2669 K2R3SCH1 2 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK ------------------------------x 3 UNITED STATES OF AMERICA, 4 v. 1 5 JOSHUA ADAM SCHULTE, 6 7 S2 17 Cr. 548 (PAC) Defendant. ------------------------------x New York, N.Y. February 27, 2020 10:00 a.m. 8 9 Trial Before: 10 HON. PAUL A. CROTTY, District Judge -and a juryAPPEARANCES 11 12 13 14 15 GEOFFREY S. BERMAN United States Attorney for the Southern District of New York BY: MATTHEW J. LAROCHE SIDHARDHA KAMARAJU DAVID W. DENTON JR. Assistant United States Attorneys 16 17 18 19 20 SABRINA P. SHROFF Attorney for Defendant -andDAVID E. PATTON Federal Defenders of New York, Inc. BY: EDWARD S. ZAS Assistant Federal Defender -andJAMES M. BRANDEN 21 22 23 24 Also Present: Colleen Geier Morgan Hurst, Paralegal Specialists Achal Fernando-Peiris, Paralegal John Lee, Litigation Support Daniel Hartenstine Matthew Mullery, CISOs, Department of Justice 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2670 K2R3SCH1 1 (Trial resumed; jury not present) 2 THE COURT: 3 MS. SHROFF: 4 MR. LAROCHE: 5 6 7 8 9 10 We all set? We think -Yes, your Honor. ready. MS. SHROFF: Your Honor, should we inform the Court what we're planning to do or do you want to just start? THE COURT: The jury's been waiting now 20 minutes, so I'd like to call the jury in and get started. You'll do whatever you think is appropriate. 11 David, call in the jury. 12 MS. SHROFF: 13 admitted into evidence, right? 14 THE COURT: 15 MS. SHROFF: 16 The government is Your Honor, you've ruled the memo Yes. We're going to move formally to introduce it, and have Mr. Fernando-Peiris read it to the jury. 17 THE COURT: 18 MS. SHROFF: 19 THE COURT: 20 MS. SHROFF: 21 (Continued on next page) All right. I am just letting you know. Thank you. You're welcome. 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2671 K2R3SCH1 1 (Jury present) 2 THE COURT: 3 MS. SHROFF: 4 Thank you, your Honor. THE COURT: Good morning. MS. SHROFF: 8 THE COURT: 9 MS. SHROFF: 10 THE COURT: 11 MS. SHROFF: 12 Do you have the memo? 13 THE WITNESS: 14 THE DEPUTY CLERK: He's not. He's just going to read? Yes. He doesn't have to be sworn then? I think it's best to swear him in. It's going to be on the screen, right? Please state your name for the record. 16 THE WITNESS: 17 THE COURT: 18 MS. SHROFF: 19 I understand he's not going to testify. 7 15 The defense calls Achal Fernando-Peiris. 5 6 Ms. Shroff. Achal Fernando-Peiris. Please sit down. You all set? Okay. The defense moves Exhibit L into evidence. 20 THE COURT: 21 (Defendant's Exhibit L received in evidence) 22 MS. SHROFF: 23 THE COURT: Yes, you may. 24 MS. SHROFF: Thank you. 25 That's received in evidence. May we publish it to the jury? ACHAL FERNANDO-PEIRIS, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2672 K2R3SCH1 Fernando-Peiris - Direct 1 called as a witness by the Defendant, 2 having been duly sworn, testified as follows: 3 DIRECT EXAMINATION 4 BY MS. SHROFF: 5 Q. 6 ask you to please, Achal. 7 A. Yes. 8 Q. Can you start with "memorandum for." 9 A. "Memorandum For: Could you read for me from the beginning and stop, when I Director, Office of Security. Via: 10 Chief, Special Activities Staff, Personnel Security Group, 11 Office of Security. 12 for Counterintelligence. 13 Leave for Michael." 14 Q. Could you continue, please. 15 A. "1. 16 administrative leave for Michael, a current CCI/COG employee 17 who is associated with the investigation into the theft and 18 unauthorized disclosure of Center for Cyber Intelligence 19 classified information published by WikiLeaks beginning in 20 March 2017, also known as Vault 7." 21 Q. Keep going. 22 A. "2. 23 inquiries into his past activities with the primary person of 24 interest in the FBI investigation and his unexplained 25 activities on the computer system from which the CCI data was From: Subject: Action requested: Justification: Deputy Assistant Director of CIA Request for Administrative CIMC requests enforced Michael's lack of cooperation with SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2673 K2R3SCH1 Fernando-Peiris - Direct 1 stolen, known as the DevLAN, and raises significant concern 2 about his truthfulness, trustworthiness, and willingness to 3 cooperate with both routine OS reinvestigation processes and 4 the criminal investigation into the theft from his office." 5 Q. 6 says "left." 7 A. That's correct. 8 Q. Okay. 9 A. That's correct. 10 Q. Okay, keep going. 11 A. "CIMC believes curtailing his access to CIA spaces and data 12 systems is necessary to safeguard against potential future 13 losses of sensitive and classified information." 14 Q. 15 bit faster if you may. 16 A. 17 student trainee in the Engineering Development Group (EDG) in 18 what is now the Center for Cyber Intelligence. 19 staff status in 2013, and remained in EDG until moving to 20 CCI/COG in the summer 2016. 21 developer with highly sensitive accesses. 22 interest in early 2016 to OS/Special Investigations Branch 23 (SIB) in connection with an investigation involving two other 24 CCI/EDG employees, Joshua Schulte and Amol, who reportedly had 25 a physical altercation within EDG spaces. Now, may I just interrupt and point out that the document Correct? And you read it as "theft," correct? Keep going, please. "3. Background: You can read this paragraph a little Michael entered on duty in 2011 as a He converted to Michael is a software exploit Michael was of Schulte alleged that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2674 K2R3SCH1 Fernando-Peiris - Direct 1 Amol had threatened his life, and Michael was interviewed as an 2 informant. 3 with Schulte in the workplace and SIB interviewed him and an 4 attempt to gain details." 5 Q. 6 reading or is it "in an attempt"? 7 A. In an attempt to gain details. 8 Q. Okay. 9 A. "Michael, however, was not cooperative and refused to Michael reportedly also had a physical altercation Let me stop you there. Is "and an" also correct in your Keep going. 10 discuss his prior altercation with Schulte. Ultimately the SIB 11 investigation did not substantiate the threat of physical harm 12 to Schulte and the case was closed when Schulte resigned from 13 CIA in November 2016. 14 to be victimized by Amol and was angered that CIA management 15 did not do more to protect him. 16 Michael with respect to his lack of cooperation with SIB." 17 Q. Keep going. 18 A. "4. 19 processing, which remains open at this time. 20 two sessions of polygraph testing in May 2017 but did not clear 21 all issues. 22 disclosure of CCI's cyber toolkit on WikiLeaks, CIMC requested 23 that OS pause all ongoing security processing involving 24 individuals who had access to the stolen data pending further 25 investigation of the incident by CIMC and FBI. At the time, Schulte perceived himself No action was taken against In February 2016, OS initiated reinvestigation Michael underwent In the wake of the theft and unauthorized SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Michael's 2675 K2R3SCH1 Fernando-Peiris - Direct 1 processing was paused as a part of that effort, as he held 2 systems administrator privileges on the DevLAN, the system from 3 which the toolkit was stolen, and was present in EDG spaces 4 during the timeframe of the theft." 5 Q. Okay. 6 A. "Investigation. 7 investigation, CIMC conducted comprehensive reviews of all 8 individuals who could have perpetrated the theft of the CCI 9 data, including Michael. We can move to the next paragraph. 5. In the support of the ongoing criminal Several concerns about Michael have 10 emerged in this review, including his close proximity to the 11 theft of the data and his relationship with Joshua Schulte, the 12 individual charged with the theft of data. 13 of Michael's activity on the DevLAN suggests that Michael may 14 have additional knowledge of anomalies on the system at the 15 time of the theft. 16 Michael is still withholding relevant information concerning 17 the circumstances surrounding the theft. 18 Forensic analysis Additionally, recent inquiries indicate "Risk assessment. 6. Given the magnitude of the 19 theft of the CCI toolkit and its concomitant damage to national 20 security, CIMC views Michael's lack of cooperation as a 21 significant and untenable risk to the security of the 22 operations on which he now works and any new tools he deploys 23 for CCI. 24 with routine inquiries by SIB and during polygraph, and has 25 failed to provide clear and verifiable information concerning Michael, whatever his reasoning, has not complied SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2676 K2R3SCH1 1 his activities in the workplace around the time of the theft. 2 Michael's behavior suggests that his knowledge of details --" 3 Q. I think you missed a word. 4 A. "Michael's behavior suggests that he has knowledge of 5 details of the theft that he has not divulged. 6 behavior suggests a lack of concern for the loss and a lack of 7 commitment to comply with the basic security agreements he 8 entered into upon hire. 9 Michael's continued presence in the workplace is incompatible Michael's For these reasons, CIMC assesses that 10 with best practices for security and insider threat 11 mitigation." 12 Q. Go ahead. 13 A. "Next steps. 14 Security: 15 that he may not gain access to CIA facilities; place Michael on 16 enforced administrative leave until the investigation into his 17 knowledge of the theft of the CCI cyber toolkit is resolved. 18 7. CIMC requests that the Office of Immediately deactivate or block Michael's badge so "Concur." Under the first line it says: 19 special activities staff and then date. 20 approved: MS. SHROFF: 22 (Witness excused) 23 MS. SHROFF: 25 And then it says Director, Office of Security, and then date. 21 24 Chief, Thank you. You may step down. Your Honor, the defense has one stip it would like to read into evidence to the jury. THE COURT: Yes, go ahead. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2677 K2R3SCH1 1 MS. SHROFF: 2 THE COURT: 3 MS. SHROFF: May I, your Honor? Yes, please. It is hereby stipulated and agreed, by 4 and among the United States of America by Geoffrey S. Berman, 5 United States Attorney for the Southern District of New York, 6 David W. Denton, Jr., Sidhardha Kamaraju, and Matthew Laroche, 7 Assistant United States Attorneys, of counsel, and Joshua Adam 8 Schulte, the defendant, by and with the consent of his counsel, 9 Sabrina Shroff, Edward Zas, and James Branden that: 10 As of March and April 2016, the Confluence virtual 11 machine had a user account named Confluence. 12 user account password of 123ABCdef. was not changed on April 16 13 of 2016. 14 The Confluence According to Government Exhibit 1207-24, no entry 15 shows that the Confluence user account was used to log into the 16 Confluence virtual machine in April or March or April of 2016. 17 It is further stipulated and agreed that this 18 stipulation as Defense Exhibit O may be received in evidence as 19 a defense exhibit at trial. 20 February 27, 2020, and is signed by Mr. Laroche, and counsel 21 for the defendant, Mr. Zas, Ms. Shroff, and Mr. Branden. 22 May I just have one minute, your Honor. 23 (Defendant's Exhibit O received in evidence) 24 THE COURT: 25 MS. SHROFF: The stipulation is dated today, Yes. And your Honor, without objection from SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2678 K2R3SCH1 1 the government, the defense would move into evidence prison 2 records that would show, as Defense Exhibit P, that as of 3 October 1st of 2016, Mr. Schulte was not -- no. 4 I'm stuck in '16. 5 population on October 1st, but was in fact in the SHU, which is 6 the Segregated Housing Unit at the MCC. I'm sorry. 2018, that Mr. Schulte was not in general 7 THE COURT: 8 MS. SHROFF: 9 THE COURT: What exhibit is that? P as in parrot, your Honor. It's received in evidence. 10 (Defendant's Exhibit P received in evidence) 11 MS. SHROFF: 12 13 14 rests, your Honor. THE COURT: The defense on behalf of Joshua Schulte Thank you. I'm going to excuse the jury for a second. There is a matter I want to take up. 15 (Jury excused) 16 (Continued on next page) 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2679 K2R3SCH1 1 2 THE COURT: I understand that Mr. Schulte is not going to testify? 3 MS. SHROFF: 4 THE COURT: That's correct, your Honor. Mr. Schulte, I have to advise you that you 5 have the right to testify if you wish to do so. 6 the right not to testify. 7 It is a Constitutional dimension. 8 right; it's your right. You also have It's a personal right that you have. It's not your attorneys' You can waive it if you wish to do so. 9 If you testify, you can be cross-examined. If you do 10 not testify, the jury will be advised that they can draw no 11 adverse inference from your not testifying. 12 I want to be sure that you've talked with your 13 attorneys and your consultants and your advisors in making your 14 decision not to testify. 15 Is that correct? 16 THE DEFENDANT: 17 THE COURT: 18 Okay. So it's your decision not to testify; is that correct? 19 THE DEFENDANT: 20 THE COURT: 21 Yes. Yes, sir. Okay. Anything else the government or Ms. Shroff want me to ask? 22 MS. SHROFF: I think you go first, Mr. Denton. 23 MR. DENTON: Nothing with respect to this issue, your MS. SHROFF: No. 24 25 Honor. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2680 K2R3SCH1 1 THE COURT: 2 You rest now. 3 can rest in front of the jury. 4 MS. SHROFF: 5 Thank you. Please be seated. I'm going to call the jury now so you Correct? We rested, your Honor. I am pretty sure we rested in front of the jury. 6 THE COURT: 7 MR. DENTON: All right. Mr. Denton? Then I think as Mr. Laroche indicated 8 yesterday, we just have one short rebuttal witness on the memo, 9 your Honor. 10 THE COURT: 11 MR. DENTON: 12 THE COURT: 13 MS. SHROFF: 14 15 Okay. You ready to proceed on that? We are. Call the jury back. I'm just curious, do you explain to them rebuttal witnesses or you just put him on and then we cross? THE COURT: I'm going to say that the government has a 16 right to make a rebuttal. 17 that's what this witness is going to do. They are going to make the rebuttal, 18 MS. SHROFF: Okay. Thank you. 19 THE COURT: 20 (Continued on next page) You're welcome. 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2681 K2R3SCH1 Hall - Direct 1 (Jury present) 2 THE COURT: As you heard, the government has rested, 3 the defense has rested. The government now has an opportunity 4 to make a short rebuttal, which they're going to do by calling 5 a witness. 6 Mr. Denton. 7 MR. DENTON: 8 THE DEPUTY CLERK: 9 The government calls Carter Hall. record. 10 THE WITNESS: 11 THE DEPUTY CLERK: 12 THE COURT: 13 right up to the microphone. 14 Please state your name for the Carter Hall. Witness sworn. Please sit down, Mr. Hall. Pull yourself Okay, Mr. Denton. CARTER HALL, 15 called as a witness by the Government, 16 having been duly sworn, testified as follows: 17 DIRECT EXAMINATION 18 BY MR. DENTON: 19 Q. Good morning, sir. 20 A. Good morning. 21 Q. Are you employed? 22 A. I am. 23 Q. Where do you work? 24 A. At the CIA. 25 Q. How long have you worked for the CIA? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2682 K2R3SCH1 Hall - Direct 1 A. About 15 years. 2 Q. What is your current position at the CIA? 3 A. I'm currently the deputy chief of the Counterespionage 4 Department within the Counterintelligence Mission Center. 5 Q. Is that sometimes known as CIMC? 6 A. It is. 7 Q. How long have you been in that position? 8 A. Since January of 2019. 9 Q. Generally speaking, what are your duties and 10 responsibilities as the deputy chief of the Counterespionage 11 Department? 12 A. 13 are conducting counterintelligence and counterespionage 14 investigations of CIA officers, contractors, and former 15 affiliated personnel. 16 Q. 17 2019. 18 CIA officer known as Michael? 19 A. Yes, I did. 20 Q. During that time period, did there come a time when you 21 participated in a decision to place Michael on administrative 22 leave from the CIA? 23 A. 24 25 It's to oversee the investigators within the department who Sir, I'd like to direct your attention to the summer of During that time period, did you become familiar with a Yes, I did. MR. DENTON: Ms. Hurst, can we put up Defense Exhibit L, please. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2683 K2R3SCH1 Hall - Direct 1 Q. Sir, do you recognize this? 2 A. I do. 3 Q. What is it? 4 A. It is the formal memo from CIMC to the director of the 5 Office of Security requesting to place Michael on enforced 6 administrative leave. 7 Q. Did you play a role in the preparation of this memo? 8 A. I did. 9 Q. What was your role? 10 A. I directed the senior investigator who drafted it to draft 11 it, and I oversaw its finalization, and approved its forwarding 12 to the director of security. 13 Q. 14 in a moment. 15 Michael be placed on administrative leave? 16 A. 17 both into a couple of incidents involving the defendant, as 18 well as his own security reinvestigation processing. 19 We're going to talk about this, the specifics of the memo But just generally, why did you recommend that He had been uncooperative through the security process, MR. DENTON: So, let's take a look at some parts of 20 this memo. Starting with the first paragraph, paragraph 1, can 21 we blow that up, Ms. Hurst. 22 Q. 23 "Michael is an employee who is associated with the 24 investigation into the theft and unauthorized disclosure of 25 Center for Cyber Intelligence classified information published Sir, do you see in this paragraph where it says that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2684 K2R3SCH1 Hall - Direct 1 by WikiLeaks beginning in March 2017, also known as Vault 7." 2 A. Yes. 3 Q. So, what agency was principally responsible for conducting 4 the investigation into that theft and unauthorized disclosure? 5 A. The FBI. 6 Q. How was Michael associated with the investigation? 7 A. So, he was an employee in the same component in the CIA as 8 the defendant. 9 where the theft took place. He was also physically present at the facility 10 Q. At the time that you prepared this memo, was Michael a 11 suspect in that theft and unauthorized disclosure? 12 A. No. 13 MR. DENTON: You can zoom out, Ms. Hurst, and look at 14 paragraph 2, please. 15 Q. 16 where it refers to "Michael's lack of cooperation with 17 inquiries into his past activities with the primary person of 18 interest in the FBI investigation." 19 A. I do. 20 Q. Who does the primary person of interest in the FBI 21 investigation refer to? 22 A. Mr. Schulte. 23 Q. What of Michael's past activities with Mr. Schulte are you 24 referring to in the memo? 25 A. So, sir, just starting with the first sentence, do you see So, they had had a long personal and professional SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2685 K2R3SCH1 Hall - Direct 1 relationship, and at one point had had a physical altercation 2 in the workplace. 3 Q. 4 "his unexplained activities on the computer system from which 5 the CCI data was stolen." 6 referring to? 7 A. 8 network in question. 9 investigative personnel in discussing why he had done that. Then, just continuing in that sentence, where it refers to What unexplained activities are you He had taken a screenshot on the day of the theft on the And he was not cooperative with 10 Q. So, when it says "unexplained activities on the computer 11 system," did you mean to indicate that Michael might have been 12 responsible for the theft of the CIA information? 13 MS. SHROFF: 14 leading the witness. 15 THE COURT: 16 MR. DENTON: I'm going to object to the leading. He's Mr. Denton, don't lead. Understood, your Honor. 17 Q. When you said "his unexplained activities on the computer 18 system," did you mean to indicate -- 19 MS. SHROFF: Again, he's leading. 20 MR. DENTON: I'm asking him what he meant. 21 MS. SHROFF: Ask him what he meant. 22 THE COURT: Go ahead, Mr. Denton. The objection is 23 overruled. 24 Q. 25 mean to indicate that Michael was responsible for the theft of When you referred to his unexplained activities, did you SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2686 K2R3SCH1 1 the Vault 7 information? 2 3 Hall - Direct MS. SHROFF: That's leading. He could ask "what did you mean." 4 THE COURT: Overruled. 5 A. No. 6 Q. So, just continuing here. 7 indicates that the past activities with the defendant and 8 screenshot that you described raise significant concern about 9 Michael's truthfulness, trustworthiness, and so on. 10 The rest of that sentence Why did those two things that you described raise 11 concern about his truthfulness or trustworthiness? 12 A. 13 clearance, to retain employment, we have to be confident that 14 you are trustworthy and you're candid about your activities and 15 those of your co-workers, your knowledge of them. Because at the agency, in order to hold a security 16 The fact that he had taken the screenshot would 17 suggest that he knew something had taken place that was -- 18 wrong. 19 investigators into that as well as the altercation with the 20 defendant, led us to believe that he was not trustworthy. 21 Q. 22 globally where you refer to his cooperation with inquiries, 23 what inquiries are you talking about? 24 A. 25 Security into the altercation between Michael and Mr. Schulte And the fact that he did not cooperate with Just starting at the top of this paragraph again, just So, there were two separate investigations by the Office of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2687 K2R3SCH1 Hall - Direct 1 as well as Mr. Schulte and another employee. 2 refused to talk to our investigators about those incidents. 3 MR. DENTON: And Michael Ms. Hurst, if we can go to the second 4 page, please, and blow up paragraph 3. 5 Q. 6 way down, I'll try to draw a little blue line here, that starts 7 "Ultimately the SIB investigation did not substantiate the 8 threat of physical harm to Schulte." 9 A. Yes. 10 Q. Is that one of the inquiries that you were just referring 11 to? 12 A. Do you see the sentence that's about three-quarters of the It is. 13 MR. DENTON: Ms. Hurst, if we can move on and go to 14 paragraph 4, please. 15 Q. 16 sentence that reads, "In the wake of the theft and unauthorized 17 disclosure of CCI's cyber toolkit on WikiLeaks, CIMC requested 18 that OS pause all ongoing security processing involving 19 individuals who had access to the stolen data pending further 20 investigation of the incident by CIMC and FBI." 21 A. Yes. 22 Q. How did the fact that an FBI investigation was ongoing 23 affect the security process? 24 A. 25 standard practice when there is an open criminal investigation So, starting about a third of the way down, you see the So there are two separate investigative tracks, and our SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2688 K2R3SCH1 Hall - Direct 1 is to pause any sort of administrative or security 2 investigation in order to protect the integrity of the criminal 3 investigation. 4 Q. 5 Michael's processing was paused as a part of that effort. 6 does that mean? 7 A. 8 open, that we were not going to proceed with resolving that 9 reinvestigation process or conducting any other interviews with Just looking down at the next sentence, it talks about how What It meant that although his security reinvestigation was 10 him until the FBI investigation had run its course. 11 Q. 12 administrator privileges on the DevLAN." 13 A. I do. 14 Q. First of all, let me ask you, are you a technical person, 15 sir? 16 A. I'm not. 17 Q. Do you know what system administrator privileges Michael 18 held? 19 A. I do not. 20 Q. Do you know how they compared to the defendant's system 21 administrator privileges? 22 A. I do not. 23 Q. Finally, it talks about how Michael was present in EDG 24 spaces during the timeframe of the theft. 25 What does that refer to? Then the next sentence continues "as he held systems Do you see that? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2689 K2R3SCH1 Hall - Direct 1 A. He was physically present in the same CCI office facility 2 that Mr. Schulte was. 3 MR. DENTON: So then, Ms. Hurst, if we can zoom out 4 and if there a way to grab the bottom of page two and the top 5 of page three, that would be perfect. 6 Q. Now, sir, can you read the first sentence of number 5. 7 A. Yes. 8 CIMC conducted comprehensive reviews of all individuals who 9 could have perpetrated the theft of the CCI data, including Thank you. "In support of the ongoing criminal investigation, 10 Michael." 11 Q. Were you working in CIMC when those reviews were conducted? 12 A. I was not. 13 Q. So, just continuing on, the paragraph identifies several 14 concerns about Michael. 15 them. 16 of the data. 17 A. I do. 18 Q. What does that refer to? 19 A. Again, his physical proximity in the same CCI office 20 facility that the theft took place in. 21 Q. 22 with Joshua Schulte, the individual charged with the theft of 23 data. 24 A. Yes. 25 Q. What about his relationship with Joshua Schulte was I'm going to ask you about each of The first one refers to his close proximity to the theft Do you see that? Then that sentence continues to refer to his relationship Do you see that? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2690 K2R3SCH1 Hall - Direct 1 concerning? 2 A. 3 with Mr. Schulte, they had had an altercation, and he had 4 refused to discuss what the status of his relationship was with 5 Mr. Schulte, what led to that altercation, and what -- you 6 know, details of the altercation between Mr. Schulte and the 7 other CCI employee. 8 Q. 9 a security concern? Again, he had had a personal and professional relationship Why is that relationship relevant to whether Michael posed 10 MS. SHROFF: Which relationship? 11 Q. Why was Michael's relationship with the defendant relevant 12 to whether Michael posed a security concern? 13 A. 14 Mr. Schulte had previously had incidents where he had been 15 removed from privileges on the network and given them back to 16 himself. 17 screenshot because he thought that Mr. Schulte had done 18 something similar, and the fact that he was unwilling to talk 19 to us about it was a concern for us. 20 Q. 21 it? 22 A. 23 something wrong, manipulated the network in an unauthorized 24 fashion. 25 employees to discuss either with their management or security Because we knew that Michael and others knew that So, we suspected that Michael had taken the Why was it a concern that he wasn't willing to talk about Because we suspected that he knew that Mr. Schulte had done So as a matter of security principle, we expect our SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2691 K2R3SCH1 Hall - Direct 1 when a co-worker does something that's unauthorized. 2 Q. 3 of Michael's activity on the DevLAN suggests that Michael may 4 have additional knowledge of anomalies on the system at the 5 time of the theft." 6 A. I do. 7 Q. First of all, what agency was responsible for conducting 8 that forensic analysis? 9 A. The FBI. 10 Q. When you refer to his activity on DevLAN, what in 11 particular are you referring to? 12 A. 13 the day of the theft. 14 Q. 15 anomalies on the system. 16 A. 17 previously given himself unauthorized access to EDG network 18 data that he had been removed from, and we suspected that 19 Michael had taken the screenshot because he thought that 20 Mr. Schulte had done the same thing again in this instance. 21 Q. 22 there. 23 Michael may have additional knowledge about those anomalies? 24 A. 25 in some way, taken data off of it and then had manipulated it Moving on, the next sentence refers to "forensic analysis You see that? Specifically the screenshot he took of the network status Then a little later on in that sentence, it refers to What anomalies are you referring to? Again, we knew that Michael knew that Mr. Schulte had Just finally, I think you may have answered this in part But, what are you referring to when you say that That he knew that Mr. Schulte had manipulated the network SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2692 K2R3SCH1 Hall - Direct 1 to look as though it hadn't happened. 2 Q. 3 the same thing that the "relevant information concerning the 4 circumstances" refers to? 5 A. It is. 6 Q. Where it says "recent inquiries indicate that Michael is 7 still withholding that information," what recent inquiries are 8 you referring to? 9 A. So then just more briefly on the final sentence. Is that He had had an interview with the Department of Justice in 10 the summer of 2019 where he again was non-cooperative with 11 questioning about that particular incident, and others 12 surrounding his interaction with Mr. Schulte. 13 MR. DENTON: Ms. Hurst, can we zoom out and go to 14 paragraph 6 on page three, please. 15 Q. 16 here. 17 A. 18 its concomitant damage to national security, CIMC views 19 Michael's lack of cooperation as a significant and untenable 20 risk to the security of the operations on which he now works 21 and any new tools he deploys for CCI." 22 Q. 23 responsible for that theft? 24 A. No, it does not. 25 Q. Why was his lack of cooperation a concern with respect to Sir, could you do me a favor and read the first sentence "Given the magnitude of the theft of the CCI toolkit and Does that sentence indicate that you believe Michael was SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2693 K2R3SCH1 Hall - Direct 1 the security of the operations on which he now works? 2 A. 3 CIA is that we trust that you are going to be a good steward of 4 classified information. 5 unwilling to cooperate with the security process, coupled with 6 his access to sensitive data, led us to feel that we could not 7 trust him in access. 8 MR. DENTON: 9 page one, Ms. Hurst. One of the fundamental principles of holding a clearance at And the fact that Michael was If we can just zoom out and go back to 10 Q. Do you see where it says "Memorandum for Director, Office 11 of Security"? 12 A. I do. 13 Q. After this memo was drafted, was it sent to the director of 14 the Office of Security? 15 A. It was. 16 Q. Did you speak with the director about it? 17 A. I did. 18 Q. Why did you speak with the director about this memo? 19 A. He was not in his office and on the computer system at the 20 time. 21 secure line about the content of the memo. 22 Q. Tell us what you spoke about with him. 23 A. We talked about the reasons for our request to place 24 Michael on enforced admin leave, and I read to him portions of 25 the memo over the secure line. So in the interest of time, I spoke with him on the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2694 K2R3SCH1 Hall - Cross 1 Q. At any point during your conversation with the director did 2 you indicate that Michael was a suspect in the Vault 7 leak? 3 A. No. 4 Q. Why didn't you indicate that? 5 A. Because he wasn't. 6 Q. Did the director ultimately agree with the recommendation 7 in the memo? 8 A. He did. 9 Q. As far as you know, were any of these reasons why Michael 10 was placed on administrative leave ever communicated to 11 Michael? 12 A. No. 13 Q. Why not? 14 A. It's not our standard practice at the agency to communicate 15 the reason for placing somebody on enforced admin leave. 16 simply tell them that they are going to be placed on enforced 17 admin leave, and walk them through the process for their 18 interaction with the agency during that time. 19 MR. DENTON: 20 THE COURT: We No further questions, your Honor. Ms. Shroff? 21 CROSS-EXAMINATION 22 BY MS. SHROFF: 23 Q. Let's start at the very beginning, okay? 24 A. Okay. 25 Q. Let's pull up the memo. In preparation of writing this SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2695 K2R3SCH1 Hall - Cross 1 memo, Mr. Hall, did you review Michael's investigative file? 2 A. I didn't personally review his investigative file, no. 3 Q. You told Mr. Denton in one of your conversations with him 4 that you had a staffer -- that's the word you used -- write the 5 memo, correct? 6 A. It was a senior investigator within our department, yes. 7 Q. Do you know if you told him to review Michael's 8 investigative file before writing this memo? 9 A. She -- I did not tell her to review his investigative file. 10 But she was familiar with it, having been an investigator on 11 this particular matter. 12 Q. 13 the way? 14 A. Tracy. 15 Q. Okay. 16 A. I did not. 17 Q. You did not. 18 A. No. 19 Q. Did you tell her to review any other documents before 20 assigning her the task of drafting this memo? 21 A. No, I did not. 22 Q. Did you review Michael's investigative file in preparation 23 for your testimony today? 24 A. I did. 25 Q. You did, right? How about, did you tell her -- what's her first name, by And did you tell Tracy to review Michael's bio file? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2696 K2R3SCH1 Hall - Cross 1 A. Yes. 2 Q. You reviewed Michael's entire investigative file before you 3 testified today, correct? 4 A. 5 security file. 6 Q. 7 called? 8 A. 9 association with this particular theft. No, I did not, not his entire file. I did not review his I reviewed the CIMC assessment of Michael. So you reviewed his investigative file; is that what it's No. I reviewed the CIMC assessment of Michael and his 10 Q. Right. When did you review those documents? 11 A. Over the course of the last week or two I would say. 12 Q. Did you also review Michael's polygraphs? 13 A. No, I did not review Michael's polygraph reports. 14 Q. You did not review the polygraph reports which he did not 15 pass conclusively? 16 A. 17 his polygraph in them. 18 reports from the Office of Security. 19 Q. 20 here? 21 A. I'm sorry. 22 Q. Sure. 23 testimony here today, did you provide a copy to Mr. Denton? 24 A. The agency provided a copy, yes. 25 Q. By agency, do you mean like those lawyers that are sitting Again, I reviewed the CIMC assessment that had summaries of I did not review the specific polygraph Did you provide that file that you reviewed to Mr. Denton Say that again? The file that you reviewed to prepare for your SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2697 K2R3SCH1 Hall - Cross 1 in the courtroom here today? 2 A. 3 Counsel, but I don't know specifically. 4 Q. 5 correct? 6 right? 7 A. Yes. 8 Q. And you were the deputy chief at CIMC, correct? 9 A. I'm the deputy chief of the Counterespionage Department, I don't know who -- I would assume the Office of General Okay. Mr. Denton asked you about your work at the CIA, You said you were employed by the CIA for 15 years, 10 which is one department within CIMC, yes. 11 Q. 12 year, not quite a year? 13 A. Over a year, since January of 2019. 14 Q. Before that, what was your position before that? 15 A. Just prior to this position, I was the chief of the 16 security intelligence cell within the Office of Security. 17 Q. 18 work seriously? 19 A. I take my work seriously, yes. 20 Q. As part of your work at the CIA, you were responsible for 21 drafting memos such as this one, correct? 22 A. 23 memos. 24 them and approve them for official routing. 25 Q. You've been in that position for how long now, about a It's fair to say, is it not, Mr. Hall, that you take your No, I'm not usually the person who drafts these types of As a senior manager within the department, I may review Okay. Well, you drafted this memo in the sense that you SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2698 K2R3SCH1 Hall - Cross 1 reviewed it with the person -- or as you called her, the 2 staffer -- who wrote the memo, correct? 3 A. I reviewed it, and I approved her final draft, yes. 4 Q. Right. 5 contemporaneously with her, correct? 6 A. Yes, that's correct. 7 Q. So as she was typing it up, you were reviewing it, correct? 8 A. Not as she was typing it up. 9 final draft. When you reviewed it, you reviewed it literally When she had completed her 10 Q. So let me direct your attention to a document here that 11 might refresh -- are you sure that you did not review it as it 12 was being drafted? 13 A. 14 final draft that I looked on her computer, did review the 15 language, and approved it for its routing to the director. 16 Q. 17 started? 18 A. No, I don't recall. 19 Q. Do you recall telling Mr. Denton that you spoke and 20 reviewed it with the person as it was being drafted and spoke 21 about it verbally? 22 A. Yes, vaguely. 23 Q. Vaguely? 24 week ago. 25 A. I did not review it as she was drafting it. She had a So, do you know what date the drafting of this memo Do you recall that? This was only February 22. That's not even a Yes, I recall it. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2699 K2R3SCH1 Hall - Cross 1 Q. Right. You were on a phone call, correct, with Mr. Denton 2 here, right? 3 A. Yes. 4 Q. And on that phone call was a CIA lawyer whose initials are 5 C.G., correct? 6 A. Yes, there was. 7 Q. Okay. 8 A. I believe so. 9 Q. Well, you are the CIA, right? Is there a CIA lawyer on the call? And then there was the agent on the call? I'm not sure. Did you take notes of who 10 was on a telephone call with you? 11 A. I did not personally take notes, no. 12 Q. Do you know who the other participants were? 13 A. I don't know specifically who was on the call other than 14 Mr. Denton. 15 Q. 16 correct? 17 A. Yes. 18 Q. And you don't recall telling him that you were with the 19 person as the memo was being drafted, correct? 20 A. 21 I cleared on the final language, the final draft. 22 Q. 23 you recall telling him that you were physically present as the 24 memo was being drafted? 25 A. Okay. So, you spoke to Mr. Denton less than a week ago, I was with her as I directed her to draft the memo, and as But that wasn't the question I asked. My question was do No, I don't recall that. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2700 K2R3SCH1 Hall - Cross 1 Q. Okay. When you reviewed this memo, you were careful in 2 your review, correct? 3 A. Yes. 4 Q. You knew it was an important memo to write, correct? 5 A. No more so important than any other memo we draft. 6 Q. No more important than any other memo you draft. 7 to execution of this memo was this memo drafted? 8 A. Within a matter of a day. 9 Q. Within a matter of a day, right? 10 A. Yeah. 11 Q. You had urgency to this memo, correct, according to you? 12 A. There was -- yes. 13 Q. Right. 14 A. The memo involved our decision that Michael was an 15 unacceptable risk to leave in place, yes. 16 Q. How close This memo involved your precious tools, correct? In August of 2019, correct? 17 He was an unacceptable risk to leave in place in 18 August of 2019, correct? 19 A. Yes, yes. 20 Q. When was this altercation with Mr. Schulte, the physical 21 one? 22 A. I don't recall the exact date. 23 Q. Did Mr. Denton not prepare you that question? 24 A. We didn't discuss specific dates of the altercation. 25 Q. Did you read it in his investigative file? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2701 K2R3SCH1 Hall - Cross 1 A. I recall reading about the altercation. 2 the specific date. 3 Q. 4 based on your concern about Mr. Michael not discussing that 5 physical altercation, the date of which you do not remember. 6 Okay? 7 A. Okay. 8 Q. You do recall, Mr. Hall, that that altercation definitely 9 did not take place in 2019, right? Ah. I did not focus on Well, we'll get to that, because a lot of your memo is 10 A. It did not. 11 Q. Not even 2018, correct? 12 A. It did not. 13 Q. Not even 2016, correct? 14 A. I don't recall whether it was '16 or not. 15 Q. Sitting here today, you did not recall that it happened in 16 October of 2015? 17 A. No, I don't. 18 Q. Sitting here today, sir, do you know when was the first 19 time Michael declined to talk to anyone at the CIA about this 20 physical altercation; do you remember? 21 A. The specific date, I don't. 22 Q. Forget about date. 23 remember a year? 24 A. It would have been -- 25 Q. No, no, not "would have been." Let's go with year. Do you even Do you remember a year? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2702 K2R3SCH1 Hall - Cross 1 A. I do not. 2 Q. Do you by any chance even know if management ever knew 3 about this altercation in 2015? 4 A. No, I don't know. 5 Q. Do you know if Sean F. even thought that altercation worthy 6 enough to escalate it to the next level of management? 7 A. 8 to do so. 9 Q. It wouldn't have been -- 10 A. The Office of Security can independently investigate 11 incidents like that in the workplace. 12 Q. 13 please try and listen to my question. 14 aware that their immediate boss did not think that fight of any 15 consequence such that he escalated it to security? I don't know, but it wouldn't have been his responsibility Great. 16 My question wasn't that. My question was, and My question is, were you Were you aware of even that? 17 A. I was not aware of that. 18 a security officer. 19 Q. 20 know if the fight started over two grown men throwing rubber 21 bands at each other? 22 A. I do. 23 Q. Right. 24 anything of it, correct? 25 correct? Okay. But their immediate boss was not We'll go with that. Let's put it this way. Do you And you know that after that fight, nobody thought Until 2019, when you wrote this memo, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2703 K2R3SCH1 Hall - Cross 1 A. No -- 2 Q. No action was taken against Mike, right, based on the 3 fight? 4 A. No, there wasn't. 5 Q. No, no. Was any action taken? 6 MR. DENTON: 7 THE COURT: 8 Q. 9 question. But that does not mean there wasn't -- Your Honor, can he answer question? He can answer the question. The question was, was any action taken. That was the 10 A. No, no action was taken. 11 Q. Was he moved out of his group? 12 A. No. 13 Q. Moved out of his branch? 14 A. I don't recall. 15 Q. They didn't even move his desk, correct? 16 A. I don't know. 17 Q. Okay. 18 you say, sir, that this memo is an important document for the 19 CIA itself to be accurate about? 20 A. We always try to be accurate in our documentation. 21 Q. So you tried to be accurate here, correct? 22 A. Yes. 23 Q. And you would agree with me that this memo has implications 24 for the employee himself, Michael, correct? 25 A. I don't know. Let's just go back to this memo, all right? It does. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Would 2704 K2R3SCH1 Hall - Cross 1 Q. Right. It has implications for his future, correct? 2 A. It does. 3 Q. It has implications for your agency, correct? 4 A. Somewhat, but it's more focused on Michael. 5 Q. It's more focused on Michael and not the mission? 6 thought the whole thing about the CIA was mission before self, 7 correct? 8 A. 9 about the memo, however. I That's not what we're talking about when we're talking 10 Q. Okay. Now, in this memo, you requested rather urgently 11 that Michael be placed on administrative leave, correct? 12 A. Correct. 13 Q. And when a person is placed on administrative leave, 14 they're not allowed to come back to work, correct? 15 A. That's correct. 16 Q. And they're banned from every CIA facility, correct? 17 A. That's correct. 18 Q. It's a serious sanction, you'd agree with me, correct? 19 A. It's a serious step, yes. 20 Q. And you knew when you wrote this memo that people would 21 read this memo, did you not? 22 A. 23 read the memo, yes. 24 Q. 25 memo, correct? I knew that a limited number of people at the agency would And you knew that people would rely on the facts in this SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2705 K2R3SCH1 Hall - Cross 1 A. Yes, I did. 2 Q. And you knew, sir, that important decisions were going to 3 be made based on this memo, correct? 4 A. Correct. 5 Q. You knew this memo would be read closely, correct? 6 A. Yes. 7 Q. Scrutinized, correct? 8 A. It would be scrutinized for its approval, yes. 9 Q. Well, no. Michael could want to take action based on the 10 memo, correct? 11 A. 12 simply processing the request. 13 Q. 14 this memo was clear, correct? 15 A. Yes. 16 Q. You wanted it to be direct, correct? 17 A. Yes. 18 Q. And you didn't want to lie or color or bias this memo in 19 any way, correct? 20 A. Correct. 21 Q. Okay. 22 with where you started. 23 answers you gave to the government today. 24 A. Okay. 25 Q. All right. It could, but that's not part of my responsibility. Okay. It's It is fair to say that you wanted to make sure that And when you take a look at the memo, let's start Okay. And then we'll compare the Okay? So let's start with paragraph 1. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 "CIMC 2706 K2R3SCH1 Hall - Cross 1 requests enforced administrative leave for Michael, a current 2 CCI/COG employee." 3 Let's just stop there for a minute. What is COG? 4 A. The Computer Operations Group within CCI. 5 Q. Right. 6 A. I don't know. 7 Q. You don't know? 8 A. No. 9 Q. You don't know Michael had been allowed to move from OSB to And Michael had moved from OSB to COG, correct? 10 COG after the physical altercation with Mr. Schulte? 11 A. I don't know what the timeline was of his moving to COG. 12 Q. At that time, I take it there were no concerns raised to 13 security about Michael, correct? 14 A. I don't know. 15 Q. COG is the unit that works with deployment of tools, 16 correct? 17 A. Yes. 18 Q. It is a coveted position to work in COG, correct? 19 A. I don't know. 20 Q. Okay. 21 A. He was. 22 Q. Okay. 23 that there is no concern about unauthorized disclosure for any 24 employee working in COG, correct? 25 A. But he was allowed to move to COG, correct? And certainly you are not suggesting, are you, sir, No. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2707 K2R3SCH1 Hall - Cross 1 Q. Okay. In fact, you want to make sure that the people 2 working in COG are people you can trust, correct? 3 A. 4 people across the agency are people that we can trust. 5 Q. 6 give that answer. 7 Correct? 8 somebody you trust, right? 9 A. Correct, the same as every other employee in the agency. 10 Q. Great. 11 this justification, right, that you give for putting this man 12 on administrative leave. 13 "Michael's lack of cooperation with inquiries into his past 14 activities with the person of interest in the FBI 15 investigation" and -- let's stop there. I would say that the -- our interest is making sure that Sure. 16 When we talk about people across the agency, you can Right now I'm asking about COG. You want to make sure everyone in COG is Let's go to paragraph 2. Now, let's start with Let's start with the first sentence. That's your first sentence, right? His lack of 17 cooperation. 18 A. Yes. 19 Q. When you wrote that memo, how many times had Mr. Michael 20 actually met with the FBI? 21 A. I don't know the specific number. 22 Q. More than one? 23 A. Yes. 24 Q. But you are saying he didn't cooperate. 25 cooperation with inquiries. It was more than one. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 He lacked 2708 K2R3SCH1 Hall - Cross 1 A. Correct. 2 Q. Right. 3 FBI on March 16, 2017, correct? 4 A. I don't know the exact dates. 5 Q. Okay. 6 preparation for your testimony here today, did you learn about 7 the fact that Michael had testified? 8 A. Yes. 9 Q. In this case? 10 A. Yes. 11 Q. Had you read his testimony? 12 A. No. 13 Q. No. 14 A. Yes. 15 Q. You knew that this United States attorney's office put him 16 in that witness stand, right? 17 A. Yes. 18 Q. Called him as a witness, correct? 19 A. Yes. 20 Q. He swore, put his hand up to tell the truth, correct? 21 A. I don't know, I wasn't here. 22 Q. Okay. 23 truthful? 24 A. I didn't have that -- we -- 25 Q. No, no. But he met with the FBI, correct? Fair enough. He met with the Let me ask you something. In But you knew he had testified? Correct? Did you tell them, Hey, we don't consider this man Did you tell these fine gentlemen here that you, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2709 K2R3SCH1 Hall - Cross 1 head of security for the CIA, did not consider this man 2 truthful? 3 A. I'm not the head of security for the CIA. 4 Q. Whatever you are. 5 Michael was truthful? 6 A. 7 security process. 8 Q. 9 word? Did you tell them that you did not think We told them that he was uncooperative throughout the Okay. Let's go to the next line right here. What is this 10 A. "Truthfulness." 11 Q. Did you tell them you doubted his ability to be truthful? 12 A. I didn't specifically state that. 13 inferred it based on our memo. 14 Q. 15 the Southern District of New York assumed that you did not 16 think Michael was truthful? 17 A. We said that he was non-cooperative. 18 Q. Read your words here. 19 sorry. 20 Just read the word for me. 21 computer system, blah, blah, blah, raises significant concerns 22 about his -- what is the first adjective you used? 23 A. "About his truthfulness." 24 Q. Right. 25 A. I didn't choose this adjective. But, would assume they You assumed that the United States Attorney's Office for Why don't you read it for me, I'm You read it for me as Mr. Denton asked you to read it. Unexplained activities on the First, you chose your adjectives, correct? I was not the one who SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2710 K2R3SCH1 Hall - Cross 1 drafted the memo. 2 Q. 3 Correct? 4 you? 5 A. I'm not blaming anybody. 6 Q. All right. 7 minute because I'm not going to shift it. You reviewed the memo, you signed off on the memo. 8 9 You are not sitting here blaming your staffer, are Let's stay with this paragraph, okay, for a Let me ask you a question here. You finalized this memo when? 10 A. In August of 2019. 11 Q. When did you give it to the United States attorney's 12 office? 13 A. I don't recall the specific date. 14 Q. You don't recall when the United States attorney's office 15 was first given this memo? 16 A. 17 specific date, I think. 18 Q. What year are we in now? 19 A. 2020. 20 Q. Were you ever told that the United States attorney's office 21 was given this memo literally after Michael took the witness 22 stand? 23 It was at some point this year. I don't recall the Did these lawyers tell you that, by the way? 24 A. I don't recall. 25 Q. You can talk to the lawyers, right? They're employees of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2711 K2R3SCH1 Hall - Cross 1 the CIA, right? 2 A. They are. 3 Q. Right. 4 They're with you now. 5 A. They are. 6 Q. Right. 7 A. I did. 8 Q. They badged you into the United States attorney's office, 9 sat you down on the fifth floor, and said Wait here until we They were with you when you testified, correct? They're sitting in court, right? You talked to them this morning, correct? 10 take you up, correct? 11 A. Correct. 12 Q. They had a badge to get into their office, correct? 13 just walked on in, right? 14 A. I don't know. 15 Q. Okay. 16 you, right? 17 A. They're physically here, yes. 18 Q. Did you ask them, Hey, when did you give this memo to these 19 people? 20 A. No, I didn't. 21 Q. You didn't ask them? 22 A. No. 23 Q. When did you first find out Michael testified in this case? 24 A. I don't recall the specific date. 25 month. You I wasn't focused on who had a badge. But you knew that the lawyers from the CIA were with It was within the last SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2712 K2R3SCH1 Hall - Cross 1 Q. You found out within the last month that Michael testified 2 in this case. 3 know, I wrote a memo where I found this man to not be truthful? 4 A. No, I did not. 5 Q. Okay. 6 A. I don't know the specific date. 7 Q. You only know it was in 2020? 8 A. Yes. 9 Q. Okay. Did you reach out to them and say, Hey, you Do you know when the CIA gave this memo to the FBI? Let's go to the next word. You had concerns about 10 his trustworthiness, correct? 11 A. Yes, that's correct. 12 Q. And you had concerns about his willingness to cooperate 13 with both routine OS investigation processes and the criminal 14 investigation into the theft from his office. 15 A. That's correct. 16 Q. His office. 17 A. From CCI, yes. 18 Q. No, no. 19 document, you have written "his office." 20 A. Are you suggesting his physical office? 21 Q. I'm not suggesting anything. 22 write it, I didn't review it, I didn't sign off on it. 23 A. It's referring to CCI. 24 Q. So you consider CCI to be Mr. Michael's office. 25 A. That's correct. Not the office. Please. His office. Right? The document is in evidence. In the Right? I didn't write it. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I didn't 2713 K2R3SCH1 Hall - Cross 1 Q. Okay. You didn't say CCI, correct? 2 A. No. 3 Q. Okay. 4 statement, right, you said your concern was that "he had not 5 been truthful, trustworthy or willing to talk about the 6 unexplained activities on the computer system from which CCI 7 data was stolen known as the DevLAN," correct? 8 A. Correct. 9 Q. Right? 10 A. That's what it says. 11 Q. Okay. 12 several times whether your concern was that he also didn't want 13 to talk about a fight in 2015, correct? 14 A. Correct. 15 Q. So let me just ask you this. 16 had never participated in a fight at all, would you have 17 believed him? 18 A. I don't know. 19 Q. Exactly. 20 do with the unexplained activities on the computer system, 21 given the fact that you had concerns about his truthfulness, 22 trustworthiness and willingness, would you have believed him? 23 A. He didn't discuss any of it with us. 24 Q. Exactly. 25 A. So I don't know. Let's just stay with this. When you wrote this And when Mr. Denton was talking to you, he asked you Who knows. Had Michael told you that he If he had told you he had nothing to SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2714 K2R3SCH1 Hall - Cross 1 Q. Exactly. Exactly. But, your testimony, and I want to be 2 sure I understood it correctly, okay, is that you left the 3 criminal investigation to the FBI? 4 A. That's correct. 5 Q. Right? 6 A. Yes. 7 Q. You don't know if Mr. Michael spoke to the FBI about the 8 screenshot, do you? 9 A. I don't know. 10 Q. You don't know if he told them that he took a screenshot, 11 do you? 12 A. I don't know. 13 Q. You don't know if he told them I checked the screenshot, do 14 you? 15 A. I don't know the specifics of his discussions with the FBI. 16 Q. For all you know, he told them everything he knew about the 17 screenshot, correct? 18 A. I don't know. 19 Q. Then why did you write it? 20 A. Because we were talking about our internal security 21 processes -- 22 Q. But -- 23 A. -- which he was uncooperative with. 24 Q. Your internal security processes? 25 A. That's correct. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2715 K2R3SCH1 Hall - Cross 1 Q. Why would you put him on administrative leave the very day 2 after which he ended his interview with the FBI in New York 3 City, August of 2019? 4 A. 5 investigators. 6 Q. 7 that he didn't cooperate with the CIA in 2015 didn't bother 8 you, 2016 didn't bother you, 2017 didn't bother you, 2018 9 didn't bother you, but all of a sudden, boom, something Because it was a continuing pattern of not cooperating with Really? So you are suggesting to this jury that the fact 10 happened on August 19 that you decided he immediately had to be 11 put on administrative leave. 12 A. Yes. 13 Q. How? 14 not exist on August 1st? 15 A. 16 and the informal feedback we received from his interview with 17 the Justice Department was that -- that he was additionally, 18 again uncooperative, and that led us to believe that he could 19 be facing potential legal jeopardy because of his 20 non-cooperation. 21 Q. 22 administrative leave. 23 all? 24 A. No. 25 Q. Oh. That's your testimony? Tell me, what concern was there on August 19 that did Again, he had been uncooperative throughout the process, So the FBI's telling you prompted you to put on him on It didn't have to do with the CIA at SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2716 K2R3SCH1 1 2 THE COURT: Ms. Shroff, would this be a convenient place to take our morning recess? 3 4 Hall - Cross MS. SHROFF: Sure. I can take a recess whenever you want. 5 THE COURT: 6 MS. SHROFF: 7 THE COURT: 8 (Jury excused) 9 THE COURT: Pardon me? This is fine. You want to do it now? Yes. See you in 15 minutes. 10 (Recess) 11 (Continued on next page) 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2717 K2rWsch2 Hall - Cross 1 (Jury present) 2 THE COURT: 3 Ms. Shroff. Please be seated. 4 BY MS. SHROFF: 5 Q. 6 signed off on placing Mr. Michael on administrative leave, did 7 you call the U.S. Attorney's Office and inform them or ask them 8 about their view on the decision? 9 A. No. 10 Q. Did you not participate in a phone call with the United 11 States Attorney's Office where somebody asked them whether or 12 not they should put Michael on administrative leave? 13 A. 14 recall specifically asking them whether we should place Michael 15 on administrative leave. 16 Q. 17 call to the United States Attorney's Office? 18 A. 19 feedback on how his interview had gone with the Justice 20 Department. 21 Q. 22 with the Justice Department given the fact that you were trying 23 to, as you put it on direct, keep the criminal investigation 24 separate from the CIA inquiry? 25 A. Mr. Hall, before you made the decision or before whoever I participated in a phone call with them, but I don't So what is your recollection of the point of that phone It was to be in receive mode from -- to receive informal Why did you want to know about how his interview had gone Because it still had a bearing on Michael's individual SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2718 K2rWsch2 Hall - Cross 1 security processing and his clearance, and even though we 2 didn't intend to necessarily take any action, we would welcome 3 that type of feedback or information about any of our 4 employees. 5 Q. 6 is prosecuting another individual? 7 A. 8 engagement with other government agencies. 9 Q. You'd welcome feedback or information from the agency that No. We would welcome factual feedback on our employee's So you wanted the FBI's feedback as to whether or not the 10 FBI was receiving the type of information that they wanted 11 because that would impact your decision on whether or not to 12 put him on administrative leave? 13 A. No. 14 Q. OK. 15 correct? 16 A. 17 was a decision based on a risk analysis. 18 Q. 19 your testimony now that you did your risk analysis for the 20 first time in August of 2019? 21 A. 22 just like for any other employee throughout the course of their 23 career. 24 Q. 25 the U.S. Attorney's Office several times before August of 2019, So, the CIA wanted to put him on administrative leave, Is that your testimony? No, we didn't want to put him on administrative leave. OK. Let's stay with that -- you did a risk analysis. Not for the first time. It It's It was -- it was done -- it's done But he had spoken -- by he, I mean Michael -- had spoken to SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2719 K2rWsch2 Hall - Cross 1 right? 2 A. I don't recall how many times he had spoken to them. 3 Q. Did you check each time that he spoke with the FBI as to 4 how it had gone? 5 A. No. 6 Q. Did you check in 2018 with the FBI, Hey, should we put him 7 on administrative leave? 8 A. No. 9 Q. How about in 2019, before August; did you check with them, 10 Hey, should we put him on administrative leave? 11 A. I'm sorry. 12 Q. Before August of 2019. 13 A. No. 14 Q. So in August of 2019, you learned that Mr. Michael had 15 invoked, correct; he had asked for a lawyer? 16 A. Correct. 17 Q. And you had also heard, had you not, that he had told the 18 FBI that he did not believe that Mr. Schulte had done the 19 reversion? 20 A. I -- I don't recall specifically hearing that, no. 21 Q. Did you ask? 22 A. No. 23 Q. You never asked? 24 A. I didn't personally, no. 25 Q. OK. On what date? Correct? Correct? How many people were on this phone call when the CIA SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2720 K2rWsch2 Hall - Cross 1 informed the agency that is prosecuting another individual 2 whether or not they should put a person at the CIA on 3 administrative leave? 4 A. Again, that wasn't the purpose of the phone call. 5 Q. What was the purpose of the phone call? 6 A. It was to receive the facts about how Michael's interview 7 had gone with the Department of Justice. 8 Q. 9 you, right? But the Department of Justice is a separate agency from 10 A. That's correct. 11 Q. You don't want to taint their investigation, correct? 12 A. It's not about taking their investigation. 13 receive -- 14 Q. No. 15 A. -- receiving the facts surrounding the interview. 16 Q. No. 17 their investigation. 18 It's about I said -- I'm sorry. I said taint, not take. I didn't think you could take I said taint. Did you want to taint their investigation? 19 A. No. 20 Q. So why involve them in what is purely an employee decision? 21 A. Because, again, it had a direct bearing, his 22 noncooperation, on his security clearance and his security 23 processing. 24 Q. 25 ask that. How did you determine that he was noncooperative? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Let me 2721 K2rWsch2 Hall - Cross 1 A. He was afforded multiple interviews with Office of Security 2 investigators for CIA in which he refused to discuss the 3 altercations or his actions taking the screenshot. 4 Q. OK. 5 A. That's correct. 6 Q. '17, correct? 7 A. I believe so. 8 Q. You didn't place him on administrative leave then, right? 9 A. No. 10 Q. OK. 11 A. No. 12 Q. You didn't call the DOJ at that time, right, saying: 13 not talking about this altercation. 14 putting him on administrative leave? 15 A. No. That's correct. 16 Q. OK. Now, you said he was uncooperative, correct? 17 A. Yes. 18 Q. On August 19, he had flown to New York, correct, or taken a 19 train or taken a bus, whichever way? 20 A. I don't know the specific date. 21 Q. OK. 22 A. With the Justice Department, yes. 23 Q. OK. 24 Department had told every CIA employee that meeting with them 25 was voluntary? But he had refused that in 2016, correct? Correct. How about 2018? He's What is your view on us Well, he had met with the FBI, correct? And do you, by any chance, know if the Justice Correct? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2722 K2rWsch2 Hall - Cross 1 A. I don't know. 2 Q. OK. 3 voluntary? 4 A. Me personally? 5 Q. Yes, you. 6 A. Yes. 7 Q. OK. 8 every other employee sign? 9 A. No. 10 Q. OK. 11 A. I have not. 12 Well, did they tell you that meeting with them was Did they have you sign a nondisclosure that they had Have you seen their nondisclosure? MS. SHROFF: What am I up to, Q? 13 Q. I'm just going to show this only to you. 14 A. OK. 15 Q. I don't need you to look at who signed it or whose name it 16 is. 17 I just want you to read the text. OK? OK? Does that refresh your recollection, by any chance, about a 18 nondisclosure agreement that the FBI had CIA employees sign? 19 A. 20 agreement from the FBI to any CIA employees in this matter. 21 Q. 22 you. 23 Again, this is the first time I'm seeing a nondisclosure OK. You can put it on aside. Just flip it over. Thank And they didn't have you sign one, right? 24 A. No, they did not. 25 Q. And do you, by any chance, know if every CIA employee was SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2723 K2rWsch2 Hall - Cross 1 told that the interview was voluntary? 2 A. I do not know that. 3 Q. Do you know that the FBI could not compel somebody to talk 4 to them? 5 A. I don't know. 6 Q. But you do know that Michael met with the FBI, nonetheless, 7 in August of 2019, correct? 8 A. Yes. 9 Q. Right. 10 A. Yes. 11 Q. And you also know that subsequent to them speaking to him, 12 he was called as a witness for the government, correct? 13 A. Yes. 14 Q. And throughout the time, you never disclosed, did you, this 15 memorandum? 16 A. No, I don't think so. 17 Q. OK. 18 but let's just go to page 2, please. 19 background section where you are at Joshua Schulte. 20 right? 21 A. OK. 22 Q. Do you see that language, where you're talking about 23 "Joshua Schulte and Amol, who reportedly had a physical 24 altercation within EDG spaces," correct? 25 A. And he sat down and he spoke to them, correct? Correct? No. Now, I'm not going to go through this entire document, And let me go back to Correct. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Here, 2724 K2rWsch2 Hall - Cross 1 Q. That's not factually correct, right? 2 A. I'm sorry? 3 Q. That's not factually correct, right? 4 A. No. It's factually correct, to my knowledge. 5 Q. OK. So it's your understanding that Mr. Schulte and Amol 6 had a physical altercation? 7 A. Uh -- 8 Q. OK. 9 You think that's accurate? I'll take that. MS. SHROFF: You can move that. 10 Q. Did you want to change your answer? 11 A. No. 12 Q. And then you talked some more, ultimately, right? 13 MS. SHROFF: Could you focus on ultimately, please. 14 Q. 15 in fact, answered all of the questions provided to him by 16 Leonard Small about the physical altercation; or do you not 17 know? 18 A. I don't know. 19 Q. OK. 20 A. I don't. 21 Q. So when you said that Mr. Michael had been uncooperative 22 with the internal investigation, you don't know if that's 23 accurate? 24 25 Sitting here today, sir, do you know that Mr. Michael had, I don't know who that is. Do you know somebody in SIB named Mr. Small? I mean actually accurate. MS. SHROFF: Q. You can take this paragraph down. Do you know? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2725 K2rWsch2 No. Hall - Cross 1 A. It was accurate. 2 from several investigators, and he, on a number of occasions, 3 refused to talk about it. 4 Q. 5 about, according to you, correct? 6 A. Correct. 7 Q. Right. 8 answered all of the questions about Amol's altercation with 9 Mr. Schulte. Right. He was asked about it several times His altercation with Mr. Schulte he refused to talk I'm asking you if you're aware that Mr. Michael had 10 A. I don't know. 11 Q. You don't know, right? 12 A. No. 13 Q. So you don't know if he had been cooperative, correct? 14 A. I don't know. 15 Q. Your testimony is it was your impression that Michael was 16 not cooperative about what he knew of the altercation between 17 Amol and Mr. Schulte? 18 A. I -- I don't recall. 19 Q. OK. 20 I think initially he was not cooperative. That's your testimony? I'll take your word for it that you don't recall. Now, you also talked about, on direct with Mr. Denton -- 21 right -- you talked about the fact that Mr. Schulte and 22 Michael, according to you, had both a personal and a 23 professional relationship? 24 A. That's correct. 25 Q. Right. Correct? Were you aware that Mr. Michael told the FBI that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2726 K2rWsch2 Hall - Cross 1 he had stopped hanging out with Mr. Schulte after he had 2 transferred out of OSB and gone to COG? 3 A. No, I was not. 4 Q. Were you aware that Michael had told the FBI that he had 5 been on a TDY; when he returned, he then started at COG and had 6 not been as friendly with Mr. Schulte? 7 A. No, I was not. 8 Q. Were you informed that he had tried to distance himself 9 from Mr. Schulte because of all the hoopla going on with 10 Mr. Schulte? 11 A. No. 12 Q. Do you recall if, after January of two thousand and -- 13 let's just be safe, seventeen or February of 2017, was there 14 any contact between Mr. Schulte and Michael? 15 A. I don't know. 16 Q. You don't know if they were friends anymore even in 2017, 17 correct? 18 A. Correct. 19 Q. You don't know if they were friends in 2018, correct? 20 A. Correct. 21 Q. So you didn't know what their personal relationship was 22 when you wrote this memo, right? 23 A. Correct. 24 Q. Now, let's talk about their professional relationship. 25 They were colleagues, correct -- I don't know. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2727 K2rWsch2 Hall - Cross 1 A. Yes. 2 Q. -- according to you? 3 Right? And what else did you know about their professional 4 relationship? 5 A. 6 physical altercation in the workplace. 7 Q. That's all you knew, right? 8 A. Yes. 9 Q. So when you said close relationship, you didn't know what That's it, basically. That and that they had had a 10 the close-relationship phrase was based on other than they were 11 colleagues? 12 A. 13 office, yes. 14 Q. 15 Mr. Michael had undergone two sessions, two polygraph sessions, 16 correct? 17 A. Yes. 18 Q. In May of 2017, correct? 19 A. Yes. 20 Q. Did not clear all issues, correct? 21 A. Correct. 22 Q. He's not placed on admin leave, is he? 23 A. No. 24 Q. OK. 25 say, "In wake of the theft of unauthorized disclosure of CCI's They were colleagues in the same component, in the same OK. Now, in paragraph 4 -- correct -- you noted that And then you have this language where you go on to SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2728 K2rWsch2 Hall - Cross 1 cyber tool kit on WikiLeaks." Do you see all of that? 2 A. Yes. 3 Q. And all of this had long happened before May of 2017, 4 right? 5 A. Correct. 6 Q. OK. 7 learned of the WikiLeaks, correct? 8 A. Correct. 9 Q. And you had still not placed him on admin leave, correct? 10 A. Correct. 11 Q. OK. 12 was paused as a part of that effort, right? 13 language? 14 A. I do. 15 Q. "As he held systems admin privileges on the DevLAN" -- 16 right -- "the system from which the tool kit was stolen and was 17 present in EDG spaces during the time frame of the theft? 18 Correct? 19 A. Correct. 20 Q. And even though you had that information way before 2019, 21 you took no steps to put him on admin leave, correct? 22 A. So he had not cleared the poly after the CIA had And then you go on to say that Michael's processing Do you see that That's correct. 23 MS. SHROFF: Now, let's look at five. 24 Q. "In support of the ongoing criminal investigation," right? 25 A. Yes. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2729 K2rWsch2 Hall - Cross 1 Q. "CIMC conducted comprehensive reviews of all individuals 2 who could have perpetrated the theft of the CCI data, including 3 Michael," correct? 4 A. Correct. 5 Q. You had no idea what comprehensive review was undertaken, 6 correct? 7 A. I wouldn't say I have no idea. 8 Q. OK. 9 comprehensive reviews did you undertake? Well, tell me. Specific to Michael, what 10 A. It's standard practice to review their security background, 11 security file, the accesses that they have, and then try to 12 piece together whether that individual is potentially 13 responsible for an incident. 14 Q. So your testimony is you think CIMC did all of that? 15 A. Uh -- 16 Q. You know, sitting here today, that CIMC undertook that 17 review? 18 A. 19 investigative process, which included that methodology for 20 everyone in the subject pool. 21 Q. 22 this gentleman? 23 A. Yes. 24 Q. OK. 25 specifically as to Michael, correct? You know that personally? When I arrived at my job, I was briefed on the My only question was, do you know that specifically as to So you knew at the time that they had done it SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2730 K2rWsch2 Hall - Cross 1 A. Yes. 2 Q. You knew that Michael had more information than the 3 run-of-the-mill CIA employee, according to you, correct? 4 A. I'm sorry? 5 Q. Well, nobody else had a screenshot, right? 6 A. No, not to my knowledge. 7 Q. Right. 8 correct? 9 A. I'm sorry? 10 Q. Nobody -- oh, did you know that Michael's vSphere was 11 running at the same time? 12 A. 13 professional. 14 analysis of the investigation. 15 Q. 16 suspect? 17 A. That's correct. 18 Q. So you don't know based on what he was eliminated? 19 A. He was eliminated based -- 20 Q. Do you know specifically based on what he was eliminated, 21 or do you just have a general idea? 22 A. 23 forensic investigation conducted by the FBI. 24 Q. 25 not -- Nobody else had a running vSphere at the same time, I -- I don't know. OK. Again, I'm not a technical I don't know the details of the forensic But you said that he was eliminated, correct, as a I have a general idea that he was eliminated based on the Oh, it was a forensic investigation conducted by the FBI, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2731 K2rWsch2 Hall - Cross 1 A. The FBI as well as our own technical professionals looking 2 at our network. 3 Q. OK. 4 A. No, it doesn't. 5 Q. OK. 6 correct? 7 A. No. 8 Q. OK. 9 A. I'm not suggesting it is. 10 Q. So somebody told you it was based on something when they 11 briefed you? 12 A. That's correct. 13 Q. OK. 14 is the date picked by the FBI, whether Michael's vSpheres were 15 running on Confluence, correct? 16 A. I don't know. 17 Q. You don't know where he was logged in, correct? 18 A. I don't know. 19 Q. You don't know what his badge records showed, correct? 20 A. I know his badge records showed that he left the facility 21 with Mr. Schulte. 22 Q. 23 where he was at the time the reversion started? 24 A. I don't recall. 25 Q. Where he was during the reversion? OK. But it doesn't mention FBI in this paragraph, does it? So it's not based on the FBI in this paragraph, And you had no idea if on the date of the theft, which Do you know what his badge records showed at the time, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2732 K2rWsch2 Hall - Cross 1 A. I don't recall. 2 Q. Do you know where he was at the end of the reversion? 3 A. I don't know. 4 Q. Sitting here today, do you even know if you need to be at 5 your desk, in the middle, while a reversion is taking place? 6 A. I don't know. 7 Q. Fair enough. 8 9 10 OK. All right. And let's keep going. risk assessment, right? You now have this testimony of I'm going to skip over this part and just go to six. 11 "Given the magnitude of the theft of the CCI tool kit," 12 correct? Right? 13 A. Yes. 14 Q. "And its concomitant damage to national security, CIMC 15 views Michael's lack of cooperation as a significant and 16 untenable risk to the security of the operations on which he 17 now works and any new tools he deploys for CCI," correct? 18 A. Yes. 19 Q. You had a significant concern about him, correct? 20 A. About his lack of cooperation, yes. 21 Q. And the "lack of cooperation," the phrase that you use in 22 paragraph 6, refers to the magnitude of the theft, correct? 23 Right? 24 A. Yes. 25 Q. Nothing about a physical altercation in here, correct? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2733 K2rWsch2 Hall - Cross 1 A. No. 2 Q. Nothing about Amol or Mr. Schulte, correct? 3 A. No. 4 Q. OK. 5 next line, whatever Mr. Michael's reasoning, he has not 6 complied with routine inquiries by SIB, correct? 7 A. Correct. 8 Q. By the way, did you know that Mr. Schulte had, in fact, 9 complied with all routine inquiries by SIB? Then, after you talk about the theft, you note, in the 10 A. I didn't know that, no. 11 Q. OK. 12 clear and verifiable information concerning his activities in 13 the workplace, correct, around the time of the theft? 14 A. Correct. 15 Q. Not around the time of the fight, correct? 16 A. Correct. 17 Q. Not around the time of the Amol threat, correct? 18 A. Correct. 19 Q. OK. 20 have several concerns now, at the time of the writing of the 21 memo? 22 A. 23 And that during the polygraph he had failed to provide Right? Now, you also note in this memo, do you not, that you Correct? Correct. MS. SHROFF: 24 the bottom. 25 Q. And if you could go back to page 1, at No, just at CIMC. Right there. Yes. Just read the last line for me, would you? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2734 K2rWsch2 Hall - Cross 1 A. "CIMC believes curtailing his access to CIA spaces and data 2 systems is necessary to safeguard against potential future 3 losses of sensitive and classified information." 4 Q. So the concern was with computer security, correct? 5 A. I'm sorry? 6 Q. Your concern was to safeguard against future losses of 7 sensitive and classified information, correct? 8 A. The concern was -- 9 Q. I'm just asking you to read this. Is that what you said 10 your concern was? 11 A. Correct. 12 Q. Right. 13 talking about a fight now, so three and a half years later, 14 let's put him on administrative leave, right? 15 A. No, but that's part of the context of the memo. 16 Q. That's not any part of the context of this line, is it? 17 A. Not that line, no. 18 Q. Right. 19 has refused to talk about a fight that happened in 2015 leads 20 me to believe that he will no longer be trustworthy on tools in 21 COG, correct? 22 A. No. 23 Q. Right. 24 A. I suppose we could have. 25 You didn't say that my concern is that he's not And you don't say, do you, that the fact that he You could have said that if you wanted, right? MS. SHROFF: Right. So let's just go back to the very SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2735 K2rWsch2 Hall - Cross 1 end, to the assessments, again. 2 page -- you know what? 3 back. 4 Q. 5 correct? 6 A. Yes. 7 Q. What loss are you talking about? 8 A. The theft of the Vault 7 data. 9 Q. OK. OK. I'm almost done. And the last Actually, could you just go one page There you go. Risk assessment. Right. Michael's behavior suggests a lack of concern for the loss, And a "lack of commitment to comply with the basic 10 security agreements he entered into upon hire," correct? 11 A. Correct. 12 Q. Security agreements, correct? 13 A. Correct. 14 Q. Would you say that a fight about rubber bands does not have 15 to do with security agreements? 16 A. I didn't say it did. 17 Q. OK. 18 2020, right? 19 correct? 20 A. That's correct. 21 Q. OK. 22 full-time employee? 23 A. I don't know. 24 Q. You're going to fire him at the end of this case, right? 25 A. I didn't say that. Now, let me ask you this. We are now in February of Mr. Michael's still on administrative leave, So is the CIA planning on bringing him back as a I can't answer that. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2736 K2rWsch2 Hall - Redirect 1 Q. I know you didn't. 2 A. It's not my judgment to make. 3 Q. I understand. 4 going to fire him. 5 going to fire him. 6 A. I don't speak on behalf of the entire CIA. 7 Q. OK. 8 A. I'm an Office of Security careerist who is assigned to 9 CIMC. OK. I'm asking you the question. I didn't ask you if you were personally I asked you if you knew whether the CIA was On behalf of what part of the CIA do you speak, sir? 10 Q. 11 recommend that Mr. Michael be fired from the CIA? 12 A. I -- 13 Q. Would you recommend? 14 recommend. 15 A. No, personally I would not at this time. 16 Q. You would not at this time, right? 17 A. Yes. 18 Q. You'd wait until the trial was over, correct? 19 A. I -- 20 21 And sitting here today as that officer, would you I'm just asking what you would MS. SHROFF: It's OK. I'll withdraw that one. THE COURT: Mr. Denton. Thank you. 22 23 REDIRECT EXAMINATION 24 BY MR. DENTON: 25 Q. Sir, could you answer Ms. Shroff's question: SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 What impact 2737 K2rWsch2 Hall - Redirect 1 does the trial have on your recommendation there? 2 A. None. 3 MR. DENTON: Could we put up the memo just briefly. 4 Q. 5 communications with the Department of Justice. 6 that? 7 A. Yes. 8 Q. Did anyone from the Department of Justice ask you to place 9 Michael on administrative leave? 10 A. Ms. Shroff asked you a series of questions about your Do you remember No. 11 MR. DENTON: Now, if we could just blow up paragraph 12 2, Ms. Hurst. 13 Q. 14 past activities with the primary person of interest in the FBI 15 investigation. 16 A. Yes. 17 Q. Again, who does that refer to? 18 A. Mr. Schulte. 19 Q. Is anything at all in this memo intended to convey that 20 Michael, and not Mr. Schulte, is responsible for the Vault 7 21 theft? 22 A. No. 23 Q. When Ms. Shroff was asking you questions, she used the term 24 "reversion." 25 A. We talked about this before, where it refers to Michael's Do you see that? Do you remember that? Yes. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2738 K2rWsch2 Hall - Redirect 1 Q. Have you heard that term in connection with this 2 investigation before? 3 A. I believe I have. 4 Q. Generally, what's your understanding of what it refers to? 5 A. Means that something looks as though it did in the past. 6 Q. What is your understanding of who executed the reversion 7 involved in this case? 8 A. Mr. Schulte. 9 MR. DENTON: 10 THE COURT: 11 THE WITNESS: 12 THE COURT: 13 (Witness excused) 14 THE COURT: 15 MR. LAROCHE: 16 THE COURT: 17 There are no more witnesses. 18 No further questions, your Honor. You're excused, Mr. Hall. Thank you. Thank you very much. Mr. Laroche. The government rests, your Honor. All right. The government has rested. We have a lot of work to do. The parties want to work 19 on their summations. 20 we're not going to meet tomorrow. 21 and we'll have the summations to the jury, I'll give you my 22 instructions and then you can begin deliberations. 23 I want to work on the jury charge. So We'll meet again on Monday Remember my standard instructions. Until 24 deliberations begin, don't discuss the case with anybody. 25 Don't do any independent research. If there are any stories in SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2739 K2rWsch2 Hall - Redirect 1 the newspaper or on TV or radio, please ignore them. 2 minds. You'll start your deliberations on Monday. 3 I hope you have a nice weekend. 4 Ms. Wiker, I hope your leg gets better. 5 (Continued on next page) 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Keep open 2740 K2rWsch2 1 (Jury not present) 2 THE COURT: 3 We sent around the jury charge last night. 4 Please be seated. Everybody got it, didn't they? 5 MR. LAROCHE: Yes, your Honor. 6 THE COURT: When do you want to get together? 7 MR. DENTON: Could we say 3:00, your Honor? 8 THE COURT: How long do you think it's going to take? 9 MR. DENTON: I'm hopeful, after talking with Mr. Zas, 10 that we may actually be able to get together on a couple of 11 things, so hopefully not all that long. 12 THE COURT: 13 THE DEPUTY CLERK: 14 THE COURT: 15 MR. ZAS: 16 MR. DENTON: Fine, your Honor. 17 THE COURT: We'll start at 2:30. 18 MR. ZAS: 19 We just want to renew our Rule 29 motion in light of 20 David, what do we have this afternoon? We're clear until four, your Honor. Do you think we could start at 2:30? Fine with us. I have one application, very quickly. all the evidence. 21 THE COURT: 22 How long do you think the summations are going to be? 23 MR. LAROCHE: 24 25 I'll reserve decision. Your Honor, I'm going to try to stay around two to two and a half hours for the government. THE COURT: Does that include rebuttal? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2741 K2rWsch2 1 MR. LAROCHE: 2 would request about 30 minutes. 3 THE COURT: 4 MS. SHROFF: No, your Honor. I think rebuttal we Ms. Shroff. I don't know. Two hours seems like a 5 lot, but I don't think I'm going to go more than 45 minutes to 6 an hour. 7 THE COURT: 8 MS. SHROFF: 9 10 Laroche does. All right. I promise to go half the time that Mr. No matter what he does, I'm going to cut it in half. 11 THE COURT: Well, OK. I was hoping that we would do 12 summations on Monday. 13 government, two hours for the defense, two hours for the jury 14 charge. 15 hours. I timed out the jury charge last night. 16 MS. SHROFF: 17 THE COURT: 18 19 It would be two hours for the I'm at two OK. But I don't want to cut anybody off. You've got important things to say. MR. LAROCHE: Your Honor, I will try to keep it as 20 short as possible. I think what we request is two hours for my 21 summation and 30 minutes, if we could, for rebuttal. 22 THE COURT: 23 MS. SHROFF: 24 25 All right. Your Honor, are you going to tell Mr. Kamaraju to only rebut, not to -- I'm just kidding. MR. KAMARAJU: I'll take any advice your Honor has on SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2742 K2rWsch2 1 2 rebuttal. THE COURT: I received a letter yesterday from 3 Mr. Schulte. 4 OK. 5 (Luncheon recess) I'm going to mark that as a court exhibit. See you at 2:30. 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2743 K2rWsch2 1 AFTERNOON SESSION 2 2:30 p.m. 3 THE COURT: 4 OK. 5 MR. ZAS: 6 THE COURT: 7 MR. ZAS: Good afternoon. Please be seated. Where do you want to start? What page? Your Honor, my first comment is on page 5. OK. On the first full paragraph at the top, the 8 last line is about "sympathy should play no role," and I think 9 you'd already said that on page 4, just before. 10 11 12 swayed by sympathy." THE COURT: I don't think it needs to be said twice. Where do I say it on page 4, Mr. Zas? "do not be swayed by sympathy." 13 MR. ZAS: 14 THE COURT: 15 MR. ZAS: 16 THE COURT: 17 OK. 18 MR. ZAS: "Do not be Oh, OK. Right. You want to strike that, I gather. Just one. We don't need repeated references. Next. On page 7, just the last sentence on seven, 19 that says, "You are to give no weight to the fact that a grand 20 jury properly returned an indictment." 21 that as being unnecessary. 22 Court's saying that the grand jury acted properly in the sense 23 of what basis, so I thought we'd just strike that sentence. 24 THE COURT: 25 MR. ZAS: We would just object to That seems to imply that the Any objection, Mr. Denton? Or if you want to say "give no weight to the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2744 K2rWsch2 1 fact that the grand jury returned an indictment," that would 2 solve our concern. 3 4 MR. DENTON: Seems easier just to strike the sentence, your Honor. 5 THE COURT: 6 OK. 7 MR. ZAS: I'll strike the sentence then. Your Honor, Mr. Branden reminds me, on the 8 same page we're on, page 7, the first full paragraph, at the 9 top, again, there's another sympathy reference. In the second 10 sentence, "It is not an excuse to avoid the performance of an 11 unpleasant duty," we would just strike the "and it is not 12 sympathy." 13 THE COURT: 14 MR. ZAS: 15 Oh, it's just that I thought it's repetitive. 16 17 This is a pretty standard charge. THE COURT: OK. I'm going to leave this the way it is. 18 MR. ZAS: OK. 19 My next comment is on page 13. 20 THE COURT: 21 MR. DENTON: 22 THE COURT: 23 MR. ZAS: Anything before 13, Mr. Denton? No, your Honor. OK. Mr. Zas, what do you have? The last full paragraph, the sentence that 24 talks about the pseudonyms, the potential danger to the 25 witnesses' safety. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2745 K2rWsch2 1 THE COURT: 2 MR. ZAS: Yes. We would just object to that in a case where 3 the jury has to determine whether this was national security 4 information, we thought it's unnecessary, and we would propose 5 the following change: 6 "The disclosure of the witnesses' true names and what 7 they look like could potentially," and then just strike 8 everything up to compromise -- "could potentially compromise 9 their work at the CIA," rather than flagging the potential 10 safety issues. 11 THE COURT: 12 MR. DENTON: Mr. Denton. I don't grasp the implications about what 13 it means to compromise their work at the CIA, your Honor. 14 think that's probably fine to strike. 15 jury has some explanation and doesn't think it's without basis, 16 I think that's fine. 17 THE COURT: 18 MR. ZAS: 19 THE COURT: 20 MR. DENTON: 21 THE COURT: 22 MR. DENTON: OK. I I think as long as the I'll make the change. On page 14, discussion of expert witnesses. Yes. Just before that, if I may, your Honor? Mr. Denton. I think with respect to a separate 23 instruction on bias and hostility, in your Honor's instruction 24 on witness credibility and in the last full paragraph on page 25 10, you already talk about how the jury can consider whether a SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2746 K2rWsch2 1 witness had any possible bias or relationship and that these 2 are factors that you may consider. 3 separate instruction is necessary there. 4 MR. ZAS: So I don't think we think a I think the difference seems to be this one 5 seems specifically aimed at any anger or resentment toward the 6 defendant, so we like that. 7 be incorporated into the other one or it could be standing 8 alone, but I think that's an additional point worth making. 9 THE COURT: 10 MR. DENTON: I don't think we care -- it could Where is the reference to bias on page 10? Your Honor, I think it's the last full 11 paragraph on the page. 12 consider whether a witness had any possible bias or 13 relationship with a party." 14 THE COURT: 15 It starts, "In addition, you may OK. I'll integrate the language on page 14 with that clause on page 10. 16 OK. We're up to expert witnesses, on page 14. 17 MR. ZAS: Yes. We have no problem up until, there's a 18 point in the middle of the instruction that sort of starts to 19 summarize what the expertise was about, and we just think 20 that's unnecessary. 21 really cover everything they said, and they don't need it. 22 Once they know that there -- I think it's three or four 23 individuals, that should suffice rather than having the Court 24 do a summary. 25 THE COURT: In a way, it's incomplete. It doesn't I'm not trying to do a summary; I'm just SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2747 K2rWsch2 1 trying to identify what the expertise is, more than just the 2 name. 3 MR. ZAS: Yes, we're fine up to, you identify in this 4 draft charge "the specialized areas were WikiLeaks, the system 5 of classifying national security materials, and the forensic 6 analysis of computers and other electronic devices." 7 would just end the paragraph there. 8 9 10 THE COURT: experts? OK. I have Rosenzweig, Leedom, Berger and Bradley. MR. DENTON: 12 MR. BRANDEN: 13 MR. ZAS: 14 THE COURT: That's what I have. That's correct, Judge. Yes, that's right. And you want to end it in the middle of the paragraph, right, Mr. Zas? 16 MR. ZAS: 17 MR. BRANDEN: 18 Before we come to that, who are the Can we agree on who the experts are? 11 15 And we Yes, after the words "electronic devices." The end of the third sentence before "the expert witnesses." 19 THE COURT: 20 MR. DENTON: Mr. Denton. I think that's fine, your Honor. If 21 people are confused about the system of classifying national 22 security materials at this point, there's not much hope. 23 24 25 THE COURT: OK. So I strike out, "The expert witnesses were allowed to testify," and that goes over -MR. BRANDEN: To the end of the paragraph. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2748 K2rWsch2 1 MR. ZAS: 2 THE COURT: 3 MR. ZAS: 4 MR. DENTON: 5 THE COURT: 6 MR. ZAS: 7 THE COURT: 8 Yes. That ends on page 15, correct? Yes. Yes, your Honor. All right. Anything else on 15? No. Do I have the name right on 15, Carlos Betances? 9 MR. DENTON: I think that is probably the best way to 10 refer to him. His full name is Carlos Betances Luna Mera, but 11 I think since he was referred to by everyone as Mr. Betances, 12 it's probably best to just call him that. 13 THE COURT: 14 Pages 16 and 17. 15 MR. ZAS: 16 OK. On 17, I think we would object to the instruction, letter K, "evidence obtained from searches." 17 THE COURT: 18 MR. ZAS: Yes. I'm not sure there's been any argument that 19 there's an illegal search that occurred in the case, so if I'm 20 right about that, I thought it would be unnecessary to put in. 21 THE COURT: Well, this is really just based on my 22 experience, which is I once had a note from a juror saying they 23 weren't sure about the evidence that had been obtained from the 24 searches, so since that time I've included it. 25 charge. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 It's a standard 2749 K2rWsch2 1 It's up to you, Mr. Denton. 2 MR. DENTON: 3 THE COURT: 4 Mr. Zas, I'm not going to make that change. 5 MR. ZAS: 6 THE COURT: 7 MR. ZAS: 8 Do you want it in or out? I think we should keep it, your Honor. Yes. Understood, your Honor. What are we up to now? On page 19, the heading O, "all available evidence need not be introduced." 9 THE COURT: 10 MR. ZAS: OK. I just object to that whole thing as 11 unnecessary. I don't think anyone thinks that either side has 12 to call or present all the evidence that might exist. 13 THE COURT: 14 MR. DENTON: 15 Mr. Denton. Your Honor, I think that's a pretty standard instruction. 16 THE COURT: 17 MR. DENTON: It is standard. Is it necessary, though? We think it's appropriate here, your 18 Honor. 19 introduced what. 20 that's not a criterion for them to evaluate the case on. 21 22 23 24 25 I think there's been sort of a question about who I think it's fair to inform the jury that THE COURT: All right. I'll leave it in. It's a standard charge. Just above that, on stipulations, do you want to give them exhibit numbers? MR. DENTON: Yes. I think they are Government SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2750 K2rWsch2 1 Exhibits 3002, 3003, 3004, 3005 and Defense Exhibit O. 2 THE COURT: 3002, '3, '4, '5 and Defense Exhibit O. 3 Are you sure we have them all? 4 MR. DENTON: 5 MR. ZAS: 6 Those are the testimonial stipulations or the facts. 7 MR. DENTON: 8 '4 are testimonial. 9 THE COURT: 10 I'm pretty sure, your Honor. check. O is a fact stipulation. Why don't you go back to your offices and I want to make sure this is complete. 11 MR. DENTON: 12 THE COURT: 13 MR. ZAS: OK. I know we omitted 3001. Inferences. Your Honor, we think that's all covered by 14 your direct and circumstantial evidence charge. 15 repeating the same point. 16 17 THE COURT: It's basically You say that circumstantial evidence and inferences are the same, Mr. Zas? 18 19 And '2, '3, and MR. ZAS: Let me just go back and see how close they are. 20 On your pages 8 and 9, in the direct and 21 circumstantial evidence instruction, you talk about what an 22 inference is and how they should be made. 23 THE COURT: OK. If there's anything critical in 24 inferences, I'll move it back and include it in direct and 25 circumstantial evidence. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2751 K2rWsch2 1 MR. DENTON: I think on that point, your Honor, the 2 main thing that we would ask that you keep is the confirmation 3 that "an inference is not a suspicion or a guess"; essentially, 4 the second paragraph of that instruction. 5 THE COURT: OK. 6 MR. BRANDEN: In the fourth paragraph of that 7 instruction, it says "the defendants," plural. 8 small, technical point, but it should be singular. 9 10 THE COURT: The defendant. I know it's a OK. The takeaway here is I'm going to consolidate letter 11 P, inferences, at page 20, with the language on page 8 dealing 12 with direct and circumstantial evidence. 13 to include that an inference is not a suspicion or a guess and 14 the rest of the language in that paragraph. 15 Motive. 16 MR. ZAS: The government wants We just have a small change. In the very 17 last sentence of that instruction, "But the presence or absence 18 of motive is a circumstance that you may consider as bearing on 19 the intent of the defendant," we would just insert "or 20 actions," intent or actions of the defendant. 21 THE COURT: 22 I think on "defendant's testimony," this is the 23 All right. language you suggested last night, Mr. Zas. 24 MR. ZAS: Yes. 25 THE COURT: We have no objection to it. Mr. Denton. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2752 K2rWsch2 1 MR. DENTON: Your Honor, I think as a general matter 2 we're fine with it. 3 is the language at the top of page 22 suggesting reasons why a 4 defendant may decide not to testify. 5 I think the main thing we would object to I think it's sufficient to instruct the jury to not 6 speculate as to why he did not testify and to instruct them 7 that they cannot draw any inference, without suggesting a 8 number of innocent reasons. 9 "there are many reasons" through "you are not to speculate as 10 11 We would propose deleting from to these things." MR. BRANDEN: I haven't looked recently, but I believe 12 that those explanations for why a defendant may not testify are 13 part of a standard Sand instruction. 14 that previously. 15 16 17 MR. ZAS: I know I've requested I think there is authority for it that I think we gave to the Court when we proposed it. MR. DENTON: It is equally true that a defendant may 18 decide not to testify because he is concerned about the outcome 19 of cross-examination, so I think the more prudent course is 20 simply not to invite speculation either way, which is what your 21 Honor did in Flores, so we'd just suggest leaving it out 22 entirely. 23 THE COURT: OK. We're resuming on the final 24 paragraph, "You are not to attach any significance to the fact 25 that Mr. Schulte did not testify"? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2753 K2rWsch2 1 MR. DENTON: That's fine, your Honor. We would also 2 have no objection to leaving in the last sentence and just 3 reiterating again that "you may not draw any inference 4 whatsoever from a defendant's decision not to take the stand." 5 THE COURT: OK. The summary of the indictment. 6 MR. DENTON: 7 Just before we move on to substantive instructions, we If I may, your Honor? 8 had requested an instruction, I think it was government's 9 request No. 4, pertaining to false exculpatory statements by 10 the defendant. We think in light of the testimony, 11 particularly from Special Agent Evanchec, about his interviews 12 with the defendant, I think it's appropriate to give that 13 instruction here. 14 THE COURT: Mr. Zas. 15 MR. ZAS: 16 On this one, I don't have the government's proposed Your Honor, if I may? 17 instruction in front of me. Could we put this to the side, and 18 if I have a view, either let you know in writing later today or 19 tomorrow morning. 20 THE COURT: 21 The summary of the indictment. 22 MR. ZAS: 23 MR. DENTON: 24 25 That would be fine. Yes. I have something on 26 too. I think we're all good until the third element of Count One, your Honor. THE COURT: Let me ask you about what appears on page SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2754 K2rWsch2 1 2 24: "First, that in or about 2016, the defendant copied, 3 took, made, or obtained a sketch, photograph, photographic 4 negative, blueprint, map model, instrument, appliance, 5 document, writing, or note, to wit"; just saying "the defendant 6 took information maintained by an intelligence agency of the 7 United States." 8 9 MR. BRANDEN: understood. I'm sorry, Judge. I'm not sure I Are you proposing to take out the sort of 10 statutory language? 11 THE COURT: 12 MR. BRANDEN: 13 THE COURT: 14 MR. ZAS: Yes. And just get into the "to wit" part. Correct. I think I attempted to deal with it when we 15 did our proposed instructions. 16 really being alleged is a document, writing, or note in the 17 sense that it's a kind of file. 18 THE COURT: It seemed to me that what was Well, I don't mind reducing it. I just 19 don't think we need all this photograph, photographic negative, 20 blueprint, map, model, instrument, appliance, document. 21 want to say exactly what it was, I don't mind putting in the 22 allegations. 23 MR. ZAS: That's what I was trying to say. If you If we took 24 out the first, you know, sketch, photograph, photographic 25 negative, blueprint, map, model, instrument, appliance, all SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2755 K2rWsch2 1 unnecessary. 2 the defendant took" -- I'm not sure information's the right 3 word because I think the statute distinguishes between 4 information and tangible things like documents. 5 6 7 8 9 10 11 I would keep "document, writing, or note, to wit, Files, does that cover it? Or a file? Something like that. MR. DENTON: The way it is charged in the indictment is exactly how it reads. THE COURT: It's charged in the indictment using the language of the statute. MR. DENTON: I wouldn't have a problem just going 12 straight to the "to wit" clause, which is also from the 13 indictment. 14 THE COURT: 15 MR. ZAS: What about that, Mr. Zas? I think we want, I think the statutory 16 language that was charged, I think it speaks of document, 17 writing, or note and maybe "or information," so I think we'd 18 like to leave that. 19 THE COURT: I can say, "The defendant copied a 20 document, writing, or note or took information maintained by an 21 intelligence agency of the United States." 22 MR. ZAS: 23 MR. DENTON: 24 THE COURT: 25 I think so. I think that's fine, your Honor. OK. And then in D, "Count One: First element -- taking information," I'd make the same change there. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2756 K2rWsch2 1 MR. ZAS: 2 THE COURT: 3 Yes. or the third element. 4 Mr. Zas. 5 MR. ZAS: 6 THE COURT: 7 I was up to the third element, on page 26. MR. DENTON: 9 MR. ZAS: paragraph on 26. THE COURT: 12 MR. ZAS: 14 No, your Honor. Just on the last sentence of the last full 11 13 Do you have anything on page 25, Mr. Denton? 8 10 Now, somebody was up to the second element "I emphasize that for Count One"? Yes. Just to make it a little more precise, I'll just read to you the way I fix it: "I emphasize that to convict the defendant of Count 15 One, you must find that the defendant had the intent that the 16 information would be used against the United States, not just 17 that it could be used. 18 really whether or not; it's to convict, they have to find that 19 he had the intent that it would. 20 THE COURT: 21 MR. ZAS: So I'd just clarify that it's not Give me the language again, Mr. Zas. "I emphasize that to convict the defendant 22 of Count One, you must find that the defendant," and then 23 everything stays the same after that. 24 25 THE COURT: "I emphasize that to convict the defendant of Count One, you must find that the defendant had the intent SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2757 K2rWsch2 1 that the information would be used against the United States, 2 not just that it could be used." 3 MR. ZAS: Exactly right. 4 THE COURT: 5 MR. DENTON: Mr. Denton. I have no objection to Mr. Zas's 6 revisions to the start of the sentence. 7 we would ask, your Honor, is that where it continues, where you 8 say that the defendant had the intent, it should be "had the 9 intent or reason to believe." 10 THE COURT: 11 MR. DENTON: 12 THE COURT: 13 MR. DENTON: All right. I think the only thing Is that from the statute? Yes, your Honor. All right: I'll just note, this is purely a semantic 14 thing, your Honor, there's a couple of different formulations 15 in this instruction in which we talk about sort of information 16 being used "to the injury of the United States," "to injure the 17 United States," or "against the United States." 18 it is probably quite stilted to say over and over again "to the 19 injury of the United States." 20 extent the inconsistency causes any concern. 21 THE COURT: 22 MR. DENTON: I realize that I only flag it just to the Does it cause you any concern? It causes me a slight concern, but not 23 enough that if it doesn't cause your Honor concern I'm not 24 going to -- 25 THE COURT: Mr. Zas. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2758 K2rWsch2 1 MR. ZAS: 2 THE COURT: 3 OK. 4 MR. ZAS: 5 THE COURT: 6 We're OK with it. I'll leave it the way it is. What are we up to now? Count Two? I have nothing until 35. Let me ask you a question on Count Two and Count Three, where you talk about lawful possession, page 30. 7 MR. BRANDEN: 8 That might help me. 9 yours. 10 11 OK. Are you talking paragraph H, Judge? My pagination is slightly different from I don't know why, but I'm trying to follow along. THE COURT: I'm at paragraph G on page 27 of the draft I sent out last night. 12 MR. BRANDEN: 13 THE COURT: OK. I'm with you. Count Two talks about "lawfully 14 possessed," and Count Three is "unauthorized possession." 15 That's at paragraph L, on page 30. 16 I guess the question I have is, are these 17 inconsistent, lawfully possessing and unauthorized possession; 18 if you have to select one or the other. 19 both? 20 How do you convict on Or acquit on both? MR. DENTON: I think, your Honor, in terms of the 21 theory of convicting on both, what I expect we will argue is 22 that what the defendant stole was the entirety of the 23 information in Confluence and Stash; that there were portions 24 of that -- that there were projects he was assigned to, for 25 example -- to which he had lawful access. But there were other SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2759 K2rWsch2 1 portions that he was not entitled to, to which he had unlawful 2 access. 3 what he was allowed to have and everything else as well. So by stealing the entirety of it, he covered both 4 THE COURT: 5 language is perfectly fine? 6 MR. DENTON: 7 THE COURT: 8 MS. SHROFF: 9 THE COURT: 10 MR. ZAS: Under your theory, Mr. Denton, this Yes, your Honor. All right. Your Honor, could we just have a minute? Yes. Your Honor's point was so good that we're 11 confused ourselves now. 12 confused because it seems, just on its face, without 13 clarification, that they are inconsistent. 14 another area we could do a little research and see if we can 15 find something. 16 THE COURT: 17 MR. DENTON: And I'm concerned the jury may be Maybe this is All right. I'll just say, your Honor, to the extent 18 that something is necessary to clarify, I think the way to do 19 it may be to talk about the term of the statute. 20 provisions of 793(d) and (e) speak in terms of the information, 21 not the system or the data or anything like that. 22 whether he obtained the information lawfully or unlawfully is 23 the subject of the computer counts. 24 information is what the espionage counts deal with, and that's 25 a slightly different issue. The And so His access to the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2760 K2rWsch2 1 2 MS. SHROFF: Isn't the government going to argue he had no access, he had no lawful access? 3 MR. DENTON: 4 system. 5 different system. 6 He did not have lawful access to the He had lawful access to the information through a MS. SHROFF: That's not what they've argued. They 7 said he had no lawful access to any information. 8 access he had was misgranted to himself. 9 argument is, which is why I'm confused by what he's saying. 10 Whatever That's what their But maybe Mr. Zas could think about it and let the Court know. 11 MR. DENTON: The point is that he was still a CIA 12 employee. He still had access lawfully to some amount of 13 information, just not the whole corpus that he stole. 14 MS. SHROFF: 15 them, they moved him to AED. 16 division. 17 18 According to They moved him to another Mr. Denton, you don't have to yell at me. I'm just trying to think about it. 19 20 But not according to them. THE COURT: lawful access to? 21 Mr. Denton, in your view, what did he have Altabackups? MR. DENTON: No. He had lawful access to the projects 22 from RDB, to which he was assigned at the time he committed the 23 theft. 24 25 THE COURT: I think I'm going to take up Mr. Zas's suggestion, and maybe we can meet again Friday or you can SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2761 K2rWsch2 1 submit further information on Friday, Friday being tomorrow. 2 MR. ZAS: 3 THE COURT: 4 Yes. What's your next comment, Mr. Denton? What page are you up to? 5 MR. DENTON: 6 THE COURT: 7 MR. ZAS: 8 THE COURT: 9 MR. DENTON: I'm on page 30. Anything before 30, Mr. Zas? No, your Honor. OK. Mr. Denton, what do you have on 30? Just at the paragraph that carries over 10 from 29 to 30 regarding the definition of an act being done 11 willfully. 12 standard language from Bryan, that "it is not necessary for the 13 government to establish that the defendant was aware of the 14 specific law or rule that his conduct may be violating." We would just ask that the Court include the 15 THE COURT: 16 MR. DENTON: What language do you want inserted? It is from request 41 of our original 17 proposed instructions, and it is simply, "However, in 18 determining whether a defendant has acted willfully, it is not 19 necessary for the government to establish that the defendant 20 was aware of the specific law or rule that his conduct may be 21 violating." 22 THE COURT: All right. 23 What are you up to, Mr. Zas? 24 MR. ZAS: 25 THE COURT: On page 35 -Anything before 35, Mr. Denton? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2762 K2rWsch2 1 MR. DENTON: 2 On Count Three, the fourth element, on page 32, 3 Just a stylistic point, your Honor. regarding transmission of the information -- 4 THE COURT: 5 MR. DENTON: Yes. -- for all three of the preceding 6 instructions, you simply direct the jury to your instructions 7 on Count Two, but this instruction you repeat in full. 8 don't have a problem with the Court repeating it. 9 flagging that, in the interest of time, you might also here be We Just 10 able to simply say that you've instructed them previously on 11 this and they should follow those instructions here as well. 12 THE COURT: I think we threw this in for emphasis -- 13 not for emphasis, but rather, it doesn't hurt to repeat every 14 once in a while. 15 suggestion in mind. 16 Page 35. 17 MR. ZAS: I'll take a look at it again with your This is the count, I think, that actually 18 alleges both a substantive crime and the attempt to transmit 19 information from MCC. 20 THE COURT: 21 MR. ZAS: Right. Mr. Denton and I discussed this. I think 22 we're in agreement that since intent is being charged, the 23 Court should give the normal instruction on what intent 24 requires. 25 I've reviewed that's fine, very close to the Sand charge, I think Mr. Denton has one from the government that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2763 K2rWsch2 1 essentially saying there has to be a substantial step toward 2 the commission, but that mere intent or in preparation may not 3 suffice, something like that. 4 THE COURT: 5 Do you have a number on your request? 6 MR. DENTON: 7 THE COURT: 8 I'm up to Count Five. 9 OK. It was request No. 42, your Honor. 42. I'll include that. I have a question. It's kind of like the question I had for Counts Two and Three. The 10 indictment here says "knowingly accessed a computer without 11 authorization and exceeded authorized access." 12 explain that to the jury? 13 MR. DENTON: How do we I think, your Honor, like anything that's 14 charged in the alternative, I think the best course is for the 15 Court to just explain both to them. 16 THE COURT: 17 MR. DENTON: 18 THE COURT: 19 MR. ZAS: You don't have to pick? No, your Honor. Mr. Zas. I don't think that the Court has to pick, 20 but I just was looking to see, does the Court explain the 21 difference between accessing a computer without authorization 22 and accessing a computer in excess of authorization? 23 that would be useful if you're going to say both. 24 understanding is a defendant accesses without authorization if 25 the defendant's not permitted to be on the device at all, but SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I think My 2764 K2rWsch2 1 that if the defendant is permitted to be on a device or certain 2 portions of a device that goes to other places, that would be 3 exceeding authorization. 4 5 I'm not sure if the Court makes that point, but I think it might be helpful if the Court's going to keep both. 6 THE COURT: 7 haven't made it yet, anyway. 8 9 MR. ZAS: I don't think I've made that point. I I know there are charges out there that do make that point explicitly, so I can add that to my list. 10 THE COURT: 11 MR. DENTON: All right. I don't think we have any problem with 12 the clarification Mr. Zas is talking about, but, your Honor, I 13 do think, given that the indictment charges it in the 14 alternative, it's appropriate to instruct the jury on both 15 options. 16 THE COURT: 17 Next. 18 MR. DENTON: OK. Mr. Denton, what do you have? I'll just say, your Honor, I think that 19 to the extent that you make that change and sort of discuss it 20 in the alternative, that may just require a few additional 21 tweaks to other places in Count Five stylistically. 22 THE COURT: OK. 23 MR. DENTON: 24 substantively until page 39. 25 THE COURT: But I don't have anything else Mr. Zas, anything before page 39? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2765 K2rWsch2 1 MR. ZAS: No. 2 THE COURT: 3 MR. ZAS: I also have something on 39, though. Why don't you go first. On page really 38 to 39, I think this is the 4 only place in the instruction that has a conscious avoidance 5 charge. 6 THE COURT: 7 MR. ZAS: Yes. And we would object to this. I don't think 8 the government laid a sufficient predicate for conscious 9 avoidance in this case. I don't recall any evidence of 10 Mr. Schulte deliberately closing his eyes to whether he had 11 access or exceeded access. 12 accept that he was given lots of instructions and didn't have 13 access or that he didn't receive such instructions, but I don't 14 recall any evidence that he was deliberately closing his eyes 15 to whether he had access. 16 memos on this subject, so it didn't seem like it was 17 deliberate. 18 THE COURT: 19 MR. DENTON: It seems to me that either you He seemed to be writing a lot of Mr. Denton. Your Honor, Mr. Schulte's own narrative 20 was that he was not told but simply discovered that he had been 21 barred from access and chose to enable it. 22 to say that he chose not to discover why he had been barred, 23 the fact that he had been barred. 24 appropriate basis for a conscious avoidance instruction if the 25 defense version of what he did is credited. We think it is fair We think that's an SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2766 K2rWsch2 1 MR. ZAS: Not being told is not being told. Being 2 told over and over again is knowing. 3 middle area, which is, for example, he got this important 4 letter, open it right away, and decided never to open it. 5 would be a conscious avoidance situation. 6 black and white. 7 THE COURT: 8 MR. ZAS: 9 This just seems In the sense that it's either knowledge or no knowledge, but not deliberately deciding not to acquire knowledge. 11 fingers in his ears or something. 12 It's not like he didn't open these emails or he put MS. SHROFF: He read the email and thought it was not clear. 14 THE COURT: 15 What's next? 16 MR. ZAS: 17 concern that I just caught? 18 That Black and white in what sense? 10 13 But I don't see the All right. Your Honor, can I just raise a general Some of the counts don't specify a time period here -- 19 they do in the indictment, of course, but they don't here -- 20 and some do. 21 was just a reference on "in or about." 22 or about a month or year that's charged. 23 jury not get confused between which time periods. 24 25 It might just be clearer for the jury if there THE COURT: I think it's usually in That might help the I do that the first time we mention each of the separate counts. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2767 K2rWsch2 1 MR. ZAS: 2 THE COURT: 3 OK. I saw some that didn't have it. OK. That's a good stylistic suggestion, so I'll do that. 4 What are you up to now, Mr. Zas? 5 MR. ZAS: 6 THE COURT: 7 MR. ZAS: 8 MR. DENTON: 9 10 I think I'm done. You're done? I think so. My next was on page 50, your Honor. "Count Nine, second element -- materiality," and this is not something I feel strongly about. 11 In the last sentence of the instruction, your Honor 12 says "proof of actual reliance on the statement by the 13 government is not required." 14 instruction. 15 the somewhat more plain-language version that just says, "It is 16 not necessary for the government to prove that the government 17 agency was, in fact, misled as a result of the defendant's 18 actions" rather than introducing the concept of actual 19 reliance. That is a totally correct I just wondered whether it might be better to use 20 Maybe I spent too long in securities work. 21 THE COURT: 22 It's longer, which is going in the wrong direction. 23 MS. SHROFF: 24 THE COURT: 25 What's your language again? It's too long. Your objection, Ms. Shroff, is it's too long? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2768 K2rWsch2 1 MS. SHROFF: 2 THE COURT: 3 MR. DENTON: Yes. This sentence is nice and short. What is it again, Mr. Denton? "It is not necessary for the government 4 to prove that the government agency was, in fact, misled as a 5 result of the defendant's action." 6 THE COURT: OK. I'll consider that. 7 What page are we up to? 8 MR. DENTON: 9 THE COURT: 10 MR. DENTON: 11 THE COURT: 12 MR. DENTON: My next is on page 52, your Honor. OK. Count Ten, first element. Yes. Your Honor, I think here it would be 13 appropriate to include the portion from the Sand instruction 14 that advises that a grand jury proceeding commences once 15 subpoenas have been issued in furtherance of the grand jury 16 investigation. 17 THE COURT: 18 MR. DENTON: What's the evidence of that in the record? I think that Special Agent Evanchec 19 testified about giving the defendant a subpoena for his phone 20 when they first met with him. 21 MS. SHROFF: That's not testimonial. 22 MR. DENTON: He testified that he -- 23 MS. SHROFF: But you could get a grand jury subpoena 24 for a phone regardless of whether or not there's an 25 investigation open on you; it has to be an investigation of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2769 K2rWsch2 1 Mr. Schulte. 2 MR. DENTON: 3 THE COURT: No, it doesn't. No. 4 been started. 5 is enough for the start. 6 Proof that the grand jury has issued a subpoena false statements? 8 false statements are? 9 What are the allegedly Should we tell the jury what the allegedly MS. SHROFF: Actually, we don't know what the false statements are. 11 12 It doesn't have to have a target. But I have a question here. 7 10 I think the investigation has to have MR. BRANDEN: I would leave it unstated for that reason. 13 MS. SHROFF: 14 MR. ZAS: No, no, no, no, no. I thought, to weigh in on the confusion, I 15 think the government gave us a bill of particulars where we 16 asked for the false statements. 17 find out what they are. 18 THE COURT: That may be the best place to Do you want a reference to the bill of 19 particulars? That's my recollection too, that the bill of 20 particulars does enumerate them. 21 Mr. Denton. 22 MR. DENTON: It does, your Honor. I'm not sure quite 23 what you're referring in terms of referencing the bill of 24 particulars. 25 It's fine to quote from it or take it. THE COURT: My recollection of the bill of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2770 K2rWsch2 1 particulars, and when you're dealing with Count Ten that 2 specifies what the acts are, that you -- 3 MR. DENTON: Yes, your Honor. 4 I'm sorry. 5 I think it would be totally fine to take the I misunderstood. 6 provisions of the bill of particulars and incorporate them 7 here. 8 bill of particulars separately. I only thought, I didn't think we should reference the 9 THE COURT: 10 MR. DENTON: Right. The only thing I would note there is that 11 there is one false statement with respect to the subway 12 incident that was referenced in the bill of particulars but as 13 to which we sort of decided to forgo the evidence. 14 THE COURT: 15 MR. DENTON: 16 There's no testimony about that. That's right. leaving that one out. 17 THE COURT: 18 I'm up to 55, venue. 19 MR. DENTON: 20 Right. OK. I apologize, your Honor. I have one on 53. 21 THE COURT: 22 MR. DENTON: 23 So we would suggest just OK. With respect to "acted to obstruct or impede" and the definition of "corruptly" -- 24 THE COURT: 25 MR. DENTON: Right. We think it's necessary to instruct the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2771 K2rWsch2 1 jury that the government need not prove that the defendant's 2 sole or even primary intention was to obstruct justice, so long 3 as the government proves, beyond a reasonable doubt, that one 4 of the defendant's intentions was to obstruct justice. 5 THE COURT: 6 MR. DENTON: 7 THE COURT: 8 Mr. Zas, how about you? 9 MR. ZAS: 10 Have you got a request on that? Yes, your Honor. Request 75. It's request 75. OK. Do you have anything else? I don't. THE COURT: Did the parties stipulate on venue? I 11 know that some of the charges deal with the Eastern District of 12 Virginia. 13 MR. DENTON: I believe your Honor allocuted the 14 defendant as to a waiver of venue, I think, at the arraignment 15 on the indictment that first presented those charges. 16 THE COURT: 17 Do you remember, Ms. Shroff? 18 Do you want to check that, David? counsel then. 19 MS. SHROFF: 20 THE COURT: You were. 21 MS. SHROFF: I was. 22 MR. ZAS: 23 24 25 I don't know if you were I was counsel then. Your Honor, I think the government's request here is correct. THE DEPUTY CLERK: The defendant waived his venue rights to Counts One through Seven of the superseding SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2772 K2rWsch2 1 indictment. The Court accepted the waiver of venue. 2 MS. SHROFF: 3 THE COURT: 4 MR. DENTON: 5 MR. ZAS: That's right, your Honor. One through Seven. So it's One through Seven. It couldn't have been One through Seven 6 because four is MCC. 7 MS. SHROFF: We did not stipulate to -- 8 MR. DENTON: I think the confusion is because the MCC 9 charges were superseded later, your Honor. So it was, at the 10 time, Counts One through Seven of the S1 superseder, which 11 corresponds to One, Two, Three, Five through Eight of the S2 12 superseder. 13 THE DEPUTY CLERK: 14 THE COURT: That's true. That raises a question. We're going to 15 send the indictment in to the jury, so we need a clean copy of 16 the indictment. 17 18 MR. ZAS: The government gave me a redacted version that takes out the child pornography counts. 19 THE COURT: 20 MR. ZAS: 21 THE COURT: 22 MR. ZAS: Yes. It takes off Twelve, Thirteen, whatever. Twelve, Thirteen, and Fourteen. Those are gone, so it will be a clean 23 indictment with nothing else. 24 renumber any charges. 25 THE COURT: The Court doesn't have to Then what I'd like to do with the venue SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2773 K2rWsch2 1 provisions is tailor those in One through Eleven the ones on 2 which he waived venue at the time of his arraignment. 3 right? 4 MR. BRANDEN: 5 THE COURT: 6 Yes, Judge. OK. Do we need a verdict sheet? I've requested that on several occasions now. 7 8 All MR. DENTON: Sorry, your Honor. I think between us we may have gotten that crossed up. 9 (Counsel conferred) 10 MR. DENTON: Your Honor, I don't think we think 11 there's any findings they need to make other than guilty or not 12 guilty, so we can put something together and get it to you this 13 afternoon. 14 THE COURT: 15 guilty or not guilty, guilty. 16 17 MR. ZAS: I'd prefer not guilty, not guilty side by side. 18 THE COURT: 19 MS. SHROFF: 20 Do you want the order to be guilty, not You're doubling up there, Mr. Zas. In keeping with the presumption, your Honor, I guess not guilty, guilty. 21 MR. ZAS: Not sure it matters, but sure. 22 THE COURT: 23 MR. ZAS: Anything else to take up? We did give the Court, very late, just 24 before we started, a proposed charge on the theory of the 25 defense. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2774 K2rWsch2 1 THE COURT: 2 MR. ZAS: Yes. And a proposed charge permitting the jury to 3 draw an adverse inference from the late disclosure of the 4 Michael issue. 5 6 THE COURT: MR. ZAS: 8 THE COURT: 10 The theory of the case I don't have any problems with. 7 9 Where would they go? I'm sorry? On the theory of the case, I think you're entitled to that charge. Where should I put it is the question. 11 MR. ZAS: 12 Where do we normally put the theory of the defense 13 14 Let me ask one of the trial lawyers. charge? (Continued on next page) 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2775 K2R3SCH3 1 THE COURT: With respect to page 41 at the top, 2 dealing with Count Six, the elements, the value of the property 3 was greater than $1,000. 4 5 6 7 How do we describe that to the jury, and how do we establish the value was $1,000? MR. DENTON: Your Honor, I think the instruction then at 42-43 talks about the value of the property. 8 THE COURT: 9 MR. DENTON: Yes. And I think some of the testimony, 10 particularly from the early CIA witnesses, was that the effect 11 of the leak was such that millions of dollars' worth of effort 12 was essentially wasted. 13 14 THE COURT: So we would intend to rely on that. So it's no specific, it is the embedded cost of the innovative work that they've done over time? 15 MR. DENTON: 16 THE COURT: That's correct, your Honor. Okay. Count Eight deals with the causing 17 the transmission of a harmful computer program information code 18 or command in violation of Title 18, 1030. 19 conduct here that you have reference to? 20 MR. DENTON: What is the actual Your Honor, in terms of the charged time 21 frame, I think that encompasses essentially the various 22 activities that constitutes his unauthorized reinstitution of 23 access on at least three separate occasions from March through 24 July of 2016. 25 THE COURT: That's when he lost access? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2776 K2R3SCH3 1 2 3 4 5 MR. DENTON: It covers essentially OSB libraries, the Altabackups and Brutal Kangaroo, your Honor. THE COURT: Do you mind if the charge refers to those Altabackups and the Brutal Kangaroo charges? MR. DENTON: I think it's probably better, your Honor, 6 because it speaks in terms of a command, and I think there was 7 evidence about a variety of commands. 8 convict him on basis of a single log deletion. 9 10 THE COURT: MR. ZAS: 12 THE COURT: 13 MR. ZAS: 14 MR. DENTON: Would first thing in the morning be okay? That would be fine. Thank you. With respect to the instructions that Mr. Zas submitted this afternoon. 16 THE COURT: 17 MR. DENTON: 18 Mr. Zas, when do you think you'll get your supplemental request in? 11 15 Okay. Yes. We object to the adverse inference instruction. 19 THE COURT: 20 MR. DENTON: You'll submit something on that? We can submit something, but as a general 21 matter we object to it in any form. 22 appropriate here. 23 The jury can choose to We don't think it's In terms of the theory of the defense charge, in terms 24 of what they want to say about their theory, I don't really 25 have a problem -- I'm not entirely familiar with the theory of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2777 K2R3SCH3 1 the defense charge where the theory is simply the defendant is 2 not guilty. 3 which the proposed charge says: "If the government fails to 4 disprove these contentions, you must acquit Mr. Schulte." 5 The more problematic sentence is the last one in I think the correct formulation is what it always is, 6 that if the government fails to prove the defendant's guilt 7 beyond a reasonable doubt, then you must acquit Mr. Schulte. 8 9 THE COURT: Okay. We'll get the charge out, we'll get your comments first thing in the morning. We'll turn them 10 around as quickly as possible. 11 by the early afternoon on Friday, and that will be the charge I 12 intend to give on Monday. 13 MR. ZAS: 14 MR. DENTON: 15 THE COURT: 16 MR. DENTON: Not from the government, your Honor. 17 THE COURT: I notice Mr. Schulte is not here today. Great. You'll probably have something Thank you. Thank you, your Honor. Anything else? 18 He doesn't have to be, but I assume that he was offered the 19 opportunity of participating? 20 MR. BRANDEN: 21 He was offered the opportunity and decided not to avail himself of it. 22 THE COURT: All right. Thank you very much. 23 MR. ZAS: 24 MR. DENTON: 25 (Adjourned to March 2, 2020, at 9:00 a.m.) Thank you. Thank you, your Honor. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2778 1 2 3 4 5 INDEX OF EXAMINATION Examination of: Page ACHAL FERNANDO-PEIRIS Direct By Ms. Shroff . . . . . . . . . . . . .2672 CARTER HALL 6 Direct By Mr. Denton . . . . . . . . . . . . .2681 7 Cross By Ms. Shroff 8 Redirect By Mr. Denton . . . . . . . . . . . .2736 9 10 . . . . . . . . . . . . .2694 DEFENDANT EXHIBITS Exhibit No. Received 11 L . . . . . . . . . . . . . . . . . . . . .2671 12 O . . . . . . . . . . . . . . . . . . . . .2677 13 P . . . . . . . . . . . . . . . . . . . . .2678 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300