do you see the And I And Jeremy was So, he was, he was Was there anything about Mr. Weber's description of the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 587 K263SCH5 Leonis - Direct 1 Q. Why did that strike you? 2 A. That's just not the way we talk. 3 that from a person with admin rights. 4 Q. What do you mean? 5 A. So, again, when you talk about an admin, this is somebody 6 that you're putting in control of a system so that they can, 7 they can help everybody else get the job done. 8 important, and this job is one of those important jobs where, 9 you know, previously, you saw that Elliot had asked for access You don't expect to hear Every job's 10 back to a library that he didn't have access to. So, admins 11 have the ability to go in and say okay, Elliot, you can have 12 access to those libraries. 13 So, when an admin says, hey, if you don't give me 14 access, or -- give me access to the libraries, because I'm 15 going to get it now, or I'm going to get it anyway, so give me 16 access now. 17 trust. 18 privileges not for a personal, you know, what they want 19 personally. 20 told. 21 That's a bit concerning, because this is about And you're entrusting somebody to use those admin But you're expecting that they do what they're So if Sean said this is the way I want access to that 22 library, then that's the way it was supposed to be. Those 23 libraries were in his branch, he decided how they were going to 24 be adminned. 25 Q. And, this runs completely contrary to that. I believe you testified that when you got Mr. Weber's SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 588 K263SCH5 Leonis - Direct 1 initial e-mail, on April 14, you were concerned; is that right? 2 A. I'm sorry, say it again? 3 Q. You grew concerned when you got his original e-mail on 4 April 14? 5 A. Yes. 6 Q. Did this e-mail response assuage your concerns at all? 7 A. No. 8 Q. Why not? 9 A. Because as you go to the bottom, it says the audit log 10 showed that Schulte re-enabled his access. 11 Q. Why was that concerning? 12 A. So, not only was it a conversation that occurred, but then 13 there was also logs that showed it. 14 Q. What, if anything, did you do after getting this e-mail? 15 A. I needed another person to tell me whether this was for 16 real. 17 statement, right. 18 and I said, hey, can you back this up, you know. 19 is your code libraries. 20 Q. You said the branch chief. 21 A. That was Sean. 22 So, it actually happened. Because, I mean, again, this is, this is kind of a big You know, I went, I went to the branch chief MR. KAMARAJU: This is, this Did this occur? Was that Sean? Ms. Hurst, can we go up to the next 23 e-mail, please. 24 Q. Who sent this e-mail? 25 A. I did. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 589 K263SCH5 Leonis - Direct 1 Q. When did you send it? 2 A. Friday, April 15, 2016 at 1:15 p.m. 3 Q. Who did you send it to? 4 A. I sent it to Sean. 5 Q. Was Mr. Weber still on this e-mail? 6 A. No. 7 Q. Why did you take Mr. Weber off? 8 A. Well, because I wanted Sean to confirm it without -- at 9 this point I wanted a third party, basically, to say yeah, this 10 really happened. 11 Q. 12 the direction you provided to Joshua"? 13 A. Yup. 14 Q. What direction are you referring to there? 15 A. It's -- right around the third, third line. 16 "I informed him that this was a decision that Sean had made." 17 Q. Now, did Sean ever confirm this for you? 18 A. I believe he did. 19 Q. Can we go up to the next e-mail, please. 20 e-mail? 21 A. Sean did. 22 Q. When did he send it to you? 23 A. Friday, April 15, 2016 at 1:50 p.m. 24 Q. Can you summarize what Sean said in this e-mail. 25 A. So, Sean said they had a discussion with Josh, and they had And do you see where you said, "Hi, Sean. Please confirm Where it says Who sent this you SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 590 K263SCH5 Leonis - Direct 1 a discussion about his abilities to contribute and what his 2 admin or lack thereof status was going to be, and he said -- or 3 I'm sorry. 4 administrator access." 5 And then he went to discuss libraries with Jeremy. 6 essentially he was stating that he actually did tell the branch 7 to remove, or to make it an OSB thing. 8 Q. Now, did this e-mail from Sean ease your concern at all? 9 A. No. 10 Q. Why not? 11 A. Well, so, essentially Sean was saying that he didn't agree 12 with -- essentially Sean was saying that -- he didn't agree 13 with Josh having admin access. 14 hoping for at that point, or up to this point, that there was a 15 mistake made. 16 a mistake. 17 Q. Why were you hoping it was all a mistake? 18 A. Because, I mean, there are policies in our organization 19 about how people have to admin systems. 20 violation of some of those policies. 21 was directly flying in the face what was he was told. 22 yeah. 23 Q. What, if anything, did you do after reading Sean's e-mail? 24 A. So, I was concerned, because essentially I had a security 25 issue on my hands. It says "At no time did the conversation we discuss So, they had a conversation about it. And And so, you know, I had been And by this point, it wasn't looking like it was This was, this was in It was, it was also -- it So, So, I penned an e-mail that I sent to SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 591 K263SCH5 Leonis - Direct 1 management and security. 2 Q. 3 security? 4 A. 5 those capabilities that we have been talking about, that's 6 where all those code libraries were. 7 that here we had a situation where even though Josh, Josh 8 changed branches and we gave him, you know, some things to take 9 with him, he had used his admin rights to go into the system, 10 and change privileges on things that we didn't allow -- have 11 him or say that he could. Why did you think it was important to notify management and So, the Atlassian tool suite was where our code, those, And I was very concerned And that just, that's a trust issue. 12 We spend a lot of time working with people, you know, 13 they go through this -- this intense process to show that they 14 are trustworthy and they can be trusted. 15 given additional responsibilities to use that trust, not for 16 their own gain, but to help with the mission. 17 was, this was a little bit more than just a, you know, a 18 mistake, right. 19 the system. 20 told he could have access to. 21 And then admins are And since this This was, appeared to be a willful change to So that he had access to something that he wasn't MR. KAMARAJU: Ms. Hurst, can we go to page one of the 22 exhibit. And can we just blow up the bottom part of the from 23 line. 24 Q. Who sent this e-mail? 25 A. I did. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 592 K263SCH5 Leonis - Direct 1 Q. When did you send it? 2 A. I sent it on Friday, April 15, 2016, at 2:06 p.m. 3 Q. Who did you send it to? 4 A. I sent it to security and HR, and then cc'd EDG management. 5 Q. Who, could you identify who is EDG management on this? 6 A. Mike S. is the deputy division chief -- I'm sorry. 7 group chief, and Karen is the group chief. 8 Q. Remind us who is Dana? 9 A. Dana was security. 10 Q. What was your goal in sending this e-mail? 11 A. Well, one, I wanted to make everybody aware that it 12 occurred. 13 out what to do next. 14 I felt like, that I could just handle at this point. 15 something that I needed some help with. 16 Deputy Chief of security. And two, you know, I needed some help in figuring So, this wasn't something that, you know, This was And I -- I really wanted to make sure that I tried to 17 explain the situation to people that, you know, I'm not a coder 18 as good as, you know, some of the other guys. 19 good as those guys. 20 what actually occurred in a way they could hopefully 21 understand. 22 Q. What subject line did you put on this e-mail? 23 A. EDG/AED security concern. 24 Q. Can we take a look at your e-mail now. 25 where you say you have included the e-mail below from Jeremy Nowhere near as I wanted to give them an understanding of I'd like to go SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 593 K263SCH5 1 Leonis - Direct Weber and a verification from Sean. 2 Why did you want to include those? 3 A. Well, so, I didn't want people thinking that, you know, 4 again, this is literally like two and a half weeks, three weeks 5 into my new responsibilities, and I really wanted people to 6 understand that this was something that we at least looked into 7 first before bringing it up. 8 thrown out there as, hey, you know, because it was a pretty big 9 deal. Not just something that was just 10 Q. Going on to the next paragraph. You see where you say at 11 the end of March 2016? 12 A. Yes. 13 Q. Why did you include that information in this e-mail? 14 A. I wanted to give some background kind of on how we kind of 15 got to this point. 16 developers, specifically Josh and Amol out of OSB to new 17 branches, one of the directions that was provided to OSB was to 18 say, hey, make sure that if you're keeping projects, that you 19 can actually do those projects. 20 on staff that can work those projects, because if you don't, 21 you know, I don't want you to just keep projects because you're 22 just keeping projects. 23 actually do those projects, they're resourced, because there 24 are mission needs behind them. 25 Q. Because as part of the, moving some of the That you have people that are We need to make sure that people can Do you see where you say, "This move was made following a SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 594 K263SCH5 Leonis - Direct 1 personnel situation that occurred in March 2016"? 2 A. Yes. 3 Q. What personnel situation are you referring to? 4 A. Between Josh and Amol. 5 Q. Can we go to the next paragraph. 6 in this paragraph? 7 A. 8 situation specifically, that the OSB administrators had removed 9 Josh's administrative access to those specific code libraries What are you describing So, I was trying to give some background about what -- the 10 when he moved to RDB. 11 access to the libraries, but they had allowed him to still use 12 the libraries or contribute code to the libraries through a 13 peer review process. 14 Q. 15 action was taken in direct response to the direction provided 16 by EDG and CCI management at the end of March 2016"? 17 A. Yes. 18 Q. What's that a reference to? 19 A. So that goes back to the previous paragraph where we were 20 talking about making sure that projects were properly resourced 21 and so forth. 22 And in doing so, they removed his admin Do you see where you referred to or you write, sorry, "This MR. KAMARAJU: If we can blow back out and go to the 23 second paragraph, please. We can blow up the numbered 24 paragraph one for right now. 25 Q. What were you describing here? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 595 K263SCH5 Leonis - Direct 1 A. So, one of the things I was told by OSB was that there were 2 times when Josh would use his admin access to some of the code 3 libraries to check in and check out code without going through 4 the peer review process. 5 place, as I understood it, was to ensure that any code that 6 went into the library was good code, quote unquote, and by 7 that, code that the developers could trust, and just, and know 8 that they could use as was. 9 The peer review process they put in And what was explained to me is that when that -- when 10 people didn't go through that code peer review process, at 11 times there was code in the library that didn't compile. 12 that meant really was these Lego building blocks that were in 13 the code library, they were broken. 14 one, it would break basically whatever you were trying to 15 build. 16 What So if you tried to use So they wanted to make sure that any code that got 17 delivered or put back into the library was something that could 18 be used, it was checked, it was good, it would compile, it 19 would work. 20 back and spend tons of manhours fixing. 21 manhours that could be. 22 that. 23 Q. 24 include here a description of Mr. Weber's description of his 25 conversation with the defendant? Because if it didn't, that would cause them to go You know, however many And so, they were concerned about If we can go to the next paragraph, please. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 So, did you 596 K263SCH5 Leonis - Direct 1 A. Yeah. 2 Q. Why did you want to include that information? 3 A. Well, because I -- I was trying to explain how we got to 4 where we are, and then where we were. 5 Q. 6 there where it starts where "Jeremy explained to Joshua." 7 A. Yes. 8 Q. Why did you include that quote there? 9 A. That quote was, it is just not how we talk. Can we go to the next page, please. You see at the top I mean, that's 10 not something that you want to hear from an admin, let alone 11 really anybody, for that matter. 12 this something I want, and if I don't get it, I'm going to get 13 it anyway. 14 Because it's basically saying So, in a professional environment, that's not 15 something you expect to hear. 16 like ours where you're trusting people to -- they have 17 sensitive materials, that's just not, that's not something 18 that's part of our, it's not part of our ethos, that's not the 19 way we talk. 20 MR. KAMARAJU: And especially in an environment Could we blow it up again, please. Can 21 we blow up the paragraph that starts "first." 22 Q. 23 paragraph? 24 A. 25 wanted to make sure that people understood what this meant on a Mr. Leonis, what were you trying to convey in this So, I realized I was talking to HR and security. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 And I 597 K263SCH5 Leonis - Direct 1 bigger scale. 2 this action was very concerning to myself and others. 3 what I wanted to do was start with something that I felt 4 everybody who works at our organization would understand. 5 I'm not just talking about CCI, I'm talking about the agency. 6 Right. We, there were a number of reasons why And so, And So there was a training that we take every year. 7 Every person that has access to our computer system you have to 8 take this training. 9 it talks about regulations on IT and user accounts. It's called AISC. And in that training, 10 And so, I wanted to make sure that I was trying to, as 11 I was trying to explain what this was, what this situation that 12 occurred was, I wanted to anchor it in something everybody 13 should at least be able to reference, if not already know. 14 MR. KAMARAJU: Ms. Hurst, can we go to the next 15 paragraph. 16 Q. What were you trying to convey here? 17 A. So, now that, you know, we're talking about the DevLAN 18 system, and specifically the code databases on the DevLAN 19 system, that's where -- a number of our very sensitive 20 capabilities were that were being used to gather intelligence. 21 And so, having those, having access to those capabilities, you 22 know, you had to be trusted to begin with. 23 to those capabilities, you know, that was, that was another 24 level of trust. 25 understanding is that people not use their admin rights to act So, and I even say it. Having admin access You know, the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 598 K263SCH5 Leonis - Direct 1 or accesses to promote having control over components that they 2 wanted to have. 3 Right. This is a professional environment. 4 no, that's no. 5 along with that. 6 Right. If you're told And there is a trust aspect that goes And so, I wanted to make it clear that, to the people 7 that I was talking to, that, you know, first, at the agency 8 level, there was, there was a, there was policies that 9 referenced this. And second, we're talking about a system that 10 has a lot of code on it, that's very sensitive, and those tools 11 needed to be protected. 12 Q. 13 "Violation of this trust is a serious matter." 14 A. Yes. 15 Q. What did you mean by that sentence? 16 A. So, if somebody was using their admin privileges to access 17 things that they were not told they could have access to, 18 that's a breach of trust. 19 people are deliberately taking action to gain access to things 20 that they're not supposed to have access to, that's not what 21 people were given their admin accesses for. Do you see at the end of that paragraph where you say And mistakes happen. But, when 22 MR. KAMARAJU: Can we look at the last paragraph, the 23 one that starts "as a result." 24 to the next page also, so maybe we can put them up together, if 25 that's possible. Actually I think it carries on Thank you. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 599 K263SCH5 Leonis - Direct 1 Q. Do you see that, Mr. Leonis? 2 A. Yes. 3 Q. What were you trying to explain here? 4 A. So I was trying to summarize, essentially, the situation 5 and summarize my e-mail and all e-mails that I received to that 6 point. 7 reading it now, it's just -- I mean, the fact is that when 8 somebody takes and they use their admin access on a system that 9 has these capabilities that can be used to gather intelligence, And it's just one of those things where, you know, even 10 using those admin controls, you know, because you want 11 something, or you want to decide how it's being managed, or you 12 want to have admin rights on something, that's a serious 13 matter. 14 not something that was condoned at any level. And frankly, it's just, it's not something that, it's 15 And I guess the big thing that I also wanted to point 16 out, when I wrote it, was that our developers were very, very, 17 very talented. 18 were a talented developer. 19 in to work on our systems because we wanted people working on 20 the toughest problems. 21 trust to people because we wanted them to have the ability to 22 innovate. 23 If you were working in our organization, you You were -- we were, we brought you And as a result, we conveyed a lot of I mean, this is intelligence that helps keep us safe 24 as a country. This is intelligence to get information on 25 people that could be doing stuff to hurt us. And I want, I SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 600 K263SCH5 Leonis - Direct 1 wanted, and I mean, even today I still want, I want people to 2 be able to innovate and come up with the best tools and 3 capabilities they can to ensure that we can remain safe. 4 And so, we put a lot of faith and ability in our 5 developers, but we also entrusted them with a lot of abilities, 6 and we didn't, we didn't try to micromanage those development 7 efforts. 8 that everybody could be trusted to protect our equities with 9 the -- with the accesses that were put in place. So, in doing so, our model really relied on the fact And if 10 anybody wasn't doing that, or wasn't following the rules, that 11 could, that could cause problems, you know, long term. 12 13 THE COURT: Mr. Kamaraju, would this be a convenient place to break? 14 MR. KAMARAJU: 15 THE COURT: I just had one more question. Go ahead. 16 Q. 17 us what you meant there. 18 A. 19 and those using them at risk to come." 20 Could you just read the last line of the paragraph and tell Sure. "Failure to do so puts our entire set of cyber tools That sentence goes with the rest of the paragraph. 21 was never -- I never wrote it to be just by itself. 22 for the rest of the paragraph. 23 It I wrote it But, my thought process there was not only the cyber 24 tools, but those using them. Because some of those tools are 25 used by people in the field to go get intelligence for us. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 And 601 K263SCH5 Leonis - Direct 1 should anything bad happen with those tools, it could put 2 people in harm's way that are out there trying to protect us. 3 And so, I wanted people to understand the severity of a lack of 4 trust and using your admin controls for personal gain. 5 6 MR. KAMARAJU: Okay, your Honor. If that's a good time to break. 7 THE COURT: Thank you. Ladies and gentlemen, we're 8 going to break now for the weekend. 9 Remember my do's and don'ts. Please be seated. Don't discuss the case with 10 anybody. 11 media reports that you may see. 12 case. 13 that the decision that you have to make is going to be decided 14 solely on evidence you hear in the courtroom, not from anyplace 15 else. 16 Don't read about it in the newspapers, ignore any Keep an open mind. Don't do any research on the You have to remember at all times So I hope you have a nice weekend. 17 Monday at 9 o'clock in the morning. 18 make sure you leave your notebooks here. 19 with you. Thank you very much. We'll resume on Have a good weekend. Don't take those home Have a good weekend. 20 (Jury excused) 21 (Continued on next page) And 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 602 K263SCH5 1 THE COURT: 2 THE WITNESS: 3 THE COURT: 4 Thank you. Can I get a listing of the witnesses you intend to call next week? 5 6 You are excused, Mr. Leonis, thank you. MR. LAROCHE: Yes, your Honor. We can provide it to you. 7 THE COURT: And a schedule? 8 MR. LAROCHE: 9 THE COURT: Yes, your Honor. Okay. Do you want to discuss the letters 10 of January 17, the government's response of January 24, and the 11 Federal Defenders' letter of January 27? 12 Mr. Laroche, do you have anything to add to your 13 letter of January 24? 14 MR. LAROCHE: 15 Your Honor, with the Court's permission, we would like to put in a brief letter tonight. 16 THE COURT: 17 first thing tomorrow morning. 18 MR. LAROCHE: 19 THE COURT: 20 21 22 23 Okay. I'll have a decision for you then Thank you, your Honor. What about the WikiLeaks task force document? MR. LAROCHE: Same request, your Honor. A brief letter tonight. THE COURT: Okay. I must tell you, Mr. Laroche, if 24 you get into assessments, I don't see how you do that without 25 producing more information about the assessments when made and SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 603 K263SCH5 1 so forth. 2 MR. LAROCHE: 3 THE COURT: 4 MR. LAROCHE: 5 THE COURT: 6 MS. SHROFF: Understood, your Honor. Anything else to take up? No, your Honor. Ms. Shroff? Your Honor, I think we're going to be 7 able to resolve this with the United States marshals service, 8 but since Mr. Schulte is on trial Monday through Thursday, we 9 have asked, I don't know Sully's last name, but I asked Sully. 10 He's worked with us tremendously throughout this whole period, 11 so I'm hopeful we'll be able to get some SCIF time with 12 Mr. Schulte tomorrow. 13 Court. 14 THE COURT: 15 MS. SHROFF: 16 THE COURT: 17 MS. SHROFF: THE COURT: 21 MS. SHROFF: 25 One of the reasons we took off on Fridays It is hard for the marshals because it's They'll do the best they can. Okay. I'm not complaining about them at all. 23 24 I do want to stress here that -- Friday. 20 22 All right. was so he could have SCIF time. 18 19 But if not, I may have to write to the THE COURT: They've been cooperative all the way through. MS. SHROFF: Amazingly so. Okay. Thank you, your SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 604 K263SCH5 1 Honor. Have a good weekend. 2 THE COURT: 3 What time can I expect your brief? 4 MR. KAMARAJU: 5 (Adjourned until February 10, 2020, at 9 a.m.) Same to you. We'll have it to you by 6:30. 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 605 1 INDEX OF EXAMINATION 2 Examination of: 3 JEREMY WEBER Page 4 Cross By Ms. Shroff 5 Redirect By Mr. Laroche 6 7 . . . . . . . . . . . . . 395 . . . . . . . . . . . 514 ANTHONY LEONIS Direct By Mr. Kamaraju . . . . . . . . . . . . 549 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300