2788 K323SCH1 2 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK ------------------------------x 3 UNITED STATES OF AMERICA, 4 v. 1 5 JOSHUA ADAM SCHULTE, 6 7 S2 17 Cr. 548 (PAC) Defendant. ------------------------------x New York, N.Y. March 2, 2020 9:00 a.m. 8 9 Trial Before: 10 HON. PAUL A. CROTTY, District Judge -and a juryAPPEARANCES 11 12 13 14 15 GEOFFREY S. BERMAN United States Attorney for the Southern District of New York BY: MATTHEW J. LAROCHE SIDHARDHA KAMARAJU DAVID W. DENTON JR. Assistant United States Attorneys 16 17 18 19 20 SABRINA P. SHROFF Attorney for Defendant -andDAVID E. PATTON Federal Defenders of New York, Inc. BY: EDWARD S. ZAS Assistant Federal Defender -andJAMES M. BRANDEN 21 22 23 24 Also Present: Colleen Geier Morgan Hurst, Paralegal Specialists Achal Fernando-Peiris, Paralegal John Lee, Litigation Support Daniel Hartenstine Matthew Mullery, CISOs, Department of Justice 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2789 K323SCH1 Summation - Mr. Laroche 1 (Trial resumed) 2 THE COURT: 3 MR. LAROCHE: 4 THE COURT: 5 (Jury present) 6 THE COURT: 7 summations now. The jury is here. You ready, Mr. Laroche? Yes, your Honor. Call the jury. Good morning. We'll start with the Mr. Laroche. 8 MR. LAROCHE: Thank you, your Honor. 9 Joshua Schulte is responsible for the largest leak of 10 classified information in the CIA's history. 11 devastating to national security. 12 gone in an instant. 13 the world stopped immediately. 14 These leaks were The CIA's cyber tools were Intelligence gathering operations around The defendant did this because he was angry. The 15 defendant did this because he wanted to punish the CIA. 16 defendant did this because he always has to win, no matter the 17 cost. 18 The And after he got caught by the FBI, he tried to do it 19 all over again from prison, repeating that same pattern of 20 anger, escalation, retaliation, and lies. 21 an information war. 22 was about punishing the FBI, the very same way he punished the 23 CIA when he didn't get his way there. 24 25 An information war. This time, declaring The defendant's war We have proven these things to you beyond a reasonable doubt in this case. These files on your screen, the March 3, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2790 K323SCH1 Summation - Mr. Laroche 1 2016, Confluence backup files that the defendant stole. 2 are the backup files the defendant sent to WikiLeaks. 3 are the backup files that WikiLeaks posted on the Internet for 4 the world to see. 5 starting point. 6 exact date and time of the theft: 7 5:43 p.m. 8 9 These These And these files, these files are your Because from these files alone, you know the April 20, 2016 at 5:42 and From that starting point you know it was the defendant who stole these files. You know it was the defendant because 10 he was the one -- the only one -- who had the motive, the 11 means, and the opportunity to steal these files. 12 was the defendant because the theft of these files followed 13 Josh Schulte's playbook. 14 time and time again, he retaliates, he declares war, he 15 punishes. 16 You know it Whenever the defendant feels wronged, And by April 20, 2016, the defendant was a disgruntled 17 man, he was ready to retaliate, he was abusing his computer 18 privileges on a top secret security network, and he was lying 19 about it. 20 exactly what he did on April 20, 2016. 21 The defendant was ready to harm the CIA, and that's At 5:35 p.m. he broke into DevLAN. Minutes later, he 22 stole these files. And then he spent the next hour deleting 23 log after log after log of his activities, trying to cover his 24 tracks. 25 and he sent them to WikiLeaks. The defendant took those backup files home with him, Following WikiLeaks' SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2791 K323SCH1 Summation - Mr. Laroche 1 instructions to a T. 2 secretly transmit data. 3 literally nuked his computer. 4 He downloaded Tails, a program to And then when he was done, he And now, defendant didn't just pick random files to 5 give to WikiLeaks. Those March 3, 2016 backup files meant 6 something to him, because March 3, 2016 was a really important 7 day in that man's life. 8 wasn't going to just take his side against Amol. 9 he realized the CIA was going to investigate, and they were not That's when he realized that the CIA That's when 10 going to tolerate unprofessional behavior, no matter who was 11 responsible, whether it was him or Amol. 12 him. So those March 3, 2016 backup files meant something to 13 him. The same files that were posted by WikiLeaks, the same 14 files that he stole on April 20, 2016. 15 So, how did we get here? And that infuriated Why did the defendant do all 16 these things? 17 vindictive man. 18 defendant is someone who thinks the rules do not apply to him. 19 He thinks CIA's access rules don't apply to him. 20 classification rules do not apply to him. 21 rules do not apply to him. 22 own orders don't apply to him. 23 We are here today because he is an angry and The evidence has shown in this case that the He thinks He thinks prison He even thinks that this Court's The evidence has shown in this case that the defendant 24 is willing to lie over and over again to try to get his way. 25 Amol threatened to kill him and his colleagues, lie; Jeremy SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2792 K323SCH1 Summation - Mr. Laroche 1 removed his privileges without authorization, lie; Karen 2 ignored his security concerns about DevLAN, lie; the defendant 3 never brought anything home from DevLAN to his home, lie; the 4 defendant had nothing to do with the Vault 7 and Vault 8 5 disclosures by WikiLeaks, lie. 6 The evidence has shown in this case that whenever the 7 defendant feels wronged, he retaliates disproportionately. 8 Time and time again at the CIA, you saw this pattern. 9 was in response to Amol. First it Then it was in response to security. 10 Then it was in response to OSB libraries. Then it was in 11 response to losing his administrative privileges. 12 step, this man escalates and retaliates. 13 against the wall, on April 20, 2016, he went nuclear, stealing 14 those backup files and sending them to WikiLeaks. At every And when his back was 15 And that same pattern of escalation, retaliation, that 16 continued in prison when the defendant declared his information 17 war. 18 others to send their government's secrets to WikiLeaks. 19 WikiLeaks. 20 classified information to WikiLeaks believes that it is okay to 21 send more government secrets to WikiLeaks, if you feel like 22 your service isn't being honored. 23 When the defendant was planning to literally encourage To The defendant who is charged with sending highly That's what he thinks. But the defendant was caught redhanded again, this 24 time in prison, using an illegal cell phone, using encrypted 25 e-mail accounts, pretending to be a third person, sending SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2793 K323SCH1 Summation - Mr. Laroche 1 classified information to a reporter, and planning to disclose 2 a whole lot more, including information about Bartender, a CIA 3 cyber tool. 4 could have literally gotten people killed. 5 didn't care. 6 relationships, close U.S. embassies, anything to bully the 7 government into dismissing this case. 8 prepared to burn down the United States government, the very 9 same way he burned it down at the CIA when he didn't get his 10 Information that, had the defendant disclosed it, The defendant He was prepared to break up diplomatic The defendant was way. 11 Josh Schulte is no patriot. Far from it. He's 12 vengeful and he's full of rage, and he's committed crimes that 13 have been devastating to our national security. 14 King Josh. That's what the defendant thinks of 15 himself. 16 of his deceptions have come crashing down in this case. 17 Well, King Josh got caught. And all of his lies, all Before I go any further, I want to talk for a moment 18 about the charges. 19 get instructions from Judge Crotty. 20 instructions about the very various charges, but I want to give 21 you an overview so you can understand the evidence as I talk 22 about it during my closing. 23 Now, at the end of the closings you will You should follow those So there are two categories of charges in this case. 24 The first relate to the Vault 7 and Vault 8 disclosures, so 25 what WikiLeaks disclosed. And, generally, what these charges SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2794 K323SCH1 Summation - Mr. Laroche 1 relate to are the theft of classified information, those backup 2 files, unauthorized computer access to get that information, 3 and the transmission of that information to WikiLeaks. 4 charges also include the defendant's efforts to lie to the FBI 5 and obstruct the investigation. 6 These That's category one charges. Category two charges are the prison charges. And 7 these are two additional charges, one for transmitting and 8 attempting to transmit more national defense information, and 9 then the other charge is contempt of court for violating this 10 Court's orders by sending search warrants that were protected 11 by an order to the reporter. 12 So with that context, this is what I'm going to do for 13 the rest of the closing. 14 to go over the evidence related to the Vault 7 and Vault 8 15 charges. 16 he had clear means and clear opportunity to steal this 17 information. 18 then he sent it to WikiLeaks after that. 19 Part one of the closing we're going And, as you'll see, the defendant had a clear motive, And that's exactly what he did on April 20, and In part two I'm going to talk about the prison 20 charges. 21 escalation, anger, retaliation, and lies. 22 was in prison, he wanted to send more classified information to 23 a reporter, and he did so. 24 whole lot more using an anonymous Twitter account. 25 And there you will see the same pattern of When the defendant And he was planning to disclose a Finally, part three I'm going to talk about how the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2795 K323SCH1 Summation - Mr. Laroche 1 evidence fits together. I'm going to talk a little bit more 2 about the charges, and how the evidence you've seen over the 3 course of this trial proves beyond a reasonable doubt the 4 defendant is guilty. 5 So let start with part one, the evidence showing that 6 he's guilty beyond a reasonable doubt of the Vault 7 and Vault 7 8 charges. 8 straightforward. 9 defendant becomes angry. Here's a timeline. The timeline is Between October 2015 and early 2016, the He becomes angry for multiple 10 reasons. One, he's upset with management that they've sent one 11 of his tools to be built by a contractor. 12 all the credit for that for himself. 13 interpersonal issues around this time are also getting worse 14 with Amol, and we'll go over some of the evidence relating to 15 that. 16 responds to that situation. 17 The defendant wanted The defendant's But he becomes furious with how security and management By April 14, the defendant has said in his own words 18 that he's prepared to retaliate. Then he starts abusing his 19 computer privileges. 20 into DevLAN, he gives himself access back to OSB libraries. 21 also, later on the 18th and 20th, does inappropriate things on 22 DevLAN, including stealing those backup files on April 20. 23 Between April 21 and May 6, the defendant continues his cover 24 up. 25 tries to cover his tracks, both at the office and at home. Between the 14th and the 18th, he hacks He transmits the information to WikiLeaks, and again he SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 He 2796 K323SCH1 1 Summation - Mr. Laroche So let's walk through it. As I said before, e-mails 2 and witnesses have testified the defendant was becoming angry 3 between October 2015 and April 2016. 4 e-mail to security on March 1st, 2016. 5 just two days before those backup files were created, the 6 defendant stole. 7 defendant accused Amol of threatening to kill him. 8 defendant wanted something done about that. 9 And this culminated in an An e-mail that was sent And the defendant was angry. And the And the Now, as you saw from the evidence, the defendant felt 10 like he was being punished for reporting the security incident. 11 He also felt like nobody was taking it seriously. 12 you there is ample evidence that they took this seriously. 13 investigated, local security investigated, SIB investigated. 14 This was taken seriously. 15 I submit to TMU There is a reason that no one substantiated the claim. 16 The reason is he was lying. 17 face. 18 threatening to kill people, including him, but apparently he is 19 the only one who reports it. 20 March, Amol threatens to kill him again. 21 multiple times, it's not substantiated by anything, so it is 22 not surprising that no one found any evidence that this 23 actually happened. 24 25 His claims made no sense on their According to the defendant, in October 2015, Amol is And then all of a sudden in His story changes But, none of that means anything because we are not here today to determine whether Amol made a death threat or SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2797 K323SCH1 Summation - Mr. Laroche 1 not. We're here today to determine whether he stole highly 2 classified information, and the Amol situation is highly 3 relevant to that because the defendant becomes furious. 4 becomes furious with how he is treated; he becomes furious that 5 people aren't taking his side. 6 He And you know he was angry, because there are numerous 7 exhibits showing it. There are numerous exhibits where he says 8 I feel like I'm being punished. 9 being taken seriously. I feel like things aren't That includes e-mails sent to his 10 supervisors, to security, to TMU, to EEO, to the head of CCI. 11 At every step, he is angry. 12 treated. 13 He is upset with how he's been The defendant also sends an e-mail that he feels like 14 he was moved to an intern desk, whereas Amol was moved to the 15 more prestigious desk with a window. 16 e-mail asking about resignation. 17 from multiple witnesses that talk about his state of mind at 18 the time. 19 this from what was recovered from his home. 20 He was upset. The defendant sends an And there is also testimony He was furious. And you also know So a year later, in March of 2017, the defendant's 21 home is searched, and what are some of the things that are 22 recovered? 23 incident. 24 was said and done, were you punished in any way for how you 25 handled the situation?" Handwritten notes about this very specific Notes like this one about Sean. "After everything There are pages upon pages of notes SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2798 K323SCH1 Summation - Mr. Laroche 1 just like this about Jeremy, about another individual Matt who 2 was in the branch, about Amol. 3 that he brought this stuff home and he kept it with him. 4 just handwritten notes, he kept e-mails. 5 related to this incident, including that March 3 e-mail. 6 He was furious. He was so mad Not He shredded things Not only did he just bring it home, he moved it with 7 him. And then you saw pictures of his apartment in New York. 8 There were things that still were not unpacked at the time this 9 apartment was searched, but you know what was unpacked? 10 documents, these handwritten notes. 11 In the headboard of his bed. 12 upset he was about this whole situation. 13 These And where were they put? That's how focused, that's how So by April 8, 2016, the defendant is ready to 14 retaliate. We're going to play a clip here from this SIB 15 interview of the defendant right now. 16 (Audio played) 17 MR. LAROCHE: "Whatever I have to do to shed light on 18 this and make this situation get resolved, I will do that." 19 That's his state of mind as of April 8, 2016. 20 And you also know that as of April 8, 2016, he is 21 still fixated on this high school counselor comment. The same 22 comment that appeared in that March 3, 2016 e-mail. 23 fixated on that day, he's fixated on the situation, and he's 24 ready to retaliate. 25 his mind to make this situation right. He's He's ready to take any steps necessary in SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2799 K323SCH1 1 Summation - Mr. Laroche What is the other thing he says during this interview? 2 He wants people to be punished. 3 please. 4 (Audio played) 5 MR. LAROCHE: Let's play this next clip, He's focused on punishment. He's 6 focused on punishing Karen. 7 escalation, you've seen more anger, you've seen him planning to 8 retaliate, and you've seen him wanting other people to be 9 punished, and that's just by April 8. 10 So by April 8, 2016, you've seen But things keep getting worse. On April 14, 2016, the 11 defendant does something that sets off red flags across the 12 agency. 13 that he had lost certain privileges to a program, OSB 14 libraries, and he's upset about that. 15 about it, and Jeremy said your privileges have been removed. 16 You are in a different branch, so your privileges have been 17 changed on OSB libraries. 18 answer. 19 Sean said it's okay, you can give me my privileges back. 20 was a lie. 21 say that, it's confirmed in the e-mails. 22 Jeremy sent him an e-mail that day, and that e-mail was very 23 clear. 24 of OSB libraries. 25 He knew that he was no longer going to be an administrator of Remember, this is the day that the defendant learned So he approached Jeremy The defendant didn't take that He went to Sean, and he came back to Jeremy and said Sean did not say that. That Sean confirmed he did not But, just to be sure, It said you are no longer going to be an administrator The defendant here responded to that e-mail. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2800 K323SCH1 Summation - Mr. Laroche 1 OSB libraries. 2 supervisors are on this e-mail. 3 supposed to be an admin of OSB libraries. 4 On this e-mail are his supervisors. What does he do? The branch He knows he is no longer Not to be stopped, because he wants 5 to win, after sending that e-mail, 20 minutes later at 6 4:05 p.m., he gives himself privileges back without 7 authorization, unilaterally, on a top secret, classified 8 security network. 9 because that's his playbook. 10 Defendant wanted something, so he took it, Here's the timeline. It's straightforward. On 11 April 4, he lose his privileges. 12 Anthony, his supervisor, asking to continue administering the 13 libraries. 14 the libraries. 15 unilaterally reinstate his privileges. 16 does it anyway. 17 supports it. 18 was lying, and he did what he wanted. 19 On April 14, he e-mailed At 3:59 p.m. Anthony says that JoJo would manage He never gives him authorization to Six minutes later he The evidence shows that. The testimony But the clear documentary evidence shows that he Now, this, as I said, was a huge red flag. We 20 often -- we've been doing this trial for four weeks and you can 21 lose sight of some context here. 22 This is the CIA. 23 available to about 200 people in the United States government. 24 200. 25 security clearance. But remember where we are. This is a top secret computer network that is Every single one of those people has a top secret This computer network is in a building SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2801 K323SCH1 Summation - Mr. Laroche 1 that's guarded by armed guards. 2 building, and then you need to badge into rooms that are 3 literally vaults to get to the computer network, because this 4 computer network stores some of the most sensitive information 5 that our country has. 6 used to target our adversaries, like terrorist organizations. 7 And the defendant decided that it could be up to him whether or 8 not he had access to certain programs. 9 deal. 10 You need to badge into the Information about cyber tools that are And that was a huge As multiple witnesses told you, this was a huge red 11 flag, they had lost trust in him, and they were concerned that 12 he was going to misuse his administrative privileges, so they 13 took action immediately. 14 in for the explicit purpose of changing the administrative 15 rights on DevLAN. 16 administrative rights, so that he could no longer act as an 17 administrator on the system to any parts of the Atlassian 18 programs or any of the servers. 19 of his rights, but they missed some things. 20 they missed some things. 21 On a Saturday, three individuals went Their purpose was to take away his They were trying to remove all They tried, but One of the things they missed was a key, his key, on 22 OSB server. And this is a key that has a password on it which 23 is KingJosh3000. 24 April 20 to help him steal this information, and so they missed 25 that. It's his key. It is the key he will use on That was one of the back doors he would use on April 20 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2802 K323SCH1 1 Summation - Mr. Laroche to steal those backup files. 2 Remember, this is the network diagram. So just to 3 talk for a moment about the defendant's privileges prior to 4 these changes. 5 the Atlassian services. 6 Confluence, of Bamboo, of Stash, of Crowd, and of Jira. 7 April 16, when the changes are made, he has none of those 8 privileges. 9 things. Prior to that, he was an administrator of all So he is an administrator of After He is not supposed to be an administrator of those And that's important, because remember, the backups 10 are accessed by points on those virtual machines, so each one 11 of those services has a pathway to the backups. 12 you get to that pathway is to log into those things as an 13 administrator. 14 no longer do that. 15 And the way When he loses his administrative rights, he can And you know that, too, because on April 15, he had 16 tried to create a different pathway to the backups but he 17 failed. 18 Remember, the defendant was the one who set up those mount 19 points, those pathways to get to the backups. 20 changes are made, he can't use those pathways anymore. 21 lost them. 22 So this is the way he knows how to get there. After those He's As we go through this, this is what you have to be 23 focused on, this part of the network infrastructure as we go 24 forward, because this is what matters. 25 administrative privileges that are left over on this server, He uses his SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2803 K323SCH1 Summation - Mr. Laroche 1 the OSB server here, to get back into Confluence on April 20. 2 We are going to walk through how he did this. 3 pathway that matters going forward. 4 time when he has access to those mount points again, and he 5 goes through that pathway to get back to the backups. 6 So April 18, 2016. But this is the He reverts Confluence to a So this is the Monday following 7 the changes of his privileges. Things continue to get worse. 8 In the morning, Mr. Stedman testified that the defendant was up 9 around OSB, up around that branch even though he was at a 10 different branch at the time. 11 He's upset because he had lost all his administrative 12 privileges and he's still upset about OSB libraries. 13 Mr. Stedman told you that the defendant came up to him and 14 said, oh, it's okay, you can put me back in as an administrator 15 on OSB libraries. 16 again. 17 back, he was willing to lie again. 18 When he's there, he's upset. That's fine. It's been cleared. Remember He lied Because he was so focused on getting his privileges That same morning, he meets with Anthony and he gets a 19 memo. Anthony gives him a memo about the change of privileges 20 he had with OSB libraries. 21 memo that I am going focus on. 22 permitted to personally attempt and/or renew their previous 23 authorization to any particular system. 24 violation of trust, and a violation of agency policy." 25 second portion is, "Please do not attempt to restore or provide And there's two portions of this One says, "Individuals are not This is a direct SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 The 2804 K323SCH1 Summation - Mr. Laroche 1 yourself administrative rights to any project and/or system for 2 which they have been removed." 3 This is in direct response to his conduct with OSB 4 libraries. He had reinstated his privileges without 5 authorization after being told not to, and so that was a big 6 deal. 7 clear that you cannot do these things. 8 like trying to get your administrative privileges back for 9 Confluence, which is exactly what he would do two days later. They wanted to give him the memo to make sure loud and 10 The defendant signed this. This included things He understood this. And 11 quite frankly, it's common sense. 12 secret network and give yourself whatever privileges you want. 13 That's not how it works. 14 You can't just go on a top But on that same day, about 1 in the afternoon, the 15 defendant sends an e-mail to Anthony. It says, "I verified 16 that all private keys with access have been destroyed/revoked. 17 I'm curious with how suddenly everything occurred and without 18 notice to me. 19 I've been the stuckie managing you all the resources and 20 ensuring the Atlassian products are updated, people have proper 21 access. 22 within the products were removed and all my permissions on the 23 servers themselves revoked and all without anyone informing me. 24 Is there a reason to this sudden turnover that occurred without 25 my knowledge?" Since Patrick Schaeffer left a few years ago, It seemed like overnight literally all my permissions SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2805 K323SCH1 1 Summation - Mr. Laroche First, this e-mail reflects he is not happy about not 2 being told, because he thinks that management needs to inform 3 him before they take action. 4 part about this e-mail. 5 knows when he sends this e-mail that he still has that back 6 door access to the server. 7 server. 8 delete log files. 9 doesn't want Anthony to know that. 10 But there is a more important These are lies. He is lying. He He knows he still has access to OSB He knows he still has the key that will allow him to But he sends this e-mail anyways, because he And you know he can still login as an administrator to 11 that server because that's what he's doing throughout the day. 12 At 11:12 a.m. he logs in as root. 13 root. 14 defendant. 15 these logs specifically show he was the one logging in. 16 logging in. At 1:47 p.m. he logs out as He's doing this throughout the day. This is the Mr. Leedom told you this is his IP address and He's 17 There is another thing he's doing that day. On the 18 evening he is using that key that was left over, he is using 19 that session to view log files. 20 Again, context here is important. 21 server. 22 OSB. 23 administrative functions at all on the OSB server. 24 doing it anyway, hours after he had lied to Anthony about his 25 accesses. He's doing reconnaissance. This is OSB server. The defendant has been in RDB for weeks. OSB He is not in He has absolutely no reason to be doing any He's doing it anyway. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 But he's 2806 K323SCH1 1 Summation - Mr. Laroche And we know that it was him doing those commands for 2 several reasons. 3 ID number that was specifically assigned to this session. 4 logged in, using his key, his private key that was left over 5 and password protected at the time. 6 the login. 7 maintained on that work ID session throughout. 8 doing it. 9 One is that this 766 number, this is the work He It's his IP address with This work ID is assigned to that, and it's This is him The other reason you know is because his unallocated 10 space has evidence of these commands being run. 11 Mr. Leedom had told you about unallocated space, essentially 12 deleted space. 13 showing essentially what he was looking at on his screen. 14 someone else's screen, not someone else running it, but what he 15 was looking at on his screen. 16 unallocated space, and that's what's recorded here in the 17 unallocated space. 18 up on server side, they are showing up in his unallocated 19 space. 20 What is it showing. Remember Unallocated space is Not That is recorded in the Him running these same commands that show You know for a third reason it was him running these 21 commands. On April 18, 2016, his badge records show that he 22 locked the eighth floor vault at 7:51 p.m. 23 testimony about locking vaults, that means you are the last 24 person in the vault that day. 25 runs VI shell log command, a command to essentially view and Last person. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Remember there was At 7:44 p.m., he 2807 K323SCH1 Summation - Mr. Laroche 1 edit logs on the system. Minutes later he's locking the vault. 2 He ran these commands. 3 it's his work ID session on his unallocated space, and he was 4 the last one that night. You know he ran these commands because 5 Let's recap what happened on the 18th. In the morning 6 he is logging into that server as root, in other words as 7 administrator. 8 that all his permissions had been revoked. 9 logged in again as root to the server. At about 1 in the afternoon, he lies to Anthony At 7:17 p.m. he And then in between 6 10 and 7:44 he's using that key, that key that was left over, to 11 view log files as an administrator with absolutely no reason to 12 do so. 13 that at the time. 14 steal the information. 15 log files that he would delete two days later. 16 He's not in OSB. He's not an administrator. He knew He was doing it because he was planning to He was looking at some of the very same Let's talk about the day that he actually stole this 17 information. 18 exhibits, and said they were very important evidence in this 19 case because they are your starting point. 20 through why they are the starting point for you. 21 several reasons. 22 Now, at the beginning I focused on these And I want to talk There are On March 7, 2017, WikiLeaks posted these files, these 23 specific Confluence backup files. And you know that for 24 several reasons. 25 information WikiLeaks posted must have come from backup files, One is that Mr. Leedom explained that the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2808 K323SCH1 Summation - Mr. Laroche 1 because there was an error in the script at the CIA so certain 2 information that WikiLeaks got didn't include everything. 3 there was user information missing, there was other things 4 missing that was included on what they posted. 5 that what they got was backup files. 6 some other part of the system. 7 So So you know Not something else, not You also know that those specific backup files that 8 they posted on March 7, 2017, you know the date of those files. 9 Mr. Berger explained to you they are dated March 3, 2016. 10 So, from that last slide, those specific backup files 11 were posted on March 7, 2017. 12 of the files. 13 You know that. That's the date The other thing you also know is that no other backup 14 files that were stored in that server had a different date 15 accessed time to date modified and date created. 16 one of those files had the same three, date created, date 17 accessed, date modified. 18 different. 19 April 20, 2016, he copied it. 20 like this. 21 that's the one that was posted on the Internet. 22 Every other There is a reason why this file is The reason why this file is different is because on That's the only one that looks That's because that's the one that was stolen, There is another reason why April 20 is an important 23 day for him. On April 20, 2016, the defendant gets two 24 e-mails. 25 Confluence and Bamboo are going to be moved off OSB server. Both e-mails essentially say the same thing, that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2809 K323SCH1 Summation - Mr. Laroche 1 And that's important. 2 server, the defendant can't use his admin privileges to that 3 server to manipulate those things, and that's what he uses on 4 the 20th to get back access. 5 Because once they're moved off the Here is the first e-mail. This is from Jeremy Weber. 6 It is explaining that Confluence and Bamboo are going to be 7 taken off of OSB server and put on ISB server. 8 is important. 9 running on it. And again, this OSB server at the time had Confluence and Bamboo The defendant still had access as an 10 administrator to OSB server. 11 administrator, and it was those privileges that he used on the 12 20th to access Confluence, to revert it, to get his accesses 13 back. 14 going to be on the 25th, then his server privileges mean 15 nothing anymore. 16 not on the specific server. 17 and he did. 18 He was still logging in as an But if Confluence and Bamboo are moved, which they are He can't do anything with Confluence if it's So he knew he had to move fast, So here is an overview of what happens on the 20th. 19 Between 5:35 and 6:51 p.m., the defendant reverted Confluence 20 to April 16, 2016, to a time where he had complete 21 administrative control over all the Atlassian services, 22 including Confluence. 23 Confluence virtual machine and get access to those mount 24 points, that pathway to get back to the backups. 25 A time when he could log into that Minutes later, he steals the backups. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 You know that 2810 K323SCH1 Summation - Mr. Laroche 1 from those files that show that it was accessed literally 2 minutes later. 3 times will be updated if you copy them. 4 they will be updated. 5 those access times are updated. 6 And multiple witnesses told you that access If you copy them over, And you know that at 5:42 and 5:43 p.m. Now, the remaining hour he spends deleting log files. 7 Any log file he can find that's dated after 5 p.m., he deletes. 8 One after the other after the other, because he was trying to 9 cover his tracks. 10 Let's walk through it. What happens before the 11 reversion? As I said, there's two e-mails that are sent out, 12 one at 12:06 and one at 3:58 p.m. 13 everyone, including the defendant, that Confluence will be 14 moved off that server. 15 that server and to Confluence. There are e-mails notifying So he is going to lose his access to 16 At 5:18 p.m., the defendant accessed Rufus's key. 17 This is Rufus's key that he could use prior to April 16 to 18 login as an administrator. 19 defendant accessed the key. 20 to steal information, and anything he can do to try to make it 21 look like someone else did it, he will do. 22 Rufus's key which was stored, not in someone else's location, 23 not in someone else's home folder, but on the defendant's home 24 folder. 25 Rufus isn't in the building. Why? The Because he knows he's going So he accessed He kept Rufus's key on his home folder. 5:19 p.m., the defendant connected a USB device into SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2811 K323SCH1 Summation - Mr. Laroche 1 his workstation. 2 this using that key that was left over that he lied about. 3 5:29 p.m., the defendant created a snapshot of Confluence 4 titled bkup. 5 listing the log files on that night because this is that work 6 ID session. 7 address, his key, his login. 8 9 At 5:29 p.m., he listed log files, and he did At You know it was the defendant, again, that was The 766 number, this is his session, his IP This is him. Again, the evidence of these logins that we are looking at right here are in the unallocated space. This is 10 what the defendant was looking at on his screen. 11 command on the server, it showed up on his screen because he 12 ran it. 13 someone else's unallocated space, not some other computer. 14 defendant's unallocated space. 15 that's where this is coming from. 16 He ran this And it was stored in his unallocated space. Not The His eighth floor computer, Here is the creation of the snapshot at 5:29 p.m. 17 These logs are VI client logs. 18 These are logs from his workstation. 19 minutes the defendant searches over and over again for VI 20 client logs. 21 reason he's searching for them is because he doesn't want these 22 to be found either. 23 he couldn't find them at the time. 24 25 This is not unallocated space. And you will see in a few He's searching in the wrong place. But the He wants to try to delete these logs, but 5:30 to 6 p.m., at 5:35 p.m. the defendant reverted Confluence to April 16, 2016. He then steals the backup files SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2812 K323SCH1 Summation - Mr. Laroche 1 minutes later. 2 and after 5:57 p.m. he searches for the VI client logs. 3 walk through these. 4 He then begins deleting log files at 5:57 p.m., Let's This is the reversion to that 4/16 snapshot to a time 5 when he had full administrative control of the system. 6 these are VI client logs. 7 workstation. 8 find later on to delete. 9 Again, These are logs that are on his These are the logs that he is going to try to Here is the evidence that he stole the backups. 10 files are accessed literally minutes after he reverts the 11 system. 12 Confluence. 13 steals the files almost immediately. 14 So he reverts the system, he now has full access to Now he's got his backup backing up the backups, he The defendant at this point starts listing log files, 15 and the total there is approximately file size. 16 from his unallocated space. 17 his screen at the time. 18 These But this is This is what he is looking at on Then the defendant starts deleting things. Over and 19 over again he starts deleting log files. And he's looking 20 specifically for log files that were modified after 5 p.m., 21 after he started to do things on a system that he knew he 22 wasn't supposed to. 23 information. 24 show what he is doing. 25 These are commands he ran that he was looking at on his screen. After he started his plan to steal this He's trying to get rid of anything that would This is in the unallocated space. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2813 K323SCH1 1 Summation - Mr. Laroche Here is the defendant after 5:57 searching for those 2 VI client logs, the logs that showed him creating the snapshot, 3 the logs showing him reverting the snapshot. 4 those VI client logs. 5 because he knows they are really bad evidence for him. 6 knows they are going to show exactly what he did. 7 find them because the way he's running commands right now, he 8 is looking in the wrong spot. 9 Those logs don't exist on the server. He is looking for The reason he's looking for them is He But he can't He is looking on the server. They exist on his 10 workstation. 11 That's part of the reason we have evidence left over, is 12 because he missed them. 13 So he was trying to find them, he just couldn't. He couldn't delete them. 6 to 6:30, he continues listing log files, searching 14 for newer logs, deleting logs, and then listing again. 15 see the file size drops as he is doing this. 16 dropping because he's deleting things, things that would have 17 shown his activity on the system. 18 The file size is Here is 6:16 p.m. he is listing again log files. 19 is, again, in the unallocated space. 20 on his screen in front of him. 21 You can This This is what is happening At 6:16 he is searching for files that are newer than 22 VMK summary log. you can see just at the top of this exhibit 23 VMK summary was last modified at 2100 which is 5 p.m. 24 looking for logs that are newer than 5 p.m. because that's when 25 his activity started to steal this information. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 He is he wants to 2814 K323SCH1 1 Summation - Mr. Laroche get rid of everything he can. 2 Then at 6:16 p.m. he deletes another log file, 3 hostd-probe.log. 4 5:55 p.m., so that file had been modified during the reversion 5 while he was stealing things. 6 rid of it. 7 space. 8 9 10 You can see that file was modified at He wanted to make sure he got Again, this is deleted space. It is unallocated It is what is on his screen as he's doing these things. After he deletes that, he lists more log files. can see the file size has gone down again. You It went down because he's deleting things. 11 From 6:30 to 7:00 he continues more deletions, more 12 listings. 13 he's looking for log files in a different part of the server. 14 He is looking for log files specific to Confluence, because 15 that's the virtual machine he was manipulating, that's the one 16 he used to get back to the backup files to steal them. 17 At 6:38 he deletes the VMware.logs. At this point At 6:51 p.m., the defendant reverts to that bkup 18 snapshot. Now, think about what the defendant had just done 19 here. 20 snapshots. 21 going to make changes to the system, and if something gets 22 screwed up, you're going to go back in time. 23 the exact opposite. 24 bkup, he then went back in time to April 16, 2016, to when he 25 had full administrative control over system. Multiple administrators told you about the use of You use a snapshot if you're concerned that you are The defendant did The defendant created a snapshot titled SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Then when he was 2815 K323SCH1 Summation - Mr. Laroche 1 done, an hour and a half later, he essentially went back to the 2 future, to bkup, that snapshot he created at the beginning. 3 Why did he do that? 4 by doing it that way, he essentially deleted all of the 5 information on the virtual machine that he was doing at the 6 time. 7 administrative reason to do that. 8 for the defendant to do it after he had lost his administrative 9 privileges. Because he wanted to cover his tracks, and There is no reason to do that. There is certainly no reason There is simply no basis to do that, other than 10 him stealing something. 11 at the time. 12 There is no And that's exactly what he was doing After he reverts to that bkup snapshot, he deletes the 13 snapshot. 14 file size. 15 just deleted a very big snapshot of Confluence. 16 more log files, then he deletes more log files from 6:56 to 17 6:58 p.m. 18 Then he lists log files again. There is a drop in The reason there is a drop in file size is he's Then he lists So let's walk through this for a second. By the end 19 of the reversion, and the end of all the log deletions, this is 20 what the defendant has done. 21 copy command, deleted. 22 would have been connected, like a USB device or a hard drive or 23 something like that, deleted. 24 Snapshot activity, deleted. 25 logs after 5 p.m. have been deleted. Commands that would have shown a Devices connected, logs showing what Auditing data, deleted. Login information, deleted. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 All 2816 K323SCH1 1 Summation - Mr. Laroche The reason the defendant was so careful is because he 2 had just stolen highly classified information, and he didn't 3 want to be caught. 4 get the unallocated space on his own workstation, and he didn't 5 get those VI client logs, and that's why we know what was left 6 over. 7 But he didn't get everything. He didn't How do we know that this was the defendant? Numerous reasons. Well, 8 numerous reasons. At the most basic level, 9 as I've been talking about throughout the closing, these logs 10 were from his workstation. 11 workstation, from his unallocated space. 12 looking at on his screen, on his computer, on the eighth floor 13 at the agency, at the time. 14 They are forensic files from his The things he was They're his files. You also have some forensic files from the server that 15 match up to what he was doing. 16 April 18 where you saw some things from the server, some 17 commands that were run. 18 unallocated space. 19 You have his password protected key that he used on the 18th 20 and 20th to view and delete log files. 21 things that put him at his desk as these things are happening. 22 You have e-mails, you have Same Time chats, you have chats from 23 his actual DevLAN computer and you have his badge records. 24 25 The example being like on That match up to what's in his But you have a lot more than that, too. But you also have other Let's go through some of those. chats. What about Same Time At 5:42 and 5:43 p.m., the defendant had copied the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2817 K323SCH1 Summation - Mr. Laroche 1 Confluence backup files. Three minutes later, he sends a Same 2 Time chat --"When's gym." He misspelled when's -- to Michael. 3 Now, remember that individuals at the agency who were DevLAN 4 users had a DevLAN computer, and they had another computer that 5 had Same Time chats and e-mails. 6 at his chair, using that Same Time chat to send a message to 7 Michael at the time. 8 do this. 9 So the defendant is sitting He is literally sitting in his chair to But there's more. At 5:52 p.m., the defendant sends 10 an e-mail to Anthony. 11 training. 12 like things are normal. 13 desk, he's stealing files, and minutes after he steals those 14 files and sends this e-mail, he's listing log files and he is 15 deleting log files. 16 his desk at the time. 17 In this e-mail he's asking about The defendant is doing this because he wants to act Things are not normal. He is at his He is at his desk at the time. But there's more. There's IRC chats. He is at DevLAN IRC 18 chats are actually on his DevLAN machine. 19 is looking at his DevLAN computer screen at the time he's 20 sending these chats. 21 messaged Michael. 22 6:51 he messaged Michael, a minute later he deletes the bkup 23 snapshot. 24 happening. 25 It means you know he We have chats from 6:37 p.m. where he A minute later he deleted log files. At He's sitting at his desk as these things are Here's just one example. On the top here is a DevLAN SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2818 K323SCH1 Summation - Mr. Laroche 1 IRC chat. This chat was taken -- was found on his workstation. 2 This is a forensic file taken from his workstation. 3 shows at 6:51 p.m., at 07 seconds, he says "I shall be" to 4 Michael. 5 Ten seconds after he sends that chat, he is reverting the 6 snapshot. 7 defendant. 8 9 Ten seconds later, he reverts the snapshot to bkup. He is at his desk. Not someone else, it's the And what about this LOL, sorry, Shane talked to me for like 30 minutes, that's a lie. We just went through what he 10 did between 6:30 and 7. 11 listing log files, he is being very careful. 12 to somebody else. 13 things. 14 And it He is deleting log files, he is He is not talking He is taking his time to systemically delete The defendant's at his desk. You also know from badge records. So again, just like 15 on the 18th, at 6:58 p.m., the defendant deleted log files, and 16 then nine minutes later, he locks the eighth floor vault. 17 again, the defendant is the last person in the vault, just like 18 April 18. 19 he wants to do this at night, he wants to do this when few 20 people are there, and you know it was him doing these things 21 because he locked the vault that night. 22 The last person in the vault. Yet He's in there because What about the defendant locking vaults? Well, 23 interesting, the defendant locked the eighth floor vault two 24 times in 2016. 25 was stealing things. Two times. April 18, and April 20. Because he He was doing reconnaissance on the 18th, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2819 K323SCH1 1 Summation - Mr. Laroche and he stole files on the 20th. 2 What about everybody else? Rufus, his badge records 3 show he's not even in the building. 4 other individuals who were administrators at times, left the 5 office before the reversion. 6 What about Michael? David, Tim and Jeremy, Michael, Michael's desk is on the 7 ninth floor. His computer, his DevLAN computer is on the ninth 8 floor. 9 of those unallocated space logs we saw were on the eighth floor The defendant's computer is on the eighth floor. 10 computer. 11 Michael's not even on the ninth floor. 12 computer. 13 physically impossible for him to have done this. 14 on the fifth floor, logs are being deleted. 15 deleted by him. 16 Michael had nothing to do with this. 17 eighth floor the whole time during the reversion, is never near 18 the defendant's desk. 19 reversion, he's on the fifth floor. 20 own desk, let alone the defendant's. 21 The defendant's computer. All Between 6 and 6:28 p.m., He's not even at his He is on a completely different floor. It is While he is They are being They are not being deleted by Michael. Michael is never on the And during a key portion of the He is not even near his And now there's been, obviously, stuff about Michael. 22 He went on administrative leave. 23 saw them testify about it. 24 administrative leave. 25 because he was a suspect. You've read the memo. You You saw why he went on He didn't go on administrative leave The memo is pretty clear. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 He was 2820 K323SCH1 1 Summation - Mr. Laroche the suspect. 2 The CIA thinks he did it. But all of that is a sideshow, because the CIA was not 3 in charge of the investigation. They were not the ones 4 investigating the case. 5 the case agents, Richard Evanchec, Evan Schlessinger. 6 heard directly from the experts, Michael Leedom and Michael 7 Berger. 8 investigation, about all the steps they took, about the things 9 they found out about Michael or David or other people, about The FBI was. You heard directly from You Those individuals testified at length about the 10 how they ran it down. 11 case. 12 They talked about reviewing administrators' computers at the 13 agency. 14 at the agency. 15 the CIA. 16 Those individuals were in charge of the Those individuals were in charge of reviewing things. They talked about reviewing regular users' computers They were in charge of the investigation. This Michael thing is a sideshow. 17 to you it could not have been him. 18 because he was not on the floor. 19 These records prove It couldn't have been him Simple as that. You also know it wasn't Michael or somebody else 20 because of what the defendant does in the following weeks. 21 between the 21st and May 6, he sends the information to 22 WikiLeaks and he continues his coverup. 23 Not So Now, the first thing he does on the 21st, so the day 24 after, the defendant gets to the office, he goes to the eighth 25 floor at 10:48 a.m. The first thing he does, minutes later, is SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2821 K323SCH1 Summation - Mr. Laroche 1 to e-mail Anthony. 2 server. 3 e-mail he sends the next day, we are going to look at it, is to 4 Anthony because he wants to try to cover his tracks. 5 concerned what he had just done the night before. 6 e-mails Anthony about it. 7 He's e-mailing Anthony about the OSB He wants to wash his hands of that server. The first He is So he About an hour later, less than an hour later, that USB 8 device that had been logged in, he reformats it. 9 he wants to make sure anything that was connected to his system 10 11 at the time is wiped. Why? Because That there is no evidence on anything. (Continued on next page) 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2822 K32Wsch2 Summation - Mr. Laroche 1 MR. LAROCHE: Let's look at that email to Anthony. 2 Again, this is minutes after he gets to the office on 3 the 21st, minutes after he gets there. 4 "transfer of equipment, especially OSB server to OSB." 5 says: 6 RDB, but I had equipment that was registered under my name for 7 OSB -- notably, our $30,000-plus server that I was custodian. 8 Probably low on your totem pole, but what is the process for 9 transferring this equipment to OSB and removing me from the CMR 10 The subject is He "Not sure if this has been done already with my move to and my access?" 11 The day before the defendant had used administrative 12 privileges on that server that he lied about to get access to 13 Confluence, to revert the system, to steal the files. 14 first thing he does the next day is to email his supervisor and 15 try to wash his hands of the server, because he's concerned. 16 He doesn't want his name associated with it. 17 cover his tracks. 18 email, he reformats that drive. 19 And the He's trying to And less than an hour after he sends this But the preparation continued over the following 20 weekend. 21 learned a couple of things. 22 his protective order, and he also learned that TMU had closed 23 its case against him. 24 to send this information. 25 Now, at this point, on the 22nd, the defendant had He learned that Amol was appealing So on the 23rd he starts his preparation On the 23rd, he prepares to delete Brutal Kangaroo SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2823 K32Wsch2 Summation - Mr. Laroche 1 with the Eraser Portable program, a secure program to delete 2 things. 3 located on his computer that was put in a queue to be deleted. 4 Remember, Brutal Kangaroo was a folder that was On the 24th, he ordered a SATA adapter for same-day 5 delivery, something that would assist him in transferring 6 information from hard drive to hard drive for transmission that 7 would not be connected to his computer. 8 downloaded Tails. 9 the program that WikiLeaks encourages individuals to download On the 24th, he also This is the program we talked about earlier, 10 to secretly transmit data. 11 the 23rd and the 28th was he added some encrypted files to the 12 queue for Eraser Portable: data2.bkp through data6.bkp. 13 remember the defendant had encrypted files on his computer that 14 he named as data.bkp. 15 through data6.bkp, were added to the queue for Eraser Portable. 16 You also know that these encrypted files were located on his D 17 drive, and we're going to come back to that in a moment. 18 And the other thing he did between You'll These folders, these files, data2.bkp Again, the defendant was following WikiLeaks's 19 instructions. He already had TOR. He already had that on his 20 home computer, but on the 24th, he got Tails. 21 testimony that that allows you to visit websites anonymously, 22 and Tails is a way to secretly transmit data over the internet 23 anonymously. 24 Tails in conjunction to make sure that you are not identified 25 when you send information to WikiLeaks. So TOR, there is And WikiLeaks instructs folks to use TOR and And that's exactly SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2824 K32Wsch2 1 Summation - Mr. Laroche what he did on the 24th -- he downloaded Tails. 2 So the next weekend, the weekend of the 30th, more 3 transmission, more cover-up. 4 and Nuke on the 30th. 5 destroys data, because he's preparing to wipe all of his 6 information. 7 transmits this information, and you know that from his activity 8 on the home computer. 9 First, he downloads Darik's Boot This is a program that irrevocably And on the 30th and into May 1 is when he Just as a general matter, you know this information 10 was transmitted to WikiLeaks because they posted it on the 11 internet. 12 he send it? 13 May 1. They obviously got it, and the question is when did And that's answered by what he did on the 30th and 14 Let's look at the evening of the 30th. 15 At 6:47 p.m., he is searching for Google history and 16 Google view browsing history. 17 been searching for. 18 searching for digital disk-wipe utility on several occasions, 19 and at 10:52 p.m., he visits a website Kill Your Data Dead With 20 These Tips and Tools. 21 out how to securely delete information that might connect him 22 to the leak, anything that he might've brought home with the 23 leak on it, anything that he might've used to transfer it. 24 25 He is concerned about what he's On the evening, that night, he is The defendant is interested in finding And at 10:55 p.m., he runs a similar search for SSD wipe utility. And you'll remember all those hard drives that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2825 K32Wsch2 Summation - Mr. Laroche 1 were recovered from his home. He was wondering how to wipe 2 them to make sure that there was no evidence of his activities. 3 Now, overnight, he continues working. 4 At 12:19 a.m., the defendant mounted his D drive onto 5 his virtual machine, the same D drive that had those encrypted 6 files, data2.bkp through data6.bkp. 7 He mounts his D drive. 8 9 They're in his D drive. Then, overnight, he is constantly looking at his computer. On at least four occasions, he is unlocking his 10 virtual machine in the middle of the night: 11 a.m.; 2:56 a.m.; 3:18 a.m. 12 transferring data and he wants to make sure it's happened 13 correctly. 14 searches he runs at of the end the night and the early morning. 15 1:57 a.m.; 2:34 He is doing that because he is And you know that is the case because of the Google At 3:18 a.m., just after he unlocks his screen saver, 16 the defendant searches for How Long Does It Take to Calculate 17 MD5? 18 Remember, calculating an MD5 is a way to confirm that 19 what you transferred from one place to another is the same, 20 that it went correctly, that there were no errors. 21 calculate an MD5 to confirm that what you transferred 22 transferred correctly, and that's what he's looking for at 3:18 23 a.m. 24 25 You Then at 3:21 a.m., the defendant visits a website, How Can I verify That a 1TB File -- one terabyte file -SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2826 K32Wsch2 1 2 Summation - Mr. Laroche transferred correctly? Remember, there was testimony about how big the 3 Confluence backups and Stash backups would have been, the files 4 he stole on April 20th. 5 How big would they have been unzipped? 6 Close to a terabyte. Several hundred gigabytes of 7 information was the testimony. 8 that much information was transferred overnight into the wee 9 hours of May 1, 2016, less than two weeks after he stole the 10 information on April 20, 2016. 11 he just transferred it. He's looking to see whether That's what he's doing, because 12 What's the defendant do next? 13 Several days later, he reformats his computer. He 14 does that because he wants to hide any evidence of what might 15 be on the computer. 16 effect of essentially making data unrecoverable from prior to 17 that time. 18 If you're going to send us data, you should remove any traces 19 of your submission. 20 get rid of them. 21 folks to do. He reformats it completely, which has the And here again, these are WikiLeaks's instructions: You should wipe your drives. You should He is doing everything that WikiLeaks tells 22 Remember another thing about the defendant. 23 Evanchec testified, he said that he asked the defendant about 24 rebuilding computers, and the defendant said, essentially: 25 Well, any time I rebuild a computer, I always wipe everything. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 When Mr. 2827 K32Wsch2 1 2 Summation - Mr. Laroche I wipe it clean, and then I rebuild it that way. There's a problem with that. Going back to 2006, the 3 only time the defendant searches for wiping utilities -- 4 anything related to wiping hard drives -- the only time he does 5 that is late April and early May 2016; the only time, because 6 that's the only time that he transmitted highly classified 7 information to WikiLeaks. 8 computers. 9 It wasn't about rebuilding It was about trying to cover his tracks. And another thing. If he's reformatting his computer, 10 why is he transferring all that data before he does the 11 reformatting, if he was just reformatting it and not doing 12 anything else? Why, several days before, is he transferring 13 all this data? If he actually was just reformatting the 14 computer, he would have reformatted it and then transferred 15 data back onto it. 16 first was transmit the data to WikiLeaks, and then he wanted to 17 cover his tracks. 18 He did the opposite because what he did And that's exactly what he did. You also know that he sent this information to 19 WikiLeaks because of his web searches. The defendant sends it 20 in May, and it becomes clear that he's wondering where it is, 21 why it hasn't been posted. 22 the defendant's Google searches relating to WikiLeaks. 23 2006 and July 2016, he conducts three WikiLeaks-related 24 searches and visits nine pages. 25 searches, nine pages. Remember, there was testimony about Between So over ten years, three Between August and January, all of a SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2828 K32Wsch2 Summation - Mr. Laroche 1 sudden, he wants to search for WikiLeaks a lot: 39 searches; 2 115 pages visited. 3 is he's wondering where his stuff is. 4 months. 5 is, and you see that from some of the searches he's running. And the reason he's searching for WikiLeaks It's been several It hasn't been posted, and he wants to know where it 6 Let's look at a few of these. 7 One is WikiLeaks code. Now, around this time there 8 are other things being posted by WikiLeaks. 9 emails are being posted by WikiLeaks. Hillary Clinton's But there's something 10 that Hillary Clinton's emails don't have: source code. 11 is no source code. 12 wondering if WikiLeaks is going to produce some source code 13 because he has provided them source code, and he's wondering if 14 it's going to come out. 15 There He is searching for code because he's He also searches, on January 4, 2017, for "WikiLeaks 16 2017" and he visits a website: 17 in 2017 Showdown. 18 he's waiting. 19 he's waiting to see what comes out. 20 to July 2016. 21 obsessed with looking at WikiLeaks. 22 because he sent them the information and he's waiting for it to 23 come out. 24 25 WikiLeaks Vows to Blow You Away He wants to see what's coming out because He had sent the information to WikiLeaks, and Again, no searches prior All of a sudden, in August to January, he is The reason he is is Now, on this point, at the beginning of the trial, Ms. Shroff said the timeline's not going to make sense, the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2829 K32Wsch2 Summation - Mr. Laroche 1 government's timeline is not going to make sense. 2 defendant has no burden. 3 that burden. 4 scrutinize them. 5 And the We have the burden, and we accept But when they do make arguments, you can The timeline does make sense. You know why the 6 timeline makes sense? Well, first, because WikiLeaks is 7 publishing some things in August; through the summer, they're 8 dealing with Hillary Clinton's emails. 9 Mr. Leedom, that it would have taken them some time to get this But you also know, from 10 information published. 11 error in the script of the backups that were provided to 12 WikiLeaks, and so they couldn't just simply take those backups 13 and put them in commercial software and just see everything. 14 They would have to figure out how the data worked together. 15 They would have to figure out a script to get that data to be 16 published again, so it would have taken them some time. 17 Mr. Leedom told you that there was an Mr. Leedom said that he alone, in a lab, with computer 18 scientists helping him, with CIA officials who knew the data, 19 it took him -- him alone -- a week just to figure out how the 20 data worked together. 21 would have needed to figure out a script. 22 to figure out how to get it put back together again. 23 would have taken time, and that's why it wasn't published 24 immediately. 25 That's just the starting point. They They would have need That Mr. Leedom explained that to you. Another reason you know the defendant knew that this SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2830 K32Wsch2 Summation - Mr. Laroche 1 information was going to be coming out, and that's what he sent 2 on his last day at the agency. 3 Here's his email to OIG that he sent on November 10, 4 2016, and just to focus on a few portions of this, some of the 5 things he said: 6 7 Management ignored security concerns, his security concerns, for two full years related to DevLAN; 8 9 It would have been easy to download and upload DevLAN or the server in its entirety to the internet; 10 11 This illustrates the lack of security and pure ineptitude of Karen; 12 13 Karen attempted to blame the insecure environment on me. 14 More lies here by Mr. Schulte. 15 The defendant did not report security concerns for two 16 full years. You want to know how you know that? Well, Special 17 Agent Evanchec testified that he reviewed his emails and Same 18 Time chats, and there are no such communications. 19 Mr. Schulte is also an individual who wants everything in 20 writing. 21 2016, he is sending email after email after email about the 22 Amol incident, page after page of emails, writing down his 23 thoughts on the Amol incident. 24 emails? 25 make them. But Over the course of months, between October and early You know what's not in those Reports about security concerns, because he didn't He was lying. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2831 K32Wsch2 1 Summation - Mr. Laroche The defendant also claimed at the time, before his 2 resignation, that his punishment was based on the Amol 3 incident. 4 concerns. 5 It had nothing to do with him reporting security And another thing. The security concerns that the 6 defendant is reporting at the time are that developers are 7 acting as administrators. 8 was fixed? 9 You know why that problem was fixed, what got it to be fixed? You know when that security concern April 16, 2016. They tried to fix the problem. 10 Him. He was the security concern that they were trying to fix, 11 not something else, not something he reported. 12 the developers were administrators and that was a problem, that 13 came to a head because of what he did. 14 of what he did. The idea that That was fixed because He was the security concern. 15 So what is the defendant doing here? 16 He knows this information at some point is going to 17 come out, and he wants to try to cover himself by saying I was 18 the one; I was the whistleblower. 19 He was lying. He was not a whistleblower. 20 So the leak does come out. 21 March 7, 2017. Here is the Twitter post on that day 22 from WikiLeaks announcing the leak. What does the defendant 23 do? 24 and not just anything about the leak; he is interested in the 25 investigation. He immediately starts searching for things about the leak, So he searches, over a seven-day period, six SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2832 K32Wsch2 1 Summation - Mr. Laroche times for the FBI -- six times for the FBI. 2 What types of things is he visiting? This is just on 3 March 7 alone, the day the leak comes out. The first thing he 4 is interested in is what is the FBI doing. He visits websites: 5 FBI Prepares Hunt for the Source of CIA's Documents; WikiLeaks 6 Reveals CIA Hacking Trove has Feds on Mole Hunt; FBI Joins CIA 7 in Hunt for Leaker. 8 9 Why is he interested in the FBI? worried. Because he is He is worried that they're going to find him. He's 10 worried that they're going to figure out he did it. 11 first thing he's interested in finding is what is the FBI 12 doing? 13 So the Then he meets with the FBI, and he tries to do exactly 14 what he did at the CIA: lie. Because when he gets caught, he 15 lies without remorse, without hesitation. 16 over again at the CIA, and he did it over and over again at the 17 FBI. He did it over and 18 The things he lied about: 19 Deny being responsible for the leaks. He denied 20 having that classified OIG email. 21 that question, Do you have that OIG email, that was before he 22 knew they were going to search his home. 23 lie? 24 he knew he wasn't supposed to have it. 25 Remember, when he was asked He lied. Why did he Because that email contains classified information, and He denied taking information from DevLAN to his home. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2833 K32Wsch2 Summation - Mr. Laroche 1 There is a chat that we read during Mr. Evanchec's testimony 2 where he says to someone he's talking to on his chats, I take 3 stuff from DevLAN and bring it home. 4 bring it home, and the individual that he's talking to responds 5 and says: 6 that. 7 network? 8 from a class network. 9 because when the defendant wants to do something, he does it. I don't understand. I put it on CDs, and I We would get in trouble for And he tries to clarify: You mean from an unclass The defendant corrected him. He said: Nope. It's I put it on CDs and I bring it home, 10 He doesn't care about the rules. 11 classification issues. 12 about it. He doesn't care about the He does it. But he lied to the FBI 13 The defendant denied working on Brutal Kangaroo at his 14 home, even though there's evidence that he securely deleted the 15 Brutal Kangaroo folder from his computer. 16 The defendant denied ever making DevLAN vulnerable to 17 a theft. 18 log files on April 20, 2016. 19 activities. 20 they're devastating evidence of his guilt. 21 any of that stuff. 22 But of course, he didn't mention that he bulk deleted He mentioned none of those The reason he didn't mention them is because He didn't mention But the defendant's lies didn't work, and the 23 defendant was caught. And after he was caught, he repeated 24 that same pattern. 25 retaliated, and he lied some more, and he tried to cover up He got angry. He escalated. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 He 2834 K32Wsch2 1 Summation - Mr. Laroche some more. 2 Again, at the beginning of this trial, Ms. Shroff said 3 that the prison conduct is going to show someone who was trying 4 to clear his name, that he was just trying to clear his name. 5 Again, we have the burden, but you can scrutinize 6 those arguments, and when you do, that argument does not add 7 up. 8 to smuggle an illegal cell phone into prison; to use that 9 illegal cell phone to set up encrypted email accounts and 10 anonymous social media accounts; to pretend to be a third 11 person using those accounts; to accuse his CIA coworkers of 12 setting him up; to violate this Court's orders; to delete 13 activities of what he's doing in prison, activities that are 14 apparently supposed to exonerate him; to communicate with a 15 reporter as a third person; to tell that reporter that he is a 16 member of Anonymous or was a member of Anonymous -- Anonymous, 17 a group that has sent information to WikiLeaks in the past; to 18 send that information, to send that reporter classified 19 information about the CIA's network; to promise that reporter 20 that he will give him more information if the reporter 21 publishes things on a timeline that is OK with Mr. Schulte; and 22 then plans to disclose more classified information using an 23 anonymous Twitter account, including information about 24 Bartender, information that witnesses told you hadn't been 25 disclosed and could have put people's lives in danger. Apparently, the defendant's idea of clearing his name is SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2835 K32Wsch2 1 Summation - Mr. Laroche That is not someone trying to clear their name, ladies 2 and gentlemen. That is Mr. Schulte's playbook. 3 escalation, retaliation and lies. Anger, That's what that was. 4 Let's walk through the prison evidence. 5 Much like what happened at the agency, the timeline is 6 similar. 7 Anger grows. He escalates. The timeline here is in May. He retaliates. He lies. There's a court 8 appearance in this case, and the defendant is instructed very 9 specifically that he cannot modify the terms of the protective 10 order. 11 marked, pursuant to the protective order, as confidential, you 12 can't just disclose it to third parties. 13 The Court has issued an order saying you cannot do that on your 14 own, and the Court instructs the defendant about that and says, 15 Do you understand? 16 now." 17 And that protective order is clear: if something is I do now. You can't do that. And the defendant's response is, "I do That's what he said to the judge. By July, his anger had grown. You've seen a bunch of 18 prison-notebook writings where the defendant is very frustrated 19 with his family. 20 he wants, which is to publish his articles. 21 hold him back, but he does not want to be held back. 22 to get his word out, and so he's furious with his family at 23 this time for not helping him. 24 25 He's frustrated that they're not doing what They are trying to He wants By August, he gets that encrypted cell phone, the Samsung cell phone. He declares his information war. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2836 K32Wsch2 1 Summation - Mr. Laroche By September, he has set up his Twitter account, and 2 near the end of the month, he emails the reporter classified 3 information about the network infrastructure, and he was also 4 planning to post tweets that contained more classified 5 information and an article that he wrote that contained more 6 classified information. 7 from doing that was the FBI. 8 October 3 and stopped his plans. 9 And the only thing that stopped him The FBI searched the MCC on Again, by August -- August 8, 2018 -- you know from 10 the prison notebooks that the defendant is furious. 11 furious with his family about his articles not getting out, and 12 he says that he is prepared to break up diplomatic 13 relationships, close embassies and end U.S. occupation across 14 the world unless his case gets dismissed. 15 wants. 16 He's That's what he He wants his case to get dismissed. And these aren't idle musings by somebody who couldn't 17 possibly cause harm to the agency or to the United States. The 18 defendant worked for years developing cyber tools. 19 involved in operations against foreign adversaries, against 20 terrorist organizations. 21 could be harmful, and you know that because just some of the 22 tweets he drafted about Bartender, witnesses told you that they 23 would never disclose that information, and that information, if 24 disclosed, could put people's lives at risk. 25 idle musings by him. He was The defendant knows information that So these were not He could do this, and his mind-set as of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2837 K32Wsch2 Summation - Mr. Laroche 1 August 8 was I will do anything I can to get out of this case. 2 Anything I can to bully the government to dismiss my case, I 3 will do it. 4 5 By August 14, the defendant is prepared and has declared his information war. 6 Now, the timing of this is not coincidental. 7 On the 13th, August 13, that's when the defendant gets 8 that Samsung cell phone, and Carlos Betances told you that he 9 wanted that specific cell phone because of the encryption on 10 it, because he felt like he could do certain things on that 11 cell phone that he wasn't comfortable doing on the other cell 12 phones. 13 declares his information war. 14 that he was not trying to clear his name. 15 that he was trying to harm. 16 government. 17 information war. 18 So the next day, after he gets this cell phone, he This is, again, more evidence It's more evidence He was prepared to harm the He's prepared to do that by, in his own words, an A week later, the defendant had already taken a number 19 of steps to set up anonymous social media accounts, to set up 20 encrypted email accounts, and the defendant has a checklist by 21 the 21st, August 21, that talks about the various things that 22 he plans to do, that he wants to do, and it is all more 23 devastating evidence that he was doing illegal things from 24 prison. 25 is trying to, in his own words, "delete suspicious emails from He is trying to delete things from these accounts. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 He 2838 K32Wsch2 1 Summation - Mr. Laroche my Gmail." 2 You don't need to delete suspicious emails if those 3 emails exonerate you, if those emails are about clearing your 4 name. 5 criminal, because they are illegal. 6 He's trying to protect himself: You need to delete suspicious emails because they are That's what he was doing. 7 "Create new ProtonMail presumedguilty@protonmail.com; 8 "Migrate WordPress to ProtonMail; 9 "Clean up apps; 10 "Reset factory phone" -- all steps he wants to take to 11 hide what he was doing, to prevent people from identifying him 12 as being the perpetrator: 13 the phone, setting the phone up to have encrypted applications 14 so he won't get caught. 15 Encrypted email accounts, cleaning He also says, at the bottom, "Set up WhatsApp app, 16 Signal, Telegram, all with different numbers." 17 wants to make it harder to catch him. Why? Again, he That's what he is doing. 18 On that same page he also has: 19 "Research. 20 "Gmail; delete deleted email." 21 He is concerned that Gmail might have those deleted 22 23 emails because they have evidence that he is committing crimes. He also has "changing Samsung IMEI." He wants to try 24 and change the number that can be associated with the phone so, 25 again, he can protect himself; he can hide his activities. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2839 K32Wsch2 1 Summation - Mr. Laroche And he keeps escalating, just like he did at the CIA. 2 By the 22nd, the defendant reaches out to Shane Harris at the 3 Washington Post. 4 to be a third person, and he asks for his nine articles. He doesn't say I'm Josh Schulte. He pretends 5 The next day, he writes, in his notebook: 6 "My brother went back and forth, but they decided for 7 me not to publish the articles, my own fucking articles. 8 that incredible?" 9 10 Isn't Then later, he writes, "Yesterday I started emailing Shane from the Washington Post." 11 There is really no doubt that the defendant is the one 12 who is doing this. 13 that I am the one emailing Shane Harris from the Washington 14 Post. 15 person because he knows what he's doing is wrong; he knows he 16 can't be doing it. 17 doesn't care what his family says. 18 rules are. 19 whatever he thinks he has to do to make the situation right, 20 just like he did at the CIA. 21 He is admitting, in his prison notebook, And you know the defendant's emailing in the third But he's doing it anyways because he He doesn't care what the He doesn't care what the law is. He is going to do On August 31, he emails Shane Harris again. This time 22 he says, "If you can consent to an embargo on disclosure of the 23 information for a limited time, we would give you an exclusive 24 to the information spanning several topics." 25 He's emailing a reporter, as a third person, enticing SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2840 K32Wsch2 Summation - Mr. Laroche 1 that reporter to publish, on his time frame, how he wants it, 2 and saying I will give you more sensitive information if you 3 take my leak, as a third person. 4 trying to clear their name. 5 to clear their name. 6 illegal, who knows he is, and doesn't want to get caught. 7 That is not someone who is That is not someone who is trying That is someone who is doing something The defendant also writes: "Secondly, I want to 8 rewrite article 10, Malware of the Mind." 9 references to Anonymous. He also has And he also has references to 10 classified information under which he has "tool for vendor 11 report, Bartender for vendor." 12 There's no doubt the defendant knows what he is doing 13 is preparing to disclose classified information. 14 on the page. 15 tell the reporter that he was a member of. He's also referencing Anonymous, which he will 16 And here's Malware of the Mind. 17 that this was intended for public dissemination. 18 "To My Fellow Engineers and the Tech Industry. 19 first page. 20 about his work at the CIA. 21 He wrote it There's also no doubt It is titled That's on the And then he discloses more classified information He says: "Do you know what my specialty was at the CIA? Data hiding and crypto. Do you 22 know what I did for fun? 23 and wrote software to conceal data in a custom-designed file 24 system contained within the drive slack space or hidden 25 partitions. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I designed 2841 K32Wsch2 1 Summation - Mr. Laroche "I disguised data. I split data across files to file 2 systems to conceal the crypto. 3 detect random or pseudorandom data indicative of potential 4 crypto." 5 Analysis tools could never Witnesses told you that is classified tradecraft that 6 should not be disclosed. 7 that is a way to determine whether the CIA has done something 8 in an operation. 9 and that's dangerous. 10 didn't care. It should not be disclosed because It's a way to attribute things to the CIA, You cannot do that. The defendant He was prepared to do it in his article 10. 11 By September 1, the escalation continues. 12 point the defendant has set up an anonymous Twitter account 13 @freeJasonBourne, and the defendant starts drafting tweets. 14 And if you look at the evidence, the only tweets that appear 15 are under @freejasonbourne. 16 At this There are several pages of them. And what are those tweets about? Those tweets are 17 about accusing his coworkers about setting him up and hacking 18 the system. 19 information, including a tweet like this: 20 authenticate myself first." Those tweets are about other classified "Just to 21 What is the defendant planning to do? 22 The defendant wants to start an anonymous account that 23 is disclosing classified information, and he wants to 24 authenticate that account so that that person might know 25 something about what actually happened in this case. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 That's 2842 K32Wsch2 Summation - Mr. Laroche 1 what the defendant thinks he can do to help himself, so he 2 starts drafting tweets about that: 3 I know Karen and Jeremy. I know those people set this 4 person up, and you can authenticate me because I have 5 classified information. 6 a tool that was deployed. 7 that's how you can authenticate me. 8 say about the defendant is true. 9 I know about Bartender. I know it was I know it was by operators, and That was his plan. That's how you know what I That's what he was drafting. 10 And you know that Bartender was a classified tool. 11 Multiple witnesses testified about it, that disclosing this 12 information could be harmful. 13 risk. Weber testified about that. 14 that. And it makes sense. 15 world that this tool is a CIA tool and identify it with a 16 specific report. 17 been used. 18 Again, the defendant did not care. 19 It could put people's lives at Stedman testified about You cannot simply just tell the You are identifying a specific tool that had You can put people's lives in danger by doing that. By September 2, the escalation continues. He sends a 20 Signal message, an encrypted message, to Shane Harris. 21 this point Shane Harris had not agreed to give him those 22 articles that he wanted so desperately. 23 And so what did he do? 24 As he always does he escalates, and he sent him a 25 Signal message that says: SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Now, at 2843 K32Wsch2 1 Summation - Mr. Laroche "Hi. I got your name from Shane P. I'm messaging 2 from Josh's phone. 3 legitimacy, helping our family and authorize the release of 4 Josh's articles to them when you get the chance." 5 6 This group is apparently some computer group Josh was a part of before. 7 8 I'm hoping to validate Anonymous "And they have agreed to switch from NYT, New York Times, to talk to you instead to help us." 9 Again, he's trying to entice Shane Harris to do things 10 that he wants. He's trying to entice him with more sensitive 11 information and he's telling Shane Harris that he was a member 12 of Anonymous, a group that sent information to WikiLeaks in the 13 past. 14 WikiLeaks, is admitting that he was a member of a group that 15 sent information to WikiLeaks. The defendant, charged with sending information to 16 It's devastating evidence of his guilt. It also shows 17 the lengths he will go to try to get what he wants with this 18 report. 19 what he wants, which is to get his articles back, because he'll 20 do whatever it takes. 21 He's promising more information if that reporter does By September 12, he's already talking about disclosing 22 his tweets, scheduling his tweets. 23 them ready for publication, and these are the only tweets that 24 you have. 25 He's talking about getting They're the tweets from the @freejasonbourne. September 17, he is prepared to disclose more. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 He 2844 K32Wsch2 Summation - Mr. Laroche 1 talks about posts he made on Facebook, and he says at the end, 2 "In a week I'm going to dump my stuff." 3 disclose what he has. He is getting ready to 4 What does he do in a week? 5 September 22, so we're about ten days away from the 6 FBI stopping him, he starts. 7 Annon ProtonMail account. 8 person, not himself. 9 warrant applications in Josh Schulte's case along with private 10 11 He emails the reporter using He's still pretending to be a third He says, "Attached are two of the search notes Josh wrote regarding the first warrant." In that email he also says -- again, he's trying to 12 entice him to do what he wants by saying -- "I have more 13 sensitive information that we're ready to share with you. 14 please help me." 15 actually trying to clear his name: 16 Just Again, not the actions of a man who is "We've decided to share with you an initial exposé 17 involving Russian oligarchs, business ties and wire transfers." 18 He wants Shane Harris to do what he wants, and he's trying to 19 bribe him to do that by saying I'm going to give you more 20 sensitive information. 21 Now, on the 24th, he sends another email to Shane 22 Harris, and the reason he had to do that was because Shane 23 Harris couldn't access the search warrants and the notes. 24 he resends it and he attaches them as a PDF. 25 he has now committed two crimes. And in this email He has now violated the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 So 2845 K32Wsch2 Summation - Mr. Laroche 1 protective order by sending this protected document to the 2 reporter, and he's also sent classified information to the 3 reporter about the CIA's network infrastructure. 4 He has done that in this email. You know the first 5 part of that because this is the search warrant application 6 that was attached to the email. 7 confidential. 8 identified in the protective order, and the defendant stood 9 before this Court and he said: 10 It is clearly marked U.S.G. U.S.G. confidential is the designation that's I understand. I understand I cannot do that. 11 He said it here, in court. He doesn't care. He will 12 say whatever he has to do, he will do whatever he has to do 13 whenever he thinks it's right, and that's clear evidence of 14 that. 15 The other thing the defendant sent was information 16 about the CIA's network infrastructure. 17 COG and at least 400 people with access, and he specifically 18 identifies Hickok. 19 connected to DevLAN through our network," an intermediary 20 network that connected both COG and EDG. 21 information to a reporter. 22 He talks about EDG and He says, "They don't include COG who is He's sending this To the extent the defendant thinks that he's got an 23 argument on that front, the way to air those arguments are in 24 this courtroom, not to send highly classified information about 25 the CIA's network infrastructure to a reporter so that he can SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2846 K32Wsch2 Summation - Mr. Laroche 1 get some sort of favorable article written about him that he 2 thinks is going to help his case. 3 in this courtroom. 4 view, he will do whatever he has to do, whatever it takes. 5 Whatever he thinks will make the situation right, that's what 6 he will do. 7 not send information about network infrastructure to a reporter 8 or somebody outside the CIA. 9 The way to deal with it is The defendant didn't care because, in his And common sense will tell you that you can simply Witnesses told you they would never talk about the 10 infrastructure of DevLAN, before the leaks or after. 11 reason they wouldn't is because you are giving information to 12 the public that could be used by adversaries to target our 13 systems, a system that, again, is only used by about 200 people 14 in the government, a system that has highly sensitive 15 information about cyber tools, a system that we use, that we 16 rely on for our national security. 17 reporters about how that system is structured. 18 couldn't do that. 19 And the You can't just go tell He knows he Another reason he knew he couldn't do that is because 20 he's communicating with this reporter as a third person. 21 not saying, Hey, my name is Josh Schulte and this is what's 22 happening. 23 that he is committing crimes. 24 25 He's He is doing it because he wants to hide the fact That's why. Now, at the beginning of this case, we talked about this tweet, and this tweet specifically that he was preparing SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2847 K32Wsch2 Summation - Mr. Laroche 1 to write, "Until your government protects you and honors your 2 service, send all your government secrets here: 3 and this is what the defendant really thinks. WikiLeaks," 4 This is what the defendant really thinks. 5 government isn't honoring your service, it's OK; send your 6 government secrets to WikiLeaks. 7 It's his handwriting. 8 That's what he thinks. 9 If the This is in his notebook. It's his words. They're his thoughts. And you know who else didn't think people were 10 honoring his service at the CIA? 11 furious that they took away his admin rights, that they didn't 12 take his side with Amol. 13 honoring his service, so what did he do? 14 The defendant. He was furious. He was The CIA wasn't He sent information to WikiLeaks. This is a 15 devastating admission for him. 16 thinks about WikiLeaks. 17 that it is OK to send secrets there when you feel like you've 18 been wronged. 19 clear, it's that he felt like he was wronged. 20 retaliate, and he was ready to do anything -- anything -- to 21 make it right in his mind. 22 CIA, and that's exactly what he tried to do again from prison, 23 repeating that same pattern of anger, escalation, retaliation 24 and lies. 25 This shows exactly what he This shows exactly what he thinks, And if there is one thing that is abundantly He was ready to That's exactly what he did at the Now, the last part of the closing is going to be going SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2848 K32Wsch2 Summation - Mr. Laroche 1 back to the charges. I want to talk about each of the charges 2 very briefly, and remember that Judge Crotty is going to give 3 you instructions on the law, and you should follow those 4 instructions, but I expect that his instructions will include 5 some of this information. Let's go through the charges. 6 Count One. 7 Now, remember, at the beginning I told you that there 8 are essentially two categories. There's the Vault 7-related 9 charges and Vault 8, which relate to the stuff that was stolen 10 at the CIA, and then there's the prison charges. 11 to start here with the first category, the Vault 7 charges. 12 Count One is illegal gathering of national defense 13 information. 14 this has three elements: We're going I expect that Judge Crotty will tell you that 15 The defendant took information; 16 That information was national defense information, and 17 He took it with the intent or reason to believe that 18 it would injure the U.S. or it could be used to help a foreign 19 country. 20 That's Count One. Count Two is transmitting national defense 21 information. I expect that you'll hear the following elements 22 for this crime: 23 That there was unlawful access to information; 24 That that information was national defense 25 information; SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2849 K32Wsch2 1 Summation - Mr. Laroche The defendant took that information with reason to 2 believe that it could injure the U.S. or help a foreign 3 country, and 4 5 That he willfully transmitted it, so he transmitted it on purpose. 6 Count Four is unauthorized computer access to obtain 7 national defense information. 8 these elements: 9 10 I expect you'll hear that it has One, that the defendant exceeded his authority, his access on the computer; 11 He knowingly did it, knowingly accessed the computer; 12 Three, he knew the national defense information could 13 injure the U.S. or help a foreign country and 14 15 Four, that he willfully communicated information to an unauthorized party. 16 17 Count Five is theft of government property. I expect you'll hear these elements: 18 One, that the property belonged to the United States; 19 Two, the defendant stole the property; 20 Three, that the defendant acted knowingly and 21 willfully; and 22 23 24 25 Four that that property was worth more than a thousand dollars. On that last point, you heard testimony from Sean Roche about the millions and millions of dollars that's put SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2850 K32Wsch2 Summation - Mr. Laroche 1 into operations for the CIA, and there's really no dispute 2 that, obviously, the information that was stolen was worth more 3 than a thousand dollars. 4 5 Count Six is unauthorized computer access to obtain CIA information. 6 7 I expect you'll hear that the elements are: That the defendant exceeded authority in accessing a computer; 8 That he acted intentionally; and 9 He obtained information from the CIA. 10 11 Count 7 is the transmission of a harmful computer command. The elements are: 12 The defendant transmitted a harmful computer command; 13 He intended to damage a computer system; 14 He thereby caused damage; and 15 His actions resulted in damage to that system. 16 Judge Crotty, I expect, will instruct you that damage 17 can include damage like the unavailability of data so that 18 deletion of data would be damage to a computer system, and we 19 saw that with the log deletions over and over again by the 20 defendant. 21 22 So there are a lot of elements we just went over, but I want to try to break them down for these counts. 23 The two elements we saw for several of the counts were 24 national defense information and injury to the United States or 25 advantage of a foreign country. And here, we've just gone SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2851 K32Wsch2 Summation - Mr. Laroche 1 through both of those and summarized some of the evidence. 2 Let's start with national defense information. 3 What is national defense information? 4 I expect that you'll being instructed that it includes 5 the intelligence-gathering capabilities for our country, and in 6 order to be national defense information, the information has 7 to be closely held. It has to be protected. 8 What evidence do we have about that? 9 There really should be no dispute that cyber tools 10 used to target foreign adversaries, used to do 11 intelligence=gathering operations, used to collect intelligence 12 is national defense information. 13 capabilities. 14 be protected and, in fact, was protected. 15 held in this case. 16 stored on a top-secret CIA computer system within a secret CIA 17 facility, protected by armed guards, accessed using special 18 badges and codes, inside offices there have vaults and only 19 about 200 people had access in the entire government to that 20 information. 21 It's information about our It's highly classified information that should So it was closely You know it was closely held because it was So it was closely held. Injury to the United States or advantage of a foreign 22 country, whether the defendant understood or had reason to 23 believe or had intent that this could harm or would harm the 24 United States, obviously he did. 25 prison notebook, #fuckyourtopsecret, the defendant had a top The defendant here, in his SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2852 K32Wsch2 Summation - Mr. Laroche 1 secret security clearance. 2 could come by disclosing this information. 3 prison notebook, Vault 7 could be used in devastating fashion. 4 It could be repurposed, redeployed by our enemies against us. 5 He knew that this would be harmful. 6 He knew the potential harm that He even says in his The defendant also signed nondisclosure agreements 7 when he started at the agency. 8 which said very clearly that disclosing classified information 9 could be harmful, could cause grave harm to the agency, could 10 11 He signed those agreements cause grave harm to the United States. You also know that there was real harm in this case. 12 The cyber tools were essentially gone instantly. 13 were stopped, and you know the defendant was willing to do 14 anything because he said so himself: 15 make this situation right. 16 Operations Whatever I have to do to When every step of his escalation didn't work, when 17 his back was against the wall, he was prepared to do anything 18 to make this situation right, including harming the United 19 States, including advantaging a foreign country. 20 So again, this slide shows several more of the 21 elements from left to right. 22 gathering and theft element, so that the information was 23 gathered and stolen. 24 25 On the left there is the In the middle there is unauthorized access, exceeded authority and harmful command, so that essentially the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2853 K32Wsch2 Summation - Mr. Laroche 1 defendant had unauthorized access to the computer and he did 2 things he wasn't allowed to do. 3 And the third is transmission. 4 Now, before we go through each of these, at a very 5 basic level, you know that the information was stolen, and you 6 know it was transmitted to WikiLeaks. 7 WikiLeaks posted it. 8 being taken and transmitted to WikiLeaks, so let's go through 9 each of these. 10 You know that because There's no question about this stuff First, on the gathering and the theft, on the left 11 side, the defendant had a clear motive to steal. 12 from all the emails. 13 You know that from his interview with SIB. 14 how he'd been treated. 15 do to try to make it right in his own mind. 16 You know that You know that from the witness testimony. He was furious at He was willing to do anything he had to He also had the capabilities to do it. The defendant 17 was an administrator. 18 in his own words, "super access," and he also knew a lot about 19 the backups. 20 them up, because he was managing them. 21 that he would use. 22 backups were not publicized at the CIA. 23 about them. 24 capabilities necessary to access them. 25 He knew how the system worked. He had, He knew a lot about the backups because he set He set up the pathways And remember, there is testimony. He was one of the them. The Very few people knew He had the administrative You also know it was him from the March 3, 2016, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2854 K32Wsch2 Summation - Mr. Laroche 1 backup files. 2 WikiLeaks. 3 the agency, the day he became furious that the agency wasn't 4 going to take his side. 5 2016, backup files. 6 expert testimony. 7 forensic evidence, which shows that they were accessed and 8 copied on April 20, 2016. 9 he stole those specific files. 10 Those are the files that are posted on Those are the files from the worst day he had at He picked those specific March 3, You know it was those files from the You know it was those files from the That is more powerful evidence that You also know from the April 20 forensics. So you 11 have forensics showing, again, from his workstation, his 12 computer, the reversion, accessing the backups and log 13 deletions, all things you would do if you were stealing that 14 data. 15 the last time it was accessed was April 20, 2016, at 5:42 and 16 5:43 p.m. 17 And you know exactly when that data was stolen because You also know it was him that gathered and took that 18 information because he immediately, the next day, tried to 19 cover his tracks. 20 wanted to try to wash his hands of that server. 21 concerned that if somebody looked at it and his name was still 22 in charge of it, he would get in trouble. 23 immediately, he tried to get rid of it. 24 25 He emailed Anthony about the OSB server. He was The day after, What about unauthorized access and exceeding authority? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 He 2855 K32Wsch2 1 Summation - Mr. Laroche Well, first, you have it is very clear that the 2 defendant knew what he was doing on the system from April 14 to 3 April 20 was wrong; that he was abusing his privileges. 4 went through the timeline of the reinstatement of privileges on 5 April 14. 6 administrator of the OSB libraries. 7 went back in and reinstated his privileges anyways. 8 9 We He was specifically told he was no longer an It did not stop him. That led to April 18, 2016. He After he had lost all of his administrative privileges, he gets that privileges memo 10 which says you cannot do that, you cannot reinstate your 11 accesses. 12 administrator of DevLAN, so he's not an administrator of the 13 Atlassian services, and he lied to Anthony about it because he 14 still had that back-door access, but he lied to Anthony because 15 he still wanted to use it. 16 He also learns that day that he is no longer an And on April 20, 2016, he took advantage of that 17 access. 18 he did the log deletions. 19 evidence of unauthorized access, exceeding his authority and 20 transmitting a harmful computer code. 21 log after log of his activities. 22 unavailable. 23 doing. 24 25 He reverted the system. He accessed the backups, and So again, all of this is more He is deleting log after That is making data That is damage to the system. That's what he was And finally, on the transmission point, again, you know that the data was transmitted, and you know that he stole SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2856 K32Wsch2 1 it. 2 itself? 3 Summation - Mr. Laroche So what other evidence do we have on the transmission You have all the steps he took concerning April 21 and 4 May 6 to transmit it and then to cover his tracks. On the 5 24th, he downloaded Tails, a program to secretly transmit data. 6 He purchased that SATA adapter which would have helped him 7 transmit data between hard drives outside of his computer. 8 Between the 23rd and 28th, he's using Eraser Portable to delete 9 Brutal Kangaroo, and he's trying to figure out what to do with 10 the actual files that he brought home with the backups. 11 the 30th, he downloads DBAN, something to nuke his computer, 12 which he will do after he is done sending the data. 13 And on And on the evening of the 30th into May 1, he is 14 taking all the steps to transmit the data, and that is exactly 15 what he's doing. 16 drives after it's done, and overnight, into the morning, he's 17 searching to confirm that one terabyte of data, the size of the 18 data that he would have stolen and given to WikiLeaks, had 19 transferred correctly. 20 middle of the night, he is unlocking his virtual machine. 21 is checking what is happening, and then he's trying to figure 22 out if the data that he sent over transferred correctly. 23 looking to see how can I calculate an MD5 to make sure that a 24 file has been transferred, large files like the backups. 25 He's trying to figure out how to wipe his Multiple times overnight, through the He He's And on May 5, days later, he reformats his computer, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2857 K32Wsch2 Summation - Mr. Laroche 1 and the reason he does that is because he wants to try to make 2 sure that there is nothing that can come back to him, nothing 3 that he did during that time -- no evidence -- will be left 4 over. 5 every way possible. He wants to make sure that he has protected himself in 6 You also know that he sent this information to 7 WikiLeaks because, all of a sudden, in August, through January, 8 he becomes obsessed with searching for WikiLeaks. 9 years before that, he'd never served for WikiLeaks -- just For ten 10 three times over that time period -- and then, all of a sudden, 11 from August to January, he is searching repeatedly for 12 WikiLeaks and things related to what they would eventually 13 disclose; WikiLeaks code. 14 coming out with because he knows they have it, and he's 15 wondering what time frame they will publish it. 16 He wants to know what WikiLeaks is Now, there are other counts related to the Vault 7 and 17 Vault 8 charges, and they are making false statements to the 18 FBI. I expect that you will hear that the elements are: 19 That the defendant made a statement; 20 The statement was material; 21 The statement was false; he made it knowingly and 22 23 willfully; and The statement was made in a matter within the 24 jurisdiction of the government, like this investigation. 25 Count Nine is obstruction of justice. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 This has three 2858 K32Wsch2 1 elements: 2 3 Summation - Mr. Laroche That there was a proceeding pending before a grand jury; 4 The defendant knew of that proceeding; and 5 He acted corruptly to obstruct or impede the 6 proceeding. 7 What's the evidence you have on this? 8 Well, first, you know that the defendant knew there 9 was a proceeding, a federal grand jury proceeding, because 10 during that first interaction with law enforcement, on March 11 15, he's handed a grand jury subpoena. 12 is a grand jury investigation. 13 FBI, so he knows that there is an investigation relating to the 14 Vault 7 and Vault 8 disclosure. So he knows that there He's also searching for the 15 So then what does he do when he meets with the FBI? 16 He lies over and over again. He lies about being 17 responsible for the leaks. He lies about that OIG email that 18 was found in his apartment. He lies about making computers 19 vulnerable to theft. 20 home computer. 21 home. 22 taking it home. 23 lies. 24 25 He lies about storing information on his He lies about working on Brutal Kangaroo at his And he lies about removing classified information and You have evidence that all of those things are The last two counts -- as I said, the last category -are the prison charges. There is another charge here, Count SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2859 K32Wsch2 Summation - Mr. Laroche 1 Three, transmitting or attempting to transmit national defense 2 information. 3 elements before: We went through these counts before, or these 4 Unlawful access to information; 5 National defense information; 6 That information he had reason to believe could injure 7 the U.S. or help a foreign country; and 8 There was willful transmission. 9 This is also charged as an attempt, and to establish 10 an attempt, you have to show that the defendant intended to do 11 something -- so intended to transmit classified information -- 12 and took a substantial step in doing so. 13 summary of the evidence on this count. 14 Let's go through a Here we have three columns -- national defense 15 information, transmission in the middle and attempted 16 transmission -- so let's walk through each of these. 17 On the left we have national defense information and 18 intent to harm. 19 to transmit or did transmit related was to CIA cyber tools. 20 They related to CIA tradecraft. 21 infrastructure, things that plainly qualify as national defense 22 information, and multiple witnesses told you why. 23 So again, the information that he was trying They related to CIA network (Continued on next page) 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2860 K323SCH3 1 Summation - Mr. Laroche MR. LAROCHE: In terms of an intent to harm, the 2 defendant himself declared an information war. 3 himself was prepared to destroy diplomatic relationships and 4 close embassies. 5 secret. 6 7 The defendant himself said fuck your top He was ready to harm. He knew that this information could harm, and he was prepared to do so. 8 9 The defendant The defendant also signed, on his way out of the agency, non-disclosure agreements. Those agreements, much like 10 the ones he signed when he started at the agency, said if you 11 disclose classified information, it could harm. 12 the United States, and that's what he knew when he left the 13 agency. 14 What about transmission? It could harm What evidence do we have 15 that he sent this information to the reporter? 16 he was using the cell phone. 17 statements in the prison notebooks. You know that from the 18 video of him using the cell phone. You know that from Carlos 19 Betances who told you he was using the cell phone. 20 Well, you know You know that from his own You also know the defendant sent that e-mail to the 21 reporter. He said in his notebooks, he was the one who was 22 e-mailing with that reporter. 23 e-mail account, the Annon account, was the account he set up. 24 The password for that account is in his prison notebooks. 25 wrote it down. He set it up. You know that that specific It's his account. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 And so He 2861 K323SCH3 Summation - Mr. Laroche 1 there's really no question that he sent this information to the 2 reporter, and that it was him who actually did it. 3 What about attempted transmission? So he attempted to 4 transmit two things: Bartender and Malware of the Mind. 5 What's your evidence here? 6 that cell phone, so you knew he was using a cell phone. 7 September 1st he set up that Twitter account, the Free Jason 8 Bourne account. 9 Jason Bourne account, tweets that he planned to submit. You have the video of his using On He drafted numerous tweets under that Free He 10 talked about scheduling the tweets. 11 get his articles published, including article 10, which is 12 malware. 13 meant for the public. 14 stuff. 15 He talked about wanting to Malware was addressed to the tech community. It was And he talked about dumping all his He was planning to disclose this information. He was doing it on a plan that made sense in his mind, 16 he was going to get the reporter to start publishing articles 17 about his case, and then there were going to be anonymous 18 tweets coming out and other information that would tend in his 19 mind to make him look like an innocent man. 20 That's what he wanted to do. 21 do. 22 That was his plan. That's what he was planning to Just days after, just days after sent to the 23 information to the reporter, he got caught. 24 him. 25 everything ready to do it. The FBI stopped But had they not, he would have done it. He had He had the Twitter account, he had SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2862 K323SCH3 Summation - Mr. Laroche 1 the cell phone, he had the tweets. 2 prepared. 3 He was ready. He was He attempted to disclose that information. Finally, last count: Contempt of court. The Court 4 issued a protective order that applied to the defendant. 5 was clearly a protective order regarding discovery in this 6 case. 7 There Evan Schlessinger testified about that. Two, that the defendant disobeyed that order. 8 September 24, the defendant sent an e-mail to the reporter 9 attaching the search warrant affidavits. 10 That is disobeying that order. 11 And third, that he acted willfully and knowingly in 12 disobeying the order. 13 defendant was in this courtroom where the judge said these are 14 the terms of the order, you cannot modify it on your own, you 15 need to come to court. 16 he understood, he didn't care. 17 disobeyed that court order. 18 did these things. 19 There can be no dispute here. He didn't care. This is a ground ball. Now, I'm getting ready to sit down. we're grateful for your time. 21 trial. 22 notes throughout. 23 weeks of what has been a long trial. 25 He was here, he said He sent it to the reporter, he 20 24 The He clearly But before I do, This is now the fifth week of You guys have been very attentive throughout and taking We're grateful for you sitting through five If you remember way back when to the beginning, when Mr. Denton gave his opening statement, he asked you to do three SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2863 K323SCH3 Summation - Mr. Laroche 1 things. He said please follow the judge's instructions, please 2 pay close attention to the evidence, and use your common sense. 3 And I expect that one of the instructions that the 4 judge is going to give you is not to speculate, and you 5 shouldn't, and you don't need to. 6 about what happened in this case because you know exactly what 7 happened in this case. 8 gentlemen. 9 sense, and what doesn't. 10 You don't need to speculate It's common sense, ladies and Please use your common sense. Think what makes And you don't need to be a CIA officer to tell the 11 difference between a truth and a lie. 12 case is that the defendant lied repeatedly at the CIA. 13 then he lied repeatedly after that to the FBI. 14 And the truth in this And The truth in this case is that the defendant was 15 furious at the CIA, that he was prepared to do anything to get 16 back at them, that he abused his privileges, and on April 20, 17 he stole that information and sent it to WikiLeaks. 18 And the truth in this case is the defendant tried to 19 do it all over again from prison, repeating that same pattern 20 of anger, escalation, retaliation, and lies. 21 information war. 22 He was doing all those things over again. 23 24 25 Declaring an Sending classified information to a reporter. Because that's the defendant's playbook. That's who the defendant is. Now it's time to please use your common sense and come SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2864 K323SCH3 Summation - Ms. Shroff 1 to the only verdict that's supported by the evidence in this 2 case. The defendant is guilty as charged. 3 THE COURT: Thank you, Mr. Laroche. 4 recess. 5 summation by Ms. Shroff. We'll resume at about 20 after 11 and we'll have the 6 (Jury excused) 7 THE COURT: 8 (Recess) 9 THE COURT: 10 MS. SHROFF: Ready or not. 11 THE COURT: Call the jury. 12 (Jury present) 13 THE COURT: 14 MS. SHROFF: 15 Mission above self. See you in 15 minutes. You ready, Ms. Shroff? All right, Ms. Shroff. Thank you, your Honor. Mission above self. 16 ethos of the CIA. 17 Leonis took the stand and told you this. 18 Take a short That's the You remember way back when, when Anthony Mission above self. Throughout this trial, and way before, the CIA has 19 been on a mission and is on a mission here. 20 support of its two mission partners, the FBI and the United 21 States attorney's office, their mission was, their mission is, 22 and their mission remains, to get the 12 of you to convict 23 Mr. Schulte of espionage and other federal crimes. 24 25 With the help and But as jurors, that is not your mission. Your mission, as Judge Crotty has told you, is to be impartial, to SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2865 K323SCH3 Summation - Ms. Shroff 1 decide only one thing: 2 under our Constitution of proving Mr. Schulte's guilt beyond 3 all reasonable doubt. 4 No, they did not. 5 guilt beyond any reasonable doubt. 6 Did the government meet its burden And the answer to that question is no. They did not prove to you Mr. Schulte's It's still morning, so good morning, ladies and 7 gentlemen of the jury. The last time I spoke to you directly 8 was almost a month ago, I think it was about a month ago. 9 I said to you then, and I say to you now, the government has And 10 simply not been able to answer even the most basic question in 11 this case. 12 when, why, where, and most importantly, who, masterminded and 13 perpetrated the biggest theft of data in the history of the 14 CIA. 15 The most basic questions, ask yourselves, how, And you know I was right to say that to you a month 16 ago. 17 investigated this case for three years. 18 investigated this case. 19 witnesses, 1,200 exhibits, videos, audios, and -- let us not 20 ever forget -- a very, very long slide show. 21 of this add up to? 22 The government still is not able to answer for you the very 23 basic questions. 24 are more questions now than when this trial first began. 25 The government, hand-in-hand with the CIA, has Three years they We've had four weeks of testimony, 18 And what does all I'll tell you what it does not add up to. In fact, quite weirdly, I tell you that there So for the next hour or so I'm going to talk to you. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2866 K323SCH3 Summation - Ms. Shroff 1 I'm going to try to be shorter here than the government has 2 been. 3 try and cut to the chase, get in, get out, because it's been a 4 long four weeks. 5 I'm going to review the evidence for you. I'm going to First, I'm going to look at how the CIA and the FBI 6 together decided almost immediately that the person to look at, 7 the person to focus on, the person to talk about, the only 8 person to present to you, was Mr. Josh Schulte. 9 Then I'm going to talk to you very briefly about the 10 DevLAN computer network. 11 being secure. 12 it. 13 least one person, at least one person, Michael, the man the CIA 14 placed on administrative leave because of concerns about his 15 behavior and his truthfulness. 16 How it was the farthest thing from Meaning that hundreds of people had access to Hundreds of people could have stolen it, and we know of at I'm then going to discuss the government's forensic 17 evidence, it's motive theory, what Mr. Schulte did and said 18 when he was locked up at the MCC, and finally we'll look at the 19 legal charges against Mr. Schulte and why the proof fails to 20 support them. 21 22 23 When we're finished, you will see that the only correct, proper, and fair verdict is a verdict of not guilty. So let's begin with the crime. The crime on March 7, 24 2017, thousands of CIA documents show up on WikiLeaks. 25 was front page news as you've heard. This And until then, until SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2867 K323SCH3 Summation - Ms. Shroff 1 that date, in 2017, the CIA had no idea that its crown jewels 2 had been stolen. 3 releasing that information, and that more information was yet 4 to come. 5 tremendous pressure to find out what was leaked, how it was 6 leaked, and who leaked it. 7 All they knew was that WikiLeaks had started The CIA was under some pressure. I will say They wanted to hold someone responsible for the leak. 8 And so they began immediately an investigation, an 9 investigation that focused on Mr. Schulte. The CIA joined up 10 with the FBI and started to work on their mission. 11 focused, literally, within days, they focused on the one man, 12 Josh Schulte, the man who had left the CIA in November of 2016, 13 on bad terms, and who was disliked at the CIA. 14 at what the investigation uncovered. 15 And they So let's look The FBI learned from working with the CIA day in and 16 day out over a period of three years that the CIA's DevLAN 17 network was highly insecure. 18 witness who took the stand, starting with the government's 19 first CIA witness, which was Jeremy Weber, until their last 20 main witness, which was Leonard Small. 21 you that DevLAN was wide open. 22 were no user controls, users shared passwords, passwords were 23 weak, passwords were stored openly. There were no audit logs. 24 there was no login activity checks. Anyone could connect to 25 the DevLAN workstation computer to the internet just by taking You heard this from almost every Each one of them told There were no controls, there SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2868 K323SCH3 Summation - Ms. Shroff 1 the ethernet cable from one computer and plugging it into the 2 other. 3 Almost every witness told that you DevLAN -- in fact, 4 almost all of them described it to you the same way. DevLAN 5 was the wild, wild west. Because 6 it tells you the system is not locked down. 7 to take my word for it. 8 Their witnesses tell you DevLAN was far too open, it left the 9 CIA at risk, and literally every witness admitted that on 10 Why? Why use that phrase? And you don't have there are transcript, ask for them. cross-examination. 11 Mr. Weber called it both the wild west and a dirty 12 network. 13 order he was, Dave, Dave told you the same thing and confirmed 14 that DevLAN was pretty open. 15 shared passwords. 16 were extremely weak and simple passwords. 17 It made it impossible to account for who was using the 18 password, and again, it left the system vulnerable. 19 the openness of the system, anyone could have copied and 20 downloaded the data that was on Confluence by something called 21 vSphere. 22 drive would not have been difficult. 23 The CIA's witness tells you that, Dave. 24 Take a look at the transcript. 25 Their next witness, or I don't know where in that You know that people on DevLAN And not only did they share passwords, they What did that do? Because of And simply carrying the data out the door on a hard I didn't tell you that. The CIA admits this over and over again and puts in its official WikiLeaks task SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2869 K323SCH3 Summation - Ms. Shroff 1 force report. 2 cannot determine the precise scope of the loss because DevLAN 3 did not require user activity monitoring or other safeguards 4 that exist on our enterprise system. 5 They tell you, they confess and they say: These are not the defense's words. We These are words 6 out of the CIA. "Day-to-day security practice had become 7 woefully lax. 8 compartmented, the CIA admits users shared system administrator 9 level passwords, there were no effective removable media Most of our sensitive cyber weapons were not 10 controls, and historical data was available to users 11 indefinitely." 12 you, "The stolen data resided on a mission system that lacked 13 user activity monitoring, it lacked a robust server audit 14 capability," and then it says "The CIA did not realize the loss 15 had occurred until a year later, when WikiLeaks publicly 16 announced it in March of 2017. 17 the benefit of a state adversary and not published, we" -- the 18 CIA -- "would still be unaware of the loss. 19 This is all in the exhibit. It goes on to tell Had the data been stolen for So why is it important here that Mr. Laroche went on 20 and on about DevLAN being so secure, and here you have a report 21 that tells you DevLAN was insecure. 22 right, bottom line is because the system was insecure, because 23 the system was poorly monitored, the government cannot know, 24 and it certainly cannot prove to you which of the many people 25 with access to this information committed this crime, when they The bottom line is this, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2870 K323SCH3 Summation - Ms. Shroff 1 committed it, or how they did it. 2 touched upon foreign adversaries, nation states, non-state 3 actors, terrorists, they haven't even touched upon that. 4 And they haven't even Just think about it this way. It's like your home. 5 If hundreds of people have a key to your home, if you leave the 6 door open, if you leave your windows open, you always leave 7 your door and your windows open, you leave them unlocked, can't 8 anyone just come in at any time they want? 9 walk out with it, and you'd never know it was gone until you Take your stuff, 10 needed to use it again. 11 from your house if you left your house that unlocked. 12 know who else doesn't know? 13 don't know. 14 You wouldn't know who stole something And you The CIA didn't know, and they And it wasn't just DevLAN in general that we're 15 talking about that was insecure. 16 testimony about this, that the Altabackup, the Altabackup files 17 in particular were insecure. 18 government said over and over again, that this is the place 19 from which the information was taken. 20 testimony and the witnesses told you that the Altabackups were 21 not locked down. 22 You also know, and you heard Remember that Mr. Laroche and the Well, you heard Take a look at Dave's testimony. He tells you the 23 Altabackups were wide open. 24 "And in fact, you just testified that Altabackup was wide open, 25 correct? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2871 K323SCH3 1 "A. Summation - Ms. Shroff Yes." 2 And there were many ways to get to that Altabackup. 3 So if DevLAN and the Altabackups are not properly protected, 4 what does that mean to you? 5 you've been here with me for four weeks. 6 means, it means that Mr. Schulte isn't the only person who 7 could have committed this crime. 8 And if others could have done it, that is reasonable doubt. 9 Now first, remember who we're talking about, okay. You already know this because You know what it Others could have done it. 10 We're talking about people who work at the CIA. 11 trained spies we are talking about. 12 you that the CIA coders and developers are trained. 13 they trained to do? 14 air gapped networks without leaving any trace. 15 expertise. 16 These are all Witness after witness told What are They're trained to gather, steal data from That's their There are spies working for other countries who are 17 trained to do exactly the same thing. 18 people who have a monopoly on this. 19 CIA has two categories targets: foreign governments and 20 non-state actors. 21 the CIA does to them. 22 We are not the only Mr. Weber told you, the And they could do to the CIA exactly what And he tells you that. Take a look at the transcript at 169. Mr. Weber tells 23 you that the CIA creates malware that allows the CIA to steal 24 information, and he told you on cross-examination that other 25 countries are doing the same thing to us. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2872 K323SCH3 1 Summation - Ms. Shroff CIA contractors are another group. They are also 2 suspects. And you don't have to take my word. 3 Dave who testified here. 4 contractor for the CIA and what did he do? 5 what he did. 6 portable hard drive, he copied the entire backup of Stash. 7 yourself, where is that hard drive? 8 no one knows. 9 where that hard drive went. He was a contractor. He was a Just think about He took a portable hard drive. Onto this No one knows. It has never been accounted for. Ask Literally Nobody knows Ask yourself, is that how 10 WikiLeaks got the Stash information? 11 know. 12 Think back to I don't know. You don't And that's reasonable doubt. Mr. Leonis told you, when I told him or asked him if 13 he would be concerned to learn of such a sloppy security 14 practice, he said yes, he would be. 15 someone put the backup of Stash on a hard drive. He would be concerned if 16 But the FBI didn't seem particularly concerned about 17 it, and when I asked Special Agent Evanchec, what did he say? 18 He punted, and he said ask the Washington FBI office. 19 Actually, it wasn't me who cross-examined Mr. Evanchec, it was 20 Mr. Branden. 21 the FBI ever find that hard drive, what did Special Agent 22 Evanchec say? 23 Washington field office's domain. 24 where they ended up with that." 25 When Mr. Branden asked Special Agent Evanchec did He said, "I cannot recall. That was more of I can't specifically recall Let's flip over and go back to what Dave says about SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2873 K323SCH3 Summation - Ms. Shroff 1 this hard drive where he has the entire Stash backup. 2 What does Dave say about the hard drive? 3 put it in a safe. 4 the FBI interviewed him in 2017. 5 witness stand that he put it in a safe. 6 safe. 7 desk cabinet. 8 one knows. 9 contractor, is kept on a hard drive in a safe, then he gets rid 10 11 Okay. First he says that he Now, he never said that ever before, when But he tells us now from that And he got rid of the And then he moved the hard drive from the safe to his And from where in the desk cabinet it went, no The entire Stash backup, according to Dave, the of the safe, moves it to his desk. Can you imagine not keeping track of a hard drive that 12 has the backup of Stash on it? 13 enough, as though the FBI has no answer for that, as though 14 that is not enough, what more does Dave tell you? 15 that you not only did he put the backup of Stash on a hard 16 drive, he also put it in his home directory on the computer. 17 But he tells you, don't worry, you shouldn't be worried about 18 the home drive, because my home directory, he says to you, was 19 password protected. 20 As though that's not bad He tells So, Dave asks you to believe him, the man who could 21 not remember what he did with the hard drive of the entire 22 Stash backup. 23 Is this what the CIA calls a secure system? And just while I'm talking about Stash, I just want to 24 ask you one thing to think about. 25 Mr. Schulte took Stash? Where is the evidence that In all of the two-hour presentation, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2874 K323SCH3 1 Summation - Ms. Shroff where is that evidence? 2 Now, you know that Michael here, Michael is a key suspect. 3 We are going to talk about Michael some more in a few minutes, 4 but for now, let me just remind you, he's present at his desk 5 in EDG at the very time the CIA information was stolen, and 6 that's according to the government's timeline. 7 he's logged into vSphere, and the CIA itself found that he, 8 Michael, was too much of a security risk to be trusted around 9 classified information. 10 Not only that, That alone is reasonable doubt. The government knows, the government knows that DevLAN and 11 Altabackups were not secure, and that many people, besides 12 Mr. Schulte, could be the real criminal. 13 government have to do to try and convince you about this 14 supposed science, the technical computer evidence that they 15 claim points to Mr. Schulte and Mr. Schulte alone. 16 at the evidence, you'll see that it fails to support the 17 government's case, and in fact, it supports the defense. 18 So what does the If you look And the key witness on this point, as you remember, was the 19 government's expert Mr. Leedom. Remember, he was the man who 20 said that he was an expert on DevLAN before he even started 21 working on the case. 22 because that's when he's trying to qualify himself as an 23 expert, and I asked him, hey, how could you be an expert on 24 DevLAN, when DevLAN was such a secure top secret system that 25 nobody ever had access to? And you can look at that testimony, And he told you he had worked on a SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2875 K323SCH3 Summation - Ms. Shroff 1 system like DevLAN before, before he ever started working on 2 this case. 3 keys, computer reversions, passwords, and many other things. 4 But none of his testimony told you why it was so easy for Dave 5 to put Stash on a hard drive, and not inventory that drive 6 properly. 7 Stash is complete? 8 answer for that at all. 9 He showed you a very long slide show about SSH Why not erase the hard drive, after migration of the Did Mr. Leedom tell you why? They have no So let's look at what Mr. Leedom says, okay. He 10 claimed as an expert that the theft took place on a very 11 specific date. April 20, 2016. 12 specific time. He said that Mr. Schulte reverted Confluence 13 back to April 16, and stole the March 3, 2016 Confluence 14 backup, and then he reverts back to April 20. And also gave you a very 15 This is when I asked him to define or think about the 16 reversion period, and Mr. Leedom admitted, if you recall, that 17 according to the government's own theory, and you can check the 18 math here. 19 hour and 15 minutes, and that's when they want you to believe 20 that the theft took place. 21 to speak, right? 22 This period, this reversion period, is about an This is the moment of the heist so Look at what Mr. Leedom says on cross-examination, 23 because that theory, I tell you, does not hold up. 24 Mr. Leedom a series of questions about whether he found any 25 evidence of a copy command during the reversion period. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I ask And he 2876 K323SCH3 Summation - Ms. Shroff 1 said he admitted that he searched high and low for a copy 2 command. 3 copy command. 4 one, right? 5 that the government had asked him to look. 6 wanted to find a copy command. 7 never found any evidence of any copy command whatsoever. 8 9 I mean, how else are you going to copy data without a I asked him, you really looked, you looked for And he said, yes, I looked. And then he admitted The government He looked and he looked and he And then what else does he tell you? that he found no storage device. He also told you No thumb drive, no removable 10 hard drive, no drive. 11 to Mr. Schulte's workstation computer during the reversion 12 period. 13 Nothing, nothing that was ever connected Nothing is plugged in. That testimony is devastating to the government's 14 case. 15 during the reversion period, and if he had no device connected 16 to his workstation during the reversion period, and he never 17 took any device out of the CIA, he couldn't have stolen that 18 information. 19 he certainly couldn't have sent it to anyone, let alone 20 WikiLeaks. 21 If Mr. Schulte never copied the March 3 backup file And if he couldn't have stolen that information, And do not for a minute believe that they have any 22 evidence that this information went directly from the CIA to 23 WikiLeaks. 24 this is a giant hole in their case. 25 know Mr. Kamaraju gets to speak again and maybe he will answer They have never proven that to you. Now, you know And after I sit down, you SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2877 K323SCH3 1 Summation - Ms. Shroff it for you, but let's see. 2 Let's see if Mr. Kamaraju is able to tell you how did 3 Mr. Schulte copy the Altabackup files without leaving a copy 4 command anywhere? 5 connecting any device, any thumb drive, hard drive, anything to 6 his computer? 7 without anybody noticing? 8 armed guards, you have to badge in, badge out, sit in a vault, 9 sit in a safe. How did he download all those files without How does he take this device out of the CIA Mr. Laroche just told you there were How does he get it out? And maybe Mr. Kamaraju 10 will also explain to you why WikiLeaks waited almost a year, 11 not a week, like Mr. Leedom took to discombobulate the 12 information that Mr. Laroche would have you believe. 13 Why would WikiLeaks wait a whole year to release this 14 information? 15 You know that they know. A year. They know there is a problem 16 with their case. 17 is why they have Mr. Leedom talk to you ad nauseam about that 18 thumb drive. 19 drive being connected to Mr. Schulte's workstation on April 20, 20 2016. 21 They know they have a problem here. And that He talks and talks and talks about that thumb And you remember this. You remember the slide that he 22 showed you, slide 105, indicating that a Sandisk thumb drive 23 was connected to Mr. Schulte's workstation. 24 slide. 25 numbers. You remember this I remember this slide because I had to read those long And remember on cross-examination what we learned SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2878 K323SCH3 Summation - Ms. Shroff 1 about this slide when I showed it to Mr. Leedom? The part that 2 he had cut off. The bottom 3 that he cut off and that he never showed you. 4 shows that Mr. Schulte pulled that thumb drive out of his 5 computer before -- I cannot emphasize this enough -- before the 6 reversion period started. 7 He had cut off the bottom part. The part that Take it back with you, take a look, the thumb drive is 8 disconnected at 5:22 p.m. Three minutes after it's connected, 9 26 minutes before the reversion starts. The reversion started 10 at 5:48 p.m. The thumb drive has nothing to do with anything. 11 Okay. 12 disconnected, and I am repeating myself now, before the 13 reversion period ever starts. You know it and I know it. 14 Take a look. It's Not only that, take a look at the thumb drive. 15 only 64 gigabytes in size. 16 small to hold Stash and Confluence backup files. 17 Mr. Laroche told you are literally hundreds of gigabytes of 18 data. 19 That's way too small. It's That's too Which even And lest we forget, because Mr. Laroche certainly did 20 not present that slide to you, the thumb drives has a write 21 blocker, something I also reviewed with Mr. Leedom, connected 22 to this. 23 All of this means what? All of this means that 24 Mr. Schulte couldn't have used that thumb drive to steal the 25 data. It had to be someone else, and maybe -- just maybe -- it SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2879 K323SCH3 Summation - Ms. Shroff 1 is that someone who is home right now enjoying his paid 2 administrative leave. 3 Ask yourself this question. Ask yourself. If the 4 thumb drive has nothing to do with this crime, why did 5 Mr. Leedom talk about it so much? 6 about it again today in his summation? 7 you that the thumb drive is disconnected before the reversion 8 period? 9 the mission. That kind of testimony destroys the mission that 10 they are on. It might lead you, you, the jury of 12, to acquit 11 Mr. Schulte. 12 Why did Mr. Laroche talk Why did they not tell The answer is really very simple. It's not part of So Mr. Leedom never gives this to you in direct, and 13 he doesn't give it up until cross-examination. 14 about the thumb drive is to lead you to think that somehow or 15 the other this thumb drive has something to do and somehow 16 makes Mr. Schulte guilty. 17 It should lead you to acquit. 18 It does not. The testimony It does the opposite. Now, if Mr. Leedom were truly an objective expert and 19 did not have a three-year relationship helping the CIA with its 20 mission, would he not have just come here on this witness stand 21 and told you, hey, listen, I looked, I looked at all of this 22 evidence, I found this, this, and this, but you know what I 23 didn't find? 24 being connected to Schulte's workstation during the reversion 25 period. I didn't find any evidence of any storage device It's obvious. Why didn't he just tell you? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2880 K323SCH3 1 Summation - Ms. Shroff And lest we forget, they've had Mr. Schulte's 2 workstation for years. 3 What do they find? 4 they find nothing that is incriminatory. 5 logs from his workstation, inserted no storage devices during 6 the reversion period. 7 His entire workstation, they had it. They look over his entire workstation and He's he deleted no I remember this testimony because it is only one of 8 two times that I got to ask a question on recross. 9 the question that I put: The workstation that he used, not a 10 single file was deleted, correct? 11 can't he just say yes. 12 to be an objective expert. 13 accurate." 14 And here's And look at his answer. "I believe that's accurate." Just answer yes. Why Supposed "I believe that's I also want to talk to you just a few seconds about 15 the document that the government keeps showing you, okay. 16 1207-27. 17 March 3 Confluence backup on April 20, 2016. 18 many times they showed it to you. 19 every witness they could find. 20 The document that indicates that somebody accessed a I don't know how I think they showed it to Let's just look at 1207-27. Because what this 21 document does not tell you, it simply does not tell you who or 22 which workstation is doing the accessing. 23 that. 24 they tried to fill that gap, because David Denton in his 25 opening statement tried to get you to think that March 3 It doesn't tell you And you know why it doesn't tell you that. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 And you know 2881 K323SCH3 Summation - Ms. Shroff 1 somehow had some significance to Mr. Schulte, and that is why 2 March 3 was picked. 3 Now, remember Mr. Denton told you in his opening 4 statement that March 3, and I quote, "was the very day that 5 Schulte felt the CIA had wronged him, and that's why he decided 6 to access the March 3 backup file." 7 But I don't see anything in the evidence, and there is 8 nothing in the evidence to support this claim. Okay? There's 9 nothing at all to suggest that Mr. Schulte viewed March 3, 10 2016, as particularly significant, because Mr. Schulte never 11 mentions that date. 12 is an important date are the prosecutors because it fits their 13 mission. 14 The only people who somehow think March 3 Second, I want you to remember that access is not the 15 same thing as copying. Just remember what the witnesses told 16 you. 17 you this -- that it stood out like a giant red flag. 18 it's the only entry where the numbers in the right column do 19 not match the numbers in the left column. 20 it back up. That the April 20 time stamp -- remember, they all told 21 So think about it. Right? Because Can we pull Mr. Schulte is a trained expert in 22 stealing computer information without leaving a trace, right? 23 That's literally his job. 24 awards. 25 would he do that? That's a job for which he won Why would he leave such an obvious red flag? You know he wouldn't. Why And how do you know SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2882 K323SCH3 Summation - Ms. Shroff 1 that? Well, I want to show you and review with you a small 2 piece of testimony that nobody really focused on, but I think 3 is quite important. 4 Go back to Mr. Leedom again. Remember when I asked 5 him if he ever heard of something call a touch command. 6 said a touch command is a command in Linux that you can use to 7 create new files. 8 the touch command to edit time stamps for files as well. 9 what does that mean to you? You heard Mr. Leedom say: You can also use And It simply means by using a touch 10 command you can change or modify the access time. 11 answer. 12 And he That's his The government's expert. And you know from all the testimony in this case that 13 Mr. Schulte certainly was an expert in Linux. 14 really going to be stealing the data on April 20, and all he 15 has to do is use a simple touch command to change the April 20 16 access time back to March 3, 2016, he could have. 17 have looked just like this. 18 at the date now. 19 looked just like this. 20 would match the time stamp on the left column, with a simple 21 touch command. 22 So if he's It would That's your touch command. That's a simple touch command. Look It would have The time stamp on the right column So why would Mr. Schulte leave such a giant red flag 23 like this for investigators to find? 24 have. 25 wasn't Mr. Schulte who did this. You know he wouldn't And that's how you know it wasn't Mr. Schulte. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 It 2883 K323SCH3 1 Summation - Ms. Shroff And I want to take a minute here to point out a 2 fundamental contradiction in the government's theory when it 3 suits them. 4 Mr. Schulte as this genius cyber criminal who can cover his 5 tracks up at will. 6 inept and such a bumbling data stealer that he's hunting on his 7 workstation and looking in the wrong place and that is why he 8 cannot find and delete VI client files. 9 10 11 When it suits them, they want you to think of And then there are other times when he's so So which one is he? Which one is it? Because you can't be both, right? Now, the government introduced for you a lot of 12 information about his home system. 13 extensively about his home system and about 14 Mr. Schulte's Amazon purchases. 15 purchases that you and I would make. 16 who is all into computers, all into movies, all into Plex 17 servers, those are very normal purchases, okay. 18 Mr. Berger testified Look, these are not Amazon But for a computer geek Now, think about the testimony you got from Mr. Berger 19 who tried to insinuate that the encrypted containers on 20 Mr. Schulte's home computer had something nefarious. 21 only later that when Special Agent Evanchec finally conceded 22 that you learned that none of the files on his home computer, 23 including the encrypted containers, had any classified 24 information in them. 25 came out in Special Agent Evanchec's cross-examination. It was Mr. Berger didn't tell you that. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 It only 2884 K323SCH3 1 Summation - Ms. Shroff And go back to this point about Brutal Kangaroo. 2 There was nothing improper. 3 about Mr. Schulte having a folder called Brutal Kangaroo on his 4 home desktop. 5 from the CIA, other witnesses told you that people work on 6 unclassified portions of a project, of a tool at home, and take 7 it into the CIA. 8 evidence that shows you that anything in that Brutal Kangaroo 9 folder on his home computer has anything classified? 10 There is nothing improper at all And why do you know that? Because other people Is there any evidence, is there any record No. So you might be asking yourself now, Ms. Shroff, if it 11 wasn't Mr. Schulte, then who was it? 12 minute to remind you, it is not our job to solve this puzzle. 13 It is not our job to solve this crime. 14 it's certainly not your job. 15 are not the FBI. 16 And I just want to take a It is not my job and That's the government's job. We're not in the business of accusing. But after all that you have heard, you have to ask 17 yourself, do you not, couldn't Michael have done this? 18 the answer is yes, isn't that reasonable doubt? 19 We And if So let's talk about Michael just for a few minutes and 20 let's remember, first, who is Michael? Michael is the guy who 21 worked in EDG, he has the same skill set as Mr. Schulte. 22 also knew, as did every other developer and coder in EDG, how 23 to covertly steal information without leaving any trace at all. 24 What else do we know? 25 CIA workstation on April 20, 2016, at 5:42 p.m., the very He We know that Michael was present at the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2885 K323SCH3 Summation - Ms. Shroff 1 moment that the government says that the Altabackups were 2 accessed. 3 to them. 4 Michael had a very easy way to copy the data by using vSphere. 5 As Dave told you, the easiest way to copy that data was to use 6 vSphere. 7 on his computer when the theft supposedly occurs? 8 vSphere open. 9 beginning and at the end of the reversion. And that's when the theft was committed, according That's called the criminal opportunity. And third, Fourth, what program does Michael happen to have open He has And Michael is present at his desk at the No matter where he 10 is in the middle, at the beginning and the end he's at his 11 desk. 12 the badge records. 13 At 6:51, Michael is back at his desk. Take a look at And now things get a little bit even more weird, more 14 suspicious. 15 sees the reversion taking place, right? 16 came over and he said I saw the reversion taking place on the 17 computer screen. 18 a screenshot of the reversion, of what's going on, because he 19 says he found it suspicious. 20 You find something suspicious, but you tell no one. 21 is not suspicious, according to the government. 22 just keep going. 23 Michael tells you that on April 20, he actually You remember that he Not only does he see the reversion, he takes That's Government Exhibit 1255. And that Okay, let's Michael never tells anyone about this screenshot that 24 he takes. Never shows that screenshot to anyone. 25 screenshot is never heard about again until the FBI finds the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 That 2886 K323SCH3 Summation - Ms. Shroff 1 screenshot all on their own when it searches Michael's computer 2 in 2017. 3 screenshot, he just says I forgot. 4 And then, when the FBI asks Michael what about the Really? Do you really forget that screenshot? 5 that believable to you? 6 to hide, something they don't want to talk about. 7 Is Or is that somebody who has something So let's look a little bit more closely at the 8 screenshot, because you are going to find even more reasons to 9 suspect Michael. 10 I know you've been here all morning, but I ask you, I'll be fast, okay. 11 Remember the screenshot here, it has three screens. 12 Because Michael, no differently than anyone else at the CIA, 13 had three computer monitors. 14 screenshot. 15 closely, at the right-hand side, you will see something kind of 16 curious, right. 17 One of them is the password for the Confluence user account. 18 123ABCdef. 19 what? 20 Well, the prosecutors stipulated to that in Defense Exhibit O. 21 Look at the right screen of the This is the Confluence web page. And if you look It is a whole bunch of passwords over there. That's like the weakest password. There it is. But you know How do you know that's the password? Why in the world, just ask yourselves when you go 22 back. Why in the world does Michael have the Confluence user 23 password up on his screen at the very moment the government 24 tells you that the theft is taking place? 25 was logging into the Confluence to access the Altabackup? Could it be that he SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I 2887 K323SCH3 Summation - Ms. Shroff 1 don't know, they don't know, you don't know, but we all know 2 that's reasonable doubt. 3 Mr. Laroche told you that Michael couldn't have 4 accessed the Altabackups that way, right, this is what he told 5 you. 6 record of any Confluence user logging into the Confluence VM at 7 any point in April of 2016. 8 to believe. Because Government Exhibit 1207-24 does not have any 9 Right? This is what he wants you But look, you know this forensic fact to be true. The 10 reversion would have erased any such record. 11 more and no less a talented developer than all the others who 12 worked at EDG, and he would have known that. 13 testimony tells you that, and he of course is the government's 14 witness. 15 the one-hour reversion period was erased. 16 And Michael is no Mr. Leedom's He told you in his testimony all the activity during And that's different from the logs on Mr. Schulte's own 17 computer. 18 only the logs on the Confluence VM are erased. 19 Mr. Schulte, could easily be the person who accessed and copied 20 the Confluence backup file, and leaked it. 21 that's reasonable doubt. 22 something Michael had the capability, the ability, the 23 opportunity, to do. 24 25 They would not have been erased by the reversion, So Michael, not He could have, You cannot convict Mr. Schulte for And now you know what? It's not just me and you. It is also the CIA who knows that Michael's behavior was highly SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2888 K323SCH3 Summation - Ms. Shroff 1 suspicious, off the wall, off the charts, and you know that. 2 You know that by looking at Defense Exhibit L. 3 official CIA memorandum, you remember this? 4 Michael was placed on forced or enforced administrative leave. 5 This is the Explaining why Now this is a document, just take a minute, okay. 6 Remember? This is a document that the CIA never, ever, ever 7 wanted you to see. 8 States government, the FBI, all of these people at this table, 9 all of these men, never told you about this document, ever. In fact, their mission partners, the United 10 We're the ones who showed it to you. 11 you the document well after the government rested. 12 We are the ones who gave Judge Crotty will give you an instruction about this 13 document. 14 is about the government's behavior. 15 attention to that instruction. 16 will tell you, that the government did not disclose this 17 document to the defense until the middle of trial, in the 18 middle of their criminal trial. 19 disclosed to the defense earlier. 20 you 12 jurors, to decide what weight to give to the 21 government's failure to disclose to you this document. 22 not just any document. 23 should give the government's conduct that they withheld this 24 document a lot of weight. 25 It is called an adverse inference instruction. It Please, pay careful It will tell you, the judge That it should have been And that it is up to you, It's It is an important document and you The government, its mission partners, the CIA, the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2889 K323SCH3 Summation - Ms. Shroff 1 FBI, the United States attorney's office, kept this information 2 about Michael to themselves. 3 shows their doubt about the case against Mr. Schulte. 4 know this, I don't even have to belabor it. 5 by looking at this document, okay. 6 the whole thing again. 7 says. 8 unexplained activities on the computer system from which the 9 CCI data was stolen known as the DevLAN. Why? It shows their doubt. It And you You know this just I'm not going to go through But remember just in parts what it It talks about Michael's lack of cooperation. His It notes that it 10 raises significant concerns about Michael's truthfulness, his 11 trustworthiness, and his willingness to cooperate with both 12 routine OS reinvestigative processes and the criminal 13 investigation into the theft from his office. 14 The document goes on to say: Michael may have 15 additional knowledge of anomalies on the system at the time of 16 the theft. 17 18 19 Yeah, he had that vSphere running with the passwords right there. Additionally, recent inquiries indicate Michael is 20 still withholding relevant information concerning the 21 circumstances surrounding the theft. 22 You don't have to take my word for it. They tell 23 themselves, they don't tell us, but internally at the CIA. 24 They're in line with their mission, they know Michael is a 25 security risk. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2890 K323SCH3 1 Summation - Ms. Shroff So what does the memo go on to say: "Given the 2 magnitude of the theft of the CCI toolkit and its concomitant 3 damage to national security." 4 This wasn't in Mr. Laroche's column. In the one, two, 5 three column, in any of those columns, did you see anything 6 about this memo? 7 No. "Views Michael's lack of cooperation as a significant 8 and untenable risk to the security of the operations on which 9 he now works and any new tools he deploys for CCI." 10 The government told you, and it's going to tell you 11 again, because this is in line with their mission, that it 12 could not have been Michael. 13 Let me just ask you something very simple. 14 couldn't have been Michael, and it wasn't Michael and Michael 15 isn't a person for you to worry about, why not just turn over 16 that memo? 17 their mission and it gives you reasonable doubt. 18 If it They didn't turn over that memo because it hurts So, if DevLAN is not secure, and there are other 19 people who could have done it, the forensic evidence is not a 20 smack down for them. 21 Michael's behavior is weird at best and suspicious. 22 It does not prove Mr. Schulte's guilt. What does the government do to further its mission to 23 convict Mr. Schulte? Well, you know. The government has a 24 special motive attributed to him. 25 again the government tells you Mr. Schulte stole the Deep anger. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Over and over 2891 K323SCH3 Summation - Ms. Shroff 1 information and gave it to WikiLeaks to harm America. 2 basically they spent four weeks trying to show you that 3 Mr. Schulte was so angry with the CIA, so angry with 4 management, that he decided to risk everything, everything, not 5 only himself but everybody else, he decided to risk the one 6 country that he loves, by leaking this information. 7 And So let's look at Mr. Schulte, not for too long because 8 I know you look exhausted, but just for a minute. 9 talk about Mr. Schulte. Let's just He's devoted his entire life, entire 10 adult life, his work life to service. He started as an intern 11 at the NSA, he worked at the CIA. 12 loved it so much he decided to graduate in four years instead 13 of three. He went there as an intern, He was an award-winning developer. 14 And even when he was being interviewed by Mr. Small of 15 TMU, under all of that stress, when the government wants you to 16 think he is seeped in anger, what did he say. 17 job as a lot of fun. 18 cared deeply about his work, and he cared deeply about his 19 project. 20 Even then, he says his job is fun. You know he is a patriot. Mr. Laroche went on and on about that. 22 when he was asked about Edward Snowden. 23 Snowden was a traitor who should be executed. 25 He I don't see what's so bad about that. 21 24 He described his But think about what Mr. Schulte said at a time He thought Edward Jeremy Weber who is the last person, the smallest fan of Josh Schulte that ever existed, what did he tell you? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 He 2892 K323SCH3 Summation - Ms. Shroff 1 told you that Mr. Schulte believed in the CIA's mission, and 2 that he thought he, meaning Mr. Schulte, that nothing ever 3 should be done against America, ever. 4 So they have to come up with some motive, right? So 5 what do they come up with? 6 they want you to think that as of April and May of 2016, 7 Mr. Schulte was so angry, and now we have the anger portion of 8 their evidence. 9 that the government has called, and think about all the times 10 they've paused in the middle of their direct to say, And did 11 Mr. Schulte sound angry to you? 12 sound angry? 13 question? 14 question over and over again. 15 changes the words. 16 testified, "How did the defendant feel about Jeremy Weber after 17 he moved to RDB? 18 "He was unhappy with him. 19 "Generally speaking, what was the reason for that unhappiness? 20 "He -- there was an argument over a project. 21 bring the project with him to the new branch, Jeremy did not 22 want him to bring that project. 23 "How do you know that the defendant was angry at Mr. Weber?" 24 25 They come up with this story that Now think back. Think back to every witness How did he sound? Did he How many times of each witness did they ask that You will have the transcript. At one point the prosecutor even Take a look at this. He never says he was angry. says he is unhappy. Search for that Remember Michael Josh wanted to Look back at line 7. When does unhappiness turn to anger? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 He Only 2893 K323SCH3 Summation - Ms. Shroff 1 when Mr. Kamaraju changes the adjective. 2 word? 3 not from the witness, it is from the government. 4 Remember the mission. 5 he's an angry, angry man. 6 Whatever it is. Is it an adjective or It is only when he changes it. It is The mission. The mission is to make sure you think Now, look, you have the testimony, you have the audio 7 recordings. Go ahead and play them. He doesn't sound angry to 8 me, okay. 9 whether the man sounds angry, or he's recounting what is You can play the recordings. You can parse out 10 troublesome to him. 11 angry, right. 12 can find some way to convince you. 13 you that the password phrase, which is chosen by WikiLeaks, 14 something about a Bay of Pigs, Splintering into 1,000 Pieces, 15 somehow or the other, that was chosen by Mr. Schulte because he 16 was angry, just as John Kennedy or Robert Kennedy was angry 17 during something having to do with Cuba. 18 so. 19 Clearly they want you to think that he's They focus on every part, every place that they They even tried to convince Okay. I don't think Go back, go back and look at that testimony and see if 20 your logical minds actually find any evidence that Mr. Schulte 21 was so angry in 2016, and that his anger continued unabated and 22 could only be satiated, only be satisfied by betraying the 23 United States. 24 25 Now, look go back to March 16, okay. files a complaint. March 16 he Says Amol threatened to kill him. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 By 2894 K323SCH3 Summation - Ms. Shroff 1 March 16 you know and I know that nobody is on his side. 2 Right. 3 away his access. 4 here told you that Jeremy made him more angry. 5 through this with you with Exhibit 1060. 6 you, I will not go through that e-mail chain with you again. 7 But you take a look when deciding whether it's anger or just 8 Mr. Schulte who is fighting to keep what he thinks he should be 9 entitled to keep. 10 That's the evidence. Nobody supported him. Weber took And according to the prosecutors, Mr. Laroche He's moved after that. I'm not, I promise Remember? He's moved. He's 11 moved out of OSB. 12 You know that he works on a new tool. 13 Vortex is compromised. 14 about the uniqueness of the tool. 15 think that Mr. Schulte didn't want to share any information 16 with the contractors, because he wanted to get the glory. 17 we tried to tell you that that wasn't in fact the case. 18 a fair worry that the CIA's predecessor tool not share any 19 unique quantities with later tools. 20 He's moved to RDB. They went What does he do at RDB? He works on Nader. Remember, we had that whole testimony Mr. Laroche wanted you to And It was You know that. They want you to think even those he's moved on, even 21 though he's happy working on Nader, there is still a lot of 22 anger and that is why he is a traitor. 23 Listen to the conversation he had with Mr. Small. 24 think Mr. Small is far more of a liar than Mr. Schulte is 25 angry. Just take a look at the way Mr. Small answers SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I 2895 K323SCH3 Summation - Ms. Shroff 1 questions. 2 never has a pause. 3 answer, question answer, question answer. 4 question, he couldn't recall, he didn't know, and then he kept 5 using that word, remember? 6 it's too nuanced. 7 nuanced on cross-examination. 8 9 10 Look at the way he answers questions on direct. He It's like a seamless strain of question I ask him a I cannot answer yes or no because Nothing was nuanced on direct. So, Leonard Small. It was only Is he credible to you? yourself, read that question-and-answer series back. (Continued on next page) 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Ask 2896 K32Wsch4 1 Summation - Ms. Shroff MS. SHROFF: Anyway, let me go back just for a minute 2 to Mr. Schulte's suppressed anger or nonsuppressed anger, 3 because although Mr. Laroche would like you to think that the 4 timeline makes sense, it actually does not. 5 and look at the timeline and ask yourself, if, according to 6 them, the theft is in April and May, what does it matter 7 whether he's angry or not in June, July, August, September, 8 October, November? 9 it's all over by then anyway, right? 10 What does it matter? So listen, go back According to them, So why do they keep talking about anger all of these months from then? 11 And you know. You know that he's not angry in 12 November of 2016 because he's at Bloomberg by then. 13 moved. 14 in the best city ever, New York City. 15 twice as much money as he ever made at CIA. 16 apartment. 17 man. 18 He's moved on with life. 19 in fact, is the CIA and its mission partners over here. 20 He's moved from Virginia. He's For God's sake, he lives now He's here. He's making He has a new Yes, he's not fully unpacked, but he's a single You know how that goes. And he's over it. He's moved. The only person who hasn't moved on, OK? So let's fast forward because I know you're getting a 21 little tired. 22 Let's move to the day that the FBI shows up at Mr. Schulte's 23 door. 24 stopped by the FBI agents and he's whisked off. 25 take him? OK? I can sense this from you. But let's move. That's March 15, 2017, and that's the day he's Where do they To Pershing Square diner, right in the middle of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2897 K32Wsch4 1 Summation - Ms. Shroff 42nd Street. 2 The agents sit him down, and remember you have 3 testimony about how orchestrated it is. On the one hand, they 4 want you to believe that he's free to leave, but then they also 5 tell you that they have agents at the front of the diner, that 6 they have agents pretending to be eating within the diner, and 7 then, of course, they have a table all the way in the back, and 8 that's OK to talk about national classified information at 9 Pershing Square diner. It's OK to do it then, because it's on 10 their terms, so that then it's just all all right, because it's 11 part of their mission. 12 Don't forget. And what does the special agent tell you? 13 angry? Does Mr. Schulte answer their questions? 14 a fit? No. 15 answers questions. 16 Is he Does he throw He sits down, they ask him questions and he And what does the agent tell you he remembers about 17 Mr. Schulte on that day? 18 Well, wouldn't your hands tremble too? 19 that whole week that you're going to take your younger brother 20 for spring break to someplace in Mexico. 21 was Cancun or someplace else. 22 Pershing Square diner being interrogated by the FBI. 23 course, they're going to tremble, but even that agent does not 24 tell you that Mr. Schulte was angry. 25 He remembers that his hands trembled. Imagine you think that I forget whether it And instead you're sitting in You know when there is some anger? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Of The anger is after 2898 K32Wsch4 Summation - Ms. Shroff 1 he's locked up at the MCC for a crime he did not commit. 2 that's what the defense is. 3 have any proof of these espionage charges. 4 give you? They focus over and over and over again on the MCC 5 evidence. OK? 6 to think that his writings will take the place of actual proof 7 of theft. 8 that they prove Mr. Schulte's innocence. 9 evidence. 10 They have nothing. And They do not So what do they And they focus on his writings. And they seem So let's look at these writings, because I think I know you're tired. You have them in You read them and you will 11 remember the circumstances under which Mr. Schulte writes them. 12 OK? 13 He's deteriorating. 14 think that prison is a nice place, but you know it's not. 15 tells you about the rats. 16 tells you about the water being backed up with sewage. 17 not a place that anybody wants to be. 18 For by this time, he's been in prison for a while. So compare. It's clear. Right? I mean, Mr. Betances might He tells you about the flooding. He It is Compare his prison writings to the way he 19 writes at the CIA, and you can see he's falling apart. 20 what does the government want you to believe about these 21 writings? 22 He But The government wants you to believe this is some kind 23 of planned army-like information war against the United States. 24 Just compare what the United States wants you to think about as 25 this information war and what the information war actually is. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2899 K32Wsch4 Summation - Ms. Shroff 1 So I promise no articles other than the titles. 2 look at the titles of these articles. Just take a OK? 3 Presumption of Innocence. 4 A Petition for a Redress of Grievances and the Loss of 5 Citizenship. 6 Do You Want to Play a Game? 7 Detention is Not Punishment. 8 Guilty Until Proven Wealthy. 9 Presumption of Innocence: 10 Its Origins. Does this sound like a battle plan? Is that what he 11 called it, a battle plan? 12 to you? 13 called it in his opening, a battle plan. 14 talking about the United States Constitution and presumption of 15 innocence, then we're all in big trouble. 16 Does this sound like a battle plan That's not a battle plan. This is what Mr. Denton If our battle plan is Mr. Schulte's focus here is not about anything other 17 than trying to prove that he is an innocent man sitting in 18 jail. 19 because he's innocent. 20 cell phone, a cell phone that was smuggled in, and he uses it 21 to try and get his story of innocence out to the Washington 22 Post. 23 anybody else who will listen to him. 24 with the search warrants. 25 search warrants are false, and that is what he's trying to get That's what his plan is. Right? He wants to get out So what does he do? Yeah, he uses a He tries to get it out to the Washington Post and to And that is what he does He writes out why he thinks the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2900 K32Wsch4 1 2 Summation - Ms. Shroff out. Look, I'm not going to stand here and tell you that 3 using a cell phone in a prison is right. It's not. It's 4 against the rules. 5 Did he use a cell phone? 6 not what he's charged with. 7 cell phone, sure, find him guilty of that. 8 what he's charged with. 9 crimes here, and they have no proof he committed those crimes, It's not in keeping with the prison rules. Yes, he used a cell phone, but that's If he was charged with using a But that is not He's charged with far more serious 10 which is why they are so focused on MCC conduct. 11 to focus on MCC conduct because that is the only way they can 12 get you to think that he did the other crime. 13 They want you They want you to think that this guy -- Mr. Laroche 14 told you this. 15 man as a man in perpetual trouble, who broke the rules at the 16 MCC, and therefore, because he broke the rules at the MCC, he's 17 the kind of guy who would leak national defense information. 18 He told you that they want you to think of this Just for a minute take a look at what he says. Take a 19 look at what he says in these articles. And just for a second, 20 take a look at the first paragraph of Malware of the Mind. 21 See if this is what you would have in your head if you're 22 trying to betray your country. OK? 23 What is he talking about? 24 "Today we are facing a stealth constitutional crisis. 25 A malware of the mind has entered and corrupted the justice SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2901 K32Wsch4 1 2 Summation - Ms. Shroff system." What is he talking about? He's talking about the 3 justice system. From there, Mr. Schulte goes on to talk about 4 the justice system in the context of technology, how the law 5 does or does not progress with technology and how these 6 prosecutors and the FBI agents, with very little knowledge of 7 forensics, are deemed experts. 8 this is, how somebody who has no real expertise is so trusted 9 to defeat the presumption of innocence, and it is in this He is talking about how wrong 10 context -- it is in this context -- that he talks about his 11 work at the CIA. 12 So go back to exhibit 801. 13 contents of this. 14 contents. 15 whole thing. 16 17 OK? Take a look. Take a look at the Just take a look at the Look at the contents. You can't read this It's 133 pages long: Introduction; transcripts -- certainly not part of a battle plan, right? 18 Search warrant, not part of a battle plan. 19 The complaint, not a battle plan. 20 Ethics and a logical look at the charges; tyranny; 21 22 conspiracy; and conclusion. It's not a battle plan. This is a man talking about 23 the constitutional system and how it works; how it works and 24 how it hurts an innocent person if you are sitting in jail. 25 And I'm telling you Mr. Betances adds nothing to this SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2902 K32Wsch4 Summation - Ms. Shroff 1 testimony. OK? I want you to just think about Mr. Betances 2 for two seconds. 3 videos and those photos in the MCC for no good reason. 4 them and he just kept them aside and he wasn't going to 5 cooperate and he wasn't going to get any benefit from the 6 United States until he hears the words "Russia" and 7 "information war." 8 and look at how he talks about information war, because 9 seriously, it's a phrase used once. He wanted you to believe that he took those OK? Just go back. He took Go back for a minute 10 Can somebody pull it up. 11 There you go. 12 "From here I will stage my information war," colon, 13 and then form tells you everything he will do: 14 15 "Facebook. I will rename simply who is John Galt or who is Josh Schulte?" 16 That does not seem like a battle plan to me. And then 17 he tells you he's going to put this up on WordPress. 18 Well, when he puts it up on WordPress, what's he going to talk 19 about? 20 anything other than his innocence? 21 Origins. 22 opinions about the presumption of innocence? 23 he's focused on. 24 or having a battle plan of any sort. 25 He's talking about his innocence. OK? Is he talking about Presumption of Innocence: Do you think anybody would want to know about his But that's what It has nothing to do with destroying America This is what they've given you because they have no SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2903 K32Wsch4 Summation - Ms. Shroff 1 evidence that he stole anything from the CIA. 2 at his words. 3 his thoughts about a criminal justice system that have nothing 4 to do with anything else. 5 These are the words. Go back and look These are his thoughts, Now, look, Mr. Laroche spent a lot of time talking to 6 you about the legal elements, and I'm not going to be that 7 long. 8 the indictment. 9 I want to spend just a few minutes talking to you about Just a very few minutes. OK? The indictment has ten charges, ten crimes. Most of 10 them have to do with accessing a CIA computer to steal 11 information and give it to WikiLeaks. 12 counts should be not guilty. 13 again and I've tried really hard to cut to the chase here, but 14 I've shown you over and over again, I hope, that the government 15 simply has not proven these counts beyond a reasonable doubt. 16 Your verdict on those I've shown you over and over Counts Three and Ten -- they fall into a different 17 category -- these are what they call the MCC counts. Those are 18 the allegations that Mr. Schulte committed the crimes in late 19 2017 and '18 after he was arrested and after he's at the MCC. 20 Those are the attempts, that he attempted to send national 21 defense information. 22 Count Ten charges that he committed attempt. 23 look at the counts, the contempt and the other charges, focus 24 on the jury instruction that Judge Crotty will give you. 25 will see that Mr. Schulte does not willfully transmit or SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 When you You 2904 K32Wsch4 Summation - Ms. Shroff 1 attempt to transmit any national defense information from the 2 MCC. 3 about those tweets, OK, this long paragraph? 4 has a Twitter handle that nobody's following. 5 knows who the hell Jason Bourne is. 6 there. 7 140-character cutoff. 8 anything onto Twitter at the rate he rambles on and on. 9 impossible. 10 11 Think about all of these things that they're telling you First of all, he Nobody even It has zero followers in Nobody's reading it, and his diatribe exceeds Twitter's There's no way this man can upload You know this. It's If you take a look at the evidence, you will know that that is impossible. The information he sends out is about his search 12 warrants. 13 search warrants, and you know that the government was, in fact, 14 wrong in these search warrants. 15 agent testified that in the search warrants, the United States 16 Attorney's Office had the wrong date, in these initial 17 warrants. 18 States Attorney's Office not only had the wrong date but also 19 tried to come up with the relationship. 20 it was March 6 or March 7, and it had to be March 6 or March 7. 21 You know why? 22 of the cube and he was alone in the office. 23 He wants to show that the government is wrong in the You know this. You know this because the You know this because the United They first said that Because that's the date everybody else was out They draw all kinds of diagrams and arrows and make up 24 all kinds of theories. 25 evidence. No, it's not correct. Look at the Don't listen to the arguments that come simply off SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2905 K32Wsch4 Summation - Ms. Shroff 1 of Mr. Leedom's 151- $60,000 custom chart. 2 elements and look at the charge. 3 that Judge Crotty gives you on the issue of willfulness and 4 corrupt. 5 Look at the Just listen to the charge That leaves you with Counts Eight and Nine, which 6 allege that Mr. Schulte lied to the FBI. 7 require the government to prove to you beyond a reasonable 8 doubt that Mr. Schulte acted willfully, corruptly, not by 9 mistake, not by accident. 10 Both these counts And you will see they will not be able to prove those to you. 11 Mr. Schulte did not act with any bad purpose. Just 12 think about what the government wants you to believe. 13 government is saying to you that Mr. Schulte, the man who knew 14 that everybody at the CIA hated him, the man who knew that if 15 anything ever went wrong, he would be suspect No. 1 -- I mean, 16 think. 17 dislike him? 18 saying. 19 OK? The Can you think of a single person at the CIA who did not That's a double negative, but you know what I'm Right? I mean, he knows, by the time he hears of the leak he 20 knows the first person they're going to come after is him. I 21 mean, which one is he? 22 extremely smart? 23 So this man obviously knows that they are coming after him. 24 And who cares that he's searching? 25 the CIA and information was stolen and you had left a long time Is he completely stupid, or is he Because they really can't have it both ways. Imagine if you worked at SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2906 K32Wsch4 Summation - Ms. Shroff 1 ago. What would you Google? 2 hell's going on. 3 nothing wrong with that. 4 You'd want to find out what the Yeah, it's normal. It's normal. There's Just go back, when Judge Crotty is instructing you on 5 the jury charge, to the facts as they have come out, and you 6 will see that the government has failed to prove guilt beyond a 7 reasonable doubt. 8 9 Look, I'm going to sit down now. It's been four weeks of trial and a lot of evidence. My 10 work is almost done, and your work is just about beginning. So 11 as you undertake this work, I ask you to ask yourself -- ask 12 yourself about these witnesses -- do I trust these witnesses? 13 Do I trust these people? 14 gave me? 15 this the kind of proof that would be enough, if Mr. Schulte 16 were my relative or my friend; would I trust that evidence? 17 done. My work is almost Do I trust the information that they Is this the kind of proof that I can depend on? Is If you ask yourself those questions, if you ask 18 yourself those questions, can I trust these witnesses, you will 19 know that the answer is no. 20 Jeremy Weber. 21 Weber's testimony. 22 accesses on April 4 of 2016. 23 and the government told you over and over again, that the 24 accesses were changed on April 4, 2016. 25 access was changed, Mr. Weber told everyone, including you, was Just for a moment think back to Just for a minute. OK? Just go back to Jeremy And he tells you that he changed He tells you over and over again, And the reason the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2907 K32Wsch4 Summation - Ms. Shroff 1 because it was standard operating procedure. 2 your access is taken out. 3 OK. Take a look at the evidence. You leave OSB, Take a look at all 4 of those charts. Think back to all of those wonderful charts 5 Mr. Laroche showed you. 6 a single email, a single conversation, a single note, anything 7 that tells you that on March 4, when they -- by they, I mean 8 Jeremy Weber -- changed Mr. Schulte's access he had 9 authorization from anyone. And in all of that evidence, is there Because remember, they gloss over 10 this. Mr. Schulte doesn't realize that his access has been 11 taken away for ten full days. 12 project, so he doesn't try to access anything until April 14. 13 So if management really did authorize Mr. Weber, and management 14 did say go ahead and remove his OSB access, why is there no 15 email? 16 Why is there nothing that supports what Mr. Weber wants you to 17 believe? He is not working on that Why is there no testimony? 18 Why is there no document? That he did this with management's backing. I'm not talking about what you see after April 14, 19 because by then it's CIA mission time and everybody lines up 20 and supports Mr. Weber. 21 Mr. Weber revoked access. 22 nothing. 23 I'm talking about the day that April 4 to April 10, there's Can you trust a person who skips over that time period 24 and then tells you to just believe that these are the real 25 reasons why he removed Mr. Schulte's access? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 When you go back 2908 K32Wsch4 Summation - Ms. Shroff 1 to deliberate, I ask you to please think of all of the gaps 2 that the government is asking you to fill. 3 are there so many gaps that they want me to say it has to be 4 this and it has to be that? 5 gaps. 6 Laroche has given you. 7 the way, but they are still assumptions. 8 evidence. 9 those gaps. 10 Ask yourself why It's not your job to fill these It's not your job to take the assumptions that Mr. He's given them to you very nicely, by They are not Do not do what he's asking you to do. Do not fill Your job as jurors is to put the government to the 11 task of proving guilt beyond all reasonable doubt, and that is 12 all I ask you to do. 13 So after this, I won't be able to speak to you again. 14 This is my one shot of telling you about all of the evidence 15 that proves Mr. Schulte's not guilty. 16 give a rebuttal. 17 everything that I have just said. 18 me, and I won't be able to answer back. 19 opportunity. 20 The government gets to The government gets to stand up and answer But you will. Mr. Kamaraju gets up after I just won't have that You know everything that I know, and no 21 matter what Mr. Kamaraju says, you will be able to answer that. 22 All you have to do is say what would Ms. Shroff say in response 23 to this argument, and you will have the answer, because in four 24 weeks, you know all of it. 25 Mr. Kamaraju says, ask yourself the four questions I asked you So I ask you, no matter what SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2909 K32Wsch4 1 Summation - Ms. Shroff at the beginning: 2 What is the proof that Mr. Schulte stole this 3 evidence? There isn't proof of that. They have given you 4 proof of other things. 5 And what I said to you in the beginning, I think, has borne 6 out. 7 difficult man. 8 that there was no doubt about that. 9 evidence would show that, and that's what the government showed And I told you this in the beginning. I told you truthfully. I told you that Mr. Schulte was a He was a difficult employee, and I told you I told you that the 10 you. For four weeks that's what they showed you. 11 to you that, yes, you can properly call him Voldemort or Vault 12 Asshole or Asshole or Jason Bourne or John Galt. 13 given you evidence of all of that. 14 cannot call him, after four full weeks, because the evidence 15 isn't there, you cannot call him guilty. 16 Thank you. 17 THE COURT: They proved They have But one thing that you Please acquit. We'll take a short recess, and then we'll 18 hear the government's rebuttal. 19 recess. We'll take about a ten-minute 20 (Recess) 21 THE COURT: 22 MR. KAMARAJU: 23 THE COURT: 24 Hold on a second, David. 25 Are we all set now? Are you all set, Mr. Kamaraju? Yes, your Honor. Call the jury, David. Where is Mr. Schulte? OK. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2910 K32Wsch4 Rebuttal - Mr. Kamaraju 1 (Jury present) 2 THE COURT: Please be seated. 3 All right. Mr. Kamaraju. 4 MR. KAMARAJU: 5 Well, I'm the last one up. Thank you, your Honor. And I'd like to start with 6 something Ms. Shroff said. 7 reasonable doubt. 8 our criminal justice system. 9 Reasonable doubt is part of why we're here. 10 Ms. Shroff talked to you about Reasonable doubt is an important standard in It's an important safeguard. Now, the other thing reasonable doubt is is something 11 that we are not afraid of. 12 and we have met it. 13 the evidence that Mr. Laroche put before you, but over two 14 hours, he described to you all of the evidence that shows that 15 this man is responsible for Vault 7; that this man is 16 responsible for breaking into the CIA computer systems; that 17 this man tried to conduct an information war from the MCC. 18 That's the evidence that you have. 19 20 It is our burden. We embrace it, Now, I'm not going to walk through all of What they gave you are conspiracy theories, speculation and guesses. 21 MS. SHROFF: Objection, your Honor. 22 THE COURT: 23 MR. KAMARAJU: Overruled. Now, they have no obligation. 24 hear that from Judge Crotty. 25 said nothing. You'll They could have sat there and But when they do offer something to you, when SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2911 K32Wsch4 Rebuttal - Mr. Kamaraju 1 they do give you a theory, you should look at it. 2 consider it. 3 should think, is it supported by any evidence? 4 that, you're going to see that nothing Ms. Shroff said to you 5 is supported by evidence or common sense. 6 7 You should You should think, does it make any sense? You And if you do So let's just start with her big other suspect, Michael, the man who took the stand here in New York. 8 Now, Ms. Shroff said that Michael was a coder who had 9 all the same skills that he did, the skills necessary to steal 10 the information. She said he was there on April 20, 2016, just 11 like he was. 12 they tried to tell you that because he was logged in to 13 vSphere, he could have used this one password and that password 14 could have been the thing that was used to copy the 15 information. They said he was logged in to vSphere, and then 16 Do you remember that? 17 But it's impossible for that to be the case because as 18 Defense Exhibit O said -- she put it up for you -- it said that 19 password was never used to log in to the Confluence VM in March 20 or April of 2016. 21 It wasn't used. It's a pure fantasy. Now, they tried to recover from that by saying, Well, 22 if it had been used, that data would have been deleted during 23 the reversion. 24 who did the reversion? 25 Ms. Shroff talked about everything from targeting to the length And that's where this all falls apart. Because Over the course of almost two hours, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2912 K32Wsch4 Rebuttal - Mr. Kamaraju 1 of tweets but did not address the critical time period in this 2 case: when the system was reverted and who did it. 3 know why? 4 And you Because there's no disputing that he did it. And you know why there's no disputing that? Because 5 all of the evidence is on his workstation. They found it on 6 his computer. 7 couldn't find their way out of a paper bag found it on his 8 workstation. 9 They found evidence that he deleted all those logs. These FBI buffoons, these forensic experts that They found evidence that he reverted the system. They found 10 evidence that he reverted back, something that makes no sense. 11 All of that they found on his box, not Michael's, not David's, 12 not anybody else. His. 13 Now, what does that mean? 14 What that means is that during the reversion, this man 15 had access to the exact data that's up on WikiLeaks. 16 no serious dispute that that's the data. 17 internet now because he copied it. 18 maybe Mr. Kamaraju will come up here and answer some of those 19 questions. 20 There's It's sitting on the And Ms. Shroff said, Well, I'm here to answer some of those questions. You know how you don't know that there's a copy 21 command, why Mr. Leedom couldn't find it? Because he deleted 22 it. 23 very logs that would show a copy command. 24 said there was no device connected, you couldn't find any 25 device? That's what happens when you delete logs. He deleted the You know how she That's because everything he was doing was in the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2913 K32Wsch4 1 Rebuttal - Mr. Kamaraju virtual machine. 2 Remember those things? We've talked a lot about 3 virtual machines, but it's that weird computer within a 4 computer. 5 log that would have showed the storage device in that virtual 6 machine. 7 enough, as if that wasn't enough, he brought everything, as Mr. 8 Laroche said, back to the future, and he wiped away all the 9 indications of what he was doing before. 10 And guess what? He deleted those logs too, every He deleted those too. And then, if it wasn't good It was him, not Michael, not anyone else. 11 Now, Ms. Shroff spent a lot of time talking about this 12 thumb drive. 13 thumb drive than we did. 14 drive was the way he took it out. 15 nervous about what he was doing on April 20, 2016, that he 16 wiped that thumb drive clean the next day even though it wasn't 17 plugged in at the time of the reversion. 18 was about what he was doing. 19 Ms. Shroff spent more time talking about that We never told you that the thumb We told you that he was so That's how nervous he But you know what you also saw that the defendant 20 took? When she talked about, Well, how did it walk out on the 21 hard drive? 22 this big. 23 the testimony of Mr. Berger. 24 from his apartment. 25 clean. You saw hard drives in this case. Do you remember them? They were about We showed them to you during Those were hard drives recovered Those were hard drives that had been wiped Those were hard drives that had been securely deleted SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2914 K32Wsch4 Rebuttal - Mr. Kamaraju 1 after he researched how to nuke data, after he researched how 2 to securely wipe a hard drive. 3 terabyte big, each one of them. 4 in his apartment, where he googled how do I guarantee that one 5 terabyte of data transferred correctly? 6 out, and that's how he sent it out. 7 8 9 Those hard drives were one Those hard drives are sitting That's how he got it Ms. Shroff also spent a lot of time saying, Well, why did it take WikiLeaks so long? Why was that a year later? Well, let me put it this way. What WikiLeaks did, 10 when WikiLeaks sent it out, that's for a trial of WikiLeaks. 11 That's their choice, because what's relevant is when he sent it 12 out, and when he sent it out was May 1, 2016, just about ten 13 days after stealing it the first time. That's what's relevant. 14 And the fact that WikiLeaks took some time to put it 15 out doesn't undercut that in the slightest because you heard, 16 for example, from Mr. Leedom. 17 long that would take. You also heard that WikiLeaks had some 18 other stuff going on. There are reasons, but you are not 19 called upon to look into the mind of WikiLeaks. 20 what your job is. 21 You heard him talk about how That's not Because you know who was trying to look into the mind 22 of WikiLeaks? This man. This man was when he tried to Google 23 what's coming up next in 2017, when he tried to Google 24 WikiLeaks's code, because he didn't see it out there. 25 trying to figure out why isn't my stuff out there? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 He was I put it 2915 K32Wsch4 Rebuttal - Mr. Kamaraju 1 out there. 2 yet? 3 4 I gave it to you. And then they did. Why haven't you disclosed it And then he started googling again. 5 Now, Ms. Shroff said: 6 CIA employee. 7 on. Oh, it's normal. He's a former Of course, he'd be interested in what's going 8 Sure. I'm sure every CIA employee is interested in 9 what happened that day. 10 googling? 11 investigation into who the mole was. 12 about that? 13 That's why he's trying to figure out what happened and what the 14 FBI was doing. 15 The FBI. You know what they all weren't They weren't googling about the FBI's Because he's the mole. Why would he be concerned That's why he's looking. Now, they offered you any number of distractions to 16 try to take you off that message. 17 with Michael, and Judge Crotty's going to instruct you about 18 that memo. 19 them earlier. 20 They talked about this memo And he's going to say we should have given it to We apologize. That's on us. But he's also going to tell you that it's up to you to 21 decide how much weight to give that memo. It's up to you to 22 decide whether it means anything at all. 23 doesn't because they got it, and look what they did with it. 24 They put it up in front of you. 25 who helped write it, and at every turn, the memo said exactly And you know it They cross-examined the guy SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2916 K32Wsch4 Rebuttal - Mr. Kamaraju 1 what it said from the beginning, which is the reason why 2 Michael is on administrative leave. 3 forced him out is because of him. 4 wouldn't talk about what he did with him. 5 Look at the memo. The reason why the CIA It's because Michael The memo talks about his lack of 6 cooperation into the investigation with the primary person of 7 interest in the FBI investigation, his lack of cooperation into 8 the investigation, into who was charged with the Vault 7 9 disclosure. 10 11 12 Well, looking around the room, who was charged with that? He was, because that is what Michael was put on 13 administrative leave for, not telling on his friend, the same 14 friend who now sits here and tries to blame him for the largest 15 theft of classified information in the CIA's history, a theft 16 that he committed. 17 Now, Ms. Shroff tried to argue in some way that he 18 wasn't angry on March 3, 2016; the day of that backup wasn't a 19 significant thing. 20 She told you that's just in our minds. Well, go back and listen to some of those recordings 21 that Mr. Small made. 22 he says I was upset that they talked about not wanting to be a 23 guidance counselor, that that wasn't their job, not to be a 24 guidance counselor. 25 You'll hear, you'll hear his words when Look at the emails. Look at the email chains. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 You'll 2917 K32Wsch4 Rebuttal - Mr. Kamaraju 1 see an email from Dana, when Dana says, It's not my job to play 2 guidance counselor. 3 3, 2016. 4 Him. 5 You'll see the date of that email. He told you that he was angry about it. March Not us. And Mr. Nuclear Option over here also told you what he 6 does when he gets angry. 7 would look to punch. 8 in his emails that he would fight back. 9 prison notebooks, where he said that he would declare an 10 information war to destroy the United States's diplomatic 11 relationships. 12 13 14 He told you in that interview. He would do whatever he can. He He told you He told you in those Ms. Shroff kept saying there's no battle plan. What's the battle plan? That's the battle plan. He wrote it down, and he 15 methodically proceeded to carry it out. 16 you know that? 17 checklist is delete suspicious emails. 18 come up with a more incriminating piece of evidence than delete 19 suspicious emails. 20 wrote down. 21 He had checklists. You want to know how One of the entries in the It is impossible to And yet that's what he did. That's what he He also wrote down a set of tweets that captured 22 highly sensitive classified information about a CIA tool and 23 how it was going to be used. 24 And he prepared to disseminate that to the world, all to try to 25 help himself. And he prepared to send it out. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2918 K32Wsch4 1 Rebuttal - Mr. Kamaraju Now, in the intelligence community, there's a phrase 2 called "false flags." 3 basically you try to convince everyone that somebody else did 4 it. 5 from, what's that called? 6 throwing someone under the bus is Josh Schulte's tradecraft. 7 That's what he does. 8 and if you look at those tweets, he tried to do it with Jeremy 9 and Karen there. 10 All right? And false flags means And that's all fine for spies. Right? But where I come Throwing someone under the bus. And He's trying to do it with Michael here, And we'll come back to Jeremy and Karen in a second and the rest of their tinfoil-hat theories. 11 That's what he does, and he continued to do it in 12 prison, posing as his brother, posing as his family, all in an 13 effort to try to get out his tweets, his articles, his 14 description of what happened, his classified information. 15 Are those the acts of an innocent man? Are those the 16 acts of a man who just wants to be heard about the Constitution 17 and the criminal justice system? 18 trying to use his training to fool the world and, in the 19 process, to conduct that information war. 20 No. That's a CIA operative Now, Ms. Shroff told you that we were going to focus 21 heavily on the prison conduct. The prison conduct took two 22 days. 23 All you have to do is go look at Special Agent Schlessinger's 24 testimony, and you'll see how he turned words on a page into 25 action in the real world. It took two days because it's pretty straightforward. And I encourage you to do that. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2919 K32Wsch4 1 2 Rebuttal - Mr. Kamaraju What we spent the bulk of the time talking about was all of the evidence, that this man is responsible for Vault 7. 3 Now, Ms. Shroff made a big deal about how the FBI 4 targeted him. Remember that? She said, Oh, he was a 5 disgruntled employee, and they went after him because they -- 6 what the FBI did, what she calls targeting, is called following 7 clues. 8 with. 9 computer systems to give himself back access to projects. It's a clue when a guy leaves on the terms that he left It's a clue when the guy illegally manipulates CIA 10 a clue when he sends an email on his way out saying: 11 wait. 12 up on the internet one day. 13 You'll see. I was right. And guess what? It's Just you All this stuff's going to end It did. Those are clues, and so the 14 FBI followed them and they investigated more and they developed 15 more evidence. 16 But they didn't just follow clues about him. He took that stand. You saw 17 Special Agent Evanchec. You heard him 18 testify, and he testified that when they found out, for 19 example, about this Stash backup that David had taken, they 20 confronted him about it. 21 what? 22 the stuff that's on the internet. 23 date. 24 But nonetheless, it was something that the FBI ran down, 25 because that's how diligent they were. They asked him about it. And guess That backup, that Stash backup, it's not even the day of It's totally irrelevant. It's a totally different That is just a distraction. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2920 K32Wsch4 1 Rebuttal - Mr. Kamaraju They even did that with Michael, Michael, the big, bad 2 boogeyman. 3 the screenshot, what did they do? 4 you they had a confrontational interview with him. 5 confronted him. 6 everything that he appears to know about what this man was 7 doing, the CIA put him on administrative leave. 8 those consequences. 9 10 When they found out Michael hadn't told them about Special Agent Evanchec told They And now, yes, when Michael did not disclose He suffered The FBI did not target anyone. Now, Ms. Shroff uses an example of that, the testimony 11 by Mr. Berger, in which she said Mr. Berger tried to insinuate 12 that the data.bkp file had something classified in it and it 13 wasn't until we cross-examined Special Agent Evanchec that the 14 truth came out. 15 You can read the transcript. 16 question. 17 trying to hide anything from you. 18 That is flat-out wrong. There's a transcript. Go take a look at who asked that Mr. Laroche asked that question, because we're not Special Agent Evanchec, the lead case agent in this 19 group that's trying to target him, took that stand and said no, 20 there wasn't anything classified in that. 21 he deleted that had the classified information, not the one 22 that he left on his computer. 23 this cadre of FBI agents who tried to target this man, he took 24 the stand and he told you, you know what, he was actually 25 pretty cooperative. It's the ones that Special Agent Evanchec, part of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2921 K32Wsch4 1 Rebuttal - Mr. Kamaraju It was just the two of them there. He could have said 2 anything he wanted on that stand. 3 truth. 4 man, with somebody who is on a mission to put him away? 5 it's not. 6 But he didn't. He told the Is that consistent with somebody who is targeting this No, And that's true for every single witness that we 7 called. Every witness that we called, if you go back and you 8 look at their testimony, if there was something that was 9 helpful for the defendant, they didn't shy away from it. They 10 didn't back down. 11 up all this testimony about was he angry. 12 Look at what Mr. Leonis said when asked that question. 13 he didn't appear that angry to him. 14 believed it, because it was the truth, because he showed up 15 here to tell you the truth. 16 In fact, if you remember, Ms. Shroff brought Go back and look. He said He said it because he Now, part of the truth is that some of these witnesses 17 thought that DevLAN was not as secure as some other CIA 18 networks. 19 snippets that she cherry-picked, not the little sections that 20 she said, Let's just look at this one line. 21 Go look at their actual testimony. That's what their testimony actually is, not the It's the CIA. 22 Computer systems are locked down. But a computer system that 23 allows for hacking tools to be developed, that allows for cyber 24 programs, cyber tools to be worked on, it can't be the same as 25 the one that's running your regular old email. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 It's got to be 2922 K32Wsch4 Rebuttal - Mr. Kamaraju 1 dirty. It's got to be a little open, because otherwise they 2 could never test what they were doing. 3 system, the part of the system from where this data was stolen, 4 the Altabackups, so there's no serious dispute about that 5 during this trial -- 6 Bless you. 7 JUROR: 8 MR. KAMARAJU: 9 But the part of the Thank you. That part of the system, you'd better believe it was locked down. And you saw that evidence. You 10 saw that evidence in David's testimony, and you also heard that 11 even though there were some people who knew about it, that was 12 a small number. 13 knew they existed. 14 This man, the guy who created them. 15 He knew how to get to them. 16 20, 2016. There were just a handful of folks who even You know who one of those people were? He knew where they were. And that's what he did on April 17 So as she tries to distract you with all this wild 18 Wild West talk, think again about what we're talking about. 19 We're talking about a CIA computer system, locked in a 20 building, behind armed guards, kept in a vault that can only be 21 accessed by people with top secret security clearance who had 22 undergone background checks. 23 one. 24 danger. 25 That one. And yes, admittedly, they missed He was the security flaw. He was the security He's the reason why we're here today. Now, there have been a lot of forensics, and Ms. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2923 K32Wsch4 Rebuttal - Mr. Kamaraju 1 Shroff has argued that, even today, we don't know what 2 happened. 3 you know exactly what happened. 4 forensic evidence here, right? 5 files that took some expertise to dig through. 6 sense tells you what happened here. That's simply false. If you use your common sense, I get it. There's some dense There are some complicated log But common Common sense. 7 Now, Ms. Shroff has twice now used this phrase, and 8 thinking about it, I have to say it's a pretty good analogy. 9 She's called it the heist. And even with this, right? 10 Matt Damon's done a few heists movies. 11 heist. 12 I think This was a digital That's what happened. What do you do before? Before you pull off the job, 13 you case the joint. 14 reconnaissance, looking at where he could get into the system, 15 looking at what log files are generated. 16 care of the log system. 17 when he reverted it, to a point where he had the codes; he 18 could unlock the alarm system. 19 That's what he did on April 18, as he Then you have to take Well, that's what he did on April 20, That was the reversion. And just like all those movies, he knew he had to move 20 right then because he had gotten an email saying that vault 21 that you have access to, that vault that's got all that 22 precious material, it's not going to be there anymore. 23 not going to be able to get it, and so he acted. 24 into that vault, and just like if it were jewelry or paintings 25 or gold bars, he took it. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 You're And he crept 2924 K32Wsch4 1 2 Rebuttal - Mr. Kamaraju Now, these are files. And Ms. Shroff keeps saying, Well, the CIA had no idea that it was taken. 3 Well, it's not a painting on the lawn. You can't walk 4 by and notice, Oh, it's gone, because what he did was he copied 5 it. 6 And yes, we put it up a lot. 7 is devastating evidence of what he did. 8 that he copied those files on that day. And you know he copied it because you saw that exhibit. 9 You want to know why? Because it It is confirmation And then, after he copied it, what did he do? He 10 crept out of that vault, and he deleted all the surveillance 11 footage to make sure he didn't get caught, because that's what 12 deleting all those logs was. 13 he's the one who did it. 14 15 It was absolutely a heist, and But it didn't end there, right? the stuff. 16 Because now you have Now what are you going to do with it? Well, he wanted to get it out because he wanted to 17 punish. Right? 18 pocket. And so that's what he did. 19 the next several days he transmitted it to WikiLeaks, but not 20 before first making sure that he could burn everything to the 21 ground in the end when he needed to. 22 It doesn't do any good burning a hole in his He transmitted it. Over That's what he did. Go back and look at those Google searches. The only 23 time since 2006 that he looked up some of that stuff was right 24 after April 20, 2016, right after he stole the material. 25 Now, you know that to be true. You know that using SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2925 K323SCH5 Rebuttal - Mr. Kamaraju 1 your common sense. 2 truth be told, they know it too. 3 You know that reviewing the evidence. And And so instead of taking that on, what did they do? 4 They come up with a story about a mission. 5 tale, a tale that this man, a random developer sitting in a 6 cubicle somewhere, is now the target of a massive conspiracy 7 run by the CIA, the FBI and these prosecutors, all to make sure 8 that instead of the real perpetrator, he goes away. 9 They tell you a (Continued on next page) 10 11 MR. KAMARAJU: It's never explained why that would be 12 the case. 13 difficult, all of a sudden, the CIA and the FBI and the U.S. 14 attorney's office, that all of these organizations, would all 15 of a sudden decide, you know what? 16 frame him for the biggest theft of classified in history in 17 America. 18 It's never explained why, because he's a little That doesn't make sense. Just take a look at the coincidences that would have 19 to happen. 20 be. 21 He is a jerk, so let's Just think about how unlucky this man would have to Just think about the chain of events. So it all starts in the fall of 2015. And in the fall 22 of 2015, he first raises death threats about a guy named Amol. 23 And he does it again in March. 24 who doesn't even report to Karen and all those other managers, 25 the CIA security office decides, we are so intent on screwing But, the CIA security office, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2926 K323SCH5 Rebuttal - Mr. Kamaraju 1 Joshua Schulte, that we're going to let a potential murderer 2 run around this building. 3 threats are credible, and say, nah, forget about it. 4 what? We're out to get him. 5 away. Never mind that he moved groups and shouldn't be working 6 on the project anymore. 7 A vindictive act by Jeremy Weber. 8 9 They look at it. They determine his Then, they take his privileges No, no, no, this was a vindictive act. You saw Jeremy Weber testify. You saw all of the management employees testify behind him. There was no 10 vindictive act. 11 Jeremy Weber takes his privileges away illegally. 12 takes them back, because that's what he does. 13 in his own words. 14 You know But in his world, that's what happened. And then he He told you that He takes them back. So now, these CIA managers, they've got him over the 15 barrel. 16 could do anything they want at that moment. 17 to frame him right then and there, they could call the FBI. 18 They could lock him up. 19 Right? He's violated all of these policies. They If they are going And they call him in at a meeting on Monday morning, 20 and what do they do? They give him a strongly worded memo. 21 That's the frame job. 22 memo. 23 committed, they are so committed to persecuting him, that when 24 he raises a concern with the memo, they incorporate his 25 feedback. That's the persecution. And the memo says don't do it again. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 They give him a But they are so 2927 K323SCH5 1 Rebuttal - Mr. Kamaraju How is that consistent with a mission to screw Joshua 2 Schulte? 3 Ms. Shroff spend all kinds of time talking about strikeouts. 4 You know what the impact of the strikeout was? 5 language that he disagreed with, and they crossed it out and 6 said, fine, Mr. Schulte, you know what? 7 this. 8 9 10 11 And that happens not once, but twice. You heard They took We're going to change If they were out to get him, why wouldn't they leave the memo exactly like it was? damning as possible? Why wouldn't they make it as Because there's no conspiracy. But, marching on through his conspiracy theory, now, 12 he leaves the agency entirely. 13 that took these e-mails and these handwritten notes about this 14 dispute and kept them next to his pillow, no, no, he's not 15 angry, he's over it. 16 that, it's CIA that can't get over it. 17 just can't let this go. 18 And even though he's the one But even though he is the one who did And so the leaks happen. It is the agency that Instead of checking out 19 whether it was Turkey, or whether it was Dave, or whether it 20 was Michael, or whether it was any of the other people, a group 21 of middle managers at CIA decide that, because he's difficult, 22 because he -- to use Ms. Shroff's term and the term that came 23 out -- was a bald asshole, they're going to frame him. 24 that make any sense? 25 Does Not only, though, does this group of middle managers SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2928 K323SCH5 Rebuttal - Mr. Kamaraju 1 do it. 2 You remember Ms. Shroff showed it to you, the task force 3 report. 4 pursuing these other angles, let's just settle on this guy. 5 Let's just go with this guy. 6 out what actually happened. 7 We are going to convene a task force, but all we really care 8 about is getting this guy. 9 But they have to get the entire CIA on board. Right? They had to convince the entire CIA that instead of It doesn't matter to us to figure It doesn't matter. It doesn't make sense. We don't care. But it also doesn't end there. 10 Because not only does the CIA have to be on board, you heard 11 from the very beginning, the FBI took over the investigation. 12 The FBI, a group of folks who had never heard of Joshua Schulte 13 until this case started. 14 And so somehow, CIA having itself concluded that the 15 best path is to screw this man, gets the FBI on board, too, and 16 gets the FBI to say, forget it. 17 real investigation. 18 We're not going to conduct a We're going to screw this guy. And then all of those folks come here to testify at 19 this trial. 20 knife in the most, what do they do? 21 And at those moments, when they could put the Think about Michael. They tell the truth. Ms. Shroff said there wasn't a 22 single person at the agency who liked the defendant. 23 one. 24 testified. 25 perpetrator, if Michael was the one who was going to do all His name was Michael. There was And he came here, and he And what did he tell you? If Michael was the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2929 K323SCH5 Rebuttal - Mr. Kamaraju 1 this, then when he took the stand and testified about a 2 conversation that these two men had on April 20, 2016, just the 3 two of them. 4 to finish the job. 5 him to convince all of you, no, no, it's him. 6 he told me all about it. 7 moment that Michael could have ended this, he took the stand, 8 and he said, no, we didn't really talk about it. 9 really say anything about it. No one else around. Perfect opportunity for him For him to put a nail in the coffin. 11 this mission that they say we are on. Josh didn't And that is totally inconsistent with this mission, The fact of the matter, ladies and gentlemen, is that 13 Joshua Schulte is not being persecuted. 14 prosecuted. 15 deliberate choices he made. 16 classified CIA computer system. 17 classified tools information from that system. 18 obstruct and lie to the FBI. 19 information war from the MCC. He is being And he's being prosecuted as a result of The choice to break into a The choice to steal sensitive, The choice to The choice to conduct an He's being prosecuted for his choice to abandon his 21 oath to defend this country against enemies, foreign and 22 domestic, and to protect its secrets. 23 The At that moment, Michael told the truth. 20 For him to say, For him to say, he slipped up. 10 12 For And now, ladies and gentlemen, it's time for you to 24 fulfill your oath, and it's time now for you to make a choice. 25 And we submit that when you look at all of the evidence, and SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2930 K323SCH5 Rebuttal - Mr. Kamaraju 1 when you hear Judge Crotty's instructions on the law, there is 2 only one choice. 3 Schulte, is guilty as charged. 4 And that is that the defendant, Joshua THE COURT: Thank you. Thank you Mr. Kamaraju. We'll take a half 5 hour break now, and then I'll charge the jury and you can begin 6 your deliberations. 7 Thank you. So half an hour, we'll start at 10 to 2. 8 (Recess) 9 (Continued on next page) 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2931 K323SCH5 Charge 1 AFTERNOON SESSION 2 1:50 p.m. 3 (Jury present) 4 THE COURT: I told you at the beginning how important 5 your service is to our country and our system of justice. 6 want to repeat that. 7 attendance, your punctuality, and the complete attention you 8 have given during the trial. 9 I You have been most conscientious in your I am going to read these instructions to you now, but 10 I want you to know that I am going to send the instructions 11 into the jury room. 12 listen. 13 Do not single out any particular instruction as alone 14 stating the law. 15 as a whole. 16 So you do not have to take notes, just You should instead consider my instructions You are about to start your deliberations. You've 17 heard all the evidence as well as the lawyers' final arguments. 18 Now it is my duty to instruct you as to the law that will 19 govern during your deliberations. 20 of this case, and as you agreed, it is your duty to accept my 21 instructions of law and to apply them to the facts as you 22 determine them. 23 to what the law may be or -- 24 25 As I told you at the start Regardless of any opinion that you may have as A JUROR: Speak up a little bit, please. hear you. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 We can't 2932 K323SCH5 1 2 Charge THE COURT: Thank you. Regardless of any opinion -- is that better? 3 A JUROR: Yes. 4 THE COURT: Regardless of any opinion that you may 5 have as to what the law may be or ought to be, it is your sworn 6 duty to follow the law as I give it to you. 7 attorney or other person has stated a legal principle different 8 from any that I state to you in my instructions, it is my 9 instructions that you must follow. 10 11 Also, if any You will begin your deliberations after these instructions. Your duty is to decide the factual issues in the case 12 and arrive at a verdict. 13 judges of the facts. 14 you determine the credibility of witnesses; you resolve such 15 conflict as there may be in the testimony; and you draw 16 whatever reasonable inferences you decide to draw from the 17 facts as you determine them. 18 The jury is the sole and exclusive You decide the weight of the evidence; In determining the facts, you must rely upon your own 19 recollection of the evidence. None of what the lawyers have 20 said in their opening statements, closing arguments, questions 21 or objections is evidence. 22 they do not testify; they make arguments about what conclusions 23 you should draw from the evidence or lack of it. 24 said, that is argumentation, not evidence. 25 applies to me. They are not sworn as witnesses; But as I And the same Anything I have said is not evidence. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 I have 2933 K323SCH5 Charge 1 allowed you to take notes, but as I said earlier, your notes 2 are not evidence either. 3 The evidence before you consists of just two things: 4 The testimony given by witnesses from the witness stand right 5 here that we received in evidence, and the exhibits that were 6 received in evidence. 7 Testimony consists of the answers that were given by 8 the witnesses to the questions that were permitted. 9 questions themselves are not evidence. The It is the answers to 10 the questions that count. 11 beginning of this case, I'm sure you complied with my 12 instruction, anything you may have seen or heard about this 13 case outside the courtroom is not evidence and must be entirely 14 disregarded. 15 Also, as I instructed you at the It is the duty of the attorney for each party to 16 object when the other party offers testimony or other evidence 17 that the attorney believes is not properly admissible. 18 also have the right and the duty to ask the Court to make 19 rulings of law and to request conferences out of the hearing of 20 the jury. 21 You should not show any prejudice against any attorney or party 22 because the attorney objected to the admissibility of evidence 23 or asked for a conference out of your hearing or asked me for a 24 ruling on the law. 25 Counsel All such questions of law must be decided by me. The testimony and the documents that have been SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2934 K323SCH5 Charge 1 admitted into evidence are appropriate for your consideration. 2 You may consider all the evidence that has been admitted. 3 I also ask you to draw no inferences from my rulings 4 or the fact that upon occasion I asked a question or made 5 certain observations. 6 application of the law, and my questions were only intended for 7 clarification or to expedite matters. 8 understand that I have no opinion as to the verdict that you 9 should render in this case. 10 My rulings were no more than the You are expressly to You are to perform your duty of finding the facts 11 without bias or prejudice as to any party. You are to perform 12 your duty with an attitude of complete fairness and 13 impartiality. 14 Mr. Schulte is charged with serious crimes. 15 guilty. 16 of the criminal laws is a prime concern of the government. This case is important to the parties. He has pleaded not It is important for the government, too. Enforcement 17 The fact that the prosecution is brought in the name 18 of the United States of America entitles the government to no 19 greater consideration than that accorded to any other party. 20 By the same token, it is not entitled to less consideration. 21 All parties, whether the government or individuals, stand as 22 equals before the Court. 23 It would be improper for you to consider, in reaching 24 your decision as to whether the government sustained its burden 25 of proof, any personal feelings you may have about SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2935 K323SCH5 Charge 1 Mr. Schulte's race, religion, national origin, gender, sexual 2 orientation, or age. 3 to consider any personal feelings you may have about the race, 4 religion, national origin, gender, sexual orientation, or age 5 of any witness or anyone else involved in this case. 6 defendant is entitled to the presumption of innocence, and the 7 government has the burden of proof, as I will discuss in more 8 detail in a moment. 9 allow any feelings you might have about the nature of the Similarly, it would be improper for you The It would be equally improper for you to 10 crimes charged to interfere with your decision-making process. 11 Do not be swayed by sympathy. 12 that you must ask yourselves as you review the evidence is: 13 Has the government proved the guilt of Mr. Schulte beyond a 14 reasonable doubt? 15 Rather, the crucial question You cannot let bias, prejudice, fear, disgust, 16 sympathy, or any other irrelevant consideration interfere with 17 your thinking. 18 arrive at a true and just verdict. 19 anything except clear thinking and calm analysis of the 20 evidence. 21 That might interfere with your obligation to So do not be guided by You should also not consider any personal feelings you 22 may have about the attorneys who represented the parties in 23 this matter. 24 the lawyers and the other participants at counsel table have 25 been instructed not to have any communications with you as As I indicated at the beginning of this trial, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2936 K323SCH5 Charge 1 jurors. 2 into counsel and they ignored you, they did so because that's 3 what they're supposed to do. 4 influence your decision regarding Mr. Schulte's innocence or 5 guilt in any way. 6 If due to the congestion in the courthouse you ran That's the rule. This should not The potential punishment of the defendant is not a 7 jury concern and should not, in any sense, enter into or 8 influence your deliberations. 9 rests exclusively with the Court. The duty of imposing a sentence Your function is to weigh 10 the evidence or lack of evidence in the case, and to determine 11 whether or not the government has proved that Mr. Schulte is 12 guilty beyond a reasonable doubt. 13 I told you before -- and I am going to tell you 14 again -- Mr. Schulte is presumed innocent until proven guilty 15 beyond a reasonable doubt. 16 to the charges alleged in the indictment. 17 government has the burden to prove the defendant's guilt beyond 18 a reasonable doubt. 19 government to Mr. Schulte for the simple reason that the law 20 presumes the defendant innocent and never imposes upon any 21 defendant in a criminal case the burden or duty of calling any 22 witness or producing any evidence. Mr. Schulte has pleaded not guilty As a result, the This burden never shifts from the 23 In other words, Mr. Schulte starts with a clean slate. 24 He is presumed innocent until such time that you, the jury, are 25 unanimously satisfied that the government has proved SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2937 K323SCH5 Charge 1 Mr. Schulte guilty beyond a reasonable doubt. 2 government fails to sustain this burden with respect to 3 Mr. Schulte, you must find him not guilty. 4 If the The government must prove the defendant guilty beyond 5 a reasonable doubt. The question then is what is a reasonable 6 doubt? 7 based upon reason. 8 after carefully weighing all of the evidence. 9 reasonable doubt must, therefore, be proof of such a convincing The words almost define themselves. It is a doubt It is a doubt that a reasonable person has Proof beyond a 10 character that a reasonable person would not hesitate to rely 11 and act upon it in the most important of his or her own 12 affairs. 13 A reasonable doubt is not a guess or a whim. It is 14 not speculation or suspicion. It is not an excuse to avoid the 15 performance of an unpleasant duty. 16 The law does not require that the government prove guilt beyond 17 all possible doubt. 18 sufficient to convict. And it is not sympathy. Proof beyond a reasonable doubt is 19 If, after a fair and impartial consideration of all 20 the evidence, you have a reasonable doubt as to the guilt of 21 Mr. Schulte, it is your duty to find the defendant not guilty. 22 On the other hand, if, after a fair and impartial consideration 23 of all the evidence, you are satisfied that the government has 24 met its burden of proving Mr. Schulte guilty beyond a 25 reasonable doubt, it is your duty to find the defendant guilty. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2938 K323SCH5 1 Charge Now I want to say a few words about evidence. The 2 indictment is not evidence. 3 in an indictment. 4 him. 5 indictment is not evidence. 6 against Mr. Schulte and may not be considered by you as any 7 evidence of his guilt. 8 9 10 11 Mr. Schulte was formally charged He is entitled to know the charges against But as I instructed you when the trial started, the It merely describes the charges I'm not going to read the indictment to you because I will send you copies of the indictment for your review in the jury room. In deciding whether Mr. Schulte is guilty or not 12 guilty, you may consider both direct evidence and 13 circumstantial evidence. 14 proves a disputed fact directly. 15 testifies to what he or she saw, heard or observed, that is 16 called direct evidence. 17 Direct evidence is evidence that For example, where a witness Circumstantial evidence is evidence that tends to 18 prove a disputed fact by proof of other facts. To give a 19 simple example, suppose that when you came into the courthouse 20 today the sun was shining and it was a nice day. 21 courtroom blinds are drawn and you cannot look outside. 22 are sitting here, someone walks in with a dripping wet 23 umbrella, and soon thereafter someone else walks in with a 24 dripping wet raincoat. 25 look outside of the courtroom and see whether it is raining, so But now the As you Now, on our assumed facts you cannot SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2939 K323SCH5 Charge 1 you have no direct evidence of that fact. 2 combination of the facts about the umbrella and the raincoat, 3 it would be reasonable for you to conclude that it had started 4 to rain. 5 Using your reason and experience, you infer from established 6 facts the existence or the non-existence of some other fact. 7 But on the That is all there is to circumstantial evidence. An inference is the deduction or conclusion that 8 reason and common sense prompt a reasonable mind to draw from 9 facts that have been proven by the evidence. Not all logically 10 possible conclusions are legitimate or fair inferences. 11 inference is not a suspicion or a guess. 12 logical decision to conclude that a disputed fact exists on the 13 basis of another fact which you know exists. 14 inferences, you should exercise your common sense. 15 inferences to which the mind is reasonably led or directed are 16 fair inferences from direct or circumstantial evidence in this 17 case. 18 course, a matter exclusively for you to decide, as are all 19 determinations of fact. 20 An It is a reasoned In drawing Only those Whether or not to draw a particular inference is, of Many material facts, such as state of mind, are rarely 21 susceptible of proof by direct evidence. There is no way for 22 us to look into people's minds, so those facts are established 23 by circumstantial evidence and the inferences the jury draws 24 from them. 25 circumstantial evidence. The law makes no distinction between direct and Circumstantial evidence is of no less SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2940 K323SCH5 Charge 1 value than direct evidence, and you can consider either or both 2 and give them such weight as you conclude is warranted. 3 Now a word about witness credibility. It must be 4 clear to you now that counsel for the parties are asking you to 5 draw very different conclusions about significant factual 6 issues in this case. 7 involve making judgments about the testimony of the witnesses 8 you have listened to and observed. 9 you should carefully scrutinize all of the testimony of each An important part of your decision will In making these judgments, 10 witness, the circumstances under which each witness testified, 11 and any other matter in evidence that may help you decide the 12 truth and the importance of each witness's testimony. 13 example, was the testimony of a witness corroborated by the 14 testimony of another witness or of another exhibit or a 15 recording which was received in evidence? 16 For Your decision whether or not to believe a witness may 17 depend on how the witness impressed you. Was the witness 18 candid, frank and forthright, or did the witness seem to be 19 evasive or suspect in some way? 20 testified on direct examination compare with how the witness 21 testified on cross-examination? 22 contradictory? 23 was talking about? 24 was trying to report his knowledge accurately? 25 witness's demeanor like? How did the way the witness Was the witness consistent or Did the witness appear to know what he or she Did the witness strike you as someone who What was the These are examples of the kinds of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2941 K323SCH5 Charge 1 common sense questions you should ask yourselves in deciding 2 whether a witness is or is not truthful. 3 In addition, you may consider whether a witness had 4 any possible bias or relationship with a party or any possible 5 interest in the outcome of the case. 6 relationship, or interest does not necessarily make the witness 7 unworthy of belief. 8 consider. 9 Such a bias, These are simply factors that you may In making a determination of witness credibility, you 10 may consider whether the witness purposefully made a false 11 statement or whether it was an innocent mistake. 12 consider whether an inconsistency concerns an important fact or 13 merely a small detail, as well as whether the witness had an 14 explanation for the inconsistency, and if so, whether that 15 explanation appealed to your common sense. 16 witness has testified falsely as to any material fact, you may 17 reject the witness's testimony in its entirety or you may 18 accept those parts that you believe to be truthful or that are 19 corroborated by other independent evidence in the case. 20 Further, you may consider whether a witness has been previously 21 untruthful, including lying under oath in another proceeding, 22 in determining how much of his or her testimony, if any, you 23 wish to believe. 24 25 You may also If you find that a You should also consider whether the witness had an opportunity to observe the facts that the witness testified SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2942 K323SCH5 Charge 1 about, and whether the witness's recollection of the facts 2 stands up in light of the other evidence in this case. 3 In other words, what you must try to do in deciding 4 credibility is to size up a person just as you would in any 5 important matter where you are trying to decide if a person is 6 being truthful, straightforward, and accurate in his 7 recollection. 8 Now a word about the preparation of witnesses. 9 have heard testimony during the trial that witnesses -- 10 A JUROR: 11 THE COURT: 12 Now a word about preparation of witnesses. 13 14 You A little bit louder again, please. Okay. Thank you. That better? You have heard testimony during the trial that the 15 witnesses have discussed the facts of the case and their 16 testimony with lawyers before the witnesses appeared in court. 17 You may consider that fact when you are evaluating a witness's 18 credibility. 19 about a witness meeting with lawyers before testifying so that 20 the witness can be aware of all of the subjects that will be 21 covered, focus on those subjects, and have the opportunity to 22 review the relevant exhibits and documents before being 23 questioned about them. 24 time and the Court's time as well. 25 fact or the nature of the witness's preparation for his or her But there is nothing either unusual or improper Such consultations help conserve your The weight you give to the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2943 K323SCH5 Charge 1 testimony and what inferences you draw from such preparation 2 are matters completely within your discretion. 3 It is for you, the jury, and for you alone, not the 4 lawyers or the witnesses or me as the judge to decide the 5 credibility of witnesses who appear here and the weight that 6 their testimony deserves. 7 assessment concerning the credibility of a witness, you can 8 then attach such importance or weight to his or her testimony, 9 if any, that you feel it deserves. After making your own judgment or You will then be in a 10 position to decide whether the government has proved the 11 charges beyond a reasonable doubt. 12 Now this is an instruction on adverse inferences. 13 You've heard testimony from a government witness named Michael 14 who the CIA place on enforced administrative leave in 15 August 2019. 16 the defendant in the course of the trial. 17 the government should have disclosed the information regarding 18 Michael's enforced administrative leave to the defendant sooner 19 in time. 20 The government only disclosed this information to I instruct you that In evaluating the evidence, you can decide what 21 weight, if any, to give to the government's conduct on this 22 issue. 23 court and his testimony for the government was influenced by 24 his taking an enforced leave. 25 You may also consider whether Michael's appearance in Law enforcement officials. You have heard the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2944 K323SCH5 Charge 1 testimony from a number of law enforcement officials. 2 government's law enforcement witnesses do not deserve any more 3 or less consideration or greater or lesser weight than that of 4 any other witness. 5 defense counsel to try to attack the credibility of such a 6 witness on the ground that his or her testimony may be colored 7 by a personal or professional interest in the outcome of the 8 case. 9 The In this context, it is appropriate for the It is up to you to accept or reject the testimony of 10 each law enforcement witness, and to give such witness the 11 weight, if any, it deserves. 12 We've also heard from a number of witnesses who are 13 currently or were previously employed by the Central 14 Intelligence Agency, the CIA. 15 directly as officers of the CIA, and some of them work as 16 contractors performing work for the CIA. Some of these people work 17 I've allowed some of these witnesses to testify either 18 by using a made-up name, a pseudonym, or just their first name. 19 The disclosure of the witness's true names and what they look 20 like could potentially compromise their work at the CIA. 21 That's why those precautions were taken, but you should weigh 22 the testimony of those witnesses just as you would any other 23 witness, and not weigh it differently because they testified 24 using a pseudonym or used their first name only. 25 should not consider the fact that I allowed these witnesses to SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Moreover, you 2945 K323SCH5 Charge 1 testify in this way as an expression of my opinion as to any of 2 the facts of this case. 3 alone to decide the fats of the case. 4 Bias and hostility. Again, it is your job and your job In connection with your 5 evaluation of the credibility of the witnesses, you should 6 specifically consider evidence of resentment or anger which 7 some government witnesses may have toward the defendant. 8 Evidence that a witness is biased, prejudiced, or hostile 9 toward the defendant requires you to view that witness's 10 testimony with caution, to weigh it with care, and subject it 11 to close and searching scrutiny. 12 In this case, you have heard testimony from 13 individuals who testified as experts in particular fields. 14 expert is someone who by education or experience has acquired 15 learning or experience in a science or a specialized area of 16 knowledge. 17 experts were: 18 system of classifying national security materials, Mr. Mark 19 Bradley; and the forensic analysis of computers and other 20 electronic devices, Mr. Patrick Leedom and Mr. Michael Berger. 21 An Here the specialized areas and corresponding WikiLeaks, that's Mr. Paul Rosenzweig; the Your role in judging credibility applies to experts as 22 well as to other witnesses. You should consider the expert 23 opinions that were received in evidence in this case and give 24 them as much or as little weight as you think it deserves. 25 you should decide that the opinion of an expert was not based SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 If 2946 K323SCH5 Charge 1 on sufficient education or experience or on sufficient data, or 2 if you should conclude that the trustworthiness or credibility 3 of an expert is questionable for any reason, or if the opinion 4 of the expert was outweighed in your judgment by other evidence 5 in the case, then you might disregard the opinion of the expert 6 entirely or in part. 7 If, however, you find that the opinion of the expert 8 is based on sufficient data, education and experience, and the 9 other evidence does not give you reason to doubt the expert's 10 conclusions, then you could be justified in relying on that 11 expert's testimony. 12 A word or two about the cooperating witness. 13 heard testimony from a witness, Carlos Betances, who testified 14 that he pled guilty to criminal conduct and is now cooperating 15 with the government. 16 a cooperating witness. 17 testimony in criminal prosecution. 18 to draw no conclusions or inferences of any kind about the 19 guilt of the defendant on trial from the fact that this 20 prosecution witness pled guilty to other charges. 21 You The law permits the use of testimony from The government frequently must use such I instruct you that you are Because of the possible interest a cooperating witness 22 may have in testifying, let me say a few things that you may 23 want to consider during your deliberations on the subject of 24 the cooperating witness. 25 scrutinized with special care and caution. Cooperating witness testimony must be SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 The cooperating 2947 K323SCH5 Charge 1 witness is facing sentencing for his own crimes, and is hoping 2 for a reduced sentence. 3 government decides whether or not to file a motion for a 4 reduced sentence, that is the 5K letter that was mentioned 5 here. 6 determination, decides what sentence to ultimately impose. 7 does not follow, however, that simply because a person has 8 admitted participation in one or more crimes he is not capable 9 of giving a truthful version of what happened. For a cooperating witness, the And the sentencing court, according to its own It But the 10 cooperating witness might be motivated by reward or personal 11 gain. 12 truth? Would the cooperator gain more by lying or telling the 13 I must caution you that it is of no concern of yours 14 why the government made an agreement with the witness. 15 sole concern is to decide whether the witness has given 16 truthful testimony in this case before you. 17 A word about persons who are not on trial. Your Some of 18 the people who may have been involved in the events leading up 19 to this trial are not on trial themselves. 20 matter. 21 unfavorable, toward the government or the defendant from the 22 fact that certain persons other than the defendant are not on 23 trial here. 24 have no bearing on your function as jurors. 25 This does not You may not draw any inference, favorable or Those matters are wholly outside your concern and Particular investigative techniques are not required. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2948 K323SCH5 Charge 1 You may have heard references to the fact that certain 2 investigative techniques were used and that others were not 3 used by the government. 4 deciding whether the government has met its burden of proof, 5 because, as I told you, you should look to all of the evidence 6 or lack of evidence in deciding whether the defendant is 7 guilty. 8 government prove its case by any particular means, and you are 9 not to speculate as to why the government used the techniques You may consider these facts in However, there is no legal requirement that the 10 it did or why it did not use other techniques. 11 is not on trial. 12 concern. 13 The government Law enforcement techniques are not your Your concern is to determine whether or not, based on 14 the evidence or lack of evidence here in this case, the guilt 15 of Mr. Schulte has been proven beyond a reasonable doubt. 16 You heard some evidence from searches. You heard 17 testimony in this case about the evidence seized in connection 18 with searches conducted by law enforcement officers, the FBI. 19 Evidence obtained from these searches was properly admitted in 20 this case and may be properly considered by you. 21 approve or disapprove of how the evidence was obtained should 22 not enter into your deliberations, because I instruct you now 23 that the government's use of the evidence is entirely lawful. 24 You must, therefore, give this evidence full 25 consideration along with all the other evidence in the case, in SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Whether you 2949 K323SCH5 Charge 1 determining whether the government has proved the guilt of 2 Mr. Schulte beyond a reasonable doubt. 3 Redaction of evidentiary items. We have, among the 4 exhibits received in evidence, some documents that are 5 redacted. 6 out. 7 item that has been admitted into evidence. 8 consider any possible reason why the other parts have been 9 deleted. 10 "Redacted" means that part of the document was taken You are to concern yourself only with the part of the Charts and summaries. You should not During the trial there were 11 charts and summaries shown to you. 12 were shown to you in order to make the other evidence more 13 meaningful and to aid you in considering the evidence. 14 are no better than the testimony or the documents upon which 15 they are based, and are not themselves independent evidence. 16 Therefore, you are to give no greater consideration to these 17 schedules or summaries than you would give to the evidence upon 18 which they are based. 19 These charts and summaries They It is for you to decide whether the charts, schedules 20 or summaries correctly present the information contained in the 21 testimony and in the exhibits on which they were based. 22 are entitled to consider the charts, schedules and summaries if 23 you find that they are of assistance to you in analyzing and 24 understanding the evidence. 25 Stipulations. You You have heard evidence in the form of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2950 K323SCH5 Charge 1 stipulations of testimony and stipulations of evidence read to 2 you from GX 3002, GX 3003, GX 3004, GX 3005, and Defense 3 Exhibit O. 4 the parties that, if called as a witness, the person would give 5 certain testimony. 6 witness would have given that testimony. 7 however, to determine the effect to be given to that testimony. 8 You've also heard evidence the form of stipulations of 9 fact. A stipulation of testimony is an agreement among You must accept as true the fact that the It is for you, The stipulation of fact is an agreement among the 10 parties that a certain fact is true. 11 agreed facts as true. 12 be given to any stipulated fact. You should regard such It is for you to determine the effect to 13 All the available evidence need not be introduced. 14 The law does not require any party to call as a witness all 15 persons who may have been present at any time or place involved 16 in the case, or who may appear to have some knowledge of the 17 matter in issue at this trial. 18 party to the produce as exhibits all relevant papers and things 19 available to either party during the trial. 20 we learned there were over 18 or 19 witnesses who testified, 21 and thousands of documents. 22 based on what has been submitted in evidence. 23 Nor does the law require any During summations You have to base your decision With regard to motive. Proof of motive is not a 24 necessary element of the crimes for which the defendant is 25 charged. Proof of motive does not establish guilt nor does a SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2951 K323SCH5 Charge 1 lack of proof of motive establish that a defendant is not 2 guilty. 3 reasonable doubt, it is immaterial what the motive for the 4 crime may be or whether any motive is shown. 5 or absence of motive is a circumstance that you may consider as 6 bearing on the intent or actions of the defendant. 7 If the guilt of a defendant is shown beyond a The theory of the defense. But the presence The defense contends that 8 Mr. Schulte did not improperly gather, steal, disclose or 9 attempt to disclose national defense information. Nor did he 10 knowingly or intentionally exceed his authorized access to any 11 CIA computer system or files. 12 that Mr. Schulte did not obstruct justice or willfully make any 13 material false statements to the FBI. 14 maintains that he did not willfully violate any court order. 15 16 17 The defense further contends Finally, Mr. Schulte If the government fails to prove the defendant's guilt beyond a reasonable doubt, you must acquit Mr. Schulte. Mr. Schulte did not testify in this case. Under our 18 Constitution, the defendant has no obligation to testify or to 19 present any evidence, because it is the government's burden to 20 prove the defendant guilty beyond a reasonable doubt. 21 right of a defendant not to testify is an important part of our 22 Constitution. 23 The As I stated earlier, the government's burden to prove 24 the defendant guilty remains with the prosecution throughout 25 the entire trial and never shifts to Mr. Schulte. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 He is never 2952 K323SCH5 1 Charge required to prove that he is innocent. 2 You may not speculate as to why Mr. Schulte did not 3 testify. 4 to testify. 5 that Mr. Schulte did not testify. 6 him may be drawn by you because he did not take the witness 7 stand. 8 way in your deliberations in the jury room. You are not to attach any significance to the fact No adverse inference against You may not consider this against Mr. Schulte in any 9 10 There are many reasons why a defendant may decide not That takes care of the evidentiary portion of the jury charge. 11 Now I'm going to turn to the substantive law. The defendant, Joshua Schulte, has been charged in a 12 10-count indictment. 13 evidence, as I've already told you. It merely describes the 14 charges made against the defendant. It is a set of 15 accusations. 16 the guilt of Mr. Schulte. 17 evidence decides that issue. 18 The indictment in this case is not It may not be considered by you as evidence of Only the evidence or lack of The indictment charges that in or about 2016, the 19 defendant allegedly took national defense information from the 20 CIA computer systems without authorization and transmitted that 21 information to WikiLeaks, which posted the information online 22 in 2017. 23 and Seven. 24 six of the counts in the indictment. 25 charges Mr. Schulte with one count, Count Three, of unlawful Specifically this is Counts One, Two, Four, Five, Six Those charges, the WikiLeaks charges, account for The indictment further SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2953 K323SCH5 Charge 1 disclosure and attempted disclosure of national defense 2 information while he was in the Metropolitan Correctional 3 Center, or MCC, a federal detention center. 4 indictment charges Mr. Schulte with two counts, Counts Eight 5 and Nine, relating to false statements he allegedly made to the 6 FBI during its investigation. 7 to his alleged violation of a protective order entered by this 8 Court in 2017. 9 the indictment beyond a reasonable doubt. 10 Finally, the And one count, Count 10, related The government must prove all these charges in You will note that the indictment alleges that certain 11 acts occurred on or about various dates. 12 it does not matter if the indictment charges that a specific 13 act occurred on or about a certain date or month and the 14 evidence indicates that in fact it was on another date. 15 law requires only a substantial similarity between the dates 16 alleged in the indictment and the dates established by the 17 evidence. 18 I instruct you that The Count One charges illegal gathering of national 19 defense information. 20 about 2016, with the illegal gathering of national defense 21 information in violation of Title 18, United States Code, 22 Section 793(b). 23 One, the government must prove each of the following three 24 elements beyond a reasonable doubt: 25 Count One charges the defendant, in or In order to convict the defendant of Count First, that in or about 2016, the defendant copied, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2954 K323SCH5 Charge 1 took, made, or obtained a document, writing, or note, to wit, 2 the defendant took information maintained by an intelligence 3 agency of the United States. 4 5 6 Second, that the information was connected to the national defense. Third, that the defendant acted with the purpose of 7 obtaining information respecting the national defense and with 8 the intent or with the reason to believe that the information 9 was to be used to the injury of the United States or used to 10 11 the advantage of a foreign country. The first element of Count One is taking information. 12 The first element of the offense that the government must prove 13 beyond a reasonable doubt is that the defendant copied, took, 14 made or obtained document, writing or note, to wit, the 15 defendant took information maintained by an intelligence agency 16 of the United States as charged in the indictment. 17 The second element is the national defense 18 information. 19 government must prove beyond a reasonable doubt is that the 20 information that the defendant is charged with taking is 21 connected with the national defense of the United States. 22 The second element of the offense that the You must determine whether the information is directly 23 and reasonably connected with the national defense. 24 "national defense" is a broad term that refers to the United 25 States military and naval establishments, intelligence, and to SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 The term 2955 K323SCH5 1 Charge all related activities of national preparedness. 2 To qualify as national defense information, the 3 government must prove that the material is closely held by the 4 United States government. 5 public by the United States government and is found in sources 6 lawfully available to the general public, it is not closely 7 held. 8 available to the public at the time of the claimed violation 9 and the United States has made no effort to guard such Where the information has been made Similarly, where sources of information are lawfully 10 information, the information itself is not closely held. 11 information relating to our national defense that is not 12 lawfully available to the public at the time of the claimed 13 violation falls within the prohibition of this section. 14 Only In determining whether material is closely held, you 15 may consider whether it has been classified by appropriate 16 authorities and whether it remained classified on the dates 17 pertinent to the indictment. 18 information has been classified in determining whether it has 19 been closely held, I caution you that the mere fact that 20 information is classified does not mean that information 21 qualifies as national defense information. 22 information is connected with the national defense is a 23 question of fact that you, the jury, must determine following 24 the instructions that I have given you about what those terms 25 mean. Although you may consider whether SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 Whether the 2956 K323SCH5 1 Charge The third element in Count One is knowledge and 2 intent. The third element of the offense that the government 3 must establish beyond a reasonable doubt is that the defendant 4 acted for purpose of obtaining information respecting the 5 national defense. 6 reasonable doubt that the government acted with intent or with 7 reason to believe that the information was to be used to the 8 injury of the United States, or used to the advantage of a 9 foreign country. The government must also prove beyond a The government is required to prove that the 10 defendant acted with criminal intent, that is, he acted in bad 11 faith, and with a deliberate purpose either to disregard or 12 disobey the law. 13 had the intent or reason to believe that the information would 14 be used to the injury of the United States or to provide an 15 advantage to a foreign country, you may consider the nature of 16 the documents or the information involved. 17 convict the defendant of Count One, you must find that the 18 defendant had the intent or reason to believe that the 19 information would be used against the United States, not just 20 that it could be used. 21 22 23 24 25 In considering whether or not the defendant MS. SHROFF: I emphasize that to The government -- Your Honor, I'm sorry to interrupt, but I think the jury is having trouble hearing you again. THE COURT: Better, much better? Who's having trouble? How is this? Okay. The government does not have to prove that the intent SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2957 K323SCH5 Charge 1 was both to injure the United States and to provide an 2 advantage to a foreign country. 3 alternative. 4 information would be used need not necessarily be an enemy of 5 the United States. 6 friend and enemy. 7 The statute reads in the Further, the country to whose advantage the The statute does not distinguish between If you find beyond a reasonable doubt, therefore, that 8 the defendant acted with the intent or with the reason to 9 believe that the information would be used to injure the United 10 States or to provide an advantage to a foreign country, the 11 third element is satisfied. 12 Count Two. 13 14 Elements. The illegal transmission of unlawfully possessed national defense information. Count Two charges the defendant, in or about 2016, 15 with unauthorized possession of information relating to 16 national defense and transmitting it to persons not entitled to 17 receive it in violation of 18 U.S. Code Section 793(e). 18 order to establish a violation of Section 793(e), the 19 government must prove each of the following four elements 20 beyond a reasonable doubt: 21 In First, that in or about 2016, the defendant had 22 unauthorized possession of, access to, or control over the 23 document or information in question; 24 25 Second, that the defendant or information in question was related to the national defense; SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2958 K323SCH5 1 Charge Third, that the defendant had reason to believe that 2 the document or information could be used to the injury of the 3 United States or to the advantage of a foreign nation; and 4 Fourth, that in or about 2016, the defendant willfully 5 communicated or delivered or transmitted or caused to be 6 communicated, delivered or transmitted the document or 7 information to a person who was not entitled to receive it. 8 9 Count Two, the first element dealing with possession. The first element of Count Two that the government must prove 10 beyond a reasonable doubt is that the defendant had 11 unauthorized possession of or control over or access to the 12 document or information in question. 13 The word "possession" is a commonly used and commonly 14 understood word. 15 holding property or the detention of property in one's power or 16 command. 17 constructive possession. 18 of something if he knows where it is and can get it any time he 19 wants or otherwise can exercise control over it. 20 unauthorized possession of something if he is not entitled to 21 have it. 22 Basically it means the act of having or Possession may mean actual physical possession or A person has constructive possession A person has Count two, second element, the national defense 23 information. The second element of Count Two that the 24 government must prove beyond a reasonable doubt is that the 25 document or information in question was connected with the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2959 K323SCH5 1 Charge national defense of the United States. 2 I previously instructed you regarding the meaning of 3 national defense in Count One. 4 as well. 5 Those instructions apply here Count two, the third element, prejudice to the United 6 States. 7 must prove beyond a reasonable doubt is that the defendant had 8 reason to believe that the information could be used to the 9 injury of the United States or to the advantage of a foreign 10 11 The third element of Count Two that the government nation. As instructed with Count One, with respect to reason 12 to believe, you may consider the nature of the documents or 13 information involved. 14 need not determine that the defendant had reason to believe 15 that the information would be used against the United States, 16 only that it could be used. 17 For this count, unlike Count One, you The fourth element deals with willfully delivered 18 information. 19 government must establish beyond a reasonable doubt is that the 20 defendant willfully communicated or transmitted the document in 21 question to a person not entitled to receive it. 22 The fourth element of Count Two that the In deciding whether a person was entitled to receive 23 information, you may consider all the evidence introduced at 24 the trial, including any evidence concerning the classification 25 status of the document or testimony concerning limitations on SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2960 K323SCH5 1 2 Charge access to the document. An act is done willfully if it is done voluntarily and 3 intentionally and with the specific intent to do something the 4 law forbids, that is to say, with a bad purpose either to 5 disobey or disregard the law. 6 The government not need prove that the defendant 7 actually delivered the information himself -- it is enough to 8 prove that he caused the act to be done. 9 I remind you now, and will remind you again, that it 10 is the government's burden to establish each element of each of 11 these counts beyond a reasonable doubt. 12 prove each element of each count beyond a reasonable doubt. 13 you find the government has not proved each of the elements of 14 a count beyond a reasonable doubt, you must acquit the 15 defendant on that count. 16 does not establish proof of guilt on any other count. 17 consider each count and each element of each count 18 individually. 19 The government must If Also, proof of guilt on one count You must Count Three deals with illegal transmission and 20 attempted transmission of unlawfully possessed national defense 21 information. 22 about December 2017, up to and including at least in or about 23 October 2018, the defendant having unauthorized possession of, 24 access to, or control over information relating to national 25 defense, willfully transmitted or communicated and attempted to Count Three charges that from at least in or SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2961 K323SCH5 Charge 1 transmit or communicate information to persons not entitled to 2 receive it in violation of 18, United States Code, Section 3 793(e). 4 In order to establish a violation of Section 793(e), 5 the government must prove each of the following four elements 6 beyond a reasonable doubt: 7 First, that the defendant had unauthorized possession 8 of or access to or control over the document, writing, note or 9 information in question; 10 11 12 Second, that the document, writing, note or information was related to the national defense; Third, that the defendant had reason to believe that 13 the document, writing, note or information could be used to the 14 injury of the United States or to the advantage of a foreign 15 nation; and 16 Fourth, that the defendant willfully communicated, 17 delivered, transmitted, or caused to be communicated, 18 delivered, transmitted, or attempted to communicate, deliver, 19 transmit, or cause to be communicated, delivered, or 20 transmitted the same to a person not entitled to receive it. 21 Count Three. The first element deals with possession. 22 The first element of Count Three that the government must prove 23 beyond a reasonable doubt is that the defendant had 24 unauthorized possession of, access to, or control over the 25 document, writing, note or information in question. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2962 K323SCH5 1 Charge I have already instructed you on the meaning of the 2 word "possession" in connection with Count Two. 3 instruction applies here. 4 5 That As instructed on Count Two, a person has unauthorized possession of something if he is not entitled to have it. 6 The second element in Count Three is the national 7 defense information. 8 the government must prove beyond a reasonable doubt is that the 9 document, writing, note or information in question was 10 The second element of Count Three that connected with the national defense of the United States. 11 You are reminded that you must determine whether the 12 information is directly and reasonably connected with the 13 national defense as I instructed you in Count One. 14 The third element deals with prejudice to the United 15 States. 16 must establish beyond a reasonable doubt is that the defendant 17 had reason to believe that the document, writing, note or 18 information could be used to the injury of the United States or 19 to the advantage of a foreign nation. 20 The third element of Count Three that the government Count Three, the fourth element deals with willfully 21 delivered information. The fourth element of Count Three that 22 the government must establish beyond a reasonable doubt is that 23 the defendant willfully communicated or transmitted the 24 document, writing, note or information in question to a person 25 not entitled to receive it. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2963 K323SCH5 1 Charge In deciding whether a person was entitled to receive 2 the document or information, you may consider all the evidence 3 introduced at trial, including any evidence concerning the 4 classification status of the document or testimony concerning 5 limitations on the access to the document. 6 An act is done willfully if it is done voluntarily and 7 intentionally and with the specific intent to do something the 8 law forbids, that is to say, with a bad purpose either to 9 disobey or disregard the law. 10 For this count, the government not need prove that the 11 defendant actually delivered or transmitted the information. 12 It is enough to prove that the defendant merely attempted to do 13 so. 14 did the act himself. 15 act to be done. 16 Further, the government need not prove that the defendant It is enough to prove that he caused the Count Three also has an attempt charge. Now, with 17 regard to Count Three, illegal transmission of national defense 18 information, in or about 2017, up to and including at least in 19 or about October 2018, if you find that the government has 20 proved the elements of this crime as I have described it, you 21 should find the defendant guilty on this count. 22 respect to Count Three only, even if you find that the 23 government has not proved beyond a reasonable doubt that the 24 defendant illegally transmitted national defense information, 25 you may find the defendant guilty of Count Three if you find SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 However, with 2964 K323SCH5 Charge 1 that the government has proven beyond a reasonable doubt that 2 the defendant attempted to illegally transmit national defense 3 information. 4 To prove the charge of attempted illegal transmission 5 of national defense information, the government must prove each 6 of the following two elements beyond a reasonable doubt: 7 8 First, the defendant intended to commit the crime of illegally transmitting national defense information; and 9 Second, the defendant did some act that was a 10 substantial step in an effort to bring about or accomplish the 11 crime. 12 Mere intention to commit a specific crime does not 13 amount to an attempted crime. 14 defendant of an attempt to illegally transmit national defense 15 information, you must find beyond a reasonable doubt that he 16 intended to commit the crime charged, and that he took some 17 action which was a substantial step toward the commission of 18 that crime. 19 In order to convict the In determining whether the defendant's actions 20 amounted to a substantial step toward the commission of the 21 crime, it is necessary to distinguish between mere preparation 22 on the one hand, and the actual doing of the criminal deed on 23 the other. 24 offense or of devising, obtaining or arranging a means for its 25 commission is not an attempt, although some preparation may Mere preparation, which may consist of planning the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2965 K323SCH5 Charge 1 amount to an attempt. 2 commit a crime will constitute an attempt when the acts 3 themselves clearly indicate an intent to commit the crime, and 4 the acts are a substantial step in the course of the conduct 5 planned to culminate in the commission of the crime. 6 The acts of a person who intends to Count Four, unauthorized access to computer to obtain 7 classified information. Count Four charges that in or about 8 2016, the defendant knowingly accessed a computer and exceeded 9 his authorized access in order to obtain protected or 10 restricted information in violation of Title 18, United States 11 Code, Section 1030(a)(1). 12 Count Four, the government must establish each of the following 13 four elements beyond a reasonable doubt: 14 In order to convict the defendant of First, the defendant accessed a computer with 15 authorization, but exceeded his authority in accessing the 16 information in question; 17 18 19 Second, that the defendant knowingly accessed the computer; Third, that the defendant obtained information 20 protected against unauthorized disclosure for reasons of 21 national defense or foreign relations, and that the defendant 22 had reason to believe that the information could be used 23 against the interests of the United States or to the advantage 24 of a foreign nation; and 25 Fourth, that the defendant willfully communicated, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2966 K323SCH5 Charge 1 delivered, transmitted, or caused to be communicated, 2 delivered, or transmitted, or attempted to communicate, 3 deliver, or transmit the information to a person who was not 4 entitled to receive it. 5 Now the first element in Count Four is unauthorized 6 access. The first element that the government must prove 7 beyond a reasonable doubt is that the defendant accessed a 8 computer with authorization, but exceeded his authority in 9 accessing the information in question. 10 As defined in the statute, a computer means an 11 electronic, magnetic, optical, electromechanical, or other high 12 speed data processing device performing logical, arithmetic, or 13 storage functions, and includes any data storage facility or 14 communications facility directly related to or operating in 15 conjunction with such device. 16 include an automated typewriter or typesetter, a portable 17 handheld calculator, or other similar devices. 18 The term "computer" does not In this case, the government charges that the 19 defendant, while authorized to access the computer, exceeded 20 his authority in accessing the information in question, here 21 the Altabackups. 22 a reasonable doubt that the defendant had access to the 23 computer, and used that access to obtain or alter information 24 in the computer that the defendant was not entitled to obtain 25 or alter. This requires the government to prove beyond SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2967 K323SCH5 1 Charge An individual does not exceed authorized access when 2 he accesses a computer to obtain information that he is 3 authorized to access, even if he does so for an improper 4 purpose. 5 The second element in Count Four is knowledge. The 6 second element that the government must prove beyond a 7 reasonable doubt is that the defendant acted knowingly in 8 accessing the computer outside the scope of his authority. 9 "Knowingly" means to act voluntarily and deliberately, 10 rather than mistakenly or inadvertently. 11 whether a person acted knowingly is a question of fact for you 12 to determine, like any other fact question. 13 involves one's state of mind. 14 The question of The question Direct proof of knowledge is almost never available. 15 It would be a rare case when it would be shown that a person 16 wrote or stated that as of a given time in the past, he 17 committed an act with knowledge. 18 The ultimate fact of knowledge, though subjective, may be 19 established by circumstantial evidence, based upon a person's 20 outward manifestations, his words, his conduct, his acts and 21 all the surrounding circumstances disclosed by the evidence and 22 the rational or logical inferences that may be drawn from them. 23 Such proof is not required. Circumstantial evidence, if believed, is of no less 24 value than direct evidence. In either case, the essential 25 elements of the crime charged must be established beyond a SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2968 K323SCH5 1 Charge reasonable doubt. 2 As a practical matter then, in order to sustain the 3 charges against the defendant, the government must establish 4 beyond a reasonable doubt that he knew that his accessing of a 5 computer was outside the scope of the authorization granted. 6 The government can also meet its burden of showing 7 that the defendant had actual knowledge of the accessing of a 8 computer without authorization if it establishes beyond a 9 reasonable doubt that he acted with deliberate disregard of 10 whether he was so authorized. 11 may satisfy its burden of proving knowledge by establishing 12 beyond a reasonable doubt that the government acted with an 13 awareness of the high probability that he was acting without 14 authorization, unless the defendant actually believed that he 15 had authorization to access a computer in the manner described 16 in the indictment. 17 established by demonstrating that the defendant was merely 18 negligent or foolish. 19 Alternatively, the government This guilty knowledge, however, cannot be To conclude on this element, if you find that the 20 defendant did not know he was acting without authorization, 21 then you should find the defendant not guilty. 22 23 24 25 Count Four. The third element deals with protected information. The third element that the government must prove beyond a reasonable doubt is that the defendant obtained SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2969 K323SCH5 Charge 1 information protected against unauthorized disclosure for 2 reasons of national defense or foreign relations. 3 The United States may determine that information 4 requires protection against unauthorized disclosure for reasons 5 of national defense or foreign relations either by Executive 6 Order or by statute. 7 This element requires that at the time he obtained the 8 protected information, the defendant must have had reason to 9 believe that the information could be used against the 10 interests of the United States or to the advantage of a foreign 11 nation. 12 The fourth element in Count Four deals with willful 13 communication. 14 government must establish beyond a reasonable doubt is that the 15 defendant willfully communicated, delivered, transmitted or 16 caused to be communicated, delivered, or transmitted or 17 attempted to communicate, deliver, or transmit the protected 18 information obtained to a person who was not entitled to 19 receive it. 20 purposefully, with an intent to do something the law forbids, 21 that is to say, with a bad purpose either to disobey or 22 disregard the law. 23 The fourth element of Count Four that the To act willfully means to act knowingly and Count Five deals with the theft of government 24 property. Count Five charges the defendant with theft of 25 government property in or about 2016 in violation of Title 18, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2970 K323SCH5 Charge 1 United States Code, Section 641. 2 defendant of Count Five, the government must prove each of the 3 following four elements beyond a reasonable doubt: 4 5 6 7 8 In order to convict the First, that the property described in the indictment belonged to the United States government; Second, that the defendant stole, embezzled or knowingly converted that property; Third, that the defendant acted knowingly and 9 willfully with the intent to deprive the government of the 10 United States of the use and benefit of the property; and 11 12 13 Fourth, that the value of the property was greater than $1,000. The first element here of Count Five is the property 14 of the United States. 15 prove beyond a reasonable doubt is that the property described 16 in the indictment belonged to the United States government. 17 To satisfy this element, the government must prove 18 that the information contained in the Altabackups allegedly 19 stolen was a thing of value to the United States. 20 that at the time the property was allegedly stolen, embezzled, 21 or knowingly converted, the United States government or an 22 agency of the United States government had either title to, 23 possession of, or control over the property. 24 25 The first element the government must That means The second element that the government must prove beyond a reasonable doubt is that the defendant stole, SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2971 K323SCH5 Charge 1 embezzled, or knowingly converted the property. 2 property means to take someone else's property without the 3 owner's consent and with the intent to deprive the owner of the 4 value of that property. 5 To steal To embezzle property means to voluntarily and 6 intentionally take or convert to one's own use money or 7 property of another after that money or property lawfully came 8 into the possession of the person taking it by virtue of some 9 office, employment or position of trust. 10 To knowingly convert property means to use the 11 property in an unauthorized manner in a way that seriously 12 interfered with the government's right to use and to control 13 its own property, knowing that the property belong to the 14 United States and knowing that such use was unauthorized. 15 The third element of Count Five deals with intent. 16 The third element of the government must prove beyond a 17 reasonable doubt is that the defendant acted knowingly and 18 willfully with the intent to deprive the government of the use 19 and benefit of its property. 20 To act knowingly means to act intentionally and 21 voluntarily and not because of ignorance, mistake, accident or 22 carelessness. 23 that one's conduct is unlawful and with the intent to do 24 something the law forbids, that is to say, with a bad purpose 25 or to disobey or disregard the law. To act willfully means to act with knowledge Whether the defendant SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2972 K323SCH5 Charge 1 acted knowingly and willfully may be proved by the defendant's 2 conduct and by all the circumstances surrounding the case. 3 Count Five, the fourth element, the value of the 4 property. The fourth and final element that the government 5 must prove beyond a reasonable doubt is that the value of the 6 property stolen, embezzled, or knowingly converted was greater 7 than $1,000. 8 or cost price, either wholesale or retail, whichever is 9 greater. The word "value" means face, par or market value, "Market value" means the price a willing buyer would 10 pay a willing seller at the time the property was stolen. 11 determining the value of the property stolen, you may consider 12 the aggregate or total value of the property referred to in the 13 indictment. 14 less, then you must find the defendant not guilty. 15 other hand. 16 $1,000, then this element is satisfied. 17 In If you find that the aggregate value is $1,000 or On the If you find the aggregate value to be greater than I remind you again, it is the government's burden to 18 establish every element of each of these counts beyond a 19 reasonable doubt. 20 each count beyond a reasonable doubt. 21 government has not proved each of the elements of a count 22 beyond a reasonable doubt, you must acquit the defendant on 23 that count. 24 establish proof of guilt on another count. 25 each count, and each element of each count, on its own. The government must prove each element of If you find the Also, proof of guilt on one count does not SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 You must consider 2973 K32Wsch6 1 Charge THE COURT: Now, Count Six deals with unauthorized 2 access to a computer to obtain information from a department or 3 agency of the United States. 4 Count Six charges the defendant, in or about 2016, 5 intentionally accessed a computer and exceeded his authorized 6 access in order to obtain information from a department or 7 agency of the United States government, in violation of Title 8 18, United States Code Section 1030(a)(2)(B). 9 prove the defendant guilty of Count Six, the government must In order to 10 prove each of the following three elements beyond a reasonable 11 doubt: 12 First, that the defendant accessed a computer with 13 authorization, but exceeded his authority in accessing the 14 information in question; 15 Second, that the defendant acted intentionally; and 16 Third, that the defendant obtained information from 17 any department or agency of the United States. 18 The first element deals with unauthorized access. 19 The first element that the government must prove 20 beyond a reasonable doubt is that the defendant accessed a 21 computer with authorization, but exceeded his authority in 22 accessing the information in question. 23 I have already instructed you with regard to the 24 definition of a "computer" in Count Four. 25 applies here. That same definition SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2974 K32Wsch6 1 Charge In this case, the government charges that the 2 defendant, while authorized to access the computer, exceeded 3 his authority in accessing the information in question. 4 requires the government to prove beyond a reasonable doubt that 5 the defendant had access to the computer, and used that access 6 to obtain or alter the information in the computer that the 7 defendant was not entitled to obtain or alter. 8 9 This An individual does not exceed authorized access when he accesses a computer to obtain information that he is 10 authorized to access -- even if he does so for an improper 11 purpose. 12 13 The second element in Count Six deals with intentional conduct. 14 The second element that the government must prove 15 beyond a reasonable doubt is that the defendant acted 16 intentionally in accessing a computer either without 17 authorization or outside the scope of authority. 18 "Intentionally" means to act deliberately and purposefully. 19 That is, the defendant's acts must have been the product of the 20 defendant's conscious objective, rather than the product of a 21 mistake or accident. 22 intentionally is a question of fact for you to determine, like 23 any other fact question. 24 mind. 25 available. The question of whether a person acted The question involves one's state of As I told you, direct proof of intent is almost never It would be a rare case when it could be shown that SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2975 K32Wsch6 Charge 1 a person wrote or stated that as of a given time in the past he 2 committed an act intentionally. 3 The ultimate fact of intent, though subjective, may be 4 established by circumstantial evidence, based upon a person's 5 outward manifestations, his words, his conduct, his acts and 6 all the surrounding circumstances disclosed by the evidence and 7 the rational or logical inferences that may be drawn from them. 8 Such proof is not required. As a practical matter, then, in order to prove Count 9 Six, the government must establish beyond a reasonable doubt 10 that the defendant knew that his accessing of a computer was 11 unauthorized or that he knew that his accessing of a computer 12 was outside the scope of authority granted, but did so 13 anywhere. 14 defendant did not know he was acting without authority or 15 outside the scope of his authority, or if he did not 16 intentionally access the computer, then you should acquit the 17 defendant. 18 19 20 To conclude on this element, if you find that the Count Six: Third element -- U.S. government information. The third element that the government must prove 21 beyond a reasonable doubt is that the defendant obtained 22 information contained in a computer of any department or agency 23 of the United States. 24 United States. 25 government has proven that, without authorization, the The CIA is a department or agency of the However, it is for you to determine if the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2976 K32Wsch6 Charge 1 defendant obtained information contained in a computer of the 2 CIA. 3 4 Count Seven: Elements -- causing transmission of a harmful computer program, information, code or command. 5 Count Seven charges the defendant, from at least in or 6 about March 2016, up to and including at least in or about June 7 2016, with causing the transmission of a harmful computer 8 program, information, code or command, in violation of Title 9 18, United States Code, Section 1030(a)(5)(A). In order to 10 prove the defendant guilty of Count Seven, the government must 11 prove each of the following four elements beyond a reasonable 12 doubt; 13 First, that the defendant knowingly caused the 14 unauthorized transmission of a program, information, code or 15 command to a protected computer; 16 Second, that the defendant caused the transmission of 17 the program, information, code or command with the intent of 18 damaging or denying services to a computer or computer system; 19 Third, that the defendant thereby caused damage, as I 20 21 22 23 24 25 will define the term for you; and Fourth, that the defendant's actions resulted in damage to a computer system operated by the CIA. The first element of Count Seven is unauthorized access of a computer system. The first element the government must prove beyond a SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2977 K32Wsch6 Charge 1 reasonable doubt is that the defendant knowingly caused the 2 unauthorized transmission of a program, information, code or 3 command to a protected computer. 4 This element requires that the government prove that 5 the defendant's transmission of the computer program, 6 information, code or command was unauthorized. 7 statute, this means that the transmission occurred without the 8 permission of the person or entity who owns or is responsible 9 for the computer receiving the transmitted program, Under the 10 information, code or command with. I have instructed you on 11 the definition of a computer in Count Four, and you should 12 apply that definition here. 13 This element also requires that the government prove 14 that the defendant transmitted the program, information, code 15 or command knowingly. 16 intentionally and voluntarily, and not because of ignorance, 17 mistake, accident or carelessness. 18 defendant acted knowingly may be proved by the defendant's 19 conduct and by all of the facts and circumstances surrounding 20 the case. 21 A person acts knowingly if he acts However, whether the Finally, this element requires that the government 22 prove that the defendant transmitted the program, information, 23 code or command to a "protected computer." 24 case, this means that the government must prove that the 25 computer was exclusively for the use of the United States SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 As relevant to this 2978 K32Wsch6 1 government. 2 3 Charge The second element of Count Seven is intent to cause damage. 4 The second element that the government must prove 5 beyond a reasonable doubt is that the defendant caused the 6 transmission of the program, information, code or command with 7 the intent to cause damage, as I will define that term for you. 8 9 To act with "intent" means to act deliberately and purposefully. That is, the defendant's acts must have been the 10 product of the defendant's conscious objective, rather than the 11 product of a mistake or accident. 12 As a practical matter, then, in order to sustain the 13 charges against the defendant, the government must establish 14 beyond a reasonable doubt that the defendant transmitted the 15 computer program, information, code or command for the purpose 16 of causing damage. 17 The third element is causing damage. 18 The third element the government must prove beyond a 19 reasonable doubt is that by transmitting the program, 20 information, code or command, the defendant caused damage. 21 As defined in the statute, "damage" means any 22 impairment to the integrity or availability of data, a program, 23 a system or information. 24 25 The fourth element in Count Seven deals with harmful consequences. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2979 K32Wsch6 1 Charge The fourth element that the government must prove 2 beyond a reasonable doubt is that the defendant's actions 3 disrupted a computer system used by or for any government 4 agency in furtherance of the administration of justice, 5 national defense or national security. 6 Count Eight: Making false statements. 7 In Count Eight, the defendant is charged with 8 knowingly and willfully making false statements to the FBI, 9 including statements such as (1) denied having any involvement 10 in leaking the classified information; (2) stated that he had 11 never worked on Brutal Kangaroo outside the CIA; (3) stated 12 that he had never removed any classified information from the 13 CIA and took it home. 14 of Count Eight, the government must establish each of the 15 following five elements beyond a reasonable doubt: 16 In order to prove the defendant guilty First, from at least in or about March 2017, up to and 17 including at least in or about November 2017, the defendant 18 made a statement or representation; 19 20 21 22 23 24 25 Second, that this statement or representation was material; Third, the statement or representation was false, fictitious or fraudulent; Fourth, the false, fictitious or fraudulent statement was made knowingly and willfully; and Fifth, the statement or representation was made in a SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2980 K32Wsch6 Charge 1 matter within the jurisdiction of the government of the United 2 States. 3 The first element is statement or representation. 4 The first element that the government must prove 5 beyond a reasonable doubt is that the defendant made a 6 statement or representation to the FBI. 7 between written and oral statements. There's no distinction 8 The second element is materiality. 9 The second element that the government must prove 10 beyond a reasonable doubt is that the defendant's statement or 11 representation was material. 12 A fact is material if it was capable of influencing 13 the government's decisions or activities. 14 actual reliance on the statement by the government is not 15 required. 16 17 18 However, proof of The third element is false, fictitious or fraudulent statements. The third element that the government must prove 19 beyond a reasonable doubt is that the statement or 20 representation was false, fictitious or fraudulent. 21 statement or representation is "false" or "fictitious" if it 22 was untrue when made, and known at the time to be untrue by the 23 person making it or causing it to be made. 24 representation is "fraudulent" if it was untrue when made and 25 was made or caused to be made with the intent to deceive the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 A A statement or 2981 K32Wsch6 1 government agency to which it was submitted. 2 3 Charge The fourth element in Count Eight is knowingly and willfully. 4 The fourth element that the government must prove 5 beyond a reasonable doubt is that the defendant acted knowingly 6 and willfully. 7 purposefully and voluntarily, as opposed to mistakenly or 8 accidentally. 9 intention of doing so the law forbids; that is, with a bad 10 An act is done willfully if it is done with the purpose to disobey the law. 11 12 An act is done knowingly and it is done The fifth element is jurisdiction of the United States government. 13 The fifth element of Count Eight is that the statement 14 or representation be made with regard to a matter within the 15 jurisdiction of the government of the United States. 16 is a department of the United States government. 17 The FBI To be within the jurisdiction of a department or 18 agency of the United States government means that the statement 19 must concern an authorized function of that department or 20 agency. 21 to prove that the defendant had actual knowledge that the false 22 statement was to be used in a matter that was within the 23 jurisdiction of the United States government. 24 to satisfy this element if you find that the false statement 25 was made with regard to a matter within the jurisdiction of the In this regard, it is not necessary for the government SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 It is sufficient 2982 K32Wsch6 1 Charge United States government. 2 I remind you again it is the government's burden to 3 establish every element of each of these counts beyond a 4 reasonable doubt. 5 each count beyond a reasonable doubt. 6 government has not proved each element of a count beyond a 7 reasonable doubt, you must acquit the defendant on that count. 8 Also, proof of guilt on one count does not establish proof of 9 guilt on another count. 10 The government must prove each element of If you find that the You must consider each count, and each element of each count, individually. 11 Count Nine deals with obstruction of justice. 12 Count Nine charges the defendant with obstruction of 13 justice. I have instructed you about the statements allegedly 14 made by the defendant in Count Eight. 15 here as well. That instruction applies 16 In order to prove the defendant guilty of Count Nine, 17 the government must prove each of the following three elements 18 beyond a reasonable doubt: 19 First, from in or about March 2017, up to and 20 including at least in or about November 2017, there was a 21 proceeding pending before a federal court or grand jury; 22 Second, that the defendant knew of the proceeding; and 23 Third, that the defendant corruptly acted to obstruct 24 or impede, or endeavored to obstruct or impede, the proceeding. 25 SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2983 K32Wsch6 1 2 Charge For the first element, there's got to be a pending proceeding. 3 The first element that the government must prove 4 beyond a reasonable doubt is that in or about March 2017 5 through November 2017, the date set forth in the indictment, 6 there was a proceeding pending before a federal grand jury; 7 The second element that the government must prove 8 beyond a reasonable doubt is that the defendant knew that such 9 a proceeding was in progress. In order to satisfy this 10 element, you need only determine that the defendant knew on or 11 about the date charged that a grand jury proceeding was in 12 progress. 13 The third element is acted to obstruct or impede. 14 The third element that the government must prove 15 beyond a reasonable doubt is that the defendant did corruptly 16 obstruct or impede, or corruptly endeavored to obstruct or 17 impede, the proceeding. 18 19 The word "corruptly" simply means having the improper motive or purpose of obstructing justice. 20 Success of the endeavor is not an element of the 21 crime. The term "endeavor" is designed to reach all conduct 22 that is aimed at influencing, intimidating and impeding the 23 jurors or judges or officers. 24 satisfy this element if you find that the defendant knowingly 25 acted in a way that obstructed or had the natural and probable Thus, it is sufficient to SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2984 K32Wsch6 1 Charge effect of obstructing justice from being duly administered. 2 Count Ten deals with contempt of court. 3 Count Ten charges the defendant, from at least in or 4 about April 2018, up to and including at least in or about 5 October 2018, with contempt of court. 6 burden of proving the charge of contempt, the government must 7 establish beyond a reasonable doubt each of the following three 8 elements: 9 10 11 12 13 14 In order to sustain its First, that the Court issued a protective order that applied to the defendant; Second, that the defendant disobeyed or disregarded that order; and Third, that the defendant acted willfully and knowingly in disobeying the Court's order. 15 The first element is specific court order. 16 The first element of the offense of contempt is that 17 the Court gave a certain order to the defendant. 18 government must prove beyond a reasonable doubt that the Court 19 ordered the defendant to use certain discovery materials only 20 for the purpose of defending against the charges in this case, 21 and not disclose them to third parties. 22 matter of law that this order was lawful and proper in every 23 respect; further, that it did not violate any constitutional or 24 other legal rights of the defendant. 25 The I instruct you as a The second element of Count Ten is knowledge. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2985 K32Wsch6 1 Charge The second element that the government must prove 2 beyond a reasonable doubt is that the defendant disobeyed or 3 disregarded the Court's order. 4 and promptly obeyed. 5 defendant failed to comply with the Court's order to use 6 certain discovery materials only for defending against the 7 charges in this case, this element of the offense is satisfied. Court orders must be precisely If you find, therefore, that the 8 The third element of Count Ten is intent. 9 The third element that the government must prove 10 beyond a reasonable doubt is that the defendant acted knowingly 11 and willfully. 12 disobedience of public authority. 13 criminal contempt, therefore, it is essential that the 14 government establish that the defendant acted knowingly and 15 with the specific intent to disobey or disregard the Court's 16 order. 17 "Contempt" is defined as willful disregard or In order to be guilty of To satisfy this element, the government must prove, 18 beyond a reasonable doubt, that the defendant understood this 19 Court's order and consciously refused to obey that order. 20 I remind you again it is the government's burden to 21 establish every element of each of these counts beyond a 22 reasonable doubt. 23 each count beyond a reasonable doubt. 24 government has not proved each of the elements of a count 25 beyond a reasonable doubt, you must acquit the defendant on The government must prove each element of If you find the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2986 K32Wsch6 Charge 1 that count. 2 establish proof of guilt on another count. 3 each count, and each element of each count, individually. 4 Also, proof of guilt on one count does not You must consider In addition to all the elements of each of the charges 5 that I have described for you, for Counts Three, Eight, Nine, 6 and Ten, you must also decide with respect to each of those 7 four elements whether any act in furtherance of the crimes 8 occurred within the Southern District of New York. 9 need to consider whether any act in furtherance of the You do not 10 WikiLeaks counts -- that is, Counts One, Two, Four, Five, Six, 11 and Seven -- occurred in the Southern District of New York. 12 The government and the defendant have agreed to venue in the 13 Southern District of New York on those counts, even though the 14 government alleges that the conduct occurred in the Eastern 15 District of Virginia. 16 includes, among other places, Manhattan, the Bronx, 17 Westchester, Dutchess, Putnam, Orange, Sullivan, and Rockland 18 counties. 19 the crime was committed in this district, or that the defendant 20 himself was present here. 21 element if any act in furtherance of the crimes charged in 22 Counts Three, Eight, Nine, and Ten occurred in the Southern 23 District of New York. 24 25 The Southern District of New York In this regard, the government need not prove that It is sufficient to satisfy this I should note that on this issue -- and this issue alone -- the government need not prove venue beyond a SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2987 K32Wsch6 Charge 1 reasonable doubt, but only by a preponderance of the evidence, 2 which is a lower standard of proof. 3 evidence" means that the government must prove that it is more 4 likely than not that any act in furtherance of the charge you 5 are considering occurred in the Southern District of New York. 6 Thus, the government has satisfied its venue obligations if you 7 conclude that it is more likely than not that any act in 8 furtherance of the crimes charged in Counts Three, Eight, Nine, 9 and Ten occurred in the Southern District of New York. 10 find that the government has failed to prove this venue 11 requirement with respect to any of Counts Three, Eight, Nine, 12 and Ten, then you must acquit the defendant on that count. 13 14 15 OK. A "preponderance of the If you I'm coming now to my conclusion of the instructions; you'll be happy to hear that. You are about to go into the jury room and begin your 16 deliberations. 17 this case and to determine whether the government has proved 18 beyond a reasonable doubt that Mr. Schulte is guilty of the 19 offenses charged in the indictment. 20 Your function now is to weigh the evidence in You must base your verdict solely on the evidence and 21 these instructions as to the law, and you are obliged under 22 your oath as jurors to follow the law as I have instructed you, 23 whether you agree or disagree with the particular law in 24 question. 25 The verdict must represent the considered judgment of SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2988 K32Wsch6 Charge 1 each juror. 2 each juror agree to it. 3 you are divided, please do not report how the vote stands, and 4 if you have reached a verdict, do not report that until you are 5 asked to do in open court. 6 In order to return a verdict, it is necessary that Your verdict must be unanimous. When you retire to the jury room, you must have a 7 foreperson. 8 and speak for you here in open court. 9 functions, the foreperson will have no greater or lesser 10 11 12 If That person will preside over the deliberations Other than these authority than any other juror. It is my custom to select juror No. 1. Ms. Wiker, you are selected as the foreperson of the jury. 13 A final word on your duty to deliberate. 14 It is your duty as jurors to consult with one another 15 and to deliberate with a view toward reaching an agreement. 16 Each of you must decide the case for him or herself, but do so 17 only after impartial discussion and consideration of all of the 18 evidence in the case with your fellow jurors. 19 your deliberations, do not hesitate to reexamine your own views 20 and change an opinion if you become convinced it is erroneous. 21 But do not surrender your honest convictions as to the weight 22 or effect of evidence solely because of the opinions of your 23 fellow jurors. 24 25 In the course of It is essential that every juror consider all the facts and arguments before reaching a decision. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 All of you 2989 K32Wsch6 Charge 1 must be present in order to deliberate. 2 break during the course of your deliberations, you must stop 3 discussing the case until he or she returns. 4 juror arrives late in the morning, you may not commence your 5 deliberations until all twelve of you are present. 6 If any juror takes a Similarly, if any For your deliberations, you will be provided with 7 copies of these instructions that I'm currently giving you and 8 copies of the indictment you. 9 one verdict sheet on which you will record your verdict. 10 You will also be provided with I'm going to send the exhibits received in evidence 11 into the jury room. If you want any of the testimony read, you 12 may also request that. 13 to locate what you might want, so be as specific as you 14 possibly can in requesting testimony or portions of testimony. 15 If you want further explanation of the law as I have explained 16 it to you, you may also request that from the Court. 17 is any doubt or question about the meaning of any part of this 18 charge, you may ask for clarification or further instruction. Please remember that it is not always If there 19 Your requests and any other communications you make to 20 the Court should be made in writing, signed by your foreperson, 21 and given to one of the court security officers that will be 22 watching over you. 23 to any person -- not even to me -- how you, the jury, stand, 24 numerically or otherwise, on the questions before you until 25 after you have reached a unanimous verdict. Bear in mind that you are never to reveal SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2990 K32Wsch6 1 Charge Your decision must be unanimous, but you are not bound 2 to surrender your honest beliefs concerning the effect or 3 weight of the evidence for the mere purpose of returning a 4 verdict or solely because of the opinion of the other jurors. 5 Discuss and weigh your respective opinions dispassionately, 6 without regard for sympathy, prejudice or favor for either 7 party, and adopt the conclusion that in your good conscience 8 appears to be in accordance with the truth. 9 Now, some of you have taken notes during the trial. 10 As I told you at the beginning of the trial, this is permitted 11 because some people find that taking notes helps them focus on 12 the testimony being given. 13 use only, as a way to help you recall the testimony as you 14 begin your deliberations. 15 any greater weight than the recollection of a juror who did not 16 take notes. 17 But your notes are for your private A juror's notes are not entitled to Your function now is to weigh the evidence in this 18 case and determine whether the government has or has not 19 established Mr. Schulte's guilt beyond a reasonable doubt with 20 respect to the ten counts of the indictment. 21 your verdict solely on the evidence and these instructions as 22 to the law. 23 the law as I'm instructing you regardless of whether you agree 24 or disagree with the particular law in question. 25 all times that you are not partisan. You must base You are obliged by your oath as jurors to follow Remember at You are judges -- judges SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2991 K32Wsch6 Charge 1 of the facts. That's why we're standing up when you come into 2 the courtroom. 3 the truth from the evidence in this case. You are judges. Your sole interest is to seek 4 As to the alternate jurors, Mr. Goldberg and Ms. 5 Gallo, only twelve jurors can deliberate, so I'm going to 6 excuse you now. 7 There may be circumstances where one or more of you will have 8 to be recalled, such as if one of the twelve jurors becomes 9 suddenly unavailable. 10 You notice I said excuse and not dismiss. I want to thank you for your punctuality and your 11 complete attention, your faithful attendance. 12 attention, but I'm going to ask you not to read or discuss 13 anything. 14 need you, we have your contact numbers. 15 you know the results. 16 17 Don't take any interviews with the press, and if we We'll call you and let Is there anything else, David, we have to tell the alternate jurors? 18 THE DEPUTY CLERK: 19 You're excused now. 20 You paid close behind. No. Just please leave your notes Thank you again for your service. 21 (Alternate jurors excused) 22 THE COURT: 23 (At sidebar) 24 THE COURT: 25 MR. ZAS: I'll see the counsel at sidebar. Yes. Your Honor, we would just renew the SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2992 K32Wsch6 1 Charge objections we raised at the charge conference. 2 THE COURT: They're preserved. 3 MR. ZAS: 4 conscious avoidance charge. 5 before, but I think legally it's not correct. 6 is on page 37 of my copy. 7 government has to prove that the defendant acted with 8 deliberate disregard whether he was so authorized," authorized 9 to access the computer. We have one more thing, just on the I'm sorry I didn't notice this It reads, this It says at one point that "the But then it has the word 10 "alternatively." "The government may establish its 11 burden..."by proving that the defendant acted with an awareness 12 of a high probability that he was acting without authorization 13 unless the defendant actually believed that he had 14 authorization to access a computer in the manner described in 15 the indictment." 16 It's not really correct to say it's alternatively. 17 It's that the defendant was aware of a high probability and 18 consciously decided not to find out. 19 to the way it was phrased as well as the prior objection we 20 raised, which was that there was not a sufficient factual 21 predicate for it in this case. 22 THE COURT: 23 Anything else? 24 MR. DENTON: 25 So we would just object It's preserved. I think it's pretty clear that you're simply saying put a different way, which is an accurate SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2993 K32Wsch6 Charge 1 description of what deliberate disregard means. It's not an 2 alternative theory. 3 THE COURT: 4 MR. ZAS: 5 Judge, on page 59, we'd also object to one line that I'm content to leave it the way it is. OK. Our objection is noted. 6 told the jury that its "sole interest is to seek the truth from 7 the evidence in this case," and we think that dilutes the 8 burden of proof to suggest that they're out to find out what 9 really happened rather than whether the government sustained 10 its burden. 11 THE COURT: 12 MR. ZAS: 13 THE COURT: 14 MR. ZAS: 15 THE COURT: That's pretty much a standard charge. I take it you're overruling my objection. Yes, I am. Overruled. I think that's all we have. OK. Just so the record is clear, the 16 objections that you had to the charge set forth at the charge 17 conference are all preserved. 18 MS. SHROFF: 19 MR. ZAS: Thank you, your Honor. This a good time for the record to make sure 20 that we still seek the mistrial. The motion is still pending 21 and hasn't been ruled on. 22 we are still requesting that relief. I want to make sure it's clear that 23 THE COURT: OK. 24 Anything from the government? 25 MR. DENTON: Nothing from the government. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2994 K32Wsch6 1 THE COURT: Mr. Branden. 2 MR. BRANDEN: 3 (In open court) 4 THE COURT: 5 (Court security officer sworn) 6 THE COURT: Nothing, Judge. David, swear the CSO. Before you start your deliberations -- 7 it's 3:20, and I don't know what you want to do today -- but 8 I'd request on behalf of all the parties that you go in there 9 and try to figure out what schedule you want to follow through 10 your deliberations, what time you want to start the day, what 11 time you want to go home at the end of the day, so we can be 12 around to serve any needs that you have. 13 here in the courtroom awaiting your verdict, or staying in the 14 courthouse awaiting your verdict. 15 now and try to agree upon a schedule, give the schedule to the 16 CSO, and then deliberate as long as you want or short as you 17 want. 18 CSO. It's up to you. 19 20 All right? We will be staying So if you can go in there You're in the hands of the (At 3:21 p.m., the jury retired to deliberate upon a verdict) 21 THE COURT: We'll take care of submitting the jury 22 instructions and the verdict sheet and the indictment to the 23 jurors. 24 Do you have the exhibits ready? 25 MR. LAROCHE: Yes, your Honor. SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2995 K32Wsch6 1 THE COURT: 2 MS. SHROFF: Are you ready too, Ms. Shroff? No. I haven't seen the computer because 3 we wanted to see if there were any markings of classification 4 on the computer itself. 5 6 THE COURT: the documents. When I say exhibits, I mean hard copies of I'm not going to send the computer in. 7 MS. SHROFF: OK. 8 THE COURT: 9 MS. SHROFF: Those we will agree to. 10 THE COURT: Have you agreed on that? 11 MS. SHROFF: 12 THE COURT: 13 MS. SHROFF: 14 THE COURT: 15 MR. LAROCHE: 16 THE COURT: 17 MR. LAROCHE: 18 MS. SHROFF: 19 MR. LAROCHE: I'm talking about the pieces of paper. Yes. OK. You've seen it. Yes. OK. We'll send those in too. Yes, your Honor. Thanks. Thank you very much. Thank you, your Honor. Thank you, your Honor. Your Honor, one question. Should the 20 parties report in the morning to the courtroom, or is it 21 sufficient that we're in the courthouse? 22 THE COURT: Well, we'll get a note, and presumably 23 they'll let us know, but I've always felt that the U.S. 24 Attorney's Office -- you're staying in your offices on the 25 fifth floor? SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300 2996 K32Wsch6 1 MR. LAROCHE: 2 THE COURT: 3 MR. LAROCHE: 4 THE COURT: 5 6 7 Yes, your Honor. Yes. Thank you. I don't know where Ms. Shroff is planning on staying. MS. SHROFF: I don't know. I thought I'd just sit in the SCIF. 8 THE COURT: 9 MR. ZAS: OK. It's a strange place to hide. Thank you, your Honor. 10 THE COURT: 11 (Recess pending verdict) 12 THE DEPUTY CLERK: Thank you. Counsel, Ms. Shroff, we got a note 13 from the jury. 14 through 4 p.m., including Fridays." 15 16 17 Just for old time's sake, It says, "We have decided to work 9 a.m. This will be marked as Court Exhibit 5, and it's received as of today, March 2. The Court will be submitting to the jury 12 copies of 18 the jury charge, three to four copies of the indictment, one 19 verdict sheet with a yellow envelope, and a few extra jury 20 notes for the jury. 21 MR. LAROCHE: 22 THE DEPUTY CLERK: 23 have stipulated to. 24 room at all times. 25 Thank you. And all the exhibits the parties And the exhibits are to stay in the jury (Adjourned to March 3, 2020, at 9:00 a.m.) SOUTHERN DISTRICT REPORTERS, P.C. (212) 805-0300