1734 K2J3SCH1 2 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK ------------------------------x 3 UNITED STATES OF AMERICA, 4 v. 1 5 JOSHUA ADAM SCHULTE, 6 7 S2 17 Cr. 548 (PAC) Defendant. ------------------------------x New York, N.Y. February 19, 2020 9:15 a.m. 8 9 Trial Before: 10 HON. PAUL A. CROTTY, District Judge -and a juryAPPEARANCES 11 12 13 14 15 GEOFFREY S. BERMAN United States Attorney for the Southern District of New York BY: MATTHEW J. LAROCHE SIDHARDHA KAMARAJU DAVID W. DENTON JR. Assistant United States Attorneys 16 17 18 19 SABRINA P. SHROFF Attorney for Defendant -andDAVID E. PATTON Federal Defenders of New York, Inc. BY: EDWARD S. ZAS Assistant Federal Defender 20 Also Present: 21 22 23 Colleen Geier Morgan Hurst, Paralegal Specialists Achal Fernando-Peiris, Paralegal John Lee, Litigation Support Daniel Hartenstine Matthew Mullery, CISOs, Department of Justice 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1735 K2J3SCH1 1 (In the robing room; counsel present) 2 THE COURT: Okay. I got a note from a juror, and it 3 deals with an incident that occurred on Thursday late in the 4 day. 5 report that he made to David on Thursday in writing, which he 6 did on Tuesday morning. He then left the courthouse. 7 This is the note. 8 Exhibit 1. 9 this now. 10 I made copies. I'm going to mark it as Court So I don't think we can resolve But I wanted to call it to your attention right away. 11 (Pause) 12 MS. SHROFF: 13 THE COURT: 14 We asked him to put the It seems okay to me. There is a whole series of cases in the Second Circuit that suggest it is okay. 15 MS. SHROFF: It's her belief. She's not saying she 16 can't be impartial. 17 opinion. 18 mean, she's saying she is a different kind of citizen. 19 what we want. 20 She's not deliberated. She's voicing an And she also notes that that was a different -- I That's A jury of peers. MR. LAROCHE: It strikes me, your Honor, that at a 21 minimum, there should be some -- it would make sense to me to 22 question the juror about her impartiality. 23 the fact that she might think the criminal justice system is 24 racist. 25 THE COURT: It seems like here, That's her husband's thought. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1736 K2J3SCH1 1 MS. SHROFF: 2 THE COURT: You're right, your Honor. So, I don't want an answer now. There are 3 a couple of cases I want to call to your attention U.S. v. 4 Abrams, 137 F.3d 704 (2d Cir. 1998); U.S. v. Viale, 312 F.2d 5 595, 602; U.S. v. Thai, 29 F.3d 783 (2d Cir. 1994); U.S. v. 6 Farhane, 634 F.3d 127 (2d Cir. 2011). 7 One of the cautions that they make in these cases -- 8 that's not all the cases, but that's enough to get you going -- 9 is that inquiry along the lines that Mr. Laroche suggests may 10 be counterproductive. 11 hearing from you. 12 MR. LAROCHE: 13 MR. ZAS: But I don't want to decide this without Understood. My concern would be what those cases suggest 14 is just singling out a particular juror. 15 would be a problem to remind them that no one should be 16 discussing the case until the end. 17 MS. SHROFF: 18 THE COURT: 19 20 21 22 I don't think it You just did that yesterday. I did that yesterday and that's part of my scenario. MR. ZAS: We're getting this juror's version of what the other juror said, which also may be not entirely accurate. THE COURT: We've got time on this. So if anybody 23 wants to submit anything or take a further position, that's 24 fine with me. 25 I'll set a deadline of tomorrow? MR. LAROCHE: Sure. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1737 K2J3SCH1 1 THE COURT: 2 MS. SHROFF: 3 THE COURT: How much longer do you have on Karen? 4 MR. DENTON: About a half hour, 40 minutes, your 5 THE COURT: 7 MS. SHROFF: 8 THE COURT: 9 MS. SHROFF: 11 12 Friday is better, your Honor. Honor. 6 10 Friday? name? Are you going to be longer? I might be. She answers so slowly. She's thinking. Do you think we could give her a last It is very hard for me to call somebody "ma'am." THE COURT: Why don't you call her Karen? She's your good friend. 13 MR. ZAS: I think this is the original. 14 THE COURT: We are going to mark this Court Exhibit 1. 15 I'll give it to David Gonzalez and he'll keep custody. 16 copies are for you. 17 (Continued on next page) 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Those 1738 K2J3SCH1 Karen - Direct 1 (In open court; jury present) 2 THE COURT: 3 I want to remind the witness, you're still under oath. 4 THE WITNESS: 5 THE COURT: 6 MR. DENTON: 7 Yes. All right, Mr. Denton. Thank you, your Honor. KAREN, 8 called as a witness by the Government, 9 having been previously sworn, testified as follows: 10 DIRECT EXAMINATION (Continued) 11 BY MR. DENTON: 12 Q. Good morning, ma'am. 13 A. Good morning. 14 Q. When we broke yesterday, you were testifying generally 15 about some of the limitations that resulted from the fact that 16 the defendant had involved the threat management unit; do you 17 remember that? 18 A. Correct. 19 Q. So despite those limitations in the spring of 2016, did you 20 take any steps to address concerns raised by the defendant's 21 complaint about a death threat? 22 A. 23 chief below that worked for him, Anthony, to determine what the 24 best approach would be. 25 we consulted with legal, we consulted with security, to I worked with my deputy, Mike, and then the acting division We consulted with HR, human resources, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1739 K2J3SCH1 Karen - Direct 1 understand as best we could what it was that we should do or 2 what our options were. 3 front office, Bonnie, to figure out the best way for us to 4 handle the situation to try to bring calm back to the 5 organization, and help everyone move forward. 6 MR. DENTON: We also consulted with my boss in the Ms. Hurst, can we put up Government 7 Exhibit 1042, please. If we can go I guess to the carryover 8 e-mail that starts on this page and then goes to the next. 9 Thank you. 10 Q. Just to orient us, who sent this e-mail? 11 A. So, the officer that sent this e-mail was the division 12 chief that -- she was in the process of moving out to a new 13 assignment, so Debra was the division chief when the incident 14 first happened. 15 Q. When was this e-mail sent? 16 A. March 24, 2016. 17 Q. Generally speaking, what is this e-mail talking about? 18 A. So, this e-mail is talking about the fact that in consult 19 with, again, the resources I had just mentioned, HR, security, 20 etc., we understood that it was best to at least try to move 21 the officers within the spaces that the branch they were in 22 were, so OSB. 23 When this incident happened, both officers were 24 sitting extremely close to each other in cubicle desk settings, 25 where, really, they both couldn't walk out at the same time, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1740 K2J3SCH1 Karen - Direct 1 they would be so close. We wanted to try to physically 2 separate them in the space as much as possible so they weren't 3 bumping into one another. 4 MR. DENTON: Ms. Hurst, can we go up to the next 5 e-mail in the chain above this on the first page. 6 Q. Did you send this e-mail? 7 A. Yes, I did. 8 Q. Who did you send it to? 9 A. I sent it to the chief of security for CCI, the center. 10 Q. Do you see where it says "CH/AED, upon verbal consultation 11 with CH/HR and myself, sent moving instructions to the officers 12 in the e-mail below." 13 A. Yes. 14 Q. Are those the consultations that you were just describing? 15 A. Yes, that would be so chief slash AED was Debra at the 16 moment that this was going on. 17 HR, we did exactly what this says, I had her send moving 18 instructions to the officers. 19 Q. Can you read the last line of the e-mail. 20 A. "This was precipitated by Mr. Schulte's refusal to move 21 until he received written direction." 22 Q. What did you mean by that? 23 A. What was relayed to me by Debra was that Josh refused to 24 move unless he was given something in writing. 25 do that. So the discussions with her and SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 So, I had her 1741 K2J3SCH1 Karen - Direct 1 Q. As a general matter, had you decided that nothing would be 2 put in writing in connection with this incident? 3 A. No, that's not true. 4 Q. Going back to the specific move, were you involved in 5 deciding what actual cubicles the defendant and Amol would be 6 moved to? 7 A. 8 as far apart as we could get them within the space. No. 9 We talked in general terms about making sure they were MR. DENTON: Ms. Hurst, can we bring up Government 10 Exhibit 1039, please. And blow up I guess it is the paragraph 11 that starts "despite the security incident." 12 Q. 13 of the third line and carries over on to the fourth, that 14 reads, "I was asked to move to an intern desk while Amol was 15 promoted to a better desk." 16 A. Yes, I see that. 17 Q. As far as you are aware, was the defendant asked to move to 18 an intern desk? 19 A. 20 are fairly standard. 21 considered to be better, people like that. 22 thing as an intern desk. 23 Q. 24 decision to move the defendant and Amol? 25 A. If you look at the sentence, ma'am, that starts at the end There's really no such thing as an intern desk. The spaces The location near a window might be But there's no such Were questions of punishment or promotion any part of the No. It was a practical decision based on available space SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1742 K2J3SCH1 1 Karen - Direct in what room we had to work in. 2 MR. DENTON: We can take that down. Thank you. 3 Q. Did there come a time after that when you decided to move 4 the defendant and Amol to different branches within EDG? 5 A. 6 restraining order in the local county against Amol. 7 that court ruling came out that the restraining order would be 8 granted or executed, we had instructions that we received that 9 those two could not interact or be near one another. So, there was a court ruling -- Josh had filed a And when And we 10 needed to avoid them running into each other even in the 11 building. 12 So, that meant that we needed to move folks around. We went through and discussed the situation -- this 13 would be my deputy and the chief or acting chief of AED -- and 14 decided that the appropriate thing to do, based on how human 15 resources really, again, as I said yesterday, wants and our 16 policies and approaches are to never disadvantage any 17 particular officer as we make decisions. 18 appropriate thing to do would be to move both officers. So, the most 19 So then we had to consider which branches made the 20 most sense for mission, for the officer's skill set, and we 21 also looked at where those branches were located in the 22 different buildings. 23 MR. DENTON: In the building. Ms. Hurst, can we put up Government 24 Exhibit 1046, please. And I think on the second page. 25 can blow up the text in the first e-mail there. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 If we 1743 K2J3SCH1 Karen - Direct 1 Q. Do you see where it says: "Josh will be moving to AED/RDB 2 and Amol will be moving to AED/MDB." 3 A. Yes. 4 Q. How did you decide which branches they should be moved to? 5 A. It was based on the officer's skill sets. 6 different things that they were good at. 7 the need of the different branches. 8 mission, those particular branches had things going on, they 9 could use the extra help. They have some And also, based on This is a very busy And these branches are located on 10 different floors in the building. So, by moving them to those 11 branches, it also helped with the fact that they were not 12 supposed to be running into one another. 13 Q. 14 as where he would be moved to? 15 A. 16 the feeling and the recommendation from the branch level 17 management and the division level management was it best 18 matched his skill set. 19 Duane, that he had worked with before. 20 that would be a good place for him to go, a good place for him 21 to transition to. 22 had a good understanding of his skill set that could guide him 23 in the new branch. For the defendant in particular, how did you settle on RDB So, as we discussed, the type of work and things going on, Plus, there was a senior engineer, And so the thought was He had somebody he had worked with before, 24 MR. DENTON: Ms. Hurst, can we go up to the response 25 e-mail in this chain, please. First page. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Can we blow that 1744 K2J3SCH1 Karen - Direct 1 up. 2 Q. Who sent this, ma'am? 3 A. Josh sent this. 4 Q. Did you receive it? 5 A. Yes. 6 Q. Generally, who else as a group did he address this to? 7 A. Let's see. 8 resources; security; Bonnie, so the head of the center; myself; 9 my deputy, Mike; Debra again, the division chief at that time, 10 who had just left the job; and then the acting division chief, 11 Anthony. 12 looks like he sent it to Michele who I think was in the 13 executive director position at the time. 14 Q. 15 defendant to RDB. 16 reporting a security incident? 17 A. Absolutely not. 18 Q. Was he being punished for submitting a protective order? 19 A. Absolutely not. 20 It looks like he sent it to HR, human He also sent it to his branch chief, and it also You've been talking a little bit about why you moved the Was the defendant being punished for MR. DENTON: If we can go up to the first e-mail in 21 Government Exhibit 1046, Ms. Hurst. 22 Q. 23 second, where the defendant says, "I'm proceeding with my move 24 assuming it is directly due to my security report"? 25 A. Do you see here in the end of the first line, start of the Yes, I see that. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1745 K2J3SCH1 Karen - Direct 1 Q. Was the move due to his security report? 2 A. The move was due to the fact that when the restraining 3 order was executed by the county, we had to physically move the 4 location of where both officers worked. 5 Q. 6 an order against? 7 A. 8 be as fair and even and not disadvantage or advantage a 9 particular officer. Why didn't you just move Amol, the officer he had obtained Again, when we look at how officers are treated, we try to At this point in time, the investigation 10 of the incident in the office and the claim from our security 11 organization, the threat management unit, had not been 12 resolved. 13 was that we should move forward and treat them both the same. 14 Q. 15 defendant? 16 A. No. 17 Q. Why not? 18 A. We were, one, trying to work things at the lowest level 19 within the organization. 20 that point largely by Anthony, who was the acting division 21 chief and also the outgoing branch chief, he had been in RDB. 22 So we were handling those interactions. 23 things going on, and actually, responding to all of these 24 e-mails got -- it gets to be too much after a while. 25 So, everything that we had related to both officers Did you respond to either of these two e-mails from the So, the interactions were handled at There was a lot of He had been told multiple times, it was documented, it SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1746 K2J3SCH1 1 Karen - Direct was time to move forward. 2 MR. DENTON: We can take that down. Thank you. 3 Q. When the defendant moved branches, was there any discussion 4 about whether he would keep projects that had been assigned to 5 him while he was in OSB? 6 A. 7 move any officer, the practice is that when they move to the 8 new assignment, they work on the things that are the work of 9 that new office. When we made the decision or when we make the decision to They don't bring their work with them. 10 Q. Is accesses to projects within EDG controlled? 11 A. Yes. 12 controlled based on the type of work that you are doing and 13 where you're working, what you're doing. 14 In general, the code activities and things are MR. DENTON: Ms. Hurst, can we put up Government 15 Exhibit 1062, please. And if we can blow up the section at the 16 bottom of the page, please. 17 Q. Ma'am, did you receive this e-mail? 18 A. Yes. 19 Q. Do you see the subject line "EDG/AED security concern Re 20 OSB libraries"? 21 A. Yes. 22 Q. Do you remember this incident? 23 A. Yes. 24 Q. First of all, just generally, what was your reaction to 25 receiving an e-mail from Anthony about an AED security concern? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1747 K2J3SCH1 Karen - Direct 1 A. So, prior to the e-mail, just prior to the e-mail, Anthony 2 had come to the front office. 3 especially talking to Mike quite a bit as we worked through 4 this. He was in and out of the office, But also me, if I was available. 5 He had come in, and talked to us and alerting that he 6 had some significant concerns based on what he had been looking 7 at. 8 Q. What was your reaction to what you had been told? 9 A. I was also very concerned at what he was talking about. And was upset, alarmed, at what he had found. So 10 he talked about a little bit more about what was found and then 11 how to proceed with addressing the situation. 12 Q. Let's take a little closer look at this e-mail. 13 MR. DENTON: If we can go to the next page, please, 14 Ms. Hurst, and blow up the first paragraph under the line of 15 asterisks there. 16 Q. 17 "At the end of March 2016, EDG/AED/OSB staff were directed by 18 EDG and CCI management to ensure that all OSB projects were 19 properly resourced." 20 A. Yes. 21 Q. What did you understand that to mean? 22 A. They were directed by us, the management chain, to ensure 23 that the branch had its proper resources aligned for its code, 24 it tools, its configuration, and the appropriate people working 25 and having access to those things. Do you see the first part of the paragraph where it says, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1748 K2J3SCH1 Karen - Direct 1 Q. Do you see a little further on where it talks about making 2 sure things were accessed by the appropriate people in OSB, and 3 any projects that were not going to remain in OSB be moved to 4 the appropriate EDG branch immediately? 5 A. Yes. 6 Q. What is that a reference to? 7 A. Going through and making sure, as they were essentially 8 tidying up and making sure things were organized, if there was 9 some code or in those libraries that more appropriately 10 belonged to another branch, they were also told to address that 11 and move it. 12 Q. Were these the decisions that you were involved in? 13 A. We talked about it with me at a high level. 14 levels removed from most of this activity. 15 it in general terms, and Anthony and Mike to a degree worked 16 through the details. 17 Q. 18 following a personnel situation that occurred in March 2016." 19 Do you see that? 20 A. Yes. 21 Q. What is that referring to? 22 A. This was referring to the fact that because of the 23 personnel situation where we had to separate the officers, and 24 assign them to new branches, this was essentially the rest of 25 making sure everything was implemented correctly. I am four So we talked about Then just following that where it says, "This move was made SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1749 K2J3SCH1 Karen - Direct 1 Q. When you say "the officers," are you talking about the 2 defendant and Amol? 3 A. Yes, I am. 4 MS. SHROFF: Objection to the leading. 5 MR. DENTON: Just trying to clarify. 6 THE COURT: 7 MR. DENTON: Overruled. If we can zoom back out, Ms. Hurst, and 8 go down to the next page. 9 number 3 there. And blow up I guess it is marked as 10 Q. Could you read this for us, please? 11 A. "After the discussion and e-mails sent on the topic 12 (reference the e-mails below) before the end of the day on 14 13 April 2016, Jeremy checked the accesses on the OSB code library 14 server and discovered that Joshua reinstituted his 15 administrative access to the server via other administrative 16 rights Joshua possessed on EDG's DevLAN system." 17 Q. 18 who Jeremy is? 19 A. Yes, I do. 20 Q. Had you dealt with him before all of this? 21 A. Yes. 22 Q. In what context? 23 A. So as a developer, like any developers working on projects, 24 he would have come and briefed me or I would have seen him in a 25 board meeting, that type of interchange, or a demonstration. First, before we get into the specifics here, do you know He's one of the other officers in the branch. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1750 K2J3SCH1 Karen - Direct 1 Like any officer, if I pass by, I would talk to him. He also 2 was very forward leaning and engaged as part of working on some 3 of those things like I talked yesterday about the TAC, the 4 Tactical Advisory Council, the group of officers that wanted to 5 be helpful and come up with and identify things that need to be 6 worked on. 7 Q. 8 paragraph 3, was it concerning to you that Joshua reinstituted 9 his administrative access to the server via other So I interacted with him on a number of things. So, with respect to the specific things described here in 10 administrative rights? 11 A. Yes. 12 Q. Why? 13 A. One, it was pretty clear that, you know, everyone had been 14 talked to about what was going on, how to basically get 15 everything appropriately resourced as we discussed a few 16 minutes ago. 17 been changed, and then going in and figuring out another way to 18 come at things is not the way the organization works. 19 violation of trust, and not the normal practice for what was 20 expected of the officers. 21 And this practice of going in, if your rights had MR. DENTON: It is a If we can zoom out again, Ms. Hurst. And 22 then go down to the last paragraph, the last full paragraph. 23 Sorry. 24 Q. Could you read first sentence there, please. 25 A. "As a result, Joshua's direct insistence that he maintain The last paragraph on the page. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1751 K2J3SCH1 Karen - Direct 1 access, using language indicating that he would find a way to 2 ensure this access is maintained regardless of management's 3 decision to remove his access, and willingness to act to 4 reinstitute his administrative access to a system that he 5 should not have these rights must be taken seriously." 6 Q. Could you just continue, please. 7 A. "This is in direct violation of agency policy, and raises 8 concerns whether Joshua should be permitted continued access 9 EDG's code bases in the future. EDG's development model relies 10 on very talented individuals across the country coming up with 11 technical solutions to some of the toughest cyber problems... 12 but it also relies entirely on the fact that all individuals 13 can be trusted to protect EDG, CCI, agency and IC equities by 14 following the security models with the appropriate accesses in 15 place to protect us all. 16 of cyber tools and those using them at risk for years to come." 17 Q. 18 had done? 19 A. I agree -- yes, I agree with what was written here. 20 Q. Was this something that you thought should be taken 21 seriously? 22 A. Yes. 23 Q. After you were alerted to this problem in your conversation 24 and this e-mail, what steps did you take? 25 A. Failure to do so puts our entire set Did you agree with this assessment of what the defendant Again, in consult with my deputy, with Anthony, in consult SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1752 K2J3SCH1 Karen - Direct 1 with human resources, security, legal, and my management, we 2 discussed what would be the appropriate next step. 3 decided to do was, there was a memo written that was worked at 4 a lower level below me by Anthony, that basically laid out and 5 documented to reaffirm the policy, regulation and practices 6 related to how accesses are to be granted, removed, and not 7 worked around. 8 Q. 9 did you settle on the memo as the right way to deal with the And what we From the menu of options that were available to you, why 10 situation? 11 A. 12 come up. 13 measured approach, a careful approach, not to escalate it to 14 more serious types of personnel actions. 15 the directions and the instructions were clear, and that we had 16 confirmed understanding that the policies had been communicated 17 and understood. 18 Q. Why didn't you present this memorandum to the defendant? 19 A. Again, we were trying to not escalate, and bring this 20 higher in the organization than we need to. 21 possibility that, if things continued, we might have to do 22 that. 23 something like this is we worked these at the lowest level 24 possible, so we did that at the acting division chief level. 25 Q. So, this was a first -- the first time that this issue had This was -- we really opted to take a -- we took a But to just make sure We reserved the But the best place to start, the normal way we go about Other than being given this memorandum, was the defendant SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1753 K2J3SCH1 Karen - Direct 1 punished in any way for what had happened? 2 A. No. 3 MR. DENTON: Ms. Hurst, can we put up Government 4 Exhibit 1616 again, please. And if we can go to the next page. 5 And blow up the second full paragraph, yes, right there. 6 you. 7 Q. 8 incident will reveal all the issues with the security of EDG's 9 systems? Thank Ma'am, were you concerned that the extra scrutiny from this 10 A. No. 11 Q. Did you attempt to pin anything on the defendant? 12 A. No. 13 Q. Would you describe your relationship with Jeremy Weber as 14 him being a faithful pawn? 15 A. 16 officer, he's a veteran, and he has his strong opinions. He is 17 not going to have somebody sway him or use him as a pawn. He's 18 a smart man, and very focused on the mission. 19 Q. 20 security of EDG systems? 21 A. 22 tightened up, and some of the way things were being managed 23 needed to be tightened up. 24 environment because of the type of work that has to be done on 25 it. I would never consider Jeremy Weber a pawn. He is a good Did this incident in fact reveal issues pertaining to the It did. We found that some of the practices needed to be It is a challenge in that You have to really work through how to implement some of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1754 K2J3SCH1 Karen - Direct 1 those controls in a way that still allows them to do the work 2 that they need to do. 3 Q. What sort of practices needed to be tightened up? 4 A. Exactly who and how the accesses were tracked. 5 honestly, it was multiple levels below me, so I'm not an expert 6 in that area. 7 Q. 8 taken to increase security on DevLAN? 9 A. But As a result of this incident, were you aware of any steps Yes. Again, Anthony and Mike and I had had multiple 10 conversations. 11 more detailed technical background in this area. 12 was working, and we engaged Jeremy to go through and really 13 take a look at this system. 14 investments in some additional computer servers so that we 15 would have the ability to, again, manage code base, making sure 16 we had good backups and all that kind of stuff. 17 Anthony and Mike are both much more, had much MR. DENTON: So Anthony And then we did make some You can take that down. Thank you. 18 Q. Did there come another time later in 2016 when you learned 19 that defendant had again altered accesses on DevLAN? 20 A. Yes, a couple months later. 21 Q. What had your interactions, if any, with the defendant been 22 like in the intervening time? 23 A. 24 hadn't been anything related to his projects that had come to 25 my office, which is not unusual. I hadn't really seen him during that period of time. There He hadn't been in any of the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1755 K2J3SCH1 Karen - Direct 1 various board meetings and things when I've been in the room. 2 I do a lot of work outside the building, and also -- so a lot 3 of times I don't see a lot of people. 4 to RDB, his location was now different, so I didn't see him 5 when I was walking to a conference room or things like I had in 6 the past when he was in OSB. 7 Q. 8 with respect to accesses on DevLAN? 9 A. And then with him moving So, what did you learn about the defendant later in 2016 So, what I learned in I think it was June timeframe, late 10 May, that he had basically violated the memo that we had had 11 him sign, and gave himself access back again to things that he 12 had been -- had his access removed. 13 Q. Again, was that concerning to you? 14 A. Extremely. 15 Q. Again, why? 16 A. Again, policy, regulation, practice, all were a part of the 17 issue here. 18 willfully and clearly going against what he had been directed, 19 both verbally by his direct management, and then also in the 20 memo that was done in April. 21 MR. DENTON: The trust factor, and now at this point, just Ms. Hurst, can we go to Government 22 Exhibit 1085, please. If we can just blow up the top matter 23 there, please. 24 Q. Who sent this? 25 A. This was from Anthony. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1756 K2J3SCH1 Karen - Direct 1 Q. Did you receive it? 2 A. Yes. 3 Q. If we can zoom back out. 4 you in this e-mail? 5 the specifics in a moment. 6 A. 7 new planned work, a new capability for operations, and talked 8 about the updating permissions to this one set of code for one 9 of the tools. And what is Anthony relaying to Just generally, we'll talk about some of So, he was relaying his -- Anthony was relaying to Josh his 10 MR. DENTON: If we can go down to the next page, 11 please. And if we can blow up the paragraph that starts 12 "first" just sort of through the end of that sequence, to the 13 end of the page. 14 Q. 15 paragraph, Anthony writes, "I told him that when changes were 16 made in early April they were directed by EDG management"? 17 A. Yes, I see that. 18 Q. Was that accurate? 19 A. Yes. 20 Q. Just continuing, he said, "He pressed on this issue 21 indicating that it was probably the C/EDG who he felt had a 22 problem with him." 23 A. I see that. 24 Q. What does C/EDG refer to? 25 A. That refers to me. Thank you. Do you see here where in the middle of this first Chief EDG. That's often the way it's SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1757 K2J3SCH1 Karen - Direct 1 shorthand. 2 Q. Did you have a problem with the defendant? 3 A. No. 4 the accesses and the difficulty we had had with him to sign the 5 memo, and then proceeding to do other things, I was extremely 6 concerned about that. 7 Q. 8 "These changes were not just made to him but also Amol." 9 you see that? I now had concerns based on the incident in April with But I had no personal issue with him. And just in the last part of this comment where it says Do 10 A. Yes. 11 Q. Was that part of the process that you were describing 12 earlier? 13 A. 14 the details, but the instructions were to go through and make 15 sure the accesses lined up with the officers. 16 moving to another branch, those accesses should be changed to 17 what was appropriate for the new branch. 18 equally to everybody. 19 Q. 20 us, please. 21 A. 22 said the following: 23 privileges were being removed unfairly, he wasn't going to just 24 allow it to happen and he would 'fight back.' 25 caught me a little off guard, and I feel they are worth Again, we went through, and I'm not as familiar with all And if they were And it should be done So, could you then read the paragraph marked "second" for Yes. "Second, during this part of the conversation, Josh In this case, where he felt that his SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 These two words 1758 K2J3SCH1 Karen - Direct 1 mentioning. Josh feels that he is being wronged in this 2 situation -- that his projects have been unfairly removed from 3 him, and that he's being punished unfairly." 4 Q. 5 his projects removed from him? 6 A. 7 changed. 8 specific to his new branch RDB. 9 assignment was different. Again, I'm sorry if we covered this before. He moved from one branch to another. But why were His assignment was He was going to work on requirements that were His work was different. His 10 Q. Was he being punished in any way? 11 A. No. 12 Q. What was your reaction to this paragraph? 13 A. It's -- it was extremely odd that someone would try to hold 14 on so strongly to a tool and some code, and drag it with them 15 to their new assignment. 16 observed before. 17 MR. DENTON: It was behavior that I hadn't really We can take that down. Thank you, 18 Ms. Hurst. 19 Q. 20 do? 21 A. 22 direction, instruction, and issue what's known as a letter of 23 warning. 24 Q. 25 significant event? After you learned about this issue, what did you decide to Well, in June, we made the decision to escalate the In general, in CIA practice, is a letter of warning a SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1759 K2J3SCH1 Karen - Direct 1 A. Yes, it's very significant. 2 Q. Why is that? 3 A. It is one that is officially taken as an action that you 4 are putting an employee on notice that there are some 5 significant issues. 6 the personnel, HR, security, legal, and it becomes and is added 7 to their file. 8 you better correct your behavior, you have a problem. 9 It's documented, it's coordinated with all It basically puts someone on notice that, hey, MR. DENTON: Ms. Hurst, can we put up Government 10 Exhibit 1094, please. 11 Q. Ma'am, what is this? 12 A. This is, this is the letter of warning. 13 Q. Did you prepare this letter? 14 A. It was written and drafted by a number of us, actually. 15 there were a lot of inputs, including Anthony, Mike my deputy 16 to a degree, HR, security, and legal. 17 inputs in writing this letter. 18 Q. Was this memo given to the defendant? 19 A. The memo was presented to him in a meeting. 20 So So there were a lot of I was very involved in it, yes. (Continued on next page) 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1760 K2jWsch2 Karen - Direct 1 BY MR. DENTON: 2 Q. 3 defendant's demeanor like? 4 A. 5 me. 6 it and talked about it. 7 points in the letter. Generally speaking, in terms of that meeting, what was the He was quiet, and he did not make eye contact at all with And he stared at the memo, and basically we walked through 8 9 MR. DENTON: And he took issue with a number of Ms. Hurst, could we blow up the paragraph marked No. 2. 10 Q. Now, do you see where it says, "Your email to Susan dated 3 11 June 2016 identified your concern that on 4 April your admin 12 privileges to EDG/AED/OSB project Brutal Kangaroo were changed 13 by Jeremy Weber without authorization"? 14 A. Yes. 15 Q. Had his privileges been changed without authorization? 16 A. No, that's not correct. 17 of his management. 18 Q. 19 letter? 20 A. Jeremy was working under direction Was that something you confirmed before preparing this Yes. 21 MR. DENTON: If we can zoom back out and go down to 22 paragraph 3. 23 Q. 24 that are marked out and then something handwritten there. 25 A. Just as a process matter, there's a couple of lines here Yes. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1761 K2jWsch2 Karen - Direct 1 Q. Do you recognize the handwriting? 2 A. Yes. 3 Q. And did you also make those strikeouts? 4 A. I did. 5 Q. Why did you do that? 6 A. As we walked through and discussed the memo, the letter of 7 warning with Joshua, he took issue with many lines in the 8 document, and I was really looking for a place where we could 9 come to some agreement. The handwriting's mine. And in this particular paragraph, I 10 was willing to accept these as the edits to that, or changes to 11 that paragraph. 12 in its place the sentence I wrote in by hand. 13 Q. 14 seriously the things the defendant said to you? 15 A. Certainly. 16 Q. Why did you do that? 17 A. Because that's the way I always operate, going through and 18 hearing a person out and trying to understand where they're 19 coming from, and if -- this is a complex business. 20 something that I didn't understand or had been communicated to 21 me differently, to hear and -- hear him out and make sure that 22 I had considered everything that was involved. 23 So we deleted the two sentences and then added Now, during the course of this meeting, did you consider MR. DENTON: If there's Ms. Hurst, could we go to the next page 24 of this exhibit, please, and if we could just blow up the 25 printed text portions. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1762 K2jWsch2 Karen - Direct 1 Q. Now, there's a couple of points here where you've marked 2 things with an asterisk. 3 A. Yes. 4 Q. Why did you do that? 5 A. Those two points, there's a note at the bottom of the page 6 I wrote in that Joshua disagreed with those points. 7 Q. Why didn't you strike these lines out? 8 A. Because I noted that he disagreed, but this was my 9 statement and this, I felt, was true. Do you see that? 10 Q. And what was the first statement the defendant disagreed 11 with? 12 A. 13 given in the memorandum you signed on 18 April 2016, referenced 14 above." 15 Q. 16 signed? 17 A. 18 on not giving himself access when he had not been granted 19 access; he couldn't independently take that action. 20 was in the memo. 21 Q. 22 second portion that the defendant disagreed with? 23 A. 24 management's lack of support for you to retain administrative 25 privileges, but nonetheless, you took steps to deliberately Could you read that, please? "These actions violated the policy stated and instructions How did the defendant violate the memorandum that he had So, the memorandum basically gave him specific instructions And that Now, going down to the bottom paragraph here, what was the "You were aware of the policy for access and your SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1763 K2jWsch2 Karen - Direct 1 violate that policy and gain those privileges." 2 Q. 3 with respect to administrative privileges? 4 A. Yes. 5 Q. Are those important policies? 6 A. Yes. 7 Q. Why? 8 A. Having administrative privileges, depending on the 9 different levels, gives someone additional access to be able to We've talked about policies in general. Are there policies 10 get into, in this case, code or whatever data, etc., and do 11 things with it. 12 technology, capability, so people have access when they need 13 it, and they don't have access when they don't need it. 14 And that -- this is really important MR. DENTON: If we can zoom out on this page, please, 15 Ms. Hurst. 16 Q. Did you sign this letter? 17 A. I did. 18 Q. Did the defendant sign it? 19 A. He did not. 20 Q. Why not? 21 A. He -- as we briefed it and walked through, he had his 22 disagreement points, as I mentioned, and at the end, it is also 23 our practice and policy that the officer is -- has the option 24 not to sign the letter of warning. 25 Q. So he opted not to sign it. And who else was present at this meeting? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1764 K2jWsch2 Karen - Direct 1 A. Our head of HR, Susan, and my deputy Mike were in the room. 2 Q. Why were all of you there? 3 A. One, as resource people and experts for the policies' 4 communication; also, for continuity of the conversation because 5 as we had worked through the issues of the moving of personnel 6 in the branches earlier in the year and the first refer -- the 7 first memo, etc., they had been involved in the conversation 8 along the way. 9 Q. Following this meeting, did you have any other interactions 10 with the defendant? 11 A. No. 12 Q. Did there come a time when you left EDG? 13 A. Yes, in -- even in June there was already work underway for 14 me to move to a new assignment, so I officially left later that 15 summer to a new assignment. 16 Q. And roughly when was that? 17 A. About August. 18 Q. I want to ask you to think a little bit forward in time to 19 March of 2017. 20 heard the term "Vault 7"? 21 A. Yes. 22 Q. What does Vault 7 refer to? 23 A. That refers to the information that was leaked. 24 Q. And where did that information come from? 25 A. I had been told it came from EDG. Did there come a time in March of 2017 when you SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1765 K2jWsch2 Karen - Cross 1 Q. And where was it leaked to? 2 A. WikiLeaks. 3 Q. What was your reaction when you learned the type of 4 information that had been published by WikiLeaks as Vault 7? 5 A. I was sick to my stomach. 6 Q. Why? 7 A. For many reasons. 8 that information getting out into a forum like that can hurt 9 people and impact our mission. 10 That is a -- those capabilities, any of It's a huge loss to the organization and puts, potentially puts people at risk. 11 MR. DENTON: Ms. Hurst, could we pull up page 9 of 12 Government Exhibit 809. Can we blow up the paragraph that 13 starts "The@Department of Justice." 14 Q. 15 the CIA set up Joshua Schulte"? 16 A. Yes, I can read that. 17 Q. Did you and Jeremy Weber set up the defendant for the Vault 18 7 leak? 19 A. Now, do you see where it says, "Jeremy Weber and Karen at No, I did not. 20 MR. DENTON: 21 THE COURT: 22 MS. SHROFF: 23 CROSS-EXAMINATION 24 BY MS. SHROFF: 25 Q. No further questions, your Honor. Ms. Shroff. Thank you, your Honor. EDG told you that the information in Vault 7 came from EDG? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1766 K2jWsch2 Karen - Cross 1 A. No, I did not hear that from EDG directly. 2 Q. I'm sorry. 3 you said? 4 A. EDG did not tell me that. 5 Q. Who told you? 6 A. I read it in the headlines. 7 Q. You read it in the headlines? 8 A. Newspaper. 9 Q. That's how you learned about where -- 10 A. I was not involved or assigned at EDG or CCI at the time 11 this happened, so I had no direct information. 12 Q. 13 Yes? 14 A. Certainly. THE COURT: Q. Is that not what Could you let me finish my question before you answer it? 15 16 Did I miss that on direct? Yes. Thank you. 17 THE COURT: And you should do the same. 18 MS. SHROFF: I was trying, your Honor. 19 THE COURT: Thank you. As a matter of courtesy. 20 BY MS. SHROFF: 21 Q. 22 was leaked in Vault 7 came from EDG? 23 A. I heard about it, read about it in the headlines. 24 Q. OK. 25 information was leaked to WikiLeaks, correct? Let's try it again. Who told you that the information that Now, you also testified that you learnt that the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1767 K2jWsch2 Karen - Cross 1 A. Later, yes. 2 Q. You don't know that to be true, correct? 3 A. I have not been personally involved in that. 4 Q. In fact, nobody knows who it was leaked to; all you know is 5 that it was released by WikiLeaks? 6 A. Is there a question there? 7 Q. Yes. 8 A. Could you repeat the question? 9 Q. Sure. That was the question. Sitting here today, do you know who the information 10 was leaked to? 11 A. I do not. 12 Q. Does the CIA, in your opinion, know who the information was 13 leaked to? 14 MR. DENTON: 15 THE COURT: Objection. Sustained. 16 Q. What's your present position? 17 A. I'm the assistant director of national intelligence for 18 systems and resource analysis at the office of the director of 19 national intelligence. 20 Q. And that's part of the CIA, right? 21 A. It is not. 22 Q. It is not. 23 the CIA? 24 A. That would -- at the CIA? 25 Q. Yes. What's the highest position you ever held at SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1768 K2jWsch2 Karen - Cross 1 A. 2 management in the digital directorate for innovation. 3 Q. And in 2017, March of 2017, what was your position? 4 A. I was the director of the office of acquisition management. 5 Q. And it is your testimony today that you do not know who the 6 information was leaked to; that is, the Vault 7 information? 7 A. That is correct. 8 Q. Right. 9 CIA knows who the information -- 10 11 Office director, director of the office of acquisition Am I correct, ma'am, that, in fact, nobody at the MR. DENTON: Q. 12 Objection. -- was leaked to? THE COURT: Sustained. 13 Q. Did you talk to management about the Vault 7 leak? 14 A. I did. 15 Q. Did you talk to Mr. Roche about the Vault 7 leak? 16 A. I did. 17 Q. Did you talk to Mike S. about the Vault 7 leak? 18 A. Uh, no. 19 Q. Let's start with the first two that you talked to. 20 talked to Mr. Roche, correct? 21 22 Did Mr. Roche ever inform you that he knew who the information was leaked to? 23 MR. DENTON: 24 THE COURT: 25 Q. Objection. Sustained. Do you know when WikiLeaks leaked the information? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 You 1769 K2jWsch2 Karen - Cross 1 A. I know that the headline in the paper was in March of 2017. 2 Q. Do you know when the CIA assumes that information was 3 taken? 4 MR. DENTON: 5 THE COURT: Objection. Overruled. 6 A. Again, I have not been involved and I do not know. 7 Q. You don't know that they think it was taken in April of 8 2016? 9 A. I do not. I have not had any insight since I left the 10 position. 11 Q. 12 you were head of EDG, right? 13 A. That's correct. 14 Q. And before March of 2016, did you have any personal 15 knowledge of what was going on in OSB? 16 A. 17 at least at a top level. 18 Q. What does that mean, at least at a top level? 19 A. There are many, many projects, programs, efforts going on 20 across what is a large organization. 21 removed from the very detailed of what's going on, but I would 22 be aware at a top level of the list of projects, of any 23 projects or programs that were particularly important or -- or 24 were having problems. 25 Q. OK. In April -- let's start with March. In March of 2016, I was aware of the work going on in all the branches to -- OK. I'm multiple layers So is it fair to say that your knowledge of what was SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1770 K2jWsch2 Karen - Cross 1 going on at the developer level in OSB was the information you 2 got from your immediate deputy? 3 A. 4 occasion, the branch chief, but much less frequent. 5 Q. So who was your deputy in March? 6 A. The deputy in March of 2016 was Debra. 7 Q. Right. 8 A. She was in the process of transitioning to a new 9 assignment. Correct? From my deputy and my division chief below that, and on Was that Debra? And Debra was on her way out, correct? 10 Q. And Mike S. was on his way in? 11 A. Different jobs. 12 Q. OK. 13 A. Debra worked below that as a division chief, below Mike and 14 I. 15 Q. So who took over Debra's job? 16 A. The position was vacant. 17 Anthony. 18 Q. OK. 19 A. So he, as she moved on, became the acting division chief. 20 Q. So Debra moved on, there's a slight vacancy, and then 21 Anthony comes in, correct? 22 A. There was -- yes, that's true. 23 Q. Right. 24 correct? 25 A. Mike S. was my deputy. The new deputy division chief was And right below, also, there is a transition, The branch chief, Sean -SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1771 K2jWsch2 Karen - Cross 1 Q. Right. 2 A. -- he was in the process of working to move to a new 3 assignment. 4 Q. 5 assignment, right? 6 assignment. 7 not know that? 8 A. 9 assignment. Well, he wasn't in the process of working to move to a new By March, he'd already had a new He had an end date in OSB of April 15, or did you So, I said in March he was working to transition to a new Right. That's true. 10 Q. By March he had received a new job within the CIA, 11 correct? 12 A. Yes. 13 Q. He was for sure leaving OSB, correct? 14 A. Yes. 15 Q. He had an end date of April 15, correct? 16 A. I'm not aware of the specific date. 17 Q. OK. 18 leaving was because of the concerns of his management style of 19 OSB? 20 A. I do not know that. 21 Q. You don't know that? 22 A. I do not know that. 23 Q. Now, when was the first time you became aware of a physical 24 fight between two developers in OSB? 25 A. And is it fair to say that part of the reason he was Not until the incident with the threat management unit SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1772 K2jWsch2 Karen - Cross 1 brought all that to my attention. 2 Q. OK. 3 A. Yes. 4 Q. Do you know when that physical fight was? 5 A. No. 6 Q. Sitting here today, you still don't know when that physical 7 fight was? 8 A. No. 9 Q. Would it surprise you to know that it was in October of And that was in end of February, March of 2016, right? 10 2015? 11 A. OK. 12 Q. No, that wasn't the question. 13 surprise you to know? 14 A. It does not surprise me. 15 Q. OK. 16 you, the pop-up email about your one-on-one? 17 A. The question was would that Now, do you remember that document Mr. Denton showed Remember that? Yesterday, yes. 18 MS. SHROFF: Yes. Could we pull that up. 19 Q. Is that the entirety of the email that is sent out? 20 A. This would be a scheduling appointment, so it's just a 21 calendar appointment, yes. 22 Q. 23 so-and-so, it's time for our annual one-on-one, right? 24 A. No. 25 Q. It's just a calendar; it goes out to everyone, correct? Right. So it's not like an invitation that says, Dear SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1773 K2jWsch2 Karen - Cross 1 A. As the -- as my secretary was working this, she would have 2 set those schedules up. 3 Q. 4 just schedule this one-on-one with you, correct? 5 A. She works each of them separately. 6 Q. Well, of course. 7 A. Yes. 8 Q. She sends them out, correct? 9 A. Yes. 10 Q. And the date on this is November of 2015? 11 A. Correct. 12 Q. After October, correct? 13 A. Correct. 14 Q. And did you, by any chance, meet with all the developers in 15 this one-on-one? 16 A. I -- during the course of a calendar -- 17 Q. No. 18 the developers in November of 2015. 19 A. Then, no, I did not do them all in November. 20 Q. OK. 21 sometime after November 30 of 2015? 22 A. 23 from this November to the end of the calendar year. 24 Q. OK. 25 A. The cycle for these was calendar year, so I would have met Right. So it goes out to all the developers, and then they I'm just asking you if you recall meeting with all of Do you remember if you met with all of the developers I would not have met with all of them in the time period How about until January? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1774 K2jWsch2 Karen - Cross 1 with them through the course of 2016. 2 have been finishing up the list of whoever I had not had a 3 chance to meet with during the course of the year. 4 Q. 5 trying to meet up with everybody you have not met up with yet? 6 A. Correct. 7 Q. And sitting here today, you do not know who else you met up 8 with in November of 2015, correct? 9 A. Correct. 10 Q. And is it fair to say that sitting here you would not even 11 be able to tell me, for example, if you met with Justin 12 Nichols? 13 A. I don't know. 14 Q. OK. 15 A. I don't know. 16 Q. Did you have a one-on-one with Sean F.? 17 A. I would have possibly earlier in the year. 18 Q. You would have had one with him earlier in the year? 19 A. Uh-huh. 20 Q. To get a status report of what's going on in OSB? 21 A. The one-on-one conversations, like I indicated yesterday, 22 were -- there was no set agenda, so we would have talked about 23 whatever the officer had on their mind as to how things were 24 going or what they wanted to talk about. 25 social, but purposefully, on my end, it was whatever they Oh. By this time, I would So you are coming towards the end of 2015, so you're For example, right? How about Michael K.? Sometimes it was very SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1775 K2jWsch2 Karen - Cross 1 wanted to talk about, whatever they had in mind. 2 Q. Whatever they wanted to talk about? 3 A. Uh-huh. 4 Q. And you didn't prepare for the one-on-one? 5 A. Correct. 6 Q. You didn't say I'm going to ask my -- 7 Did you call her your secretary? Is it secretary? You had 8 a secretary? 9 A. Uh-huh. 10 Q. -- your secretary to get a cheat file on each person -- 11 A. No. 12 Q. -- whatever their interests were? 13 You didn't know anything about the person, correct? 14 A. Correct. 15 Q. This was all left up to them, correct? 16 A. It was a meet-and-greet social kind of meeting. 17 Q. How long did they last, by the way? 18 A. Generally about a half an hour. 19 Q. Half an hour. 20 A. Well, it was in -- same floor -- 21 Q. Uh-huh. 22 A. -- across the hall from the vault we worked in -- 23 Q. Uh-huh. 24 A. -- and then down towards the end of the building. 25 know -- I don't know exactly how far that is. And how far is your office from OSB? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I don't 1776 K2jWsch2 OK. Karen - Cross 1 Q. 2 follow-up, right? 3 A. 4 project or something that might come up that might get me to 5 think about something I should, you know, learn more about. 6 But in general, no. 7 designed to just open up a line of communication with the 8 officers. 9 Q. No. And after these one-on-ones, you didn't really do any In general, not. Sometimes I would learn about a They were just very -- again, they were So your thinking was that you were pretty good at creating 10 rapport; that's what you said yesterday, right? 11 A. Yes. 12 Q. You thought you had a skill set that built rapport with the 13 people that were having these 30-minute one-on-ones with you, 14 right? 15 A. Yes. 16 Q. The one-on-ones were in your office, right? 17 A. Yes. 18 Q. Set up by your secretary, correct? 19 A. Yes. 20 Q. The people walked in, sat down and had a little chat with 21 you for 30 minutes, correct? 22 And you testified, on direct, did you not, that the chat 23 you had with Mr. Schulte stood out for you because he didn't 24 make eye contact, is that right? 25 A. That is correct. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1777 K2jWsch2 Karen - Cross 1 Q. So you had a person come in for 30 minutes and make no eye 2 contact with you, correct? 3 A. Uh-huh. 4 Q. That was in November, sometime in November of 2015, 5 correct? 6 A. Uh-huh. 7 Q. And you thought that was odd, correct? 8 A. Correct. 9 Q. And you did nothing to follow up on that oddity, is that Yes. Yes. 10 correct? 11 A. I -- 12 Q. No, right? 13 A. No, I didn't. 14 Q. You didn't say to his boss: 15 with Mr. Schulte. 16 with him? 17 A. I don't recall. 18 Q. Right. 19 were going in OSB as part of this one-on-one? 20 A. As part of Josh's one-on-one? 21 Q. Well, not specifically him, but just generally. 22 A. I don't know if I had any other meetings with OSB officers 23 during that time. 24 Q. 25 there come a time when you were talking to Bonnie and Bonnie Hey, you know, I had a meeting He made no eye contact. What's going on No? Did you ask any of the other developers how things Let's fast forward a little bit and ask you this. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Did 1778 K2jWsch2 Karen - Cross 1 told you that perhaps he didn't make eye contact because she 2 thought he had Aspberger's? 3 A. 4 how to handle the situation. 5 Q. 6 of 2015, that that might be the reason for the no eye contact, 7 correct? 8 A. It was the first time -- 9 Q. Just yes or no. 10 A. No, it had not occurred to me. 11 Q. And you never, ever asked anybody anything about the 12 failure to make eye contact, correct? 13 A. Correct. 14 Q. OK. 15 information that came to you. 16 that you had no idea about the October 2015 physical fight, 17 correct? 18 A. Correct. 19 Q. And when you learnt that there had been a physical fight, 20 you were very concerned, were you not? 21 A. Certainly. 22 Q. Right. 23 you had? 24 A. 25 all of this, the threat management unit had already been Do you recall that? We had that conversation when we were trying to figure out Right. And it never occurred to you back then, in October Now, let's talk about information flow, about the OK? You've already testified And what did you do to assuage that concern that So, as I indicated yesterday, by the time I became aware of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1779 K2jWsch2 Karen - Cross 1 contacted. 2 Q. 3 because of Mr. Schulte and Amol, right? 4 A. Correct. 5 Q. Right. 6 A. I don't know. 7 Q. You don't know? 8 A. I don't know. 9 Q. But it was a physical fight that you were concerned about? 10 A. By the time I found out about this, the threat management 11 unit investigation was already ongoing, so -- 12 Q. 13 not involve that October 2015 physical fight, did it? 14 A. I do not know. 15 Q. You're concerned, correct? 16 A. Yes. 17 Q. You're upper management, correct? 18 A. Yes. 19 Q. This is a serious mission, correct? 20 A. Yes. 21 Q. You know of two grown men who have a physical fight, 22 correct? 23 A. I learned it at that time, yes. 24 Q. Right. 25 learnt of it, you were concerned, correct? Right. Right. But the threat management unit had been contacted But the physical fight was between whom? But the threat management investigation unit did Whenever you learnt it, ma'am, the moment you SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1780 K2jWsch2 Karen - Cross 1 A. Yes. 2 Q. And there was only one physical common denominator that 3 precluded you from talking to Mr. Schulte and Amol; that was 4 TMU, correct? 5 A. Correct. 6 Q. You took no steps at all to talk to the person, other 7 person involved in the physical fight, correct? 8 A. Correct. 9 Q. You directed no one to talk to that other person, correct? 10 A. Correct. 11 Q. You never checked to see if that person was OK, correct? 12 A. By the time I learned about this -- 13 Q. Ma'am -- 14 A. -- it was months afterwards. 15 Q. Months or years afterwards, did you check? 16 A. No. 17 Q. Did you assign someone to check? 18 A. No. 19 Q. Did there come a point, ma'am, when you were told by either 20 Debra or someone else that there had been an incident on 21 February 29? 22 A. February 29, I'm not familiar with the exact date. 23 Q. OK. 24 to her was, Get to the bottom of this, correct? 25 A. Yes or no. And when Debra came to your office, your instruction I told her she needed to meet with all the off -- the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1781 K2jWsch2 Karen - Cross 1 officers involved and speak with the branch chief to figure out 2 what's going on. 3 Q. 4 after she spoke to Sean? 5 A. 6 with everyone and engaging HR, etc., it was the end of the day. 7 By the time she was able to get back, the threat management 8 unit had already been engaged, so we were not able -- she was 9 not able to really implement the plan as we had talked about, 10 because when threat unit, management unit engaged, we had to 11 back off so that they could do their investigation. 12 Q. 13 My question wasn't whether or not Debra engaged with 14 Mr. Schulte. 15 Amol. 16 that time, who was Sean F. Tell me, please, what was the conclusion Debra reached So, to my memory, after Debra and I spoke about meeting You keep saying that, but my question was different, ma'am. My question was not whether Debra engaged with My question was whether Debra engaged with their boss at 17 MR. DENTON: 18 THE COURT: Objection, your Honor. Overruled. 19 BY MS. SHROFF: 20 Q. Did she? 21 A. I don't recall. 22 Q. Did you ever say: 23 can talk about this. 24 A. Uh -- 25 Q. Just yes or no. Hey, Sean, come up to my office so we I'm very concerned? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1782 K2jWsch2 Karen - Cross 1 A. No. 2 Q. Did you learn at any point in time that on March 1, Amol, 3 who was a project leader, took Mr. Schulte off of a project and 4 put another developer named David on the project? 5 learn that? 6 A. No, I did not. 7 Q. Now, did there come a point when you actually learned that 8 Sean had neglected to tell his immediate supervisor -- I 9 believe her name was Sunny -- about any of the issues that were Did you ever 10 going on in OSB? Did you just learn that fact? 11 A. At the time this all -- 12 Q. Just yes or no, ma'am. 13 A. Yes. 14 Q. And you learnt that Sunny was completely in the dark and 15 had no knowledge from Sean as to what was happening, correct? 16 A. That's not accurate. 17 Q. OK. 18 you've pointed out many times, that TMU was involved so neither 19 you nor anyone else interacted with Amol or Mr. Schulte? 20 Correct? 21 A. When this first happened, that is correct. 22 Q. OK. 23 job description, for lack of a better phrase, you interacted 24 with many different levels and groups outside of the branches 25 that you supervised, correct? By the time you became involved, am I correct, as Now, you also testified on direct that as part of your SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1783 K2jWsch2 Karen - Cross 1 A. Correct. 2 Q. And one of the functions of your job was to make sure, 3 wasn't it, to keep in mind the security of the base, is what 4 you called it? 5 A. Yes. 6 Q. OK. 7 system had gone down? 8 A. I do not recall that. 9 Q. Do you recall that somebody had failed to update or keep Correct? In 2015, did you come to learn that the entire DevLAN 10 updated the certificate of accreditation on DevLAN? 11 A. I don't recall that specifically. 12 Q. Do you recall that Mr. Schulte discussed with you the fact 13 that he was at that time in Las Vegas and was called about the 14 entire system going down? 15 A. Josh never told me that. 16 Q. OK. 17 one developer, who was in Las Vegas at a conference, to figure 18 out why all of DevLAN had gone down because somebody did not 19 upgrade its certificate or keep it current? 20 A. That is not accurate. 21 Q. OK. 22 A. There's not -- there was not one person that would have had 23 to be contacted to resolve that problem. 24 Q. 25 lapse of licensing on Stash? Did anyone ever tell you that they had to contact the Well, correct me. Did you ever come to learn that in 2015 there had been a SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1784 K2jWsch2 Karen - Cross 1 A. No. 2 Q. Did you ever come to learn that it affected the entire 3 office? 4 A. 5 entire office. 6 Q. 7 that impacts all of the developers in OSB is an important 8 security issue? 9 A. It might have affected the developers, but that's not the You don't think that the lack of having an updated license I do think that's important; it's just not the entire 10 office. 11 Q. OK. 12 A. In OSB? 13 Q. Yes. 14 A. The developers. 15 Q. So the most important work to the CIA's mission is done by 16 OSB, correct? 17 A. No, that's not correct. 18 Q. Oh, it's not? 19 A. There are other branches that would do equally as important 20 work. 21 Q. 22 in whatever group you want to call it, had failed to update the 23 license? 24 A. No, I did not. 25 Q. And did you ever learn or were you ever told that the OK. Who does the most mission-focused work in OSB? The developers in OSB, right? Did you learn that Stash had gone down because nobody, Did you ever learn that? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1785 K2jWsch2 Karen - Cross 1 developers were at a conference in Las Vegas and had to be 2 called to fix it? 3 A. I don't recall that. 4 Q. Do you recall an employee named Justin Nichols? 5 A. Yes. 6 Q. Did you ever have a one-on-one with him when he mentioned 7 that to you? 8 A. He never mentioned that to me. 9 Q. Do you recall at any point in late 2015 and 2016 being told 10 that because the system had gone down this way, they should 11 hire a new person to work and keep the programs running? 12 A. I don't recall that. 13 Q. Why was Rufus hired? 14 Let me help you out. Do you know who Rufus is? 15 A. I do not. 16 Q. Now, in describing your job, you said that you worked with 17 other parts of the CIA, right? 18 A. I did, yes. 19 Q. What is CIMC, by the way? 20 A. That is the Counterintelligence Mission Center. 21 Q. OK. 22 A. They work counterintelligence issues. 23 Q. Right. 24 A. I did not personally coordinate with them. 25 Q. I don't mean ever personally. And what exactly do they do? And you coordinate with them, correct? I just mean in your job SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1786 K2jWsch2 Karen - Cross 1 description. You do not coordinate with them? 2 A. I did not, at the -- no. 3 Q. By the way, did you ever use DevLAN? 4 A. I did not. 5 Q. Do you know anything about DevLAN? 6 A. I knew that it would -- DevLAN existed; that it was the 7 development environment for the hands-on developers. 8 Q. What does that mean, development environment? 9 A. That's where they would -- most or a lot of the work was 10 done. 11 Q. 12 did you ever hear the phrase "Wild West" being used to describe 13 it? 14 A. What? 15 Q. Wild. 16 A. No, I never heard that. 17 Q. You never heard that, right? 18 A. No. 19 Q. Did you ever hear your developers or people in OSB talking 20 about the weakness or insecurity of DevLAN? 21 A. No. 22 Q. You never heard anyone discuss the insecurities of DevLAN 23 even after the Snowden leaks; is that your testimony? 24 A. I never heard that. 25 Q. OK. And when you had this very high-level knowledge of DevLAN, What was that? I didn't hear the word. They never told that to me. So if developers were talking after the Snowden leak SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1787 K2jWsch2 Karen - Cross 1 and mentioned that your system was at similar risk, you never 2 heard that, correct? 3 A. I do not recall any of that. 4 Q. Now, you testified on direct that you remained disengaged 5 from Mr. Schulte because you had received input that 6 Mr. Schulte did not like you? 7 because I don't want to put words in your mouth. 8 A. 9 was uncomfortable with me. Is that -- you phrase it, The way I remember it is that it was relayed to me that he 10 Q. And when that was relayed to you, was that related -- was 11 that told to you by one of your deputies? 12 A. It was told to me by Mike and by Anthony. 13 Q. OK. 14 Anthony had been in the job for, what, two or three months? 15 less? 16 A. A couple of months. 17 Q. A couple of months, right? 18 here today, when Mike told you that, correct? 19 A. I don't remember. 20 Q. And by the way, did you ever have a discussion with Mr. 21 Roche about that? 22 A. 23 after I had left the assignment. 24 Q. After you left the assignment? 25 A. Yes. So Anthony had been -- when Anthony had told you that, Or And you don't remember, sitting Any discussion about Josh with Mr. Roche happened long SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1788 K2jWsch2 OK. Karen - Cross 1 Q. So during the time that you were still head of EDG, 2 you never spoke to Sean Roche about it, correct? 3 A. Not that I recall. 4 MS. SHROFF: OK. Now, let's take a look at, if I 5 could, the memo of warning. 6 me. 7 No. 8 THE COURT: 9 MS. SHROFF: 10 THE COURT: 11 MS. SHROFF: 12 Q. OK? Could somebody pull it up for That's the letter. What's the exhibit number, Ms. Shroff? It's 1095, your Honor. Thank you. Sorry about that. Could you just take a look at this document? 13 MS. SHROFF: And let's focus on the to-from and the 14 first paragraph. 15 Q. 16 memorandum at the time it was sent? 17 A. As I recall, I did re- -- I did see a copy. 18 Q. Did you see a copy after it was fully drafted, or did you 19 participate in its draft? 20 A. I don't remember. 21 Q. You don't remember, correct? 22 A. I don't remember. 23 Q. OK. 24 of whether or not Mr. Weber removed Mr. Schulte's privileges on 25 the OSB library on his own? Am I correct that you -- did you get a copy of this Is it fair to say that you had no personal knowledge SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1789 K2jWsch2 Karen - Cross 1 A. 2 up accesses, and so, yes, I know that he was directed to 3 basically make sure that people had the appropriate accesses, 4 based on their jobs. 5 Q. 6 Mr. Weber was directed to go through and review and clean Who told you that? I'm sorry. Have you finished? Just finish. 7 A. I'm done. 8 Q. Are you finished? 9 A. Yes. 10 Q. Who told you that? 11 A. It was part of the discussion that we had with Mike S. and 12 with -- with Anthony. 13 Q. The question was who told you that? 14 A. Who told me what? 15 Q. Who told you that that is what the assignment was to 16 Mr. Weber? 17 A. Mike would have been the one to tell me that. 18 Q. Mike would have been the one? 19 A. Yes. 20 Q. Do you know? 21 A. I don't recall specifically. 22 Q. OK. 23 remove any of Mr. Schulte's privileges, correct? 24 A. Correct. 25 Q. You did not directly know who told Mr. Weber, correct? Who told you that? So let's try it again. You did not tell Mr. Weber to SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1790 K2jWsch2 Karen - Cross 1 A. Anthony would have told him. 2 Q. I didn't ask you who would have told him, ma'am. 3 who may have told him? 4 A. I don't -- 5 Q. Do you know? 6 A. I don't recall. 7 Q. OK. 8 don't know? 9 A. I don't recall. 10 Q. OK. 11 first time that Mr. Weber removed these privileges? 12 A. Who knows I'm only asking you if you know. So is it that you don't actually recall or that you Which one is it? Do you, sitting here today, even recall when was the No. 13 MS. SHROFF: OK. So let's just move down in this 14 memo. Let's go to the second paragraph. 15 Q. 16 you, sitting here today, have no personal knowledge of those 17 facts, correct? 18 A. Of which facts? 19 Q. Well, that something happened on early April of 2016. 20 never learn about this until well after April, correct? 21 A. I'm sorry. 22 Q. OK. 23 all about what Jeremy Weber is doing about accesses, correct? 24 A. That is not accurate. 25 Q. OK. "As part of this process on early April 2016," correct, You I don't understand your question. I'll try it again. Early April, you were not aware at Tell me how it's not accurate. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1791 K2jWsch2 Karen - Cross 1 A. I know that he was directed by his supervisors to go 2 through and clean up the accesses. 3 Q. 4 you don't know that. 5 correct? 6 A. I don't believe there's a memo. 7 Q. There's no email to you saying that, correct? 8 A. I don't believe there's an email. 9 Q. There's no contemporaneous note, correct? 10 A. No. 11 Q. In fact, in early April, you have no involvement; you're 12 not engaged in the process at all, correct? 13 A. 14 Anthony. 15 Q. 16 somebody changing accesses on the OSB libraries? 17 A. 18 up the accesses, I was made aware of that. 19 Q. 20 information you have? 21 A. Yes. 22 Q. OK. 23 know if Jeremy Weber was ever authorized prior -- not supported 24 in his decision -- was authorized prior to the time to remove 25 access, correct? You don't know that, though, correct? Nobody -- all you -- There's no memo to you saying that, I'm getting regular updates from my deputy and from You are getting regular updates from your deputy about That they were in the process of going through and cleaning Just they were cleaning up accesses; that's the high-level So at that high-level information, you still don't SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1792 K2jWsch2 Karen - Cross 1 A. I don't know. 2 Q. Exactly. 3 A. Yes. 4 Q. Have you spoken to -- 5 Do you recall who Amol is? MS. SHROFF: You can take that down for now. 6 Q. Have you spoken to Amol during your time when you were head 7 of EDG? 8 A. Yes. 9 Q. Did you ever sit down and have a one-on-one with Amol? 10 A. Yes. 11 Q. Do you recall your one-on-one with Amol? 12 A. No. 13 Q. Do you recall if he told you what his goals were at the 14 CIA? 15 A. I don't recall. 16 Q. Do you recall whether or not he was interested and devoted 17 to being a coder? 18 A. 19 some different types of coding things. 20 background. 21 Q. 22 coding? 23 A. No. 24 Q. Do you recall if he wanted to be part of the leadership and 25 not remain a coder? I know he had a number of interests and had done some -He had a different But I don't recall anything specific. Do you recall that he was interested in management and not SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1793 K2jWsch2 Karen - Cross 1 A. I do not recall that. 2 Q. Do you recall ever saying to someone, Before I move them, 3 let me evaluate the skill sets of these two individuals? 4 testified to that, right? 5 A. 6 they would fit well. 7 Q. 8 Where do you see yourself going so we can place you properly? 9 A. No, we did not have a conversation. 10 Q. And did you have a conversation with Sean about that as to 11 what Amol wanted to see for his future before you placed him? 12 A. No, I don't recall doing that. 13 Q. So how did you determine what his skill set was if you 14 didn't talk to Amol and you didn't talk to Sean? 15 anybody I'm missing in this layer of hierarchy, because I don't 16 know your hierarchy well? 17 A. 18 the acting division chief, Anthony, who was working with the 19 branch, and we did need to have them identify what skills the 20 officers had -- 21 Q. Let's go -- 22 A. So that was relayed. 23 Q. Sorry. 24 A. That was relayed up the chain. 25 Q. And Anthony was in that job for three months, at most -- Yes. OK. You We had to determine their skill sets to figure where And in determining their skill sets, did you ask Amol, Or was there So, again, my conversations were with my deputy and with That was what? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1794 K2jWsch2 Karen - Cross 1 not even, correct? 2 A. Anthony, yes. 3 Q. Right. 4 was Mike S.? 5 A. Yes. 6 Q. He didn't know what their skill sets were, correct? 7 not work with them directly, right? 8 A. He did not work with them directly. 9 Q. OK. So let's put him aside for a minute. Let's put them aside. Your deputy He did How did you -- let's back up. 10 How did you figure out what their skill sets were? 11 A. 12 skill sets and possibilities were, that's how we would know. 13 Q. Who was the branch manager? 14 A. That was -- had been Sean, was Sean. 15 Q. But you said you didn't talk to Sean? 16 A. I did not directly. 17 Q. You did not directly, but you participated and agreed that 18 the move should take place and that these were the correct 19 units to move them to? 20 A. Yes. 21 Q. Right. 22 information you were given, correct? 23 A. Correct. 24 Q. If the information was accurate, you made the correct 25 decision, correct? So, identified by their branch manager as to what their So in essence, you made decisions based on the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1795 K2jWsch2 Karen - Cross 1 A. If the information's accurate. 2 Q. And if the information is inaccurate, you made the wrong 3 decision, correct? 4 A. Could -- that's possible. 5 Q. OK. 6 I'll take "that's possible." And is it fair to say that these are subjective evaluations 7 of skill sets? 8 A. 9 wouldn't be able to function, so it's not subjective. No. If somebody has no skill set to apply to a job, they If they 10 don't have the skills, they can't do the job. 11 Q. 12 right? 13 A. 14 of narrow, technical areas, so you may have somebody that is 15 very good at doing one particular type of thing, but they have 16 no experience or exposure doing another type of thing. 17 and if you just move somebody over there, they -- if they don't 18 have any skill set in that area, they can't do the job and 19 they'd have to basically learn something new. 20 Q. Are you finished? 21 A. Yes. 22 Q. OK. 23 I just want to make sure -- is you relied on Mike S., correct? 24 A. Yes. 25 Q. And Anthony, correct? Well, everybody in OSB has a base level of skill set, Yes, but not -- this is a very complicated business, lots So -- So in determining these skill sets, your testimony -- SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1796 K2jWsch2 Karen - Cross 1 A. Yes. 2 Q. And you did not have any personal knowledge about the skill 3 set of Amol, correct? 4 A. Just at a high level. 5 Q. Right. 6 A. Correct, at a high level. 7 Q. Except that you knew that he couldn't make eye contact, 8 correct? 9 A. And the same for Mr. Schulte, correct? Correct. 10 MS. SHROFF: Now, let's go to the letter of warning. 11 Q. Did you draft the letter of warning? 12 A. I was one of the primary writers, yes. 13 Q. OK. 14 correct? 15 A. Correct. 16 Q. It is a serious thing to give to an employee of the CIA, or 17 for that matter, any employee, correct? 18 A. Correct. 19 Q. And you wanted to be accurate, correct? 20 A. Correct. 21 Q. You wanted the facts to be accurate, correct? 22 A. Correct. 23 Q. And you thought it was important for Mr. Schulte to know 24 that you had the facts correct, right? 25 A. And you testified that this is a serious step, Correct. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1797 K2jWsch2 Karen - Cross 1 Q. Because you wanted to appear objective, correct? 2 A. Correct. 3 Q. You wanted him to believe you were giving him a fair shake, 4 correct? 5 A. We were trying to be as fair as we possibly could. 6 MS. SHROFF: OK. Well, let's start with the bottom of 7 page 1 of 2. 8 Q. 9 it. 10 A. OK. 11 Q. Who wrote this line, "The ISB member did not implement a 12 privilege change at this time"? 13 A. 14 sentence in this letter. 15 Q. OK. 16 A. I would have had Anthony check. 17 Q. You had Anthony check? 18 A. I would -- 19 Q. Is Anthony -- 20 A. -- ask Anthony to go through, is this accurate. 21 Q. So Anthony had reviewed this letter of warning, correct? 22 A. Yes. 23 Q. He had told you it was accurate, correct? 24 A. Correct. 25 Q. Because obviously if he had told you it was inaccurate, you Just take a minute and let me know when you're done reading All right? I don't know -- I don't recall who wrote each specific Who verified that each specific sentence was accurate? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1798 K2jWsch2 Karen - Cross 1 would never have presented it to Mr. Schulte, correct? 2 A. Correct. 3 Q. And then you presented this to Mr. Schulte, correct? 4 A. Correct. 5 Q. Was Anthony at the meeting? 6 A. No. 7 Q. But he verified the facts in the memo, correct -- I mean in 8 the letter. 9 A. Correct. 10 Q. OK. 11 team member did not implement a privilege change at this 12 point," correct? 13 A. Correct. 14 Q. Let me ask you something. 15 scratch-out, after the meeting is finished or -- 16 A. 17 Mike sitting in the room. 18 happening. 19 Q. 20 right? 21 A. A choice in scratching -- 22 Q. Yes. 23 A. =This out? 24 Q. Yes. 25 A. I could have elected not to make that change. It's a letter, correct? And you testified that you then scratched out "The ISB When do you make this We did it in the meeting with Josh and our HR person and OK. I did it right as the meeting was And it wasn't like you had a choice in doing this, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1799 K2jWsch2 Karen - Cross 1 Q. How? 2 A. I wouldn't have done it. 3 Q. How could you not change something that is wholly 4 inaccurate? 5 A. It's not wholly inaccurate. 6 Q. Really? 7 Let me show you. MS. SHROFF: 8 Q. 9 document. Can I have an exhibit number for this? I'm just going to ask that you take a look at this OK? It's 3511-45. 10 MS. SHROFF: 11 I'm just going to mark it for now, your Honor -- 12 THE COURT: 13 MS. SHROFF: 14 THE COURT: 15 MS. SHROFF: 17 THE COURT: 18 MS. SHROFF: break? 20 21 24 25 -- as Defense Exhibit I. All right. Defense I. Defense I is -- 45. -- 45. OK. Your Honor, would this be a good time to That way I could -THE COURT: Let's finish this line of questioning, and then we'll take our break. 22 23 All right. 3511 -- 16 19 Don't publish it yet. MS. SHROFF: I need to admit this in, and I need a break. THE COURT: All right. now, ladies and gentlemen. We'll take our morning recess We'll resume at quarter after. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1800 K2jWsch2 Karen - Cross 1 (Jury not present) 2 THE WITNESS: 3 THE COURT: 4 THE WITNESS: 5 THE COURT: 6 See you at 11:15. 7 (Recess) What do I do with this? You can step down. Do I leave this here? Just leave it there. 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1801 K2J3SCH3 1 (In open court; jury not present) 2 THE COURT: Yesterday, I reviewed the letter from the 3 government of February 17 dealing with Michael, and I asked 4 that the author of the CIA memorandum, which was attached to 5 the memo of February 12, that the author be identified and his 6 name be produced to the defendant. 7 I also received last night the files, the security 8 file and the investigative file, some 270 pages of materials. 9 I've read the files last night, and I direct that the security 10 file doesn't have to be produced, but the investigative file 11 should be produced to the defendant. 12 MR. LAROCHE: 13 THE COURT: 14 MR. LAROCHE: 15 THE COURT: 16 MR. LAROCHE: 17 THE COURT: 18 (Continued on next page) Yes, your Honor. Yes? I just said yes, your Honor. Thank you. Is Karen available? Yes, your Honor. Okay, David. 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1802 K2J3SCH3 Karen - Cross 1 (Jury present) 2 THE COURT: 3 MS. SHROFF: Ms. Shroff. Thank you, your Honor. 4 BY MS. SHROFF: 5 Q. 6 that you didn't have to cross that line out, correct? 7 A. Correct, I didn't have to. 8 Q. And I said why not. 9 accurate. So when we broke you said -- and correct me if I'm wrong -- It does not seem to be truthful or Correct? 10 A. I didn't hear you -- I don't recall you saying that. 11 Q. Okay. 12 member did not implement a privilege change at this point." 13 was incorrect, correct? 14 A. That was what Josh told us in the meeting. 15 Q. Well, he didn't just tell you that in a meeting, he then 16 told you that in an e-mail, correct? 17 A. The e-mail that you provided me just now? 18 Q. So let's take a look at that e-mail, if we can pull that up 19 from bottom up. 20 A. 21 project Brutal Kangaroo. 22 project." 23 Q. Who is it sent to? 24 A. It was sent to the ISB, which is the folks that did our 25 support or IT support. I'm saying it now. That statement, "The ISB team Yes. Could you read that for me. "Could a Stash admin grant me admin privileges for the I seem to have lost access to this SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 It 1803 K2J3SCH3 Karen - Cross 1 Q. They did more than IT support, right? They did more than 2 IT support, correct? 3 A. Well, they managed the system. 4 Q. Right. 5 A. Correct. 6 Q. Okay. 7 A. Yes. 8 Q. He's not sending it to one special friend that's going to 9 backdoor access to him, correct? They managed access, correct? So he's sending it to everyone in ISB, correct? 10 A. Correct. 11 Q. Okay. 12 many e-mail systems CIA has. 13 A. This is our primary e-mail system. 14 Q. So it's not anything nefarious, no gmail, no backdoor 15 throwaway e-mail, correct? 16 A. Correct. 17 Q. Okay. 18 A. He received a response from David. 19 Q. Uh-huh. 20 A. That said "completed." 21 Q. Okay. 22 e-mail -- by "him" I mean Mr. Schulte, correct? 23 A. Correct. 24 Q. He sends it to you. 25 A. Correct. And it's sent on which e-mail? I don't know how And what is the response? And let's just move up. And now he sends the Correct? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1804 K2J3SCH3 Karen - Cross 1 Q. Mike S., correct? 2 A. Yes. 3 Q. Susan? 4 A. Yes. 5 Q. And he says -- read it for us, would you. 6 A. He says, "Here is proof that I didn't deliberately talk to 7 a separate ISB member after initially being refused access to 8 the BK tool." 9 You want me to keep going? 10 "I sent ISB the request on 5/26 at 12:39 p.m., Dave 11 promptly responded at 1:04 p.m. saying he had completed the 12 action... then Tim responded at 1:15 p.m. requested branch 13 chief approval, at which point I had already been given access 14 to BK." 15 Q. 16 meeting? 17 A. That was in the -- which meeting? 18 Q. In your letter of warning meeting. 19 A. I think that was who was in the room, yes. 20 Q. He includes everyone, right? 21 A. I think so, yes. 22 Q. If we can just move up on that e-mail chain. 23 you an e-mail now? 24 A. 25 to Anthony. Does he leave out anybody on the cc that was in the Anthony sent an e-mail to -- oh. No. And who sends Mike sent an e-mail SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1805 K2J3SCH3 Karen - Cross 1 Q. Okay. And Mike is who? 2 A. Mike is my deputy. 3 Q. Right. 4 A. Correct. 5 Q. There's a lot of Mikes floating around. 6 A. Mike is my deputy, correct. 7 Q. And he says what? 8 A. He says, "Hmm. 9 is true." Okay. That's Mike S., right? This does indicate that what he is saying 10 Q. So that's your deputy. You rely on your deputy, 11 correct? 12 A. Correct. 13 Q. He is an honorable man, right, according to you? 14 A. Correct. 15 Q. Wouldn't get something wrong, correct? 16 A. He would be -- he would work very hard not to get anything 17 wrong. 18 Q. Right. 19 A. Yes? 20 Q. Tell me, what choice did you have in canceling that line? 21 A. Can you go -- what's the date on the letter of warning? 22 Q. What is the date? 23 A. Yes. 24 Q. 6/22/2016. 25 page over. And so, going back to the letter of warning. Take a look at the back of -- if you flip the There you go. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1806 K2J3SCH3 Karen - Cross 1 A. 6/22/2016. Okay. With that -- the discussion that we had 2 in the room, and getting that clarification, the right thing to 3 do was to edit the document. 4 Q. 5 have in taking that out. 6 A. Yes. 7 Q. It was inaccurate, correct? 8 A. Correct. 9 Q. There was no reason that you had to not scratch it out. 10 A. Correct. 11 Q. It wasn't to placate Mr. Schulte, correct? 12 A. It was to get the facts correct. 13 Q. Right. 14 Mr. Denton on direct, to try to be moderate, correct? 15 A. That's not correct. 16 Q. Really? 17 A. It was trying to listen and make sure that I took all that 18 feedback and input, and get his facts straight. 19 Q. Feedback? 20 A. That's part -- yes. 21 took it and made those edits. 22 Q. 23 statement a comment? That's not what I asked. I asked you what choice did you It was factually wrong, correct? In fact, it had nothing to do, as you told His comments, I listened to them, and Do you consider somebody correcting a factually inaccurate 24 THE COURT: 25 MS. SHROFF: Was that a question? Yes. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1807 K2J3SCH3 1 Karen - Cross THE COURT: Okay. Do your best to answer. 2 A. Yes, it is a comment. 3 Q. It is a comment according to you. 4 warning, correct? 5 A. Correct. 6 Q. You are going to put it in someone's personnel file, 7 correct? 8 A. Correct. 9 Q. It is going to remain there for a year, correct? 10 A. Correct. 11 Q. It's going to have repercussions for him, correct? 12 A. If there is no further problems, it would just take -- come 13 out of his file and that would be the end of it. 14 Q. 15 letter in his file, correct? 16 A. Correct. 17 Q. A person gets a letter of warning might quit their job, 18 correct? 19 A. I can't make that conclusion. 20 Q. I said "could." 21 A. It's possible. 22 Q. A person who gets that letter of warning could get 23 depressed, correct? 24 A. It's possible. 25 Q. Right. No. This is a letter of For a year there would be a repercussion of having a So, a factual inaccuracy, according to you, is SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1808 K2J3SCH3 Karen - Cross 1 simply a comment. 2 A. Yes. 3 Q. Okay. 4 changed on the same day, "You subsequently repeated the request 5 for administrative privileges to Brutal Kangaroo, this time in 6 person to a different ISB team member, and the change was 7 made." 8 9 Is that your testimony? Let's keep going. The next sentence that you Is that Mr. Schulte just commenting to you that, hey, my comment is, like, you know, this is wrong? 10 A. His comment was that it was wrong, so I took action and 11 modified the paragraph. 12 Q. And your position is that that's merely a comment, correct? 13 A. I'm not sure -- of your use of the word, but he's made a 14 statement, I acted on his statement. 15 Q. 16 meeting, correct? 17 A. Correct. 18 Q. He told you you were wrong, correct? 19 A. Correct. 20 Q. He told you that something was factually inaccurate in the 21 letter of warning, correct? 22 A. Correct. 23 Q. Then he went back to his desk, correct? 24 A. I don't know what he did after he left the room. 25 Q. Well, you do know at some point he fished out the e-mail Well, he didn't just make a statement. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 He came to the 1809 K2J3SCH3 Karen - Cross 1 and sent it to all of you to make sure you knew that he had 2 taken the issue seriously, correct? 3 A. Yes, he provided this information after the meeting. 4 Q. Right. 5 information to you, it was more than merely a comment, correct? 6 A. 7 made. 8 Q. 9 asterisks that you testified to before? And it was obviously, if he provided the It was still -- it was a comment. Okay. Let's turn to paragraph 4. It was a statement he You see the two 10 A. There is one on paragraph 4. 11 Q. Right, and one on paragraph 6, correct? 12 A. Yes. 13 Q. Right. 14 letter of warning is a serious document, right? 15 A. Yes. 16 Q. Did you write down why Mr. Schulte believed those 17 statements to be inaccurate? 18 A. Can we go to the bottom of the document? 19 Q. Sure. 20 A. No. 21 Q. 23 what. 24 25 And you testified, and I won't belabor this, that a MS. SHROFF: 22 Yes. You can take that down. You testified on direct that you disagreed -- you know I withdraw that. Let me ask you this: You spoke to the FBI about this case, correct? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1810 K2J3SCH3 Karen - Cross 1 A. Yes. 2 Q. Right. 3 Mr. Schulte's team wanted to speak with you? 4 A. Yes. 5 Q. Okay. 6 them, or no, I don't want to talk to them? 7 A. I said no, I don't want to talk to them. 8 Q. But you talked to the FBI, correct? 9 A. I did. 10 Q. And as part of your conversations with the FBI -- did they 11 take place at the CIA offices, by the way? 12 A. The meetings with the FBI? 13 Q. When you talked to the FBI, you discussed with them the 14 facts of this case, correct? 15 A. I told them everything that I knew. 16 Q. Right. 17 correct? 18 A. Correct. 19 Q. And there were some questions that you could not answer, 20 correct? 21 A. I don't recall, but that's probably true. 22 Q. And you directed them, did you not, and I can show you the 23 302 if you want, 3510-01. And were you ever told that the lawyers from Much later. And much later, did you say, yes, I will talk to Yes. And they asked you questions about Mr. Schulte, 24 MR. DENTON: Is there a question? 25 THE COURT: We'll building to it. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1811 K2J3SCH3 Karen - Cross 1 Q. You told them, did you not, in response to certain 2 questions that they had, that you couldn't answer them but that 3 maybe Anthony could. 4 A. 5 that's possible. 6 Q. Correct? I don't recall the specifics that you're referring to, but Let me see if I can refresh your recollection. 7 MS. SHROFF: 3510-01. 8 THE COURT: Thank you. 9 Q. If you could just take a look at the last page, that might 10 be quicker. 11 A. Okay. 12 Q. Okay? 13 could talk to, correct? 14 A. Where are you? 15 Q. The third paragraph from the bottom. 16 A. Yes. 17 Q. Okay. 18 A. Correct. 19 Q. And Anthony, correct? 20 A. Correct. 21 Q. And Sean F., correct? 22 A. Correct. 23 Q. And Mr. Weber, correct? 24 A. Correct. 25 Q. And to the FBI, you only described Mr. Weber, correct? You recommended a whole slew of people that the FBI And you suggested that they talk to Liz, correct? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1812 K2J3SCH3 Karen - Cross 1 A. Only described Mr. Weber? 2 Q. Right. 3 A. I don't recall. 4 Q. It's right there. 5 your recollection. 6 A. Okay. 7 Q. You didn't describe the positives of Liz, correct? 8 A. I did not discuss the managers, no. 9 Q. You did not discuss Anthony, correct? 10 A. Correct. 11 Q. And you did not discuss Sean F., correct? 12 A. Correct. 13 Q. But you did discuss Mr. Weber, correct? 14 A. Correct. 15 Q. And you described him as very strong technically -- not 16 "very," I take that back. 17 Take a look if the next line refreshes You said strong technically, correct? 18 A. Hmm-hmm. 19 Q. You described him as very mature, correct? 20 A. Correct. 21 Q. Then you said, and could provide the FBI with a good optic, 22 correct? 23 A. I don't remember the choice of words, but that's accurate. 24 Q. Okay. 25 A. Again, I don't remember the specific choice of words, but And by good optic, what did you mean? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1813 K2J3SCH3 Karen - Cross 1 my -- I knew that Jeremy had been working on the accesses and 2 setting up a lot of the control base and the structure of how 3 we were managing the code libraries, so he was hands on and 4 down in the details in a way that the management chain would 5 not be. 6 Q. 7 involved in an issue about access? Management chain? 8 You're saying that Sean F. would not be Isn't access the most important thing for the CIA? 9 A. He would certainly be involved. 10 Q. Right. 11 immediate boss, correct? 12 A. 13 code on the computer that Jeremy would have. 14 Q. He is the supervisor of Jeremy, correct? 15 A. Correct. 16 Q. He is the person in management, correct? 17 A. Correct. 18 Q. Mr. Weber is certainly not management, correct? 19 A. Correct. 20 Q. And you would want management involved in an issue of 21 access, correct? 22 A. I would -- 23 Q. Correct? 24 A. Yes. 25 Q. Okay. And he would be hands on because he is the He would not have the same amount of time in the actual Now let me direct your attention to January 13. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1814 K2J3SCH3 Karen - Cross 1 This is a little bit more recent for you. 2 A. January 13? 3 Q. 2020. 4 A. Okay. 5 Q. Did you recall meeting with the FBI then? 6 A. They were in the room, yes, I think. 7 Q. Do you recall telling them about Mr. Weber again, that in 8 your opinion, Mr. Weber was one of the go-to guys in OSB; 9 that's your opinion, correct? 10 A. I don't recall the statement at that time. But, that is 11 something I would say. 12 Q. Okay. 13 A. Like I said, I don't recall that exact statement. 14 Q. And do you recall singling Mr. Weber out as the only other 15 employee about whom you spoke positively? 16 A. I don't recall that. 17 Q. Do you recall telling the FBI that you considered Mr. Weber 18 to be a proactive employee, correct? 19 A. I have used those words to describe him in the past. 20 Q. Right. 21 team, correct? 22 A. Yes. 23 Q. Right. 24 the go-to people in OSB, correct? 25 A. And you told that to the FBI, correct? And he certainly was one of the people on your TAC And you told the FBI that you considered him one of That's true. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1815 K2J3SCH3 Karen - Cross 1 Q. Right. 2 A. Correct. 3 Q. Right. 4 talking about the developers, the only developer you singled 5 out to the FBI was Mr. Weber, correct? 6 A. I don't recall. 7 Q. Okay. 8 That's your opinion, correct? And isn't it fair to say that in describing or Well, let me show you 3510-11. (Pause) 9 A. Okay. 10 Q. Does that refresh your recollection at all? 11 A. Yes. 12 Q. Okay. 13 praise you sing to the FBI, correct? 14 A. He's the only officer mentioned here. 15 Q. And he's mentioned in a positive way, correct? 16 A. Correct. 17 Q. You describe him as I alluded to before, correct? 18 A. Correct. 19 Q. You can put that aside if you want. 20 And I'm correct, right? He's the only one whose Now, I'm not going to spend a lot of time on this. 21 remember with Mr. Denton talking about desk moves? 22 A. Yes. 23 Q. Right. 24 at the CIA? 25 A. Do you You said there was no such thing as an intern desk Correct. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1816 K2J3SCH3 Karen - Cross 1 Q. There are desks on which interns are seated, correct? 2 A. We have summer students. 3 Q. Right. 4 A. That will, when they're there for the summer, will sit in a 5 desk. 6 Q. 7 intern desk, right? 8 A. Well, there's no specific desk for that purpose. 9 Q. Of course not. Right. And that's generally what they refer to as the True that. But the question is when an 10 intern sits at a desk in an office, you would generally call 11 that the intern desk, right? 12 A. When they're sitting there. 13 Q. Only when they're sitting there? 14 A. Another time an officer can use that as their desk. 15 Q. But you just don't know, right? 16 A. Don't know what? 17 Q. That that's what happens. 18 desk is used or not used or left empty, correct? 19 A. 20 summer student. 21 Q. 22 was moved to that desk, people who walked by said to him, "Hey, 23 heard you got demoted to be an intern sitting on the intern 24 desk." 25 A. You don't know if the intern Any particular desk could be used for any officer or any Okay. Now, do you know at the time that when Mr. Schulte Did anybody tell you that? No. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1817 K2J3SCH3 Karen - Cross 1 Q. Okay. By the way, you talked about the timetable for the 2 move, correct? 3 A. Which timetable? 4 Q. For moving desks, right? 5 e-mails of Mr. Schulte asking for his desk move situation to be 6 put in writing, correct? 7 A. Yes. 8 Q. And you then sent out an e-mail or somebody sent out an 9 e-mail, I've forgotten who, saying these are the official desk For which move? You were shown all of those 10 moves, correct? 11 A. Yes. 12 Q. Before that e-mail was sent out, did anyone tell you that 13 there had been a confusion as to when Mr. Schulte was supposed 14 to be moved? 15 A. No. 16 Q. Do you recall at all finding out that on the dates of the 17 move, or the purported move, Mr. Sean F. was in and out of the 18 office? 19 A. No, I don't recall that. 20 Q. Do you recall being told that Sean F. had told Mr. Schulte 21 that he had to move, but that he had left the timetable open? 22 Do you recall that? 23 A. I don't recall that. 24 Q. Did Mr. Weber not tell you that? 25 A. I don't remember speaking with Mr. Weber about desk moves. I don't recall that. Do you recall that? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1818 K2J3SCH3 Karen - Cross 1 Q. Okay. And do you recall knowing or learning at any point 2 that because Mr. Sean F. had not set a date for Mr. Schulte, 3 there was no rush to move? 4 A. 5 discussion on the timetable. 6 Q. 7 right? 8 A. I did not know that firsthand. 9 Q. You didn't know that firsthand, that he didn't want to move I remember that they were told to move. Right. And everybody knew he didn't want to move anyway, 10 out of OSB? 11 A. I mean, you didn't know that? 12 about? 13 Q. 14 separation of the desks. This move was not out of OSB. Which move are we talking I'll get to the OSB move first. 15 I don't remember a Let's just talk about the You never heard that he didn't want to move desks? 16 A. I eventually did, yes. 17 Q. You eventually heard, right? 18 A. Yes. 19 Q. He didn't want to move, correct? 20 A. That was my understanding yes. 21 Q. He felt he had lodged a complaint, correct? 22 A. Thought he had lost what? 23 Q. Lodged a complaint, correct? 24 A. Complained about Amol? 25 Q. Yes. He had complained, correct? Is that what you are talking about? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1819 K2J3SCH3 Karen - Cross 1 A. Yes. 2 Q. Right. 3 was in the right, correct? 4 A. That was my understanding. 5 Q. Right. 6 correct? 7 A. That was my understanding. 8 Q. Right. 9 a date by which to move? And he didn't want to move because he thought he And he told people that I don't want to move, And then he said -- do you know if he was even told 10 A. I do not recall. 11 Q. Okay. 12 an e-mail sent about the move? 13 A. Yes, yes. 14 Q. And why was that e-mail sent, by the way? 15 A. Because the move -- the moves needed to happen. 16 hadn't been done. 17 Q. 18 asking you to put a move in an e-mail? 19 A. No. 20 Q. There's nothing wrong. 21 to me in a job, put it in writing. 22 right? 23 A. Correct. 24 Q. Even if you'd never seen that before in your career, it was 25 still fine to ask somebody to put something in writing. Okay. And did there come a time eventually when there was They We needed to make sure they were done. And tell me, is there something wrong with somebody There's nothing wrong. You want to do something official Nothing odd about that, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1820 K2J3SCH3 Karen - Cross 1 A. It was unusual, but fine. 2 Q. What's so unusual about asking someone to send you an 3 e-mail confirming something that is being done to you? 4 A. 5 their desk. 6 Q. 7 saying that is the only way he could move the desk. 8 something in writing, correct? 9 A. Right. 10 Q. Right. 11 asking you. 12 A. 13 e-mail was sent. 14 Q. 15 consensus amongst all of you that that was highly unusual, 16 correct? 17 A. I don't recall the specific conversation. 18 Q. Okay. 19 WikiLeaks leak, you did not engage with anyone at OSB, correct? 20 A. Correct. 21 Q. You didn't reach out to anyone, correct? 22 A. Correct. 23 Q. You were out of town at that time, correct? 24 A. I was out of town when the news hit. 25 Q. Right. Usually it doesn't take an e-mail to have somebody move Well, that's not what he was saying, right? What's so unusual about that? Just doesn't happen very often. Right. He wasn't He wanted That's what I'm But he asked for it, so an But the e-mail was only sent after there was a Is it fair to say that after you learned of the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1821 K2J3SCH3 Karen - Redirect 1 A. Correct. 2 Q. Right. 3 you, correct? 4 A. And then you just waited until somebody contacted Correct. 5 MS. SHROFF: 6 THE COURT: 7 MR. DENTON: 8 REDIRECT EXAMINATION 9 BY MR. DENTON: I have nothing further. Mr. Denton. Just very briefly, your Honor. 10 Q. 11 about a physical fight you learned about in the office? 12 A. Yes. 13 Q. You said something about learning about it while TMU had an 14 investigation ongoing; is that right? 15 A. Correct. 16 Q. Why was it significant that TMU had an investigation 17 ongoing? 18 A. 19 TMU in my career. 20 encountered it or anybody in my management team had 21 encountered. 22 more extreme actions. 23 or not to engage at that time. 24 25 Ma'am, do you remember Ms. Shroff asking you some questions Well, one, it's -- I never had an incident that involved So it was -- it was a first time I had It's very serious. It's, like I said, one of the And there are rules about how to engage So, we were doing our best to the figure out and how to handle all that. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1822 K2J3SCH3 Karen - Redirect 1 Q. Does TMU investigate concerns about physical violence with 2 respect to employees? 3 A. Yes, that's one of the things they look at. 4 Q. Would that include a fight in the office? 5 A. Yes, it would. 6 Q. Did you learn about the fight from the unit that 7 investigates that kind of thing? 8 A. 9 it as the management team was relaying information to me about No. I don't recall learning it from them. I heard about 10 that. 11 Q. 12 things like software licenses expiring and things like that? 13 Do you remember there was a whole series of questions? 14 A. Yes. 15 Q. Did the defendant ever e-mail you about issues like that? 16 A. I don't recall ever seeing an e-mail to me from Josh 17 regarding anything like that. 18 Q. 19 those kinds of issues? 20 A. No. 21 Q. Ever swing by your office to talk about them? 22 A. No. 23 Q. Ever raise a security concern with you in any form 24 whatsoever? 25 A. Do you remember Ms. Shroff asked you some questions about What about a phone call; did he ever call you to raise No. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1823 K2J3SCH3 Karen - Redirect 1 Q. I think you testified also about the access changes that 2 were part of this whole process; is that right? 3 A. Correct. 4 Q. Were those a security concern? 5 A. Yes. 6 Q. When you learned about that security concern, did you take 7 steps to increase security? 8 A. 9 acting division chief, Anthony, and we said, look, we need to 10 really take an assessment of what the situation is, and figure 11 out what we should do in order to make sure things are 12 tightened up and as controlled as we could make them. 13 Q. 14 they're raised to you? 15 A. Yes. We talked with -- I talked with my deputy, with the Is it fair to say you try to address security concerns when Yes, that would be accurate. 16 MR. DENTON: Ms. Hurst, can we put up Government 17 Exhibit 1094 for a moment, please. 18 Q. 19 questions about this here? 20 A. Yes. 21 Q. And the changes that you made at the bottom; is that right? 22 A. Yes. 23 Q. Was the only issue related to this the fact that the 24 defendant had requested access to the project? 25 A. Do you remember Ms. Shroff asked you a whole series of It's -- the policy and the approach for requesting access, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1824 K2J3SCH3 Karen - Redirect 1 and the approvals that needed to happen, if things were -- as I 2 understood them a little bit out of order. 3 already, you know, talked about this so much that, yes, it was 4 not consistent with what the directions had been. 5 MR. DENTON: And plus, we had So, if we can look at the next page, 6 Ms. Hurst, and put up paragraph 4. 7 Q. 8 you? 9 A. Yes. 10 Q. And she asked you some questions about it? 11 A. Yes. 12 Q. And do you see where it describes "You revoked the 13 administrative privileges of the EDG/AED/OSB officer assigned 14 responsibility for Brutal Kangaroo"? 15 A. Right. 16 Q. Do you remember Ms. Shroff showed you some e-mails that the 17 defendant had forwarded you? 18 A. Hmm-hmm. 19 Q. Did he ever show you an e-mail showing he was authorized to 20 do that? 21 A. Not to my knowledge or recollection. 22 Q. Is it a problem when one person revokes administrative 23 privileges for another officer? 24 A. 25 Do you remember Ms. Shroff blowing this paragraph up for Yes, if they don't have management direction to do so. MR. DENTON: No further questions, your Honor. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1825 K2J3SCH3 Roche - Direct 1 THE COURT: 2 (Witness excused) 3 THE COURT: 4 MR. DENTON: 5 Call the next witness. The government calls Sean Roche, your THE DEPUTY CLERK: THE WITNESS: 9 THE DEPUTY CLERK: 10 THE COURT: Sean Roche. Witness sworn. Please sit down, Mr. Roche. All right Mr. Denton. 12 13 Please state your name for the record. 8 11 Thank you. Honor. 6 7 You are excused. MR. DENTON: Thank you, your Honor. SEAN ROCHE, 14 called as a witness by the Government, 15 having been duly sworn, testified as follows: 16 DIRECT EXAMINATION 17 BY MR. DENTON: 18 Q. Good morning, sir. 19 A. Good morning. 20 Q. Are you currently employed? 21 A. I'm currently an independent contractor who advises, 22 consults, and does public speaking. 23 Q. About how long have you been doing that? 24 A. Since 31 October of 2019. 25 Q. Where did you work before that? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1826 K2J3SCH3 Roche - Direct 1 A. I worked at the Central Intelligence Agency. 2 Q. How long did you work for the Central Intelligence Agency? 3 A. More than 26 years. 4 Q. Generally speaking, did you work in any particular field or 5 specialty during your time at the CIA? 6 A. 7 and leadership of organizations that built collection systems 8 for covert and clandestine collection. 9 Q. Yes. I worked in the fields of project program management, Can you tell us some of the positions that you've held 10 during your career at the CIA. 11 A. 12 group manager managing an entire mission area, and then a 13 deputy office director that managed multiple missionaries, then 14 an office director, and then the deputy director of the 15 Directorate of Science and Technology, and then the deputy 16 director of the Directorate for Digital Innovation. 17 Q. What is the Directorate for Digital Innovation? 18 A. Directorate of Digital Innovation is one of five 19 directorates at the CIA. 20 Cyber Intelligence, that conducts cyber operations and cyber 21 intelligence gathering missions across the world. 22 responsible for CIA's worldwide secure communications, and IT 23 infrastructure -- information technology infrastructure that's 24 responsible for all of the open source collection worldwide, 25 and the curation of agency data. Yes. I was a division director, large program manager, It is composed of the Center for SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 It is 1827 K2J3SCH3 Roche - Direct 1 Q. When was the Directorate of Digital Innovation created? 2 A. It was announced on March 6 of 2015, and started to stand 3 up about two to three weeks later, and was formally open for 4 business on one October of 2019. 5 Q. Is that sometimes referred to as DDI? 6 A. Yes. 7 Q. Were you part of the process of standing up the Directorate 8 of Digital Innovation? 9 A. Yes, I was. 10 Q. Why was it created? 11 A. It was created to accelerate the agency's ability to bring 12 digital technologies into the agency, incorporate them into the 13 missions, to inform HUMINT operations, and as well as all sorts 14 analysis and covert action. 15 It was also brought in, it was also created to ensure 16 that the agency was aware of the challenges associated with 17 these digital technologies, to ensure that our operations were 18 secure. 19 Q. You referred to HUMINT operations. 20 A. Human intelligence operations are conducted by the agency 21 where officers from the agency overseas have contact with 22 foreign nationals to get information from them, to inform our 23 national security. 24 Q. What was your role in the creation of DDI? 25 A. I was appointed the first deputy director of the new What is HUMINT? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1828 K2J3SCH3 Roche - Direct 1 directorate. 2 Q. Was that your position in the spring of 2016? 3 A. Yes. 4 Q. In your capacity as the deputy director of DDI, did you 5 have occasion to interact with line officers within the 6 directorate? 7 A. On a constant basis. 8 Q. Tell us about that level of interaction. 9 A. I had the opportunity to speak to every incoming class of 10 new officers across the CIA for many years while I was in DDI. 11 We had forums in DDI, informal forum. 12 "breakfast with the bosses" where officers went by to sit down 13 with supervisors for two to three hours, and the supervisors 14 would bring breakfast, and they would talk to us about what 15 their experience was. 16 One was called I had a program personally that I was recognized for 17 to take the newest officers we had on trips, whether they were 18 domestic or overseas, we called these ride alongs. 19 a considerable amount of time in the field at some of our most 20 remote locations talking to officers about what we needed to do 21 for them and what their experience was at CIA. 22 Q. 23 and tell us if you recognize anyone who was a line officer in 24 the Directorate of Digital Innovation in the spring of 2016. 25 A. And I spent So, sir, I'd like to ask you to look around the courtroom Yes, I do. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1829 K2J3SCH3 Roche - Direct 1 Q. Who do you recognize? 2 A. I recognize a gentleman sitting at the back table with the 3 beard, Mr. Schulte. 4 Q. Have you met personally with the defendant? 5 A. Yes, I have. 6 Q. So, just before we get to that, on a day-to-day basis, what 7 was your duties and responsibilities as the deputy director of 8 DDI? 9 A. The type of responsibilities were resource allocation, and 10 that was personnel and budgets. 11 a new culture for a new directorate, working to design a new 12 pay system, a new recruiting system, a new promotion system. 13 All for these digital specialties that we needed. 14 A lot of time spent designing I would attend meetings at the White House frequently, 15 they were known as Deputies Councils. 16 West Wing. 17 They were held in the I would have frequent meetings with the leadership of 18 the agency, particularly the executive director, who is the 19 number three officer at the agency. 20 Q. 21 the deputy director of DDI, help orient us, where were you in 22 the hierarchy of the agency? 23 A. 24 director is number three. 25 director chief, Andrew Hallman, and myself were both basically You mentioned the number three officer in the agency. As There is the director, the deputy director, the executive The director chief, my boss is the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1830 K2J3SCH3 Roche - Direct 1 reporting to the executive director. 2 director that determined what our ratings were for the year, 3 our performance, whether or not we changed jobs or advanced, 4 etc. 5 Q. 6 defendant? 7 A. Yes. 8 Q. Had you had any interaction with him that you can recall 9 prior to that? 10 A. 11 It was the executive Did there come a time when you received an e-mail from the Not that I can recall. MR. DENTON: Ms. Hurst, can we put up Government 12 Exhibit 1093, please. If we can just blow up the addressing 13 information, please. 14 Q. Do you recognize this, sir? 15 A. Yes, I do. 16 Q. Who sent it? 17 A. Joshua Schulte. 18 Q. Who did he send it to? 19 A. He sent it to my direct supervisor, Andrew Hallman who was 20 the director of DDI, the executive director of the agency, 21 Meroe Park, and myself. 22 Q. What is the subject line? 23 A. "Resignation over retaliatory management." 24 Q. Let's take a look at some parts of this e-mail, sir. 25 can blow up the first two paragraphs. If we Just before we talk SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1831 K2J3SCH3 Roche - Direct 1 about some of the things that are said here, do you see in the 2 middle where the black box is where the defendant refers to "my 3 group chief Karen"? 4 A. Yes. 5 Q. Do you know who that refers to? 6 A. Yes, I do. 7 Q. Have you worked with Karen at the CIA before? 8 A. For more than 15 years. 9 Q. What is Karen like as a manager? 10 A. Karen is one of the most soft spoken, polite, congenial, 11 agreeable people that I've ever worked with at senior levels. 12 Q. 13 her wrath as described here? 14 A. Yes, very much. 15 Q. You see at the start of that paragraph, sir, where it says, 16 "Unfortunately, in 3/2016, an employee threatened to kill me 17 which resulted in my subsequent report to security and 18 escalation to TMU." 19 A. Yes, I do. 20 Q. Would you describe that as a serious incident? 21 A. Very serious. 22 Q. Have you worked with TMU in the past? 23 A. Extensively. 24 Q. What does TMU stand for? 25 A. TMU is part of our security team. Would it surprise you to learn that someone had incurred I can't imagine Karen having wrath. It's known as Threat SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1832 K2J3SCH3 Roche - Direct 1 Management Unit. 2 Q. What do they do? 3 A. They're called in any time we believe that there is any 4 possibility of an escalation that could lead to an employee 5 harming themselves, harming others, and they have expertise 6 working with other parts of the agency to immediately get on 7 the problem and do an assessment of what the situation is, and 8 they have authority to intervene and take necessary steps. 9 MR. DENTON: You can zoom out, Ms. Hurst. And if we 10 can go to the next page, and zoom in on the paragraph that 11 starts "the next week." 12 Q. Could you read that first sentence, sir. 13 A. "The next week I noticed my permissions as administrator 14 had been revoked entirely, and I was hit with a memorandum on 15 'self-granting previously revoked admin privileges on an agency 16 computer network,' which I have attached." 17 (Continued on next page) 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1833 K2jWsch4 Roche - Direct 1 BY MR. DENTON: 2 Q. Did you review that memorandum that he had attached? 3 A. Yes. 4 Q. What was your reaction to it? 5 A. My reaction to it was that this was a very serious breach 6 of agency rules. 7 referring to Edward Snowden, a traitor who is now in Russia, 8 any officer taking an action like this on an agency computer 9 system was a very, very serious red flag. In the post-Snowden environment, and that's 10 Q. Now, going down to the bottom of this blown-up section, do 11 you see where it says, "Karen used her royal pawn Weber to 12 execute her will of removing me from the OSB libraries, not 13 inform me and wait for me to logically add my permissions back 14 to a project I thought was still mine"? 15 A. Yes, I do. 16 Q. In your work in DDI, are access to permissions to projects 17 important? 18 A. Yes, they are. 19 Q. Why are they important? 20 A. They're important because they are part of a system that's 21 known as need to know and compartmentalization, the idea being 22 that with all of the different activities across the agency, 23 you would only want access to the people you know needed that 24 information, first and foremost; and then have the right 25 disposition and -- and ability to protect that information. Do you see that? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1834 K2jWsch4 1 Roche - Direct MR. DENTON: If we could zoom out here, Ms. Hurst, 2 please. And if we could go to, I think it's the next page, and 3 zoom in on the bottom five or six lines of the full paragraph. 4 Sorry. Above that. 5 No. Sorry. One more up. Thank you. 6 Q. Now, I don't want to go through all of this, but do you see 7 at the bottom where, in the last full line, the line, "I feel 8 wronged and continually mistreated by the system"? 9 A. Yes. 10 Q. What was your reaction to that? 11 A. My reaction was that this was something that I needed to 12 get with this officer right away. 13 This was, again, a very strong red flag. 14 that was disgruntled, an officer that was angry, and -- and 15 this was something -- this was a very, very strong statement 16 that demanded a response. 17 MR. DENTON: It was very concerning. It was an officer If you can zoom out and go back to the 18 first page, Ms. Hurst. 19 Q. 20 multipage emails from line officers in DDI? 21 A. No. 22 Q. As a general matter, what was your reaction to this email 23 as a whole? 24 A. 25 have an officer that is displaying, in a vitriolic message, Just as a general matter, was it typical for you to receive My reaction, immediate reaction, was we have a problem. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 We 1835 K2jWsch4 Roche - Direct 1 that, in my experience, contained a number of warning flags 2 that this officer was going to do something, and that this 3 officer was -- had a motivation that may include harming the 4 agency or harming agency personnel. 5 MR. DENTON: Ms. Hurst, if we could put up Government 6 Exhibit 1096, please, and just blow up the email at the top. 7 Q. Did you reply to the defendant's email, sir? 8 A. Yes. 9 Q. And what did you say? 10 A. I said: 11 with personnel. 12 have to the agency. Would you like to come see me tonight -- 13 about this tonight? I have a meeting with the director of the 14 CIA that will be over at 1745, and I will stay as long as it 15 takes. 16 certainly hope that you will. 17 the No. 1 issue on my plate. 18 I replied in less than five minutes. "Josh, I spend hours a day on issues associated It's one of the most important obligations I Please let me know if you would like to speak to me. The note: I This is important, and it is now Very respectfully, Sean." "There are no cc's," that meaning copies, "or 19 bcc," blind copies, "on this message." 20 Q. 21 plate, how many employees did you oversee in the directorate of 22 digital innovation? 23 A. The number of government employees was more than 3,000. 24 Q. Was the defendant's email something that you, in fact, took 25 seriously? When you say that this is now the No. 1 issue on your SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1836 K2jWsch4 Roche - Direct 1 A. Very seriously. 2 Q. Was it something that you believed should be addressed? 3 A. Yes. 4 MR. DENTON: 5 Exhibit 1097. 6 Q. 7 email, sir? 8 A. 9 next day. Ms. Hurst, if we could put up Government Were you the only person who replied to the defendant's No. My boss, Andrew Hallman, replied before meeting the 10 Q. And what did he say? 11 A. He said: 12 contrary, Sean and I spend most," italicized, "of our time on 13 personnel issues and I know Sean is in touch. 14 with him to discuss where we're at. 15 Q. 16 personnel issues, was that true? 17 A. Absolutely. 18 Q. Why were personnel issues such a focus for you? 19 A. In the end, it is people that deliver the mission of the 20 agency, we ask people to do sometimes incredibly difficult, 21 always challenging and most often in a very compressed time 22 frame, and so spending time with the workforce, developing ways 23 for the workforce to maximize their creativity and their 24 ability to deliver a mission is the obligation that senior 25 managers have. "Josh, just getting to my email, and to the I'll sit down Regards Andrew." Where he says that you and he spend most of your time on SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1837 K2jWsch4 Roche - Direct 1 And as I mentioned, there's a number of things we were 2 working on as a new directorate to establish a culture for 3 digital innovation and to establish a culture that accelerated 4 digital capability. 5 was being done. 6 We changed the way we hired people, how we paid them, how we 7 promoted them, how we moved them around, how we developed their 8 careers. 9 to work. 10 And there was an awful lot of work that We were changing -- we changed people's pay. So it was every day. MR. DENTON: It was the No. 1 thing we had Ms. Hurst, if we could go back to 1096 11 for a moment and again just blow up the top email. 12 Q. 13 him that day in response to his email? 14 A. No, he didn't. 15 Q. After you received this email, did you take any steps to 16 gather more information about what the defendant had claimed? 17 A. 18 human resources team to pull his agency biography. 19 parallel, I reached out to my direct reports in the CCI front 20 office. 21 email, and the tone, was tell me exactly where this person is. 22 Someone put eyes on him right now. 23 actions is he taking, was he going to take? 24 25 Did the defendant take you up on your offer to meet with Yes. I reached out to my front-office team to get with the And in The first question I had, given the nature of the Someone's very upset. What The team looked into his status on the agency computer that sent me this note and saw that he had logged off almost SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1838 K2jWsch4 Roche - Direct 1 immediately after sending it. I received communication back in 2 a short while later saying that people had confirmed he had 3 left the CCI building. 4 Q. 5 defendant to discuss the issues raised in his email? 6 A. 7 morning of 30 June at the CCI building. 8 Q. 9 other steps with regard to the defendant? Did there, in fact, come a time when you met with the Yes. I believe the date was 30 June, and it was in the And during the couple of days intervening, did you take any 10 A. Yes, I did. I asked my direct report at the CCI front 11 office to get background on what was happening with this 12 officer and had the officer, in fact, resigned -- was the 13 officer gone from the agency -- as we tried to arrange a time 14 to meet, and they gave me a briefing on several incidents of 15 concern, some of which are raised in the note that Mr. Schulte 16 sent me. 17 Q. 18 ever actually respond to you? 19 A. No. 20 Q. How did the meeting get arranged? 21 A. I believe, to the best of recollection, the CCI 22 front-office team worked with my scheduling team to arrange a 23 time, and, from memory, what happened was I was supposed to be 24 on leave, annual leave. 25 was headed overseas, but instead, we scheduled the meeting so Now, you say you were trying to arrange a meeting. Did he I was supposed to be on vacation. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I 1839 K2jWsch4 Roche - Direct 1 that I could meet with Mr. Schulte before I headed to the 2 airport to fly overseas. 3 Q. And was that a memorable meeting for you? 4 A. Yes, it was. 5 Q. Why was it memorable? 6 A. It was very memorable because I wanted to engage the 7 employee and find out had he, in fact, resigned; try and 8 de-escalate what I saw was a lot of anger and vitriol; 9 understand what was happening from his perspective, with just 10 him in the room and no one else, and go over some of these 11 points he had made and some of the issues that had arisen 12 during his time as an agency employee. 13 What I encountered was an employee that did not buy into 14 any part of any action that was his; that explained to me that 15 there were managers at all level that had conspired to deny him 16 the ability to work on what he wanted to work on; and that, he 17 explained to me that these people were terrible people; that 18 TMU had not done anything for him. 19 be extremely alerting, to the point where, afterwards, I spoke 20 to the deputy director of CCI and gave him some actions. 21 Q. 22 discuss issues pertaining to the defendant's report to TMU that 23 he wrote to you about? 24 A. Yes, I did. 25 Q. What did you talk about? And I found the meeting to Let's stay focused on the meeting for a moment. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Did you 1840 K2jWsch4 Roche - Direct 1 A. My recollection, the -- I had a discussion with him about 2 the TMU unit, which he described, his terms, he felt they were 3 not responsive to him. 4 threatened, and they just did -- didn't do enough for him. 5 I explained my experience, working with them over many 6 years, was that if they investigated and found a single shred 7 that indicated that there was behavior or someone who was going 8 to take an action against another officer, to harm them, even 9 threaten them, that they always took action in those cases. He felt that his life had been 10 And they took very prompt action and they had the authority to 11 do that. 12 which was very extensive, did not match what he said to me, 13 which was basically, Hey, I had a real problem here and they 14 didn't do anything and they didn't care. 15 Q. 16 multiple layers of management were conspiring against him. 17 that right? 18 A. 19 knew and had worked with, sometimes for years, some of those 20 managers. 21 experience. 22 which he could not provide an answer. 23 So I basically explained that my experience with TMU, I think you said you talked about the defendant saying that Yes. And he mentioned some of the managers by name. Is I And I explained to him -- Gee, that's not my I know these people. Why would they do this -- to I asked him about some of his behaviors. Did you change permissions? Did you do these 24 things? Did you -- there was a 25 thumb-drive incident, and he didn't have an explanation nor SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1841 K2jWsch4 Roche - Direct 1 really acknowledge that he had done them. 2 Q. 3 permissions? 4 A. 5 his -- he had -- his permissions had been changed, and when his 6 management explained to him, he went back in and changed his 7 permissions back to get access again, and they had issued a 8 letter of warning to him explaining how serious that was and 9 that that behavior is not acceptable. What did you mean when you say you asked him about On the system that he was working on, an agency network, 10 Q. Why was that something you discussed with him? 11 A. Because of how serious the nature of that is. 12 any system that holds agency data, agency tools, things that we 13 call sources and methods, is -- is -- it is very, very 14 important that we not have a doubt about what people have 15 access to and maintain the integrity and the protection of that 16 information. 17 Q. What did you discuss with him about his permission changes? 18 A. I said to him something to the effect of in the post-Edward 19 Snowden era, you don't do something like that. 20 draw attention that you certainly don't want. 21 serious, and you cannot be taking that kind of action. 22 Q. And how did he respond? 23 A. He talked a little bit about the project that he had been 24 working on and some new work that he had been given, and he was 25 not pleased with it. Activity on That's going to It's really But at one point, he stopped and he SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1842 K2jWsch4 Roche - Direct 1 looked at me and said, You know, I could get back on it if I 2 wanted to, something to -- that's not -- I won't say that's the 3 exact quote, but it's pretty darn close. 4 Q. 5 raising a security concern about the network? 6 A. 7 because, to me, it illustrated that after everything that had 8 happened, all the warnings, all of this formal process, that he 9 was determined to undermine the controls on the network. Now, when he said that, did you understand him to be No. What I, what I realized -- it was a striking comment 10 Q. 11 during your meeting with him? 12 A. 13 call a level-set conversation. 14 trying to work another place at the agency. 15 frustration with every level of management. 16 As a general matter, what was the defendant's demeanor like His demeanor was reasonable. He -- he -- we had what I'd I made some suggestions about He expressed great I talked about first-level managers and how they struggle 17 to sometimes learn what it is to manage, but what I didn't see 18 was, is there -- he asked about his chance for promotion. 19 said, Would this affect my chance for promotion? 20 most likely, although I told him -- I informed him, I don't 21 make your promotion decision. 22 do that. 23 Q. 24 promotion? 25 A. He I said yes, A panel, a panel by CCI, would Why did you think this would affect his chances for Because key criteria for promotion is judgment, judgment SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1843 K2jWsch4 Roche - Direct 1 ability to follow the agency rules and follow the directives we 2 have to protect the mission. 3 promoted, is having that judgment. 4 very poor judgment at the minimum. 5 Q. 6 your reaction to the defendant? 7 A. 8 lot of risk. 9 of different possibilities that had to be mitigated and That's an inviolate part of being And he had demonstrated a Again, stepping back, just at a general level, what was So, my reaction was that we -- I had to ensure -- I saw a I saw a lot of risk at a lot of levels and a lot 10 addressed accurately. It's my job to get in front of that risk 11 and try and understand and then mitigate it. 12 immediately afterwards with the deputy director of CCI and said 13 I believe you have somebody here who is going to do something 14 on the networks or is determined to do something to get back at 15 people or get back at the system. 16 monitored very, very closely. 17 said, We're on it. 18 Q. 19 with the defendant? 20 A. Not that I can ever recall, no. 21 Q. I'd like to go forward in time, sir, and ask you to think 22 about March 7, 2017. 23 A. Very well. 24 Q. Why do you remember that day very well? 25 A. I received a frantic call from the director of CCI, who was I took -- met And I said he needs to be And the deputy director of CCI We're -- exact quote, We're all over it. After that meeting, did you have any further interactions Do you remember that day? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1844 K2jWsch4 Roche - Direct 1 out of breath, and said something very big has happened. 2 Our -- our information is out in the public on WikiLeaks. 3 We're going to have to get over there and -- and get your full 4 brief. 5 morning. 6 Q. What do you mean by that? 7 A. Our capabilities were revealed, and hence, we were not able 8 to operate and our -- the capabilities we had been developing 9 for years that were now described in public were decimated. And the day very quickly -- and this happened in the It was the equivalent of a digital Pearl Harbor. 10 Our operations were immediately at risk, and we began 11 terminating operations; that is, operations that were enabled 12 with tools that were now described and out there and 13 capabilities that were described, information about operations 14 where we're providing streams of information. 15 undermined the relationships we had with other parts of the 16 government as well as with vital foreign partners, who had 17 often put themselves at risk to assist the agency. 18 our officers and our facilities, both domestically and 19 overseas, at risk. 20 Q. 21 take in the immediate aftermath of those disclosures to address 22 those concerns? 23 A. 24 we had to get a team together that did nothing but focus on 25 three things, in this priority order. It immediately And it put Just staying at a very general level, what steps did you A task force was formed. Because operations were involved In an emergency, and SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1845 K2jWsch4 Roche - Direct 1 that's what we had, it was operate, navigate, communicate, in 2 that order. 3 for all of these operations across the world and figure out how 4 to mitigate that risk, and most often, the vast, vast majority 5 we had to back out of those operations, shut them down and 6 create a situation where the agency's activities would not be 7 revealed, because we are a clandestine agency. 8 9 So the first job was to assess the risk posture The next part of that was to navigate across all the people affected. It was not just the CIA. There were equities for 10 other government agencies. 11 places and bases across the world, where we had relationships 12 with foreign partners. 13 and asking what do I do, what do I say? 14 There were, of course, equities at People heeded immediately, were calling And the third part of that was to communicate, which was -- 15 in the course of looking at this as a what systemic issues led 16 to the ability to have our information out there -- was to 17 document that and write a report that would serve as a lessons 18 learned with the idea of preventing it from ever happening 19 again. 20 Q. 21 referral in connection with the disclosure of that information? 22 A. Yes. 23 Q. And who was that referred to? 24 A. It was referred to the Department of Justice. 25 Q. What was the relationship between that criminal Did there come a time when the CIA made a formal criminal SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1846 K2jWsch4 Roche - Direct 1 investigation and the task force that you described? 2 A. 3 they were kept separate. 4 Again, it was operate, navigate, communicate. 5 investigate. Both were aware that those activities were going on, but They were kept separate and isolated. It was not to 6 Investigation needed to be kept separate, and from the 7 beginning, there were steps taken to make sure that it was the 8 Department of Justice that was handling anything that could 9 later serve as evidence, and that they would protect the 10 evidentiary chain; and that if there came a time to de-conflict 11 something, that the task force would talk to them before 12 possibly getting even near that line. 13 Q. 14 limited to evaluating CCI? 15 A. No. 16 Q. Generally speaking, what were they looking at? 17 A. They were looking at the systemic issues associated with 18 agency technology networks. 19 You talk about the work of the task force. Was their work No. The agency has two general classes of networks. One is the 20 agency's worldwide secured network that every employee has 21 access to, and then a much, much smaller subset of networks 22 that were created because the very special functions of them 23 could not run on the main network. 24 not been sanitized and quarantined and, therefore, contained 25 things like malware; or the information that would be held on a The information on them had SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1847 K2jWsch4 Roche - Direct 1 network was so extremely sensitive that -- and handled in a 2 different way than the work flow from the network that it 3 needed a mission network. 4 networks and to look at systemic issues associated with how 5 those networks were run, the data curation, etc. 6 Q. Did the task force make recommendations? 7 A. Yes, they did. 8 Q. Without getting into the specifics of what they were, what 9 was the standard those recommendations were trying to meet? So they were to look at all IT 10 A. 11 fast as possible, that we accelerate ensuring that all of the 12 mission networks got to what is, what was referred to by the 13 White House as the gold standard for audit on the systems; the 14 ability to understand what people were doing on the systems and 15 to get ahead of behaviors that might indicate someone was 16 taking nefarious action on any IT agency platform. 17 So, the agency -- the main standard was to ensure that as Those capabilities are in place for the large, worldwide 18 network that everyone has access to. The much smaller 19 footprint of mission networks represents very unique problems 20 in each one of those mission networks, and the main part of the 21 task force was that that work needed to be accelerated across 22 the board. 23 Q. And remind me, sir, when did you leave the CIA? 24 A. October 31, 2019. 25 Q. At that time were you still dealing with issues resulting SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1848 K2jWsch4 1 from the Vault 7 disclosures? 2 A. Yes. 3 MR. DENTON: 4 THE COURT: 5 MS. SHROFF: 6 No further questions, your Honor. Ms. Shroff. Your Honor, I need a sidebar before I can cross. 7 THE COURT: 8 MS. SHROFF: 9 (Continued on next page) All right. Thank you. 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1849 K2jWsch4 1 (At sidebar) 2 THE COURT: 3 MS. SHROFF: Yes. Your Honor, look, I don't take great 4 notes, but Mr. Denton has elicited from him what a HUMINT is. 5 He talked about what line officers do. 6 ride-alongs and the work he does in remote locations. 7 now testified about the WikiLeaks task force report, their 8 recommendations. 9 the repercussions of the leaks involved foreign nations calling He talked about He has He's testified about clandestine efforts, how 10 him. He's talked about how foreign officers were at risk. 11 yesterday, the Court ruled that I couldn't even ask the witness 12 if, because of the leak, the foreign office itself had to be 13 shut down, moved or in any way curtailed. 14 THE COURT: 15 MS. SHROFF: And Right? Where is this going? Either strike his testimony or allow me 16 to cross. But to have them just elicit all of this stuff and 17 say it's at a high level, high level and I can't get to cross 18 seems to be rather wrong here. 19 THE COURT: 20 haven't even started cross. 21 22 23 24 25 MS. SHROFF: I don't know. Has there been an objection on cross? You Well, I know, but yesterday when I tried to cross on the foreign offices -THE COURT: If he testified to it on direct, you can cross on it. MS. SHROFF: Well, yesterday they objected and you SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1850 K2jWsch4 1 sustained the objection. 2 Court had already ruled on, and I think this is improper. 3 elicited this. 4 THE COURT: 5 MR. DENTON: I just don't want to do what the They Mr. Denton. I think it's clear, your Honor, he did 6 not testify about the specifics of operations or where these 7 bases were located. 8 operations existed, that there were foreign bases. 9 wants to cross-examine him about that, that's fine. He testified about the concept, that the 10 MS. SHROFF: What concepts? 11 Is there a foreign location? 12 That's improper. 13 information about HUMINT. If she What I can cross-examine? He knows it's improper. He elicited He didn't need to do that. 14 MR. DENTON: I asked him to define the term. 15 MS. SHROFF: Why? It's a term that I can't cross on. 16 It's a term that I can't cross on. I can't cross on the 17 foreign repercussions. 18 the way, are there other issues that the CIA has to have dealt 19 with when your biggest problem is that you did this to friendly 20 nations? 21 problem was that you got caught doing this to friendly nations. 22 This is all proper cross because he brought it out at a high 23 level. I can't, for example, ask this man, By Your problem wasn't that there was a leak. 24 THE COURT: 25 MS. SHROFF: Your Mr. Denton. He can move to strike if he wants. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I'll 1851 K2jWsch4 1 give him that option. 2 MR. DENTON: I didn't ask any of those questions, your 4 MS. SHROFF: Yes, but I need to ask them. 5 THE COURT: 6 MS. SHROFF: 3 Honor. I don't know about that. Why? How else am I going to show that 7 the foreign nations were upset with the CIA for a thousand 8 different things; that this leak was no more harmful than any 9 of the other leaks that the CIA has been caught with? 10 11 not able to show that? Why am I He elicited it. Look, they can take a break. They can go back and 12 move to strike, but I think to leave me in this position of not 13 crossing this man is improper. 14 15 THE COURT: I suggest you start cross-examination, and we'll see where the objections go. 16 MS. SHROFF: OK. 17 (Continued on next page) 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1852 K2jWsch4 1 Roche - Cross (In open court) 2 CROSS-EXAMINATION 3 BY MS. SHROFF: 4 Q. Good afternoon, sir. 5 A. Good afternoon. 6 Q. Sir, is it fair to say that one of the repercussions of 7 this leak was that friendly nations that had been the subject 8 of CIA intervention, siphoning of data and theft of their 9 information, were upset with the CIA? 10 A. That's not my experience, no, ma'am. 11 Q. What do you mean by that's not your experience? 12 A. Ma'am, if I understand the question, you said friendly 13 nations were upset over these releases that the CIA was 14 siphoning their data. 15 Q. Right. 16 A. In my experience, as the deputy director of DDI and senior 17 staff officer who had to speak to many nations about this, I 18 would offer the concern was cooperating foreign partners were 19 concerned that their helping us would be revealed. 20 aware, ma'am, of any country -- and I'm not sure what the 21 definition of a friendly country is -- but I'm -- I'm not aware 22 of any country that approached CIA or approached CCI or our 23 officers and expressed that concern for this leak. 24 Q. OK. 25 A. Yes, ma'am. Let me try it again. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 But I'm not 1853 K2jWsch4 Roche - Cross 1 Q. Do you know what a friendly nation is? 2 A. Ma'am, there -- we have -- I would define friendly nation 3 as ones that help facilitate the collection and sharing of 4 information in a way that matches our mission pace. 5 wide spectrum of longstanding partners that we have that work 6 with us very well and other partners that would only work on 7 selected issues and other partners that won't work with us at 8 all and everywhere in between. 9 friendly nation would be our commonwealth partners. OK. Let me try it again. There is a So I would -- an example of a 10 Q. A friendly nation is a nation 11 that believes that working with the United States is fine, at a 12 simple level. 13 A. 14 intelligence matters. 15 Q. 16 trial. 17 intelligence, right? 18 A. Yes, ma'am. 19 Q. OK. 20 A. Yes, ma'am. 21 Q. And the nations with which you share intelligence in a 22 friendly manner is what the CIA calls the friendly nations, 23 right? 24 A. 25 this discussion, I understand. Is that accurate? Ma'am, I would amend that to say it has to be on Right. I'm only -- we're all about intelligence at this Nothing else. I mean, it's the CIA. Only We're not talking about anything else. So you share intelligence, correct? That's not a term that we use, ma'am, but for purposes of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1854 K2jWsch4 OK. Roche - Cross 1 Q. And is it fair to say that the CIA uses covert means 2 to extract data from friendly nations? 3 MR. DENTON: 4 THE COURT: Objection. Overruled. 5 A. Uh -- 6 Q. You know, just a very simple yes or no would be fine. 7 A. As pertains to this leak -- 8 Q. No, no. 9 THE COURT: 10 Read the question back, please. (Record read) 11 A. The CIA collects publicly available information from all 12 over the world. 13 what do you mean by covert means? 14 Q. 15 read Angela Merkel's emails, are you reading it in the 16 newspaper? I would, ma'am, may I ask your definition, Well, let me put it to you this way. 17 MR. DENTON: 18 THE COURT: When you're trying to Objection. Sustained. 19 Q. Do you recall a time when the CIA covertly tried to read 20 Angela Merkel's emails? 21 MR. DENTON: 22 THE COURT: 23 MS. SHROFF: 24 Q. OK. 25 a friendly nation? Objection. Sustained. Your Honor -- Let me try it this way. Do you consider Germany to be SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1855 K2jWsch4 Roche - Cross 1 A. 2 We're not at war with Germany. 3 Q. 4 friendly nation? 5 A. 6 Germany. 7 Q. 8 does the CIA still use covert methods to gain intelligence from 9 Germany? I know that we don't consider Germany to be an adversary. OK. So Germany is not an adversary nation, but it's not a We have -- the United States has a good relationship with OK. And as part of these good relationships with Germany, 10 MR. DENTON: 11 THE COURT: 12 MS. SHROFF: Objection. Sustained. Your Honor, this was all part of their 13 direct. 14 lunch break at this point. 15 16 If you want to take a lunch break, I'm happy to take a THE COURT: I think we'll take our luncheon recess now. 17 MS. SHROFF: 18 THE COURT: 19 You can step down, Mr. Roche. 20 (Continued on next page) Thank you. And resume at 1:30. Let the jury go out. 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1856 K2jWsch4 Roche - Cross 1 (Jury not present) 2 THE COURT: 3 (Witness not present) 4 THE COURT: Please be seated. 5 All right. Ms. Shroff. 6 MS. SHROFF: OK. You're excused. Thank you. Your Honor, this witness testified on 7 direct about all the harm that came to the United States 8 because the information was leaked. 9 that destroyed relationships between foreign countries. He talked about the harm He 10 talked about the harm with nations. He talked about the harm 11 with people and agents in remote locations. 12 although Mr. Denton kept prefacing his questioning with "at a 13 high level," all of that information is now before the jury. 14 This is information -- obviously, the government is He testified, and 15 going to argue at summation -- that hurt the United States, No. 16 1. 17 exactly what the harm came from because the harm doesn't flow 18 just from what the government says it flows from. 19 proper cross-examination. And also, it goes to harm. I should be allowed to explore And it's 20 If the government thinks that this level of 21 cross-examination is improper and they only should be allowed 22 to elicit facts that go to harm and the second table should 23 just sit in silence, then that's, I think, unfair to 24 Mr. Schulte SSH. 25 through -- I don't have his direct in front of me, because I On a very basic level, let's just go SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1857 K2jWsch4 1 Roche - Cross don't have the transcript, but I tried to take good notes. 2 He talked about the harm to the foreign offices, how 3 the foreign offices were down. 4 stand also testified about foreign offices. 5 to cross on whether there was, in fact, any harm to the foreign 6 office. 7 able to cross for reasons that are clear at the sidebar, and I 8 disagreed. 9 or is that not even allowed? 10 13 14 I was not allowed The government objected and said that I should not be But may I even now put my objection in open court, I don't even know if I can put my objection in open court. 11 12 Yesterday, the witness on the THE COURT: I thought you were putting your objections now. MS. SHROFF: No. I haven't told you why I feel -- they said it at sidebar. 15 MR. DENTON: Mr. Denton. 16 MS. SHROFF: That transcript wasn't released to me 17 yesterday. 18 THE COURT: 19 MR. DENTON: All right. Your Honor, the problem with what Ms. 20 Shroff said at the sidebar was that what she wanted to elicit 21 was classified information about the location of the CIA 22 facility. 23 MS. SHROFF: 24 All I was seeking to elicit -- 25 THE COURT: That's not what I was seeking to elicit. I thought she was trying to elicit the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1858 K2jWsch4 1 Roche - Cross fact that the location had to move. 2 MS. SHROFF: Exactly. That they had to take no steps. 3 Listen, if there was a bomb threat to the Federal 4 Defenders office, we might actually move or we may not move. 5 Right? 6 They're saying there was a threat. 7 worried about something, and I'm not allowed to cross about 8 whether or not they did anything in reaction to the threat? The response to the threat needs to be relevant. 9 MR. DENTON: They're saying they were First of all, your Honor, to the extent 10 that Ms. Shroff is asking about the effect of the Vault 7 11 leaks, she did ask Mr. Roche that; she didn't get the answer 12 she wanted and so she started asking about Angela Merkel and 13 Germany totally out of context. 14 15 MS. SHROFF: context. It's not out of context. There is a The context -- 16 THE COURT: 17 Go ahead. 18 MR. DENTON: One at a time, please. He was not asked about particular 19 operations, particular countries. 20 conversations he had in particular. 21 particular details about the specifics of what was going on. 22 What he talked about were, at a general level, facts that are 23 not classified. 24 25 I didn't ask him about any We didn't get into Ms. Shroff, as she tried to do in her CIPA filings and the Court rejected, wants to get into the details of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1859 K2jWsch4 Roche - Cross 1 operations, get into details of foreign relations, get into 2 matters that are classified. 3 MS. SHROFF: Let me ask you something. 4 MR. DENTON: Yes, ma'am. 5 MS. SHROFF: OK. Those are not relevant. Are you done? You know how they got it at a high 6 level? Because they don't want to elicit anything on cross. 7 It's a very clever tactic, and that's what I'm calling out. 8 What I'm saying to the Court is, please, if I may, all I'm 9 saying to you is this, if you elicit facts at a high level, I'm 10 allowed to cross at any level to show that those facts don't 11 lead to an element of the offense. 12 the leaks did not cause the kind of harm that they're talking 13 about. 14 West and I want to show there was no harm to the Foreign Office 15 West. 16 didn't shut down. Foreign Office West didn't have anything 17 wrong done to it. I'm allowed to show that. 18 says he did the direct at a high level and I'm going at a low 19 level, that doesn't make my cross inappropriate. 20 them the option -- you can move to withdraw those facts and not 21 sum up. 22 withdraw, but I don't think it's proper and constitutional to 23 elicit facts at a high level and then say to the defense 24 lawyer, Well, you simply can't cross because it's classified. 25 I'm allowed to show that They want to talk about the harm to the Foreign Office Foreign Office West didn't move. Foreign Office West Just because he I am giving If this is so classified for them, they can move to THE COURT: Mr. Denton. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1860 K2jWsch4 1 Roche - Cross MR. DENTON: Judge, we had days of CIPA proceedings on 2 precisely this point, that the level of generality is 3 significant to the question of what is classified and what's 4 national security. 5 Shroff is now trying to say that because the government stayed 6 within the boundaries of what the Court said was acceptable she 7 should get to completely change the game. 8 9 The Court has already ruled on that. MS. SHROFF: in that manner. Ms. No, the Court didn't rule on this issue That's clearly incorrect. I don't have 10 anything from a classified point of view about Angela Merkel. 11 Anything I know about Angela Merkel, trust me, comes from 12 nothing more than either talking to Mr. Zas or reading a 13 newspaper. 14 given us any information. 15 repeatedly asked. 16 asked for documents related to damages. 17 these documents in discovery repeatedly. 18 thing. 19 20 21 That is all I know. The government has never once We have repeatedly asked -- We asked for documents related to harm. THE COURT: We We asked for all of They never gave us a In your view, Mr. Denton, what can the defense ask? MR. DENTON: I think she's entitled to ask questions, 22 as any defense lawyer is, about the testimony that was elicited 23 on direct examination. 24 whether it was true that it had an effect on their dealings 25 with foreign countries, she's entitled to do that, but she's If she wants to ask questions about SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1861 K2jWsch4 Roche - Cross 1 not entitled to spin a hypothetical that's going to ask whether 2 certain operations were, in fact, conducted or not, none of 3 which was part of the direct. 4 MS. SHROFF: What spin? 5 spinning an operation. 6 cross? 7 8 THE COURT: What operations? I'm asking him. I'm not How can I possibly What about the Angela Merkel situation, because there was publicity about that? 9 MR. DENTON: First of all, and as we've discussed many 10 times, your Honor, whether or not there's publicity doesn't 11 change the classification on something, but more specifically, 12 it has nothing to do with this case. 13 14 15 16 17 MS. SHROFF: It does. It does have something to do with it. THE COURT: Ms. Shroff, you've got to stop. You can't interrupt. MR. DENTON: If the question is whether there was harm 18 for the Vault 7 leaks, which, first of all, the question for 19 the jury is going to be whether the defendant should have known 20 that there was harm from it, not whether, objectively, Ms. 21 Shroff can prove that there wasn't harm from it. 22 before the witness pertained only to that, and so going into 23 what other operations may have been conducted at some other 24 time in history with respect to some other country by some 25 other part of the CIA or some other part of the U.S. government SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 The questions 1862 K2jWsch4 Roche - Cross 1 has no bearing whatsoever on whether the defendant should have 2 known that the Vault 7 leaks that he disclosed would be harmful 3 to the United States. 4 MS. SHROFF: You know what? The Court should strike 5 all of that testimony, have Mr. Denton ask this witness, Should 6 Mr. Schulte have known that release of Vault 7 would harm the 7 United States, whatever answer Mr. Roche gives, I will have no 8 cross on that. 9 But that is not what he did. Had he done that, your Honor, I would not be seeking 10 to cross on Angela Merkel or harm. 11 Mr. Denton can still fix that narrative. 12 do is to agree to strike that testimony, ask the question that 13 he now clearly is telling the Court is the only relevant 14 question, put it to the witness, and we're done. 15 have a shorter cross. 16 MR. DENTON: He set the narrative, and All Mr. Denton has to And you'll Your Honor, that's obviously not 17 necessary. Also, the question I asked him was simply what 18 happened when the leak happened, which is entirely proper for a 19 trial about a crime. 20 MS. SHROFF: I'm sorry. Am I missing something? 21 Mr. Denton said the only thing that's relevant is whether or 22 not Mr. Schulte knew that there was harm caused by the Vault 7 23 leak. 24 strike. 25 actually relevant to this case, and then there is no need for Nothing in his direct went to that point. Strike all of that. Move to He can reask the question that is SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1863 K2jWsch4 1 Roche - Cross this argument anymore. 2 THE COURT: All right. I think, Ms. Shroff, you're 3 going to have to continue with your questions. 4 Mr. Denton's objections as you go along, and I'll rule on them. 5 I think that Mr. Roche testified at a very high level, and 6 there is room there for you to cross-examine. 7 get down into the details, Mr. Denton will make his objections, 8 and I'll rule on them as they come across. 9 10 MS. SHROFF: 13 14 If you want to Or Mr. Denton could at least move to strike and then ask the only relevant question. 11 12 OK. I'll listen to THE COURT: things. Mr. Denton can probably do a lot of It's up to Mr. Denton. MS. SHROFF: Well, I encourage Mr. Denton to think about my proposal. 15 THE COURT: All right. 16 (Luncheon recess) We're done. 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 See you at 1:30. 1864 K2J3SCH5 1 AFTERNOON SESSION 2 1:30 p.m. 3 (In open court; jury not present) 4 THE COURT: 5 Some scheduling matters first. Ms. Shroff, you want to be finished by 3? 6 MS. SHROFF: I do, your Honor, because I did tell 7 Dr. Bellovin to actually cancel his class at Columbia and come 8 and meet Mr. Schulte at 3. 9 THE COURT: 10 MS. SHROFF: 11 THE COURT: 12 Tomorrow one of the jurors has a court appointment, 13 I even have an e-mail to prove it. I'll take your word for it. and so we'll be starting at 11:30 tomorrow. 14 15 Okay. Ms. Shroff, you'd do much better in your questions if you'd confine yourself to what Mr. Roche said on direct. 16 MS. SHROFF: 17 THE COURT: 18 MS. SHROFF: 19 THE COURT: 20 MS. SHROFF: I was trying to. He didn't say a word about Angela Merkel. That's right. He didn't. Confine yourself to the direct. But the problem, your Honor, is the 21 direct was purposely at a high level. 22 robbery. Think about it as a If there is a robbery -- 23 THE COURT: 24 MS. SHROFF: 25 Right -- I don't need an analogy. But the analogy, if I could just put it on the record for a minute. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1865 K2J3SCH5 1 THE COURT: 2 MS. SHROFF: Yes. If you want to prove that's not how the 3 robbery happened, you cross on the details. 4 trying to do, cross on the details. 5 somebody's just making something up. 6 7 THE COURT: 10 That's how you show If you confine yourself to the direct and explore that, you won't have a problem. 8 9 That's all I'm Call in the jury. Mr. Roche, too, please. David. (Continued on next page) 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 All right, 1866 K2J3SCH5 Roche - Cross 1 (Jury present) 2 THE COURT: 3 going to break at 3 o'clock. 4 jurors has a court appointment tomorrow, so we'll resume 5 tomorrow morning at 11:30. 6 and 11:30 we'll resume tomorrow. Before we start this afternoon, we're And I understand one of the So 3 o'clock we're going to break 7 All right, Ms. Shroff. 8 MS. SHROFF: 9 Thank you, your Honor. BY MS. SHROFF: 10 Q. 11 over. 12 Sir, let me just ask you about -- could you let me start Tell me how to properly pronounce your name. 13 A. My last name is pronounced "Roche." 14 Q. Okay. 15 Exhibit 1093, please. 16 A. Yes, ma'am. 17 Q. And it's fair to say, right, that you received this 18 document via e-mail, you received this e-mail with attachments, 19 correct? 20 A. Yes, that's correct. 21 Q. And if you could just keep your voice up because I have a 22 hard time hearing, and then I think you're finished and then I 23 interrupt you. 24 A. Yes, ma'am. 25 Q. Thank you. Mr. Roche, if I could have you take a look at So keep your voice up. Was it the first time that you had heard of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1867 K2J3SCH5 Roche - Cross 1 Mr. Schulte when you got this e-mail? 2 A. Yes. 3 Q. And before you got this e-mail, you had not had any 4 conversation with Karen about Mr. Schulte, correct? 5 A. No, ma'am. 6 Q. And you had not had any conversations with anyone else, 7 because this is the first time you heard of him, correct? 8 A. 9 large meeting I was in. Yes, to the best of my recollection. Again, no direct. 10 Q. 11 you remember where you were? 12 A. Yes. 13 Q. Where were you, sir? 14 A. I was sitting at my desk at CIA headquarters. 15 Q. You were in your office when you got the e-mail? 16 A. Yes, ma'am. 17 Q. And when you got this e-mail, you see that he has copied 18 three people on -- is it three people on it, correct? 19 A. That's correct. 20 Q. And before you replied, and I think your reply was marked 21 as 1096, right. 22 it pulled up. 23 That's fine. Unless he was in a And when you got this e-mail, do you know, do Do you have the hard copy there or do you need Take a look at Government Exhibit 1096, right? 24 A. Yes, now I have it. 25 Q. Correct? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1868 K2J3SCH5 Roche - Cross 1 A. Yes. 2 Q. When you reply, before you reply, do you talk to this 3 individual named Andrew Hallman? 4 A. 5 office in a meeting or an appointment. 6 tag up later at night. 7 6:30 at night I spoke to Andrew and said, hey, there is 8 something going on, let me go through the issues with you. 9 This was one of them. No. To the best of my recollection, Andrew was out of the Andrew and I usually My recollection is that around maybe 10 Q. So your testimony is that you spoke to Mr. Hallman before 11 you replied to this e-mail, correct? 12 A. No, ma'am. 13 Q. You did not? 14 A. No, ma'am. 15 Q. So you just replied to the e-mail, even though the e-mail 16 is to Mr. Hallman, and you are copied, right? 17 A. That's correct. 18 Q. Okay. 19 much. 20 come, let's have a conversation, correct? 21 A. Yes, basically. 22 Q. Right. 23 to your invitation to meet, right? You basically say, look, this is part of my job, and 24 25 And your e-mail states, and I won't belabor it too And you figure out that Mr. Schulte has not replied He doesn't reply, you testified on direct, correct? A. Yes. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1869 K2J3SCH5 Roche - Cross 1 Q. And then you learn that he doesn't reply because he's 2 logged off the system and left for the day; is that correct? 3 A. 4 with a phone call trying to reach him by phone. 5 Q. 6 that you figured out he left for the day or because you looked 7 at the system and saw he had logged out? 8 A. 9 call, there was no answer. That is correct. Okay. I sent this e-mail and then followed it So is it because you couldn't reach him by phone Ma'am, I tried to get his contact information. Made a So I called my counterpart, my 10 colleague, my direct report in CCI front office and said I need 11 you to go find where this employee is right now, and the system 12 will indicate if an employee is logged on or logged off. 13 I received information back, that the -- Mr. Schulte 14 had logged off. 15 explained that he had said he had left for the day. 16 work spaces for the day. 17 Q. 18 badge records, right? 19 A. I personally did not look at his badge records. 20 Q. Right. 21 you would have known just by looking at his badge records that 22 he had left for the day, correct? 23 A. Well, ma'am, the people that I call -- 24 Q. I just wanted to know if you could have just looked at his 25 badge records? Okay. And that his work team and work unit had Left the Well, you would know that just from looking at his But any one of the people that you had working for SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1870 K2J3SCH5 Roche - Cross 1 A. No, I could not have. The people that work for me in CCI 2 front office do not have access to badge records nor do I. 3 Q. 4 that would tell you where an employee was? 5 A. 6 have to make a request to the office of security. 7 Q. Right. 8 A. No, ma'am, I didn't. 9 Q. So, you found out by some other means that Mr. Schulte had So you're saying that you had no access to badge records The office of security has access to badge records. And my question is did you make that request? 10 left the building for the day, correct? 11 A. 12 left for the day. 13 in the work spaces in the CCI building. He had left his work spaces they said. 14 You He appears to have But he was not where anybody could find him Their conclusion was that he had left for the day 15 because he was logged off and because he was no longer in the 16 work spaces. 17 Q. When you say work space, do you just mean the office? 18 A. His office, yes, ma'am. 19 Q. Right. 20 the day? 21 A. Yes. 22 Q. Okay. 23 the next day. 24 A. 25 front office that schedule meetings, special assistants and So like a general office. He left the office for And when you learned that, you tried to reach him Is that your testimony? I asked for a meeting to be arranged. I have people in my SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1871 K2J3SCH5 Roche - Cross 1 executive assistants, and I told the CCI front office that I 2 wanted a meeting arranged with him. 3 Q. 4 you and Mr. Schulte? 5 A. That is correct. 6 Q. And then there came a time when somebody set up the meeting 7 between you and Mr. Schulte, correct? 8 A. 9 30th of June. So you directed somebody else to set up a meeting between Yes. It was not too long after, I believe, again, on the This was sent on the 28th. 10 Q. June -- is it 28 or 26? 11 A. It was sent on the 28th, ma'am, in the afternoon. 12 recollection is meeting with him in CCI spaces on the 30th. 13 Q. 14 administrative assistants scheduled the meeting for you, for 15 the 30th, Mr. Schulte showed up, correct? 16 A. Yes, ma'am. 17 Q. And when he showed up you said you thought his demeanor was 18 normal. 19 A. Yes. 20 Q. Conversational demeanor. 21 it is Mr. Schulte who sent you the memo of warning that he had 22 been given, correct? 23 A. That is correct. 24 Q. And it's also fair to say did he also send you the letter 25 of warning? Okay. Then my So, when you scheduled -- not you, but your Was his demeanor normal to you? It was not -- it was a conversational demeanor. And it's fair to say, right, that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1872 K2J3SCH5 Roche - Cross 1 A. Yes, the attachments. 2 Q. Okay. 3 see on 1096 where it says on top it says very/respectfully 4 Sean, correct? 5 A. Yes, ma'am. 6 Q. And then it says N? 7 A. Yes. 8 Q. There are no cc's or bcc's on this message, correct? 9 A. Yes, correct. 10 Q. What does that mean? 11 A. So, in the system it is possible to take someone's note and 12 blind copy other people, and I wrote there are no cc's or bcc's 13 on this message. 14 note, there is a cc to Meroe Park. 15 to him -- 16 Q. 17 what it does say. 18 A. 19 message. 20 Q. That's inaccurate, right? 21 A. That's inaccurate. 22 Q. There is in fact a cc on it? 23 A. There is a copy, yes. 24 Q. In fact, you don't know if there is a bcc because we 25 wouldn't see the bcc? And let me just make sure I get this correctly. You I, in responding back to the way he sent the But this was trying to say I didn't ask what it is trying to say. I just asked you It says N, for note, there are no cc's or bcc's on this SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1873 K2J3SCH5 Roche - Cross 1 A. I know there wasn't a bcc. 2 Q. I'm asking you to take a look at the document. 3 A. I'm looking at the document, ma'am. 4 Q. Right. 5 A. Documents don't show bcc. 6 Q. So that statement that you are telling Mr. Schulte, the man 7 with whom you want to build trust with, is wrong, right? 8 N note, correct? 9 A. It is technically incorrect, yes. 10 Q. What do you mean "technically incorrect"? 11 A. Well, ma'am, no one could see a bcc, so what I was 12 trying -- 13 Q. I'm talking about the cc. 14 A. The cc is incorrect. 15 I didn't add any more people or up the ante. 16 Q. 17 statement there are no cc's is incorrect. 18 A. Yes, ma'am. 19 Q. So, Mr. Schulte sends you this attachment, correct? 20 A. Yes. 21 Q. And again, you've testified before that this is the first 22 time you read the attachment, correct? 23 A. This is the first time I knew anything about these matters. 24 Q. And it's normal for you to not be in the loop on this. 25 This is not out of the ordinary? Shows no bcc, correct? That I did a reply all and there was a cc. That really wasn't my question. I just wanted to know that That's incorrect. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1874 K2J3SCH5 Roche - Cross 1 A. It's not out of the ordinary. 2 Q. Were you surprised that nobody in management below you had 3 looped you in? 4 A. No, I was not. 5 Q. You were not? 6 A. Because at this level a letter of warning, in the CIA 7 procedures, a level of warning normally would not be brought to 8 directorate level. 9 concurrence. It does not need directorate level There are more -- there are down the road avenues 10 for disciplinary actions in the agency that require directorate 11 intervention, and I discussed some of those with the deputy 12 director of CCI. 13 Q. 14 know is it's not unusual for you not to be in the loop at this 15 level, correct? 16 A. That's correct. 17 Q. Okay. 18 you read it, correct? 19 great detail, correct? 20 A. 21 fast as I could. 22 Q. 23 after you've immediately replied? 24 A. Yes, ma'am. 25 Q. Okay. I don't know what all of that means. But all I wanted to So, you get this memo of warning that's attached, And I am assuming you read the e-mail in I read the e-mail very quickly and wanted to respond as No, no, I mean do you go back and then read it carefully And you've read the entire e-mail before you meet SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1875 K2J3SCH5 Roche - Cross 1 with Mr. Schulte, correct? 2 A. That's correct. 3 Q. And you have read the letter of warning, correct? 4 A. Yes. 5 Q. And you testified you had pulled his file, correct? 6 A. I pulled his agency bio. 7 Q. By "agency bio" do you just mean a folder that's on him? 8 A. That is a summary document that shows when someone came on 9 board, where they went to school, if they have that, if they 10 went to school, where they've been assigned. 11 Q. Where did he go to school? 12 A. University of Texas at Austin. 13 Q. Right. 14 correct? 15 A. Yes, ma'am. 16 Q. And was there any other information in that file other than 17 he had gone to UT Austin? 18 A. 19 he had been assigned to in CIA. 20 Q. What were those? 21 A. I only remember the last one, because it was relevant. 22 unit in CCI. 23 Q. The what? 24 A. The unit that is located in CCI. 25 Q. What unit was that? And that was in there, and that was accurate, There was information about the particular work units that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 The 1876 K2J3SCH5 Roche - Cross 1 A. Group level unit in CCI. 2 Q. What was the group level unit? 3 A. I don't know -- in the instructions -- we normally don't 4 identify group names. 5 Q. Go ahead. 6 A. It was the Engineering Development Group. 7 Q. Okay. 8 A. Yes. 9 Q. Where in EDG? 10 A. I do not recall which part of EDG he was in. 11 Q. Do you recall what he did? 12 A. Yes. 13 Q. What did he do? 14 A. He was a -- he developed tools to support cyber 15 intelligence. 16 Q. 17 intelligence? 18 A. 19 allowed the United States to collect intelligence from computer 20 systems. 21 Q. Collect intelligence how? 22 A. Collect intelligence by exploiting weaknesses in those 23 systems that allow access and insight into how the systems are 24 used or what's being done with the systems. 25 Q. He was in the EDG group? What does that mean, to develop tools to support cyber He developed capabilities, software-based capabilities that Let's break that down. He designed software you said? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1877 K2J3SCH5 Roche - Cross 1 A. He developed, which in engineering we use to say you have a 2 requirement to have a capability, and he would be working with 3 others to develop a capability that then could be used later to 4 solve this requirement. 5 Q. To solve what requirement? 6 A. To solve a cyber requirement. 7 allowed us to get access via cyber. 8 Q. To allow you to get what kind of access via cyber? 9 A. Access into a system that would be a clandestine access To solve a requirement that 10 into a computer network. 11 Q. What is a clandestine access? 12 A. Clandestine defined means that there was no signs that it 13 is going on. 14 Q. There's no signs, meaning like hidden access? 15 A. Yes. 16 Q. Unrevealed access? 17 A. Yes. 18 Q. Secret access? 19 A. Yes. 20 Q. Covert access? 21 A. Covert, ma'am, is a different word than clandestine. 22 different meaning. 23 Q. 24 these developers are developing is basically secret access, 25 correct? Unrevealed access. You'll explain it to me in a minute. Has a But the access that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1878 K2J3SCH5 Roche - Cross 1 A. Access that would not be easily detected, yes. 2 Q. Not just not easily detected, also not linked back to the 3 United States, correct? 4 A. That's the objective of clandestine operations. 5 Q. Tell us some more about this objective of clandestine 6 operations. 7 A. Clandestine -- 8 9 MR. DENTON: Can we just get a specific question, your MS. SHROFF: Okay. Honor? 10 11 Q. Pick a specific project that the United States had as a 12 clandestine project and explain it to us. 13 MR. DENTON: 14 THE COURT: Objection. I think your first question is not 15 objectionable. Why don't you ask that again. 16 Q. 17 United States? 18 A. 19 happening, whether it's physical, digital, is managed in a way 20 that would not reveal that the activity is happening. 21 Q. 22 is doing the activity, correct? 23 A. Yes. 24 Q. Right. 25 it out into the universe and then putting a signature that says So, tell us, please, what is a clandestine operation by the Something is clandestine when the signature of what's Well, not just that the activity is happening, but also who So you are not developing a tool and then sending SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1879 K2J3SCH5 Roche - Cross 1 "made by the CIA," correct? 2 A. No, you are not doing that. 3 Q. Right. 4 that nobody can ever attribute it back to the CIA, correct? 5 A. That's the goal. 6 Q. That's the goal. 7 A. Correct, that's the mission, correct. 8 Q. That's your mission, correct? 9 A. Yes. 10 Q. Right. 11 dollars ensuring that that mission comes to fruition, correct? 12 A. Yes. 13 Q. Now, when these tools are designed and sent off into the 14 universe, those are the tools that are developed at this OSB 15 level, correct? 16 A. Yes. 17 Q. And when you checked Mr. Schulte's file, or the -- what did 18 you call it? 19 A. Agency bio. 20 Q. Agency bio. 21 reading in that agency bio? 22 A. 23 normally give a lot of description about the current 24 assignment. 25 Q. In fact, you're taking great pains to make sure And the CIA invests millions and millions of Bio something? Was there anything more that you remember Not to the best of my recollection. It was -- it does not It lists the assignments. But I'm not talking just about assignments. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I'm talking 1880 K2J3SCH5 Roche - Cross 1 about anything else you learned from his agency bio about him. 2 A. It's a very brief summary. 3 Q. Okay. 4 bio, I mean? 5 agency bio? 6 A. 7 direct reports in the CCI front office asking them for 8 background on this employee. 9 Q. So what else did you learn, other than the agency What other documents did you pull, other than the In addition to the attachments he sent, I spoke to my So, translate that into things we would understand. What 10 did you ask for? 11 A. 12 where is he assigned, what is this letter of warning, what is 13 the background behind this. 14 Q. Just by using first names, tell us who did you speak with. 15 A. I spoke with John. 16 Q. John. 17 A. Yes. 18 Q. Okay. 19 A. No. 20 dealt with him. 21 Q. 22 on direct was something about thumb drives? 23 A. Yes. 24 Q. Okay. 25 drive incident that occurred in 2016, correct? I asked them tell me what do you know about Mr. Schulte, Anybody other than John? He is my direct, he was my direct report so he -- I And is that the time that you learned about what you said In fact, you never learned anything about a thumb SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1881 K2J3SCH5 Roche - Cross 1 A. When I spoke -- my recollection is when I spoke to John, he 2 relayed an incident where Mr. Schulte, it had been detected 3 that Mr. Schulte put a thumb drive into the agency's enterprise 4 IT system. 5 Q. Right. 6 A. I don't remember the date, no, ma'am. 7 Q. Do you remember that it happened when he was an intern? 8 A. No, ma'am, I don't. 9 Q. Do you remember that he self-reported it? 10 A. No. 11 Q. Do you remember that he was told that that was a rookie 12 mistake? 13 A. No. 14 Q. Did you ever follow up and say, hey, I'm reading something 15 about a thumb drive incident, let me follow up before I testify 16 in court about it? 17 A. The thumb drive -- 18 Q. Yes or no? 19 A. I did not read about it, I was told verbally. 20 ma'am, I did not follow up. 21 Q. You did not follow up? 22 A. No. 23 Q. Sitting here today, you have no idea when that thumb drive 24 incident, as you call it, occurred, correct? 25 A. And when was that incident; do you remember? That's correct. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 And no, 1882 K2J3SCH5 Roche - Cross 1 Q. 2 on a minute, please. 3 Did you by any chance talk to his supervisor named -- hold (Counsel conferring) 4 Q. You spoke to a man named Gordon? 5 A. No. 6 Q. Why? 7 A. As a very senior official, to reinforce the chain of 8 command in CCI, I dealt with my direct reports. 9 Q. But this guy -- 10 A. And my direct reports in the CCI front office. 11 point of contact. 12 Q. 13 contact was not Mr. Schulte's supervisor, when he was an 14 intern, and had that thumb drive incident as an intern, you 15 spoke to no one else other than the direct office report, 16 correct? 17 A. The CCI front office, yes, ma'am. 18 Q. So you never went back and checked as to whether or not 19 this was an intern incident, correct? 20 A. That's correct. 21 Q. You never reached out to a man named Gordon, even though 22 you knew who he was, correct? 23 A. I did not know who Gordon was. 24 Q. Wasn't he listed as Mr. Schulte's supervisor when he was an 25 intern? Right. Okay. That was my So, if a direct report who was your point of I mean, that's office-level knowledge, right? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1883 K2J3SCH5 Roche - Cross 1 A. No, that's not something -- that's not something I would 2 know. 3 Q. 4 his supervisors were over the years, right? 5 A. I could get access to that. 6 Q. Right. 7 A. But that is not something that I would readily have access 8 to. 9 Q. That would not be on an agency bio. Certainly you would have access to information as to who Well, I mean, you had access to his immediate supervisor at 10 that time Sean, correct? Sean F. 11 A. I never met Sean. 12 Q. Oh, I didn't ask you if you met Sean. 13 you had access to him. 14 A. 15 officer using my direct reports who I hold accountable for that 16 organization. 17 Q. You could have talked to Sean F., correct? 18 A. That's correct. 19 Q. You could have talked to Gordon? 20 A. Correct. 21 Q. You could have talked to Karen? 22 A. Correct. 23 Q. You could have talked to Mr. Weber, correct? 24 A. Correct. 25 Q. You could have talked to Justin Nichols? I just asked you if Through the CCI front office, I would get access to any SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1884 K2J3SCH5 Roche - Cross 1 A. Correct. 2 Q. You could have talked to Amol, correct? 3 A. Correct. 4 Q. You could have talked to Michael K., correct? 5 A. Correct. 6 Q. You could have talked to Michael S., correct? 7 A. Correct. 8 Q. In fact, you were so high up, you could talk to anyone you 9 wanted to about Josh Schulte, correct? 10 A. If the arrangements were made for me to get to them, yes, I 11 could have. 12 Q. Who would make those arrangements? 13 A. The CCI front office. 14 I did in fact -- 15 Q. 16 arrangements, right? 17 A. Yes. 18 Q. That's all I wanted. You, right? I would task the CCI front office. No, my question was you had the power to make the 19 Thank you. So you get this e-mail, and then you get ready for 20 your meeting with Mr. Schulte, correct? 21 A. Correct. 22 Q. And you testified on direct, did you not, that you were 23 concerned when you met with him, right? 24 A. Yes. 25 Q. Okay. And you testified that you were concerned because SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1885 K2J3SCH5 Roche - Cross 1 you saw a red flag, correct? 2 A. Yes. 3 Q. And the red flag you thought was partially because you read 4 phrases such as "incurred her wrath" in his e-mail, correct? 5 A. Hmm-hmm. 6 Q. And by the way, do you know what the phrase "incur 7 somebody's wrath" means? 8 A. I believe so. 9 Q. What does did mean? 10 A. Wrath to me means retribution. 11 Q. Is that what it means? 12 get mad at you? 13 someone's wrath? 14 A. 15 somebody just getting frustrated or angry with you. 16 Q. 17 used when somebody's frustrated or angry, correct? 18 A. Yes. 19 Q. Okay. 20 flag for you, right? 21 A. Yes. 22 Q. Okay. 23 mind, you said you wanted to have somebody keep an eye on him, 24 correct? 25 A. Meaning you don't want somebody to Is that the normal understanding of you incur In my vernacular, wrath means retribution. More than You think that the phrase "incur somebody's wrath" is only And that was one of the things that caused the red And after this red flag was in the back of your Is that what you said? Following the meeting, and the full content of the meeting, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1886 K2J3SCH5 Roche - Cross 1 I spoke to deputy director of CCI and said make sure his 2 actions are being closely monitored. 3 Q. Who is that person? 4 A. John. 5 Q. John. 6 A. That's correct. 7 Q. And when you told John that you wanted Mr. Schulte closely 8 monitored, what exactly did you mean? 9 A. Right. Just give me a first name. And you told John that, correct? That means that any time that he is on the agency network, 10 that means that the security team is aware of the cumulative 11 number of challenges he's had in following our rules, that 12 there is followup any time he's given a directive to make sure 13 that directive is followed, and to make sure that any further 14 incidents are fully documented. 15 Q. Okay. 16 A. Yes. 17 Q. 2016, correct? 18 A. Yes. 19 Q. And sitting here today, do you know what steps they took to 20 keep an eye on him? 21 A. Yes, I do. 22 Q. Okay. 23 A. To the extent possible on DevLAN. 24 Q. You are the CIA. 25 A. So, the network, the enterprise network has the gold And this was in June, correct? So they monitored his use of DevLAN, correct? Isn't it possible? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1887 K2J3SCH5 Roche - Cross 1 standard for audit. The DevLAN was a system that was working 2 to try and achieve that standard, did not have that standard. 3 Q. 4 did not meet the gold standard? 5 A. No, I did not know that at that time. 6 Q. You did not know? 7 A. No. 8 Q. Let's figure out what you knew about DevLAN at that time. 9 Did you know that it was an open network? Your testimony is that you knew at that time that DevLAN I did not know that at that time. 10 A. I'm sorry, I'm not familiar -- what do you mean by open 11 network? 12 Q. Did you know it was a dirty network? 13 A. I knew that it handled data that had needed quarantine. 14 Malware, etc. 15 Q. Okay. 16 A. That's what I believe you mean by "dirty network." 17 Q. But, you knew that it wasn't a secure network, right? 18 A. I believed it to be a secure network. 19 Q. You believed it to be a secure network at that time? 20 A. Yes, yes. 21 Q. Post-Snowden it is your testimony today that you still 22 believe DevLAN to be a secure network? 23 A. Yes. 24 Q. Post-Snowden? 25 A. Yes. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1888 K2J3SCH5 Roche - Cross 1 Q. People at the CIA never expression any qualms to anyone at 2 the CIA management level, including to you, that what happened 3 with Snowden could happen at the CIA; that's your testimony? 4 A. No. 5 Q. That's not your testimony? 6 A. No. 7 Q. Okay. 8 A. My testimony is that the vast, vast majority of people who 9 come work at the CIA are on the CIA enterprise network, which So what is your testimony? 10 is the gold standard for audit. And my testimony is that from 11 the first days of the creation of DDI, the mission networks 12 that represent a much smaller specialized footprint, that the 13 goal was to get those to the highest levels of audit as fast as 14 possible. 15 Q. 16 again. 17 A. Sure. 18 Q. Snowden happened. 19 A. Hmm-hmm. 20 Q. Right? 21 A. Yes, ma'am. 22 Q. Okay. 23 your industry, correct? 24 A. Yes. 25 Q. It was classified information, correct? That really wasn't my question. Let me try my question You remember that? People talked about it, right, because this was in SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1889 K2J3SCH5 Roche - Cross 1 A. Yes. 2 Q. That had gotten out, correct? 3 A. Yes. 4 Q. Related to your field of work, correct? 5 A. Related to intelligence. 6 Q. Right. 7 A. Yes. 8 Q. And you certainly didn't want it to happen to DevLAN, 9 correct? Which is your field of work? 10 A. Ma'am, Snowden happened 2013. DDI had not been created 11 yet. 12 Q. 13 2013. 14 that whatever happened with Snowden you didn't want to happen 15 again, correct? 16 A. Yes, ma'am. 17 Q. Okay. 18 correct? 19 A. Yes. 20 Q. And you wanted to make sure he didn't access DevLAN 21 incorrectly, correct? 22 A. Any computer system, ma'am. 23 Q. Any computer system, right? 24 A. That's right. 25 Q. And you made sure that whatever he was doing on these I was not having discussions about DevLAN in 2013. I didn't ask you if you were having discussions only in I am just asking you after 2013, you had on your horizon So, basically, you had somebody you had red flagged, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1890 K2J3SCH5 Roche - Cross 1 computer systems was being watched, correct? 2 A. I directed that his activities be monitored. 3 Q. Right. 4 fact monitored? 5 A. I gave the directive -- 6 Q. Just can you try and answer my question? 7 help. 8 A. Yes, ma'am. 9 Q. So did you follow up and make sure that your directive was You followed up, right, that his activities were in It would really I'm trying to answer your question. 10 followed? 11 A. I was told that it was being followed. 12 Q. You asked? 13 A. Yes, ma'am. 14 Q. And you were told it was being followed? 15 A. Yes, ma'am. 16 Q. His activity on DevLAN was being monitored, correct? 17 A. I asked that all his activities were being monitored. 18 Q. You broke it down for them, correct? 19 A. No, I did not. 20 Q. This guy is a huge red flag you testified on direct. 21 Right? 22 you, you canceled a trip to Europe. 23 A. No, that's not what I said. 24 Q. Okay. 25 A. Yes, it was. I asked. I mean, you were so concerned about it, according to Is that what you said? It was a big red flag for you, you said, right? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1891 K2J3SCH5 Roche - Cross 1 Q. So you followed up, right? 2 down each network, and you ticked off, right? 3 A. No. 4 Q. Oh, okay. 5 You had a checklist, you wrote One of the other things you testified, did you not, 6 that he told you during this meeting that he was just -- he was 7 still able to get his access back. 8 A. Yes. 9 Q. Can you just paraphrase for me again, because I don't have Is that what you testified? I'm paraphrasing. 10 a transcript. What the exactly do you recall being told? 11 A. 12 should never try to do something like that again, and him 13 explaining that he did not have access to this previous project 14 he had worked on, he paused and said, you know, I could get 15 back onto that if I wanted to. 16 Q. 17 if I want to? 18 A. Yes. 19 Q. I got that. 20 A. Yes. 21 Q. Okay. 22 leave at the CIA? 23 A. 24 leave for allocating your pay and your hours worked. 25 in pay status or you are in various aspects of leave status. What I recall being told is after a conversation of why he He paused and he said, you know, I could get back onto that Right after discussing -Huge red flag for you, right? And let me ask you this. What is administrative Administrative leave is one of several forms of time card SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 You are 1892 K2J3SCH5 Roche - Cross 1 Administrative leave is one type of leave. 2 Q. 3 administrative leave if you see a red flag, correct? 4 A. The office of security has to do that, ma'am. 5 Q. You could make a referral to the office of security, 6 correct? 7 A. That's correct. 8 Q. Right. 9 A. No, I did not. 10 Q. Okay. 11 leave. Okay. 12 And you can put an individual or an employee on Did you? So you didn't tell them to put him on administrative Can you say that again for me -- what did you say he 13 said to you, according to you? 14 A. 15 that if I wanted to. 16 Q. 17 e-mail to John saying this guy said, you know, I can get back 18 onto that if I want to? 19 A. I had a discussion -- 20 Q. No, no. 21 if you sent an e-mail. 22 A. No. 23 Q. Okay. 24 correct? 25 A. Words to the effect of, you know, I could get back into Okay. So you didn't tell security. And did you send an We'll get to the discussion. I'm only asking you Did you send an e-mail? And your testimony is you didn't send an e-mail, Correct. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1893 K2J3SCH5 Roche - Cross 1 Q. You did not memorialize it, correct? 2 A. I'm sorry, ma'am. 3 Q. Sure. 4 A. I don't recall. 5 Q. You don't recall. 6 A. I don't recall. 7 Q. Okay. 8 A. Absolutely. 9 Q. Right. 10 A. John responded back to me, Sean, we're all over it, we're 11 monitoring him, security is all over it, CIA is all over it. 12 Q. He told you CIA is all over him, right? 13 A. Basically. 14 Q. So from at least June, everybody was watching him? 15 A. That's what I was told. 16 Q. June, July, August, September, October, November is when he 17 leaves, correct? 18 A. Correct. 19 Q. Somebody's watching him the whole time, right? 20 are all over, it correct? 21 A. Hmm-hmm. 22 Q. Right? 23 A. Yes. 24 Q. Right. 25 idea when the information was taken from the CIA that ended up Could you repeat that? Did you memorialize it? But you recall telling John about it, correct? And what did John do, by the way? November 10, 2016, correct? Because you By the way, sitting here today, do you have any SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1894 K2J3SCH5 Roche - Cross 1 in Vault 7? 2 A. 3 which is March. 4 Q. It's March, right? 5 A. Yes. 6 Q. Okay. 7 information went from the CIA to a third party, correct? 8 A. I know a third party published it. 9 Q. No, no. 10 A. Okay. 11 Q. I'm not asking who published it. 12 trajectory. 13 went to Russia first, correct? 14 A. Correct. 15 Q. You don't know if it went to Spain first, correct? 16 A. Correct. 17 Q. In fact, you don't even know it just went to Baltimore, 18 correct? 19 A. Correct. 20 Q. Right. 21 correct? 22 A. That's correct. 23 Q. And did you by any chance learn that even after 2017 24 publication, the CIA still did not know whether or not 25 WikiLeaks had the information from the gold repository? I have the date that corresponds to the date of the data According to you it's March? And you don't know sitting here today whether the You have no idea, right? I'm asking you the You don't know if it All you know is, in 2017, WikiLeaks published it, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1895 K2J3SCH5 Roche - Cross 1 MR. DENTON: 2 THE COURT: Objection. Overruled. 3 A. Could you repeat that, please, ma'am. 4 Q. Sure. 5 don't know if WikiLeaks has the gold repository? 6 7 THE COURT: Rebecca, could you read the question back, please. 8 9 Is it fair to say, sir, that the CIA slash you still (The record was read) A. I believe that represents the last conversation I had on 10 what is called the gold repository. 11 Q. So I'm correct. 12 A. Yes. 13 Q. CIA still doesn't know? 14 A. I don't know that, ma'am. 15 Q. You know what the WikiLeaks task force report is? 16 A. Yes, I do. 17 Q. Could you pull that up for this gentleman, please. 18 I don't work there anymore. Are you happier with a paper copy or the screen? 19 A. We can do this. 20 Q. Could we just go to page 45. 21 actual text. 22 moderate confidence"? 23 A. Yes. 24 Q. Right. 25 possess the gold folder," correct? Could you just focus on the You see that line, "However we now assess with "Moderate confidence that WikiLeaks does not SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1896 K2J3SCH5 Roche - Cross 1 A. Correct. 2 Q. We can take that down and show him the first page of the 3 document. 4 correct? 5 A. Yes. 6 Q. Were you at the CIA then? 7 A. Yes, I was. 8 Q. After you had the meeting with Mr. Schulte and after you 9 talked to John, you did not ever follow up about him, correct? First page. There you go. And that's the date, 10 A. I verbally asked about him several times. 11 Q. You verbally asked about him several times? 12 A. Yes. 13 Q. So this is a person that you thought was a huge red flag 14 and you only followed up verbally, correct? 15 A. 16 did, where at the end of the meeting we would discuss personnel 17 issues. 18 Q. And? 19 A. And during that portion of the meeting I'd say where do we 20 stand on Mr. Schulte? 21 Any latest problems? 22 Q. Uh-huh. 23 A. Words to that effect. 24 Q. Right. 25 A. On several occasions in these biweekly formal meetings. No, ma'am. We had formal biweekly meetings with CCI, I Has he resigned? Is he going to resign? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1897 K2J3SCH5 Roche - Cross 1 Q. And in these biweekly formal meetings you never made any 2 formal notation, correct? 3 A. No. 4 Q. You did not suggest at that at these biweekly meetings that 5 this person with this humungous red flag should be put on 6 administrative leave, correct? 7 A. No. 8 Q. You did not even say to these people revoke his clearance, 9 correct? 10 A. No. 11 Q. You didn't even say take away his top secret clearance, 12 correct? 13 A. Correct. 14 Q. You did not even ask them to reduce his level of clearance, 15 correct? 16 A. That's correct. 17 Q. You did not do anything at all that you memorialized 18 anywhere, correct? 19 A. Correct. 20 Q. Okay. 21 didn't take any of those steps? 22 Let me ask you something. Is there a reason why you I'm not asking for a discourse on management. 23 asking you why you didn't take any of those steps. 24 A. Yes. 25 Q. What is the reason, sir? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I am 1898 K2J3SCH5 Roche - Cross 1 A. Because I trusted the leadership team at CCI. 2 Q. Okay. 3 to do, and you had handed it over, correct? 4 A. That's correct. 5 Q. Okay. 6 Harbor, correct? 7 A. Yes. 8 Q. When did you come up with this phrase, by the way? 9 A. I'm not sure. 10 Q. Not sure. 11 A. That to me is the most accurate analogy. 12 Q. It is the -- I'm sorry? 13 A. It was a surprise, it was devastating, left us with very 14 little capability. 15 Q. 16 Pearl Harbor, do you know? 17 A. More than 3,000. 18 Q. How many people died as a result of the Vault 7 and the 19 Vault 8 leaks? 20 A. I don't have an answer for that. 21 Q. Why not? 22 A. Because, it -- it's not something someone's keeping a count 23 of. 24 Q. 25 Pearl Harbor. Okay. So you thought you had done what you were supposed You called this leak, did you not, a digital Pearl That's okay. Let's talk about that. How many people died in You are not keeping an account of it, but you called it SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1899 K2J3SCH5 Roche - Cross 1 A. Yes, I called it a digital Pearl Harbor. 2 Q. How many people died as a result, I mean, how many people 3 died as a result of Vault 7 and Vault 8? 4 A. I don't know. 5 Q. In fact, none, correct? 6 A. I can't say that either. 7 Q. You can't say that. 8 A. No, ma'am. 9 Q. Okay. You don't know? Did the CIA ever commission a report to find out how 10 many people died as a result of the Vault 7 and the Vault 8 11 leaks? 12 A. Not that I am aware of. 13 Q. Okay. 14 figure out what harm Vault 7 and you Vault 8 caused to 15 America's relationships with friendly nations? 16 report ever commissioned? 17 A. I'm not -- I do not know. 18 Q. You do not know? 19 A. I do not know. 20 Q. No. 21 wrote down the harm that came? 22 A. I do not know. 23 Q. And you do not know if anybody ever wrote a report, 24 correct? 25 A. Was there ever a report commissioned by the CIA to Was there a Do you know if anybody went and formally asked and You don't know, right? The task force report. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1900 K2J3SCH5 Roche - Cross 1 Q. 2 the task force report. 3 about the repercussions on friendly foreign nations, correct? 4 A. Correct. 5 Q. Right. 6 report to find out what exactly the impact was of Vault 7 and 7 Vault 8 on America's relationships with other friendly nations. 8 There was no such report, correct? 9 A. I'm not aware of one. 10 Q. Okay. 11 of the Vault 7 and the Vault 8 leaks on America's relationships 12 with adversary nations? 13 A. I am not aware. 14 Q. How about with non-state foreign hostile actors; was there 15 a report done on that? 16 A. On -- there was reporting. 17 Q. No, no, I'm not asking about reporting, sir. 18 you if the CIA commissioned a report to document the harm done 19 by the leak. 20 report that you saw that said this is the harm that has come to 21 our relationship with adversary nations. 22 No, no. I didn't ask about a task force report. We have The task force report does not talk So I'm only asking you if somebody commissioned a Was there a report to find out what the impact was That's what I'm asking you. I am asking Was there a written Yes or no? 23 A. I'm not aware. 24 Q. Sitting here today, do you know of any report that actually 25 created a statistical number of any CIA agents that were placed SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1901 K2J3SCH5 Roche - Cross 1 at risk because of the release of Vault 7 or Vault 8? 2 A. I am aware of assessments of operations. 3 Q. Listen to my question carefully. 4 A. Yes. 5 Q. Right. 6 of operations in a minute. 7 say let's get a report and let's write down how many CIA agents 8 were left at risk because of Vault 7 and Vault 8? 9 A. I'm not aware. 10 Q. Did the CIA ever do a report to figure out how many CIA 11 officers were left at risk because of Vault 7 or Vault 8? 12 A. That work was done. 13 Q. That work was done. 14 A. I'm not aware. 15 Q. Well, there was work done but you are not aware if a report 16 was written? 17 A. 18 assessments. 19 Q. 20 report written? 21 A. 22 document. 23 Q. 24 asking you the question, sir, and you are under oath now, 25 right? So my question to you is, you can get to assessment My question to you is, did the CIA Was there a report written? Yes, for all these issues. No, no. Okay? Across the agency, there were Are you changing your answer now that there was a In terms of report, I think you're looking for a summary I'm not -- don't think about what I'm looking for. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I'm 1902 K2J3SCH5 Roche - Cross 1 A. Yes, ma'am. 2 Q. Okay. 3 report was written? 4 THE COURT: 5 MR. DENTON: Do you want to change any of your answers that a Sustained. Thank you, your Honor. 6 Q. Would you like to change your answer? 7 A. No, ma'am. 8 Q. So there were no reports that you received, correct? 9 A. There was reporting. 10 Q. No. 11 A. Ma'am, I am trying to be responsive. 12 to be responsive. 13 of the agency on which officers could have been exposed, etc. 14 There was a team dedicated to doing that assessment. 15 Q. 16 assessments? 17 A. Yes. 18 Q. Okay. 19 A. Teams of CIA officers who had access to the information. 20 Q. They wrote actual assessments, correct? 21 A. They produced reporting. 22 Q. Right. 23 reporting? 24 A. No, I did not. 25 Q. You did not. I'm not asking you about reporting, sir. I'm honestly trying There were assessments by the various parts There were written assessments. Do you want to call them Who wrote these assessments? They produced reporting. And did you see this Do you know if the reporting was ever given SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1903 K2J3SCH5 Roche - Cross 1 to the United States attorney's office as part of this case? 2 A. I do not know what form the reporting took. 3 Q. So you don't know what form the reporting took, correct? 4 You don't know what form the assessments were written in, 5 correct? 6 A. Correct. 7 Q. You do not know if these assessments were written or 8 when -- you do know they were written, correct? 9 you now? I do not know. According to 10 A. Yes. 11 Q. You don't know when they were written, correct? 12 A. The exact dates they're completed, no, I can't recall. 13 Q. You don't know what the conclusions were, correct? 14 A. Not in detail, no. 15 Q. Well, in any form. 16 all? 17 A. 18 that -- that may have risked exposure via the information that 19 was released -- 20 Q. 21 asking you if there was a report that somebody was actually at 22 risk. 23 A. I'm not aware. 24 Q. Okay. 25 assessment was done, correct? Do you know any of the conclusions at That's all I want to know. There were conclusions about CIA officers and programs May have risked exposure is not what I am asking you. I am You are not even aware of how that quote unquote SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1904 K2J3SCH5 Roche - Cross 1 A. I'm aware of the team that came in and did it. I even 2 spoke to them while they were going through the Vault 7 3 material. 4 Q. You spoke to a team, correct? 5 A. Yes. 6 Q. Who's the team? 7 A. A team of analysts. 8 Q. They were a team of analysts who were analyzing the Vault 7 9 and Vault 8 leak. That's not what I am asking you about, sir. 10 I am asking you about a risk assessment. Please. I'm asking 11 you if you ever saw a risk assessment done that said these 12 analysts, officers, or agents are at risk. 13 MR. DENTON: Asked and answered, your Honor. 14 MS. SHROFF: I don't think so. 15 A. I did not see such a report. 16 Q. Thank you. 17 offices had to be closed as a result of this leak? 18 answer none? By the way, do you know how many CIA foreign 19 MR. DENTON: 20 THE COURT: Objection. Overruled. 21 A. I don't know of any offices that were closed. 22 Q. That had to be closed. 23 THE COURT: 24 Q. 25 Vault 8 leak? Isn't the He is not aware of any that were closed. Were there any that were closed because of the Vault 7 or SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1905 K2J3SCH5 Roche - Cross 1 A. I'm not aware. 2 Q. You are not aware, right? 3 A. No. 4 Q. And you are aware, though, that the CIA's position is that 5 the information was taken in March and released more than a 6 year later, correct? 7 MR. DENTON: Objection. 8 MS. SHROFF: That's what he testified to. 9 MR. DENTON: That's not what he testified to. 10 THE COURT: I don't think that is what he testified 11 to. It was the CIA's position. 12 Q. When did the CIA think the information was taken? 13 A. The -- based on what has been published, an assessment was 14 that the information was as -- the information was dated in the 15 March time frame. 16 Q. March of what year? 17 A. 2016. 18 Q. Okay. 19 A. It was released in -- March 7, 2017. 20 Q. A whole year went by, right, in the middle? 21 A. Yes, ma'am. 22 Q. CIA survived, correct? 23 A. Yes, ma'am. 24 Q. Business went on as usual, correct? 25 A. No, ma'am. When was it released? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1906 K2J3SCH5 Roche - Cross 1 Q. You didn't even know about the leaks until 2017? 2 A. I'm sorry, ma'am. 3 leak, business did not go on. 4 Q. I am only talking about that gap now. 5 A. Yes, ma'am. 6 Q. Work went on, correct? 7 A. Yes, ma'am. 8 Q. Field locations survived, correct? 9 A. That's correct. 10 Q. Foreign offices survived? 11 A. Correct. 12 Q. Agents continued to do whatever syphoning they were doing, 13 correct? 14 A. As far as I know. 15 Q. Officers continued to write code, develop, and move right 16 along, correct? 17 A. Yes, ma'am. 18 Q. In fact, had WikiLeaks not released that information, the 19 CIA would never even know it was gone. 20 A. I can't say that, actually, ma'am. 21 Q. Okay, let's pull this up. 22 look at page 4. 23 until a year later." 24 25 I misunderstood. After the -- after the Isn't that correct? Take a look, would you. "We did not realize the loss had occurred Page 4. You with me? A. Take a Yes, ma'am. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1907 K2J3SCH5 Roche - Cross 1 Q. Do you read that? 2 A. Yes. 3 Q. Okay. 4 A. This is the WikiLeaks task force report. 5 Q. What is the WikiLeaks task force report? 6 A. It is the task force communicating findings from their 7 examination of systemic issues that led to the WikiLeaks 8 release. 9 Q. By the way, could you tell me what this report is? Could you tell me that in, like, simpler English, and if 10 you could speak into that mic that would be most helpful to me. 11 A. 12 after the Vault 7 release that examined what we should do 13 operationally as a result, and looked at any systemic issues to 14 make recommendations for -- to prevent something like this from 15 ever occurring again. 16 Q. Okay. 17 A. Yes. 18 Q. And this report says that you didn't know until -- not you 19 personally, but the CIA didn't know until a whole year later, 20 right? 21 A. Yes. 22 Q. And by the way, do you see on page -- actually, do you see 23 on page 4 on the top, do you see where it says "Day-to-day 24 security practices had become woefully lax"? 25 A. Okay. This is the task force that was formed immediately And this is the formal report, right? Yes. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1908 K2J3SCH5 Roche - Cross 1 Q. You didn't know that at that time, did you? 2 A. No. 3 Q. Did you also know that CCI had not worked with CIMC to put 4 in any procedures in place? 5 A. No, I was not aware. 6 Q. You were not aware, right? 7 A. No. 8 Q. Okay. 9 that there was some embarrassment, was there not -- can you 10 And you were aware, though, right, at some point, just take that down. 11 Thank you. -- at the fact that the CIA didn't know that this 12 information had been gone for a whole year, right? 13 embarrassing, wasn't it? 14 A. I don't recall myself feeling embarrassed. 15 Q. It wasn't embarrassing that the Central Intelligence Agency 16 of the United States of America had lost data that nobody 17 realized had been gone for a whole year? 18 MR. DENTON: 19 THE COURT: It was Asked and answered, your Honor. Sustained. 20 Q. You do know that the WikiLeaks report blamed Mr. Schulte, 21 correct? 22 A. I don't recall. 23 Q. Okay. 24 you'd seen it, right? 25 A. I read it quite a while ago. You saw the WikiLeaks report, right? Yes, ma'am. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 This report; 1909 K2J3SCH5 Roche - Cross 1 Q. 2 assessment report, correct? 3 A. I saw damage assessment reports on operations, routinely. 4 Q. No, no, I'm not talking about e-mail traffic. 5 about a report. 6 A. 7 about having the operations team describe the status of 8 operations, and what was happening on a periodic basis given 9 the status of operations after the Vault 7 disclosure. And I'm correct, am I not, that you saw no damage Ma'am, I'm not talking about e-mail traffic. 10 Q. 11 operations. 12 A. The damage was to operations, ma'am. 13 Q. The damage was to operations. 14 assessment operations report? 15 A. Periodically. 16 Q. No, no, not reporting to you. 17 received an actual report. 18 methodology, statistics, numbers, and facts. 19 receive such a report? Right. I am asking about a damage assessment report. MR. DENTON: 21 THE COURT: 23 A. I'm talking That's what's happening on your status of 20 22 I'm talking And you received a damage I am asking you if you A report on which you can examine Did you ever Objection. Overruled. I received briefings and copies of those briefings. (Continued on next page) 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1910 K2jWsch6 Roche - Cross 1 BY MS. SHROFF: 2 Q. OK. 3 A. The briefing was the report. 4 Q. No, no. 5 said WikiLeaks damage assessment task force report. 6 receive one? 7 A. 8 briefings that damage -- Great. Did you receive a report? I'm asking you if you received a document that I received briefings. 9 THE COURT: That's reporting. I received Listen to the question, Mr. Roche. 10 THE WITNESS: 11 THE COURT: Yes, sir. Did you get a report that said WikiLeaks 12 damage assessment task force report? 13 A. No, ma'am. 14 MS. SHROFF: Thank you. 15 MR. DENTON: Nothing further, your Honor. 16 THE COURT: 17 Mr. Roche, you're excused. (Witness excused) 19 THE COURT: 20 MR. KAMARAJU: 22 Thank you very much. 18 21 Next witness. Yes, your Honor. The government calls Mark Bradley. MARK A. BRADLEY, 23 called as a witness by the government, 24 having been duly sworn, testified as follows: 25 Did you THE COURT: Please sit down, Mr. Bradley. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1911 K2jWsch6 Bradley - Direct 1 THE WITNESS: 2 THE COURT: 3 MR. KAMARAJU: 4 THE COURT: 5 MR. KAMARAJU: Yes, sir. Pull yourself right up to the microphone. May I proceed, your Honor? Yes, you may. Thank you, your Honor. 6 DIRECT EXAMINATION 7 BY MR. KAMARAJU: 8 Q. Good afternoon, sir. 9 A. Good afternoon to you. 10 Q. Sir, are you employed? 11 A. I am. 12 Q. Where do you currently work? 13 A. I am the director of the information security oversight 14 office at the National Archives administration, Washington, 15 D.C. 16 Q. 17 of all, what's the National Archives? 18 A. 19 information than any agency of the United States government. 20 All records of the U.S. government ultimately come to the 21 National Archives. 22 Q. 23 like to talk about your background. 24 A. Sure. 25 Q. Do you have any degrees? We're going to talk a little bit more about that, but first We are the national memory. We sit on more classified Before we dig into a little bit of your current duties, I'd SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1912 K2jWsch6 1 A. 2 of Washington and Lee. 3 master's degree in modern history from Oxford, where I was a 4 Rhodes scholar. 5 Virginia School of Law. 6 Columbia bar. 7 Q. 8 closer to the mike. 9 A. Sure. 10 Q. And maybe slow down a little bit for the court reporter. 11 A. Is that better? 12 Q. Yes, that's better. 13 I do. Bradley - Direct I have a bachelor's of arts degree from university Thanks. I graduated Phi Beta Kappa. I have a And I have a law degree from the University of I'm a member of the District of I'm just going to ask you to sit a little bit Now, you testified that you have a law degree -- 14 A. Yes, sir. 15 Q. -- is that right? 16 A. I do. 17 Q. Have you ever actually practiced law? 18 A. I have. 19 Q. What was your practice? 20 A. First practice was with a law firm in D.C., and then I went 21 out on my own and was a criminal defense for almost eight 22 years. 23 Metro to first degree murder, even had an espionage case. 24 25 I defended everything from indecent exposure on the I later also, too, practiced law with the Department of Justice from November of 2000 until December of 2016. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1913 K2jWsch6 OK. Bradley - Direct 1 Q. So let's just break that down. You testified that you 2 were working at a law firm for a period of time -- 3 A. Uh-huh. 4 Q. -- is that right? 5 A. Right. 6 Q. And then after that you moved on to doing criminal defense 7 work? 8 A. Correct. 9 Q. And could you just give us some general examples of the 10 kind of work you did as a criminal defense lawyer? 11 A. 12 solicitation. 13 passed out in the courtroom. 14 I've done everything from serious felonies to misdemeanors, and 15 felonies included first degree murder. 16 Q. And did you do any criminal cases that involved espionage? 17 A. I did. 18 Q. Now, I believe you testified that after that you moved on 19 to the Department of Justice, is that right? 20 A. Well, as I said, I did drug trials. Started out with First trial I ever had my client overdosed and I thought -- I was petrified. I did. 21 And we forgot one critical point. 22 Intelligence Agency from 1985 until 1989. 23 Q. We're coming to that. 24 A. We're coming back to that. 25 myself. OK. I was at the Central I'm getting ahead of Sorry. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1914 K2jWsch6 Bradley - Direct 1 Q. At the Department of Justice, what positions did you hold? 2 A. Started out as a line attorney, then promoted to assistant 3 counsel and then rose up to be the deputy counsel for 4 intelligence policy in a small office that was called then the 5 office of intelligence policy and review. 6 legal counsel for the Department of Justice on intelligence 7 matters. 8 Surveillance Court for almost eight years. 9 Q. OK. We were kind of the Also practiced in front of the Foreign Intelligence Let's talk about that. The office that you mentioned, 10 what were its general responsibilities? 11 A. 12 covert searches and electronic surveillance for the 13 intelligence, United States intelligence surveillance court, 14 the FISA court? 15 Q. And what is the FISA court? 16 A. The Foreign Intelligence Surveillance Court is the 17 so-called secret court. 18 of late, a lot more than some people would like. 19 again, it's the -- comes out of the Church Committee. Primary responsibility was to prepare applications for 20 THE COURT: 21 THE WITNESS: It's been in the news quite a bit as It's -- Comes out of the Church Committee. Yes, sir. Comes out of the Curch 22 Committee. 23 A. 24 particularly the CIA and FBI, had run amok, illegally 25 surveilling American citizens in particular, and we needed a So the idea was that the intelligence communities, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1915 K2jWsch6 Bradley - Direct 1 more regulated way of doing that. So Article III judges were 2 appointed by the Chief Justice of the Supreme Court to sit on 3 this court and hear these so-called secret cases. 4 in a SCIF, a sensitive compartmented information facility, 5 highly classified cases. 6 Article III judges, just like the judge sitting here today. 7 Q. How long were you with the Department of Justice? 8 A. Went over from November of -- November 22 of 2000 until 9 December 26 of 2016, when President Obama approved my They're held But they -- they, you know, regular 10 appointment of archivist of the United States to my current 11 position as the director of the information security oversight 12 office. 13 Q. And that's your current position? 14 A. Correct. 15 Q. And we'll talk about those responsibilities in a second. 16 You mentioned that you were with the Central Intelligence 17 Agency for a period? 18 A. Correct. 19 Q. Generally speaking, what did you do at the CIA? 20 A. I spent most of my career in what was called the office of 21 Near Asia and South Asian analysis. 22 experts on Pakistan, particularly its politics. 23 mostly in Washington but did time out in Pakistan. 24 Q. And did that job involve classified information? 25 A. Highly classified information. I was one of the agency I served The Russians had invaded SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1916 K2jWsch6 Bradley - Direct 1 Afghanistan in 1979 so we were running a war through there, so 2 we were doing a lot of very highly classified things. 3 Q. 4 mentioned that you were first appointed in November of 2016 -- 5 A. Right. 6 Q. -- is that right? 7 Now, I want to turn to your current position. You And was that appointment ever approved? 8 A. I'm sorry? 9 Q. Was that appointment approved? 10 A. It was. 11 Q. And when was that? 12 A. It would have been, first day on the job was December 26, 13 2016. 14 Q. 15 U.S. intelligence community? 16 A. 17 intelligence community for a reason. 18 of us as the umpires in the game. 19 members of the IC itself, intelligence community, but we have 20 oversight over it. 21 Committee findings, that they needed a neutral overseer of what 22 they do. 23 declassify national security information. 24 Q. 25 your responsibilities are in your current position. President Obama approved my appointment. The approval happened sometime in late November. In your current position, does that make you part of the It does not. In fact, we are explicitly not part of the We are kind of -- I think We don't -- we're not And again, it's another one of the Church So what we do is we oversee how they classify and Let's talk about a little bit at a high level about what SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Can you 1917 K2jWsch6 Bradley - Direct 1 describe your day to day? 2 A. 3 These range from how U.S. government classifies and 4 declassifies national security information to how it handles 5 control of classified information. 6 industrial security policy advisory committee. 7 role in the national industry security base. 8 guess, the U.S. government relies a lot on private contractors 9 to build things, like airplanes and submarines. No day is the same. I oversee five executive orders. I chair the national We have a big As you might If you think 10 about that, we have to give a lot of classified information to 11 the private sector, so we're trying to oversee how they're 12 handling the information themselves, make sure they're doing it 13 properly. 14 Q. Let's take that one at a time. 15 A. Sure. 16 Q. What's the first department that you mentioned? 17 A. You mean the executive order? 18 Q. Yes. 19 A. Executive Order 13526. 20 Q. OK. 21 A. Executive order is an order signed by the President of the 22 United States that spells out how he wants certain things 23 carried out, and in this particular case, 13526, federal 24 government -- how we, we as the government, classify and 25 declassify state programs or national security information. What's an executive order? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1918 K2jWsch6 Bradley - Direct 1 Q. 2 the president issues an executive order -- 3 A. Right. 4 Q. -- is that right? 5 Let's take that a little bit slowly. You mentioned that And the executive order that you testified to, how did you 6 become familiar with it? 7 A. 8 Department of Justice. 9 intelligence policy. I became familiar with it first when I was at the I was the deputy counsel for I was one of the DOJ's, for lack of 10 better way to say it, top experts on intelligence, and so I sat 11 on a variety of committees at the National Safety Council that 12 actually helped write that order. 13 Q. 14 orders -- 15 A. Right. 16 Q. -- that you were also responsible for administering -- 17 A. Right. 18 Q. -- is that right? 19 A. There were. 20 Q. Let's talk about those one at a time. 21 A. 12 -- 22 Q. What's the next one? 23 A. 12998, which governs the national industrial security 24 program; 12949, which is the state, local triable; 12956, which 25 is control of unclassified information, just a bevy of these, And you mentioned that there were some other executive SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1919 K2jWsch6 Bradley - Direct 1 these orders. And again, they're governing different aspects 2 of how the government, U.S. government shares and protects 3 national security information. 4 Q. 5 and strikes? 6 A. Right. 7 Q. What did you mean by that? 8 A. I mean that we are seen as the neutral arbiter in disputes 9 and how things are supposed to be carried out. Now, you mentioned that you were the umpire, you call balls I myself -- how 10 can I describe this? I am kind of the information czar, a 11 better way -- the president is the true czar. 12 little czar. 13 order are being carried out lawfully and correctly. 14 I don't have a dog in the fight. 15 done properly. 16 home plate, strike or ball, I don't care which team wins, as 17 long as it's done correctly and lawfully. 18 Q. And how is one of those provisions teed up for you? 19 A. Well, it will often come as a -- we do a lot of oversight 20 over the intelligence community. 21 make sure that they're marking the documents properly. 22 make sure that they're handling them properly, that they're 23 storing them properly, that their systems are up to snuff. 24 it's a wide variety of oversight that we look at when we look 25 at, you know, how a government agency is handling the I'm kind of the But we make sure that the edicts of the executive So again, I just want to see that it's So again, I think of myself sitting right at So we'll go out and we'll SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 We'll So 1920 K2jWsch6 Bradley - Direct 1 information. 2 Q. 3 that you administer? 4 A. 5 that we practice it almost daily. 6 different groups in my office that go out. 7 security team that's constantly reviewing self-inspection 8 enforcement gains here. 9 agency officials from the IC. How do you familiarize yourself with the executive orders Well, I helped write it, so that's one way. Other way is I mean, we have -- I have I have a national We're constantly meeting with senior We have a real hands-on way of 10 doing oversight. 11 Q. 12 classification system? 13 A. 14 classification authority, an OCA, so I have to go through 15 yearly training, refresher training, really. 16 receives yearly training. 17 Q. 18 been dealing with classified information? 19 A. 20 And do you receive any trainings with respect to the U.S. I do. I mean, I'm what they call an original And my staff also For approximately how many years of your career have you Sometimes I think too long. MR. KAMARAJU: About 26, going on 27. Your Honor, the government would offer 21 Mr. Bradley as an expert on the United States government 22 classified national security information system. 23 MS. SHROFF: Your Honor, we have no objection at all. 24 THE COURT: 25 You've been recognized as an expert before, haven't OK. He's recognized as an expert. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1921 K2jWsch6 1 you? 2 3 Bradley - Direct THE WITNESS: This is my first time testifying, but yeah, I've been recognized as an expert before. 4 THE COURT: OK. 5 MR. KAMARAJU: Ms. Hurst, could you pull up for just 6 the witness and the parties Government Exhibit 1701, please. 7 Q. Sir, could you take a look at that? 8 A. Yes, sir. 9 Q. Do you recognize it? 10 A. I do. 11 Q. What is it? 12 A. It is a slide that my office, under my over-- oversight 13 prepared for this, this hearing, this trial. 14 Q. Does it represent a summary of your testimony? 15 A. It does. 16 Q. And will it aid in your testimony? 17 A. Yes, sir. 18 19 MR. KAMARAJU: Your Honor, the government would offer Government Exhibit 1701 as a demonstrative. 20 MS. SHROFF: 21 THE COURT: 22 (Government Exhibit 1701 received in evidence) 23 MR. KAMARAJU: 24 slide, please. 25 Q. We have no objection, your Honor. 1701 is in evidence. Ms. Hurst, could we go to the first You're the director of the information security oversight SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1922 K2jWsch6 Bradley - Direct 1 office, correct? 2 A. Correct. 3 Q. Let's talk a little bit about what that office is. 4 you explain the first bullet point, please? 5 A. 6 the government's complying with Executive Order 13526, which 7 governs how the federal government classifies safeguards and 8 declassifies national security information. 9 OK. We're authorized by the president to make sure that Now, I want to add a -- 10 Q. I just want to ask you to keep your voice up. 11 A. Yeah, sure. 12 Could I want to add one thing to this slide, which is that I 13 spent two years working for Senator Daniel Patrick Moynihan. I 14 was his legislative director. 15 years for Daniel Patrick Moynihan, who this courthouse is named 16 after. 17 commission that basically found that the U.S. government 18 classifies too much, doesn't declassify enough. 19 things that 13526 tries to do is, again, strike this balance 20 that we are in a democracy. 21 information as we can to keep the people's trust in the 22 government. I worked for a little over two And we -- he chaired something called the U.S. secrecy So one of the We try to declassify as much 23 Same side, we face extraordinarily grave threats, and so 24 it's critical that we have classified information to be able to 25 protect this republic, so it's a balancing act that we're SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1923 K2jWsch6 Bradley - Direct 1 constantly tasked with. 2 Q. 3 bullet that talks about serving as an impartial broker? 4 A. Yeah, that's it. 5 Q. What did you mean by that? 6 A. Means exactly just what I just said. 7 the game. 8 understood that we were going to be the neutral overseer of the 9 system. And I think you talked about this, but do you see the We are the umpires in The president, when this office was stood up, it was We understand the IC -- in fact, I was even part of it 10 once, but we are not -- we are not, we don't work for the 11 intelligence community. 12 intelligence community. 13 We don't take our orders from the My policy direction comes from two places. It comes from 14 Archivist of the United States and also from the National 15 Security Council, but not from the IC. 16 Q. 17 community. 18 intelligence community? 19 A. 20 range from the FBI. 21 We have NRO, the National Reconnaissance Office. 22 national geospatial, and just a plethora of agencies. 23 expanded dramatically. 24 we had the office of director of national intelligence, since 25 we had the Department of Homeland Security, things we didn't You mentioned that you're not a member of the intelligence What are some of the entities that are in the Well, you have Central Intelligence. We have CIA. There are 17. We have DOD. They We have DIA. We have It's It's expanded again after 9/11, since SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1924 K2jWsch6 Bradley - Direct 1 have before 9/11. 2 Q. You mentioned the executive order, correct? 3 A. Correct. 4 5 MR. KAMARAJU: Your Honor, we're breaking at 3:00 today? 6 THE COURT: 7 BY MR. KAMARAJU: 8 Q. 9 order. 10 So it's constantly evolving. A. 11 Yes. Let's just start talking generally about the executive Sure. MR. KAMARAJU: Could we go to the next slide, please. 12 Q. 13 information can be classified? 14 A. Right. 15 Q. And this slide, does this slide summarize some of the 16 categories that can be classified? 17 A. It summarizes such in 1.4 of Executive Order 13526. 18 Q. Let's talk just about some of these first. 19 where it says "information pertaining to military plans, 20 weapons systems or operations"? 21 A. Correct. 22 Q. Could you explain what that means, please? 23 A. When this order was written -- back up just a little bit. 24 25 Would the executive order provide guidance on what types of Do you see These executive orders, the way they started, back in the early 1950s with Harry Truman, we had just come out of a war SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1925 K2jWsch6 Bradley - Direct 1 and we were getting ready to go into another one called the 2 Cold War. 3 information. 4 very broad because the threats are constantly evolving. 5 What you have here is something that would still be 6 applicable in the 1950s but also be applicable in 2020. 7 again, military plans are exactly that. 8 plans, for instance, if the Iranians were to roll into Iraq 9 today, I mean, obviously we have plans for that. So debate raged about what to include as classified So intentionally the government made these orders They would be the U.S. Do we want 10 them out in the New York Times? 11 systems that we're going to use to counter the threats out in 12 the New York Times? 13 out? 14 American lives. 15 Q. 16 Why does there need to be flexibility in the -- 17 A. 18 been in this business a long time, and they're morphing all the 19 time. 20 we were in the Cold War and the Russians were the problem. 21 some ways the Russians are still the problem. 22 worry about many other -- the nation state actors and also the 23 individual actors in a way we never had to do before. 24 idea is to give us enough flexibility to be able to defend the 25 United States but have a system to be able to do it. No. No. So Do we want our weapons Do we want our operational planning The answer's no, because that would cost lives, cost And I think you mentioned the need for flexibility there. Because the threats are constantly evolving. I mean, I've I can't tell you how much -- when I first started out, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 In Now we have to So the I mean 1926 K2jWsch6 1 it's not just the Wild West. 2 here. 3 4 5 6 7 MR. KAMARAJU: THE COURT: We'll break now, ladies and Remember the common instructions. 9 the case. 12 All right. gentlemen. research. 11 Your Honor, I think the next couple of categories might take a little bit longer. 8 10 It is a logical, planned system Keep open minds. Don't talk to one another about We'll see you tomorrow. tomorrow. Don't do any We're going to start at 11:30 Safe home tonight. (Continued on next page) 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1927 K2jWsch6 1 (Jury not present) 2 THE COURT: 3 You're excused, Mr. Bradley. 4 THE WITNESS: 5 THE COURT: 6 THE WITNESS: 7 (Witness not present) 8 THE COURT: 9 Please be seated. Yeah. Thank you, Judge. See you tomorrow. Indeed. Where are we on witnesses now for the government? 10 MR. LAROCHE: Your Honor, I believe we have about four 11 witnesses left, four to five witnesses. 12 we have a short day tomorrow, but I think that we expect to be 13 done Monday or Tuesday at some point. 14 THE COURT: 15 MR. LAROCHE: 16 THE COURT: 17 18 I think that we will, Mr. Bradley was an added starter. I'm sorry, your Honor? He was an added starter. He wasn't on my list. MR. LAROCHE: Oh, I'm sorry, your Honor. 19 our fault. 20 of some witness scheduling issues. And that's We moved -- we had to adjust the schedule because 21 THE COURT: I see. 22 MR. LAROCHE: 23 THE COURT: 24 Ms. Shroff, do you want to bring up anything? 25 MS. SHROFF: I apologize about that. OK. No, your Honor. Thank you. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1928 K2jWsch6 1 2 THE COURT: OK. Thank you very much. See you tomorrow. 3 MR. LAROCHE: 4 MR. DENTON: 5 (Adjourned to February 20, 2020, at 11:30 a.m.) Thank you, your Honor. Thank you, your Honor. 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 1929 1 2 3 INDEX OF EXAMINATION Examination of: Page KAREN 4 Direct By Mr. Denton . . . . . . . . . . . . .1738 5 Cross By Ms. Shroff 6 Redirect By Mr. Denton . . . . . . . . . . . .1821 7 . . . . . . . . . . . . .1765 SEAN ROCHE 8 Direct By Mr. Denton . . . . . . . . . . . . .1825 9 Cross By Ms. Shroff 10 11 MARK A. BRADLEY Direct By Mr. Kamaraju . . . . . . . . . . . .1911 12 13 14 . . . . . . . . . . . . .1852 GOVERNMENT EXHIBITS Exhibit No. 1701 Received . . . . . . . . . . . . . . . . . . .1921 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300