Sussmann Trial 517 Afternoon

IN THE
IN THE UNITED
UNITED STATES
STATES DISTRICT
DISTRICT COURT
COURT
FOR THE DISTRICT OF COLUMBIA
FOR THE DISTRICT OF COLUMBIA
THE UNITED
THE UNITED STATES
STATES OF
OF AMERICA,
AMERICA, Criminal Action
Criminal Action No.
No.
Plaintiff,
Plaintiff, 1:21-CR-00582-CRC-1
1:21-CR-00582-CRC-1
May 17, 2022

May 17, 2022
vs.
vs. 2:19 p.m.
2:19 pum.
MICHAEL
MICHAEL A. SUSSMANN,
A. SUSSMANN, #AFTERNOON SESSION*
*AFTERNOON SESSION
Defendant.
Defendant.
____________________________________________________________
TRANSCRIPT OF
TRANSCRIPT OF JURY
JURY TRIAL
TRIAL
HELD BEFORE
HELD BEFORE THE
THE HONORABLE
HONORABLE CHRISTOPHER
CHRISTOPHER R.
R. COOPER
COOPER
UNITED STATES
UNITED STATES DISTRICT
DISTRICT JUDGE
JUDGE
____________________________________________________________
APPEARANCES:
APPEARANCES:
For the
For the United
United States:
States: ANDREW DeFILIPPIS,
ANDREW DeFILIPPIS, ESQ.
ESQ.
JONATHAN EDGAR
JONATHAN EDGAR ALGOR,
ALGOR, IV,
IV, ESQ.
ESQ.
MICHAEL T. KEILTY, ESQ.
MICHAEL T. KEILTY, ESQ.
BRITTAIN SHAW,
BRITTAIN SHAW, ESQ.
ESQ.
SPECIAL COUNSEL'S
SPECIAL COUNSEL'S OFFICE
OFFICE
145 NN Street
145 Street Northeast
Northeast
Washington, DC
Washington, DC 20002
20002
(212) 637-2231
(212) 637-2231
For the
For the Defendant:
Defendant: SEAN M.
SEAN BERKOWITZ, ESQ.
M. BERKOWITZ, ESQ.
MICHAEL BOSWORTH,
MICHAEL BOSWORTH, ESQ.
ESQ.
CATHERINE YAO,
CATHERINE YAO, ESQ.
ESQ.
NATALIE HARDWICK RAO,
NATALIE HARDWICK RAO, ESQ.
ESQ.
LATHAM && WATKINS
LATHAM WATKINS LLP
LLP
1271 Avenue
1271 Avenue of
of the
the Americas
Americas
New York,
New York, NY
NY 10020
10020
(212) 906-1200
(212) 906-1200
Court Reporter:
Court Reporter: Lorraine T.
Lorraine T. Herman,
Herman, RPR,
RPR, CCR
CCR
Official Court
Official Court Reporter
Reporter
U.S. Courthouse,
U.S. Room 6718
Courthouse, Room 6718
333 Constitution
333 Constitution Avenue,
Avenue, NW
NW
Washington, DC
Washington, DC 20001
20001
(202) 354-3187
(202) 354-3187
INDEX
I N D E X
WITNESS
WITNESS PAGE
PAGE
SCOTT HELLMAN
SCOTT HELLMAN
Cross-Examination by
Cross-Examination by Mr.
Mr. Berkowitz
Berkowitz 429
429
Redirect Examination
Redirect Examination by
by Mr. DeFelippis
Mr. DeFelippis 481
481
Recross-Examination by Mr. Berkowitz
Recross-Examination by Mr. Berkowitz 496
496
STEVE DEJONG
STEVE DEJONG
Direct Examination
Direct Examination by Mr. DeFilippis
by Mr. DeFilippis 501
501
Cross-Examination by
Cross-Examination by Mr.
Mr. Bosworth
Bosworth 524
524
EXHIBITS
E X H I B I T S
EXHIBIT
EXHIBIT PAGE
PAGE
Defendant's No.
Defendant's No. 513
513 Admitted
Admitted into
into Evidence
Evidence 460
460
Defendant's No.
Defendant's No. 514
514 Admitted
Admitted into
into Evidence
Evidence 468
468
Defendant's No.
Defendant's No. 531
531 Admitted
Admitted into
into Evidence
Evidence 496
496
Government's No.
Government's No. 111
111 Admitted
Admitted into
into Evidence
Evidence 512
512
Government's No. 1600 Admitted
Admitted into
into Evidence
Evidence 515
515
Government's No.
1602 Admitted
Admitted into
into Evidence
Evidence 517
517
Government's No.
717 Admitted
Admitted into
into Evidence
Evidence 519
519
Government's No.
716 Admitted
Admitted into
into Evidence
Evidence 521
521
Government's No.
719 Admitted
Admitted into
into Evidence
Evidence 523
523
426
426
1
1 PROCEEDINGS
P R O C E E D I N G S
2
2 THE COURT:
THE COURT: All
All right.
right. II hope
hope everyone
everyone had
had aa nice
nice
3
3 lunch.
lunch.
4
4 Mr. Bosworth,
Mr. Bosworth, II think
think II cut
cut you
you off.
off.
5
5 MR. BOSWORTH: Thank
MR. BOSWORTH: Thank you,
you, Your
Your Honor.
Honor.
6
6 There had
There had been
been two
two issues.
issues. Now there's
Now there's just
just one.
one.
7
7 THE COURT:
THE COURT: If II waited
If another 10
waited another 10 minutes,
minutes, would
would
8
8 there be
there be zero?
zero?
9
9 MR. BOSWORTH: By
MR. BOSWORTH: By dinner
dinner time
time you'll
you'll be good.
be good.
10
10 The issue
The issue relates
relates to
to the
the subject
subject matter that we
matter that we
1
11 objected over
objected over during
during Special
Special Agent-1's
Agent-1's testimony,
testimony, and
and II just
just
12
12 wanted to
wanted to explain
explain aa little
little more and, apologies,
more and, apologies, II should
should
13
13 have said
have said II wanted
wanted to
to pick
pick up
up the
the phone
phone to
to discuss.
discuss.
14
14 And that
And that relates
relates to
to the
the termination
termination of
of Rodney
Rodney
15
15 Joffe's status
Joffe's status as
as aa confidential
confidential human
human source.
source.
16
16 THE COURT:
THE COURT: Right.
Right.
17
17 MR. BOSWORTH: Our
MR. BOSWORTH: Our understanding
understanding is
is that
that Mr. Joffe
Mr. Joffe
18
18 was terminated
was terminated as
as aa source
source for
for cause
cause in
in 2021
2021 as
as an
an outgrowth
outgrowth
19
19 of this
of this investigation.
investigation. Our concern
Our concern is
is that
that the
the termination
termination
20
20 of Mr.
of Joffe sounds
Mr. Joffe sounds prejudicial
prejudicial as
as though
though he
he had
had been
been
21
21 charged or
charged or at
at least
least raises
raises questions about whether
questions about he has
whether he has
22
22 been separately
been separately charged,
charged, that's
that's aa reason
reason for
for his
his absence,
absence, or
or
23
23 that there's
that there's something
something else
else going
going on
on that
that they
they are
are not
not
24
24 hearing about.
hearing about.
25
25 We think
We think that
that it's
it's appropriate
appropriate to
to limit
limit discussion
discussion
427
427
1
1 of his
of his status
status as
as aa source
source to
to the
the time
time period
period relevant
relevant in
in the
the
2
2 indictment, 2016,
indictment, 2016, '17,
'17, '18,
'18, but
but we
we think
think it
it is
is prejudicial
prejudicial
3
3 to explore
to explore or
or elicit
elicit further
further testimony
testimony about
about his
his termination
termination
4
4 given that
given that it
it happened
happened so
so late
late and
and was connected to
was connected to this
this
5
5 case.
case. That's the
That's the basis
basis of
of the
the objection,
objection, and
and we
we think
think this
this
6
6 will keep
will keep coming
coming up
up so
so we just wanted
we just to file
wanted to file it.
it.
7
7 THE COURT:
THE COURT: Remind me,
Remind me, the
the witness
witness said
said he
he was
was not
not
8
8 aware of
aware of whether
whether he
he had
had or
or had
had not
not been terminated; is
been terminated; is that
that
9
9 right?
right?
10
10 MR. BOSWORTH: That's
MR. BOSWORTH: That's correct.
correct.
n
11 THE COURT:
THE COURT: SoSo it's
it's not
not so
so much
much the
the evidence
evidence
12
12 that's in
that's in the
the record
record but
but ----
13
13 MR. BOSWORTH: It's
MR. BOSWORTH: It's what's
what's to
to come.
come.
14
14 THE COURT:
THE COURT: ---- prophylactic?
prophylactic?
15
15 MR. BOSWORTH: Yes,
MR. BOSWORTH: Yes, sir.
sir.
16
16 THE COURT:
THE COURT: DoDo you
you want
want to
to respond
respond or?
or?
17
17 MR. DeFILIPPIS: Yes,
MR. DeFILIPPIS: Yes, briefly,
briefly, Your
Your Honor.
Honor.
18
18 I think
I think the
the government's
government's view is that
view is that Mr. Joffe's
Mr. Joffe's
19
19 termination as
termination as aa source
source really
really does
does concern
concern his
his conduct
conduct in
in
20
20 2016 and
2016 and the
the reason
reason he
he was terminated. Although
was terminated. Although itit came
came to
to
21
21 Light because
light because of
of this
this investigation,
investigation, the the reason
reason he
he was
was
22
22 terminated, as
terminated, as we understand it
we understand it from
from the
the FBI,
FBI, is
is because
because of
of
23
23 what he
what he did
did in
in connection
connection with
with the
the conduct
conduct that
that the
the
24
24 defendant was
defendant was involved
involved in,
in, which is, rather
which is, rather than
than bringing
bringing
25
25 this Alfa-Bank
this Alfa-Bank information
information to to his
his source
source handler,
handler, bringing
bringing
428
428
1
1 it to
it to the
the general
general counsel
counsel of
of the
the FBI,
FBI, that
that was a breach
was a breach of
of
2
2 how aa source
how source is
is supposed
supposed to
to report
report information.
information.
3
3 So to
So to the
the extent
extent that
that the
the defense
defense is
is trying
trying to
to
4
4 advance the
advance the argument,
argument, which
which they
they are
are absolutely
absolutely entitled
entitled to,
to,
5
5 that Mr.
that Mr. Joffe
Joffe was at one
was at one time
time aa trusted
trusted source,
source, aa paid
paid
6
6 source, absolutely,
source, absolutely, they
they should
should be
be able
able to
to do
do that.
that. But we
But we
7
7 think it
think it would
would unfairly
unfairly hamstring
hamstring the
the government
government to
to not
not be
be
8
8 able to
able to point
point out
out that,
that, in
in fact,
fact, the
the very
very things
things he
he was
was
9
9 doing as
doing as alleged
alleged in
in this
this case
case were
were aa breach
breach of
of what
what aa source
source
10
10 is supposed
is supposed to
to do.
do.
n
11 THE COURT:
THE COURT: I want
I want you
you to
to steer
steer clear
clear of
of that
that
12
12 topic for
topic for two
two reasons.
reasons. One, as
One, as Mr.
Mr. Bosworth
Bosworth said,
said, what's at
what's at
13
13 issue is
issue is how
how he
he was
was regarded
regarded by
by the
the FBI
FBI at
at the
the time,
time, not
not
14
14 subsequently.
subsequently.
15
15 Second, the
Second, the Court
Court has
has already
already ruled
ruled that
that the
the
16
16 propriety of
propriety of his
his gathering
gathering and
and collection
collection effort
effort and
and what
what he
he
17
17 did with
did with the
the data
data is
is not
not at
at issue.
issue. So for
So for those
those two
two
18
18 reasons, let's
reasons, let's keep
keep that
that out.
out.
19
19 MR.
MR. DeFILIPPIS:
DeFILIPPIS: Okay, Your Honor.
Okay, Your Honor.
20
20 THE
THE COURT: Thanks.
COURT: Thanks.
21
21 THE
THE COURT: All
COURT: All right.
right.
22
22 Are
Are we ready
we ready to
to go?
go? Mr. Berkowitz, you'll
Mr. Berkowitz, you'll be
be
23
23 crossing him?
crossing him?
24
24 MR.
MR. BERKOWITZ:
BERKOWITZ: I figure
I figure II should
should do
do some
some work
work
25
25 today.
today.
429
429
1
1 THE COURT:
THE COURT: You may
You may step
step up.
up.
2
2 CROSS-EXAMINATION OF
CROSS-EXAMINATION SCOTT HELLMAN
OF SCOTT HELLMAN
3
3 DEPUTY CLERK:
DEPUTY CLERK: Your Honor,
Your Honor, jury
jury panel.
panel.
4
4 (Jury entered
(Jury entered the
the courtroom.)
courtroom.)
5
5 THE COURT:
THE COURT: All right.
All right. Welcome back,
Welcome back, ladies
ladies and
and
6
6 gentlemen.
gentlemen. II hope
hope you
you enjoyed
enjoyed your
your lunch.
lunch.We are ready
We are ready to
to
7
7 get back
get back started
started with
with the
the cross-examination
cross-examination of
of Agent
Agent
8
8 Hellman.
Hellman. You can
You can be
be seated.
seated.
9
9 I would
I would remind
remind you
you that
that you're
you're still
still under
under oath.
oath.
10
10 THE WITNESS:
THE WITNESS: Yes, sir.
Yes, sir.
1
11 BY
BY MR.
MR. BERKOWITZ:
BERKOWITZ:
12
12 @.
Q. special Agent
Special Agent Hellman,
Hellman, you
you don't
don't know
know my client,
my client,
13
13 Michael Sussmann,
Michael Sussmann, do
do you?
you?
14
14 A.
A. No, sir.
No, sir.
15
15 Q.
Q. You've never
You've never spoken
spoken with
with him?
him?
16
16 A.
A. Correct, no.
Correct, no.
17
17 Q.
Q. You don't
You don't know
know what
what role,
role, if
if any,
any, he
he played in the
played in the
18
18 white paper
white paper that
that you
you analyzed?
analyzed?
19
19 A.
A. At the
At the time,
time, no.
no.
20
20 Q.
Q. You didn't
You didn't know
know what
what he
he knew
knew or
or didn't
didn't know
know about
about
21
21 the white
the white paper.
paper. Correct?
Correct?
22
22 A.
A. correct.
Correct.
23
23 Q.
Q. You don't
You don't even
even know,
know, at
at least
least as
as of
of that
that time,
time, who
who
24
24 it was
it that provided
was that provided the
the thumb
thumb drive
drive and
and white
white paper to
paper to
25
25 Mr. Baker,
Mr. Baker, do
do you?
you?
430
430
1
1 A.
A. That's correct.
That's correct. II did
did not
not know.
know.
2
2 ©.
Q. In fact,
In fact, at
at least
least as
as of
of 2020,
2020, you
you said
said to
to this
this day
day
3
3 [| I1 still
stirs don't
don't know.
know. Correct?
correct?
a
4 A.
A. Correct.
Correct.
5
5 ©.
Q. Nor do
Nor do you
you know
know what
what happened
happened inin the
the meeting
meeting
6
6 || between Mr.
between Baker and
Mr. Baker and Mr.
Mr. Sussmann
Sussmann on
on September
September 19th.
19th.
77 || correce2
Correct?
88 A.
A. Correct. II did
Correct. did not
not know
know anything
anything about
about aa meeting.
meeting.
99 Q.
Q. Or any
Or any of
of the
the subsequent
subsequent communications
communications that
that
10 ||
10 wr. Baker and
Mr. Baker and Mr.
Mr. Sussmann
sussmann had.
had. Right?
Right?
un
11 A.
A. Correct.
Correct.
12
12 ©.
Q. And you
And you don't
don't know
know me,
me, do
do you?
you?
13
13 A.
A. No, sir.
No, sir.
14
14 ©.
Q. Never met
Never before?
met before?
15
15 A.
A. Correct.
Correct.
16
16 ©.
Q. But you
But you do
do know
know Mr.
Mr. DeFilippis.
DeFilippis. Correct?
Correct?
17
17 A.
A. Ido.
I do.
18
18 ©.
Q. And, in
And, in fact,
fact, you've
you've met
met with him aa number
with him number of
of
19 ||
19 times in
times in connection
connection with
with this
this case.
case. Correct?
Correct?
20
20 A.
A. Yes.
Yes.
21
21 ©.
Q. Do you
Do you know
know how
how many
many times?
times?
22
22 A.
A. In person?
In person?
23
23 Q.
Q. or via
Or via telepresence?
telepresence?
24
24 A.
A. I believe
I believe three
three times
times in
in telepresence
telepresence and
and another
another
25 ||
25 in person.
in person. and then, dating
And then, dating back
back to
to 2020,
2020, maybe two
maybe two
431
431
1
1 additional times,
additional times, maybe
maybe five
five telepresence
telepresence and
and one
one in
in person
person
2
2 plus today.
plus today.
3
3 ©.
Q. If II told
If told you
you it
it was six, do
was six, do you
you think
think that
that would
would
4
4 be correct?
be correct? I'll
I'll run
run through
through each
each of
of them
them with you briefly.
with you briefly.
5
5 A.
A. Could be.
Could be.
6
6 ©.
Q. So March
So March 12th
12th of
of 2020,
2020, you
you met
met with
with Mr.
Mr. DeFilippis
DeFilippis
7
7 in order
in order to
to be
be interviewed
interviewed inin connection
connection with
with this
this case.
case.
8
8 Correct, as
Correct, as aa fact
fact witness?
witness?
9
9 A.
A. ves.
Yes.
10
10 ©.
Q. And during
And during that
that interview,
interview, there
there was an FBI
was an FBI
n
11 Special Agent
Special Beutler that
Agent Beutler that was
was present?
present?
12
12 A.
A. I believe
I believe that's
that's accurate.
accurate.
13
13 ©.
Q. And typically
And typically when
when an
an FBI
FBI --
-- when there is
when there is an
an
14
14 interview conducted
interview conducted with
with an
an FBI
FBI agent
agent present,
present, the
the FBI
FBI agent
agent
15
15 takes notes.
takes notes. Correct?
Correct?
16
16 A.
A. The FBI
The FBI takes
takes notes
notes pretty
pretty much
much during
during any
any
17
17 interview.
interview.
18
18 ©.
Q. And in
And in connection
connection with
with an
an interview
interview involving
involving aa
19
19 case, those
case, those notes
notes can
can be
be written
written up
up into
into aa report.
report. Correct?
Correct?
20
20 A.
A. Yes.
Yes.
21
21 ©.
Q. Those reports
Those reports are
are what's
what's known
known as
as an
an FBI-302.
FBI-302.
22
22 Correct?
Correct?
23
23 A.
A. Yes, it
Yes, it would
would be
be known
known as
as an
an FD-302.
FD-302.
24
24 Q.
Q. It's something
It's something that's
that's common
common to
to people
people like
like us,
us,
25
25 but the
but the jury
jury doesn't
doesn't know.
know. Explain
Explain to
to the
the jury,
jury, if
if you
you
432
432
1
1 could, what
could, an FBI-302
what an FBI-302 is
is and
and what
what the
the purpose of it
purpose of it is.
is.
2
2 A.
A. The purpose
The purpose of
of aa 302
302 is
is to
to document
document pretty
pretty much
much
3
3 any observation
any observation an
an FBI
FBI agent
agent might
might make.
make. IfIf that's
that's an
an
4
4 interview, you
interview, you interview
interview someone,
someone, you're
you're going
going to
to take
take notes
notes
5
5 and then
and then you're
you're going
going to
to document
document anything
anything that
that was
was talked
talked
6
6 about during
about during the
the interview.
interview.
7
7 ©.
Q. The agent
The agent is
is trained
trained toto be
be accurate
accurate in
in their
their note
note
8
8 taking. Correct?
taking. Correct?
9
9 A.
A. Yes. We
Yes. We do have practice
do have doing interviews
practice doing interviews during
during
10
10 training, yes.
training, yes.
n
11 ©.
Q. And that
And that is
is because,
because, atat some
some point, the witness
point, the witness
12 || may
12 testify at
may testify at trial.
trial. correct?
Correct?
13
13 A.
A. ves.
Yes.
14
14 ©.
Q. And you
And you want
want to
to have
have as
as accurate
accurate aa reflection
reflection as
as
15
15 possible as
possible as you
you do
do of
of what
what occurred.
occurred. Correct?
Correct?
16
16 A.
A. ves.
Yes.
17
17 ©.
Q. Does the
Does the FBI
FBI ever
ever tape
tape record
record interviews?
interviews?
18
18 A.
A. ves.
Yes.
19
19 ©.
Q. Okay. Do
Okay. Do you
you know
know whether
whether your
your interviews
interviews were
were
20
20 tape recorded?
tape recorded?
21
21 A.
A. I do
I do not
not believe they were.
believe they were.
22
22 ©.
Q. And with
And with respect
respect to
to --
-- so
so we
we talked
talked about
about March
March
23
23 12th of
12th of 2020.
2020.
24
24 You met
You met the
the very
very next
next day.
day. Correct?
Correct?
25
25 A.
A. ves.
Yes.
433
433
1
1 ©.
Q. With Mr.
With DeFilippis and
Mr. DeFilippis and Special
Special Agent
Agent Beutler?
Beutler?
2
2 A.
A. over the
Over the phone, yes.
phone, yes.
3
3 9.
Q. I'm sorry
I'm sorry over
over the
the phone.
phone. WasWas it
it aa factual
factual
4
4 || interviews In
interview? 1n other
other words,
words, were
were you
you providing
providing them
them
5 ||
5 information in
information in connection
connection with
with the
the case?
case?
6
6 A.
A. Yes.
Yes.
7
7 ©.
Q. And did
And did you
you call
call them
them back
back or
or did
did they
they call
call you
you
8 [|
8 pack to
back to follow
for1ow up?
up?
9
9 A.
A. I called
I called them
them back
back to
to follow
follow up.
up.
10
10 ©.
Q. You went
You went and
and looked
looked atat some
some more
more information;
information; isis
1|
11 that right?
that rigne2
12
12 A.
A. I remembered
I remembered additional
additional things.
things. II hadn't
hadn't talked
talked
13 ||
13 about the
about the --
-- prior
prior to
to that
that previous interview on
previous interview on the
the 12th,
12th, II
14 ||
14 hadn't really
hadn't really thought
thought about
about the
the situation
situation inin almost
almost two
two
15 ||
15 vears. We
years. we had
naa the
tne initial
initial interview.
interview. And then II thought
And then thought
16 |
16 about it
about it some
some more,
more, remembered
remembered some
some additional
additional things,
things, and
and
17 ||
17 called back
called to make
back to sure II was
make sure was providing complete answers
providing complete answers toto
18 ||
18 their questions.
their questions.
13
19 ©.
Q. Because it
Because it can
can be
be difficult
difficult toto remember
remember things
things
20 ||
20 from several
from several years
years ago.
ago. Right?
Right?
2
21 A.
A. Yes.
Yes.
22
22 ©.
Q. sometimes you
Sometimes you refresh
refresh your
your recollection
recollection before
before you
you
23 ||
23 talk about
talk about them.
them. Right?
might?
2
24 A.
A. ves.
Yes.
25
25 ©.
Q. And you
And you also
also spoke
spoke with
with Nate
Nate Batty
Batty around
around that
that
434
434
1
1 || time.
cine. Right?
migne:
2
2 A.
A. ves.
Yes.
3
3 ©.
Q. Did you
Did you talk
talk to
to him
him before
before the
the first
first interview
interview toto
4 || kind
4 xing of
of get
get ready
reaay for
for it?
itz
5
5 A.
A. I think
I think so,
so, but
but II don't
don't remember.
remember.
6
6 ©.
Q. Is that
Is that something
something that
that you
you encourage
encourage witnesses
witnesses toto
7 || do,
7 do. to
to talk
talk to
to other
other witnesses
witnesses toto see
see if
if your
your recollections
recollections
8 [| are
8 are consistent?
consistent?
9
9 A
A. Yo.
No.
10
10 ©.
Q. Okay. It's
Okay. It's not
not something
something that
that would
would be ordinary
be ordinary
11 | practice.
11 practice. Correct?
correct?
12
12 A.
A. Correct. II was
Correct. was unaware
unaware at
at the
the time
time what
what the
the topic
topic
13 || of
13 of the
the interview
interview would
would be.
be. I1 was
was making
making some
some assumptions.
assumptions.
14
14 ©.
Q. And then,
And then, more recently, you
more recently, you met with
met with
15 || Mr.
15 wr. DeFilippis
perilippis and
and II think
think Johnny
Johnny Algor,
Algor, who
who is
is also
also at
at the
the
16 | table
16 table here,
nere, who's
who's an
an Assistant
Assistant U.S.
U.S. Attorney. Correct?
Attorney. Correct?
17
17 A.
A. ves.
Yes.
18
18 Q.
Q. They wanted
They wanted toto talk
talk to
to you
you about
about whether you might
whether you might
19 || be
19 ve able
able to
to act
act as
as an
an expert
expert inin this
this case
case about
about DNS
DNS data?
data?
20
20 A.
A. Correct.
Correct.
21
21 ©.
Q. You said,
You said, while
while you
you had
had some
some superficial
superficial
22 [| knowledge,
22 xnowledge, youyou didn't
didn't necessarily
necessarily feel
feel qualified
qualified toto be
be an
an
23 || expert
23 expert inin this
this case.
case. Correct,
correct, on
on DNS
DNS data?
data?
24
24 A.
A. on DNS
On DNS data,
data, that's
that's correct.
correct.
25
25 Q.
Q. You then
You then met on May
met on May 6th,
6th, May 12th and
May 12th and yesterday,
yesterday,
435
435
1
1 May 16th, and
May 16th, and when
when II say
say met,
met, it
it could
could have
have been
been via
via
2
2 telepresence. II don't
telepresence. don't know.
know. But
But you
you interacted
interacted with
with them
them
3
3 in connection
in connection with
with preparation
preparation forfor your
your testimony.
testimony. Correct?
Correct?
1
4 A.
A. Yes.
Yes.
5
5 ©.
Q. And last
And last night
night they
they even
even went over with
went over with you
you what
what II
6 || miont
6 ask you.
might ask you. Right?
right?
7
7 A.
A. correct.
Correct.
8
8 ©.
Q. Okay. So
Okay. So hopefully,
hopefully, we can make
we can make this
this smooth,
smooth,
9
9 since it's
since it's my first time
my first time meeting
meeting and
and talking
talking to
to you,
you, but
but
10
10 let's see
let's see what
what we can do.
we can do. Let's
Let's turn
turn to
to your
your testimony.
testimony.
n
11 I'm going
I'm going to
to hit
hit the
the topics.
topics. You
You testified
testified aa little
little bit
bit
12
12 about yourself.
about yourself. Right?
Right?
13
13 A.
A. ves.
Yes.
14
14 ©.
Q. You testified
You testified aa little
little bit
bit about
about obtaining
obtaining the
the
15
15 evidence, the
evidence, the collection
collection ofof the
the evidence.
evidence. Correct?
Correct?
16
16 A.
A. ves.
Yes.
17
17 ©.
Q. You testified
You testified about
about your
your analysis
analysis of
of what you did
what you did
18
18 with the
with the evidence.
evidence. Right?
Right?
19
19 A.
A. ves.
Yes.
20
20 ©.
Q. You testified
You testified about
about your
your conclusions
conclusions about
about the
the
21
21 analysis of
analysis of the
the evidence?
evidence?
22
22 A.
A. Yes.
Yes.
23
23 ©.
Q. And then
And then finally
finally why you think
why you think it
it mattered
mattered ifif you
you
24
24 knew the
knew the source,
source, essentially.
essentially. Right?
Right? High-level
High-level topics?
topics?
25
25 A.
A. Correct.
Correct.
436
436
1
1 ©.
Q. Okay. That's
Okay. That's my road map
my road just so
map just so you
you know
know where
where
2
2 we're going
we're going for
for the
the cross-examination.
cross-examination. So So let's
let's talk
talk about
about
3
3 your background.
your background. YouYou are
are aa Supervisory
Supervisory Special
Special Agent.
Agent.
4
4 Correct?
Correct?
5
5 A.
A. ves, sir.
Yes, sir.
6
6 Q.
Q. Let's break
Let's break that
that down. "Supervisory", II think
down. "Supervisory", think you
you
7
7 said, was
said, was you
you no
no longer
longer do
do investigations,
investigations, you
you supervise
supervise
8
8 then?
them?
9
9 A.
A. Correct.
Correct.
10
10 ©.
Q. How many
How many people do you
people do you supervise?
supervise?
n
11 A.
A. When II have
When have aa full
full team,
team, it
it would
would be
be 10
10 agents
agents and
and
12
12 several additional
several additional support
support staff.
staff.
13
13 ©.
Q. Okay. And
Okay. And "special",
"special", you
you are
are aa special
special agent.
agent. IsIs
14
14 there something
there something unusual
unusual about
about you
you that
that you're
you're aa special
special
15
15 agent, sir?
agent, sir?
16
16 A.
A. No, special
No, special agents
agents and
and the
the term
term agent
agent can
can be
be used
used
17
17 interchangeably. There's
interchangeably. There's nono difference
difference between
between calling
calling
18
18 someone an
someone an agent
agent or
or aa special
special agent
agent in
in the
the FBI.
FBI.
19
19 ©.
Q. So all
So all FBI
FBI agents
agents are
are special
special agents?
agents?
20
20 A.
A. Yes.
Yes.
21
21 ©.
Q. And you
And you testified
testified ---- and
and Ms. Beutler, who
Ms. Beutler, who was
was
22
22 present for
present for your
your first
first two
two interviews,
interviews, isis also
also aa special
special
23
23 agent. Right?
agent. Right?
24
24 A.
A. ves.
Yes.
25
25 ©.
Q. Agents or
Agents or special
special agents,
agents, interchangeably,
interchangeably, they're
they're
437
437
1
1 the ones
the ones who
who actually
actually do
do investigations.
investigations. They take
They take notes,
notes,
2
2 yes?
yes?
3
3 A.
A. ves.
Yes.
4
4 Q.
Q. Write reports.
Write reports. Correct?
Correct?
5
5 A.
A. Correct.
Correct.
6
6 ©.
Q. And Jim
And Jim Baker
Baker was
was aa name
name we've heard here.
we've heard here. He
He was
was
7
7 with the
with the FBI
FBI in
in 2016.
2016. Right?
Right?
8
8 A.
A. ves.
Yes.
9
9 Q.
Q. Was he
Was he an
an agent
agent or
or special
special agent?
agent?
10
10 A.
A. I don't
I don't think
think so.
so. II think
think he
he was
was general
general counsel
counsel
1
11 for the
for the Bureau.
Bureau. II don't believe he
don't believe he was
was aa special
special agent.
agent.
12
12 Q.
Q. So not
So not an
an investigator?
investigator?
13
13 A.
A. Correct.
Correct.
14
14 Q.
Q. Now you
Now you are
are and
and were
were assigned
assigned in
in 2016
2016 to
to the
the cyber
cyber
15
15 division
division of the
of the FBI.
FBI. Correct?
Correct?
16
16 A.
A. Yes, sir.
Yes, sir.
17
17 Q.
Q. And I'm
And I'm repeating
repeating some
some of
of it
it just
just to
to set
set the
the jury.
jury.
18
18 There's aa cyber
There's cyber division
division and
and aa counter
counter intelligence
intelligence
19
19 division.
division. Correct?
Correct?
20
20 A.
A. ves.
Yes.
21
21 ©.
Q. And the
And the cyber
cyber division,
division, is
is that
that the
the initials
initials or
or
22
22 acronym is
acronym is Cy?
Cy?
23
23 A.
A. cyp.
CyD.
24
24 Q.
Q. cyp?
CyD?
25
25 A.
A. Yes, so
Yes, so Cy
Cy for
for cyber
cyber and
and then
then DD for
for division.
division.
438
438
1
1 ©.
Q. What is
What is the
the acronym
acronym for
for the
the counter
intelligence
2|
2 aivisionz
division?
3
3 A.
A. co.
CD.
4
4 ©.
Q. CD. Okay
CD. so CyD
Okay so or CD?
CyD or CD?
5
5 A.
A. Correct.
Correct.
6
6 ©.
Q. And you
And you mentioned,
mentioned, under
under Mr. DeFilippis’
Mr. DeFilippis'
7
7 || questioning, that
questioning, that you
you sometimes
sometimes collaborate.
collaborate. The
mhe two
two
8 ||
8 divisions sometimes
divisions sometimes work
work together.
together. Right?
Right?
9
9 A.
A. ves.
Yes.
10
10 Q.
Q. As of
As of 2016,
2016, there
there was
was aa big
big divide
divide between
between the
the two
two
11 ||
11 asvisions. Correct?
divisions. correct?
12
12 A.
A. There were
There were --
-- in
in 2016,
2016, there
there were competing points
were competing points
13 ||
13 of view
of as to
view as to whether
whether or
or not
not the
the cyber
cyber division
division should
should be
be
14 ||
14 part of
part of the
the counter
intelligence division,
division, and
and so
so there
there was
was
15 ||
15 oftentimes disagreement
oftentimes disagreement between
between the
the two
two divisions.
divisions.
16
16 Q.
Q. Would you
Would you call
call that
that aa big
big divide?
divide?
17
17 A.
A. I would
I would call
call it
it --
-- there
there was
was many, many
many, many
18 |
18 disagreements.
disagreements.
13
19 9.
Q. Did you
Did you call
call it
it aa big
big divide
divide when you met
when you with
met with
20 ||
20 Mr. DeFilippis
Mr. perilippis and
and Special
special Agent Beutler on
Agent Beutler on March
March 12th
12th of
of
21 |
21 20202
2020?
22
22 A.
A. If that's
If that's what's
what's in
in the
the notes,
notes, then
then it
it certainly
certainly
23 ||
23 could have
could have been something II said.
been something said.
2
24 ©.
Q. Do you
Do you want
want to
to see
see the
the report?
report? Would
Would that
that refresh
refresh
25 [[
25 your recollection?
your recolrection?
439
439
1
1 A.
A. sure.
Sure.
2
2 MR. BERKOWITZ: Judge,
MR. BERKOWITZ: Judge, you
you have
have materials.
materials. My
My
3
3 question to
question to you
you is
is would you like
would you like me
me to
to put
put it
it up
up on
on the
the
4
4 screen or
screen or give
give him
him --
--
5
5 THE COURT:
THE COURT: Well, if
Well, if you're
you're refreshing,
refreshing, he
he should
should
6
6 read them
read them to
to himself.
himself.
7
7 MR. BERKOWITZ: Okay.
MR. BERKOWITZ: Okay.
8
8 THE WITNESS:
THE WITNESS: II don't
don't recall
recall specific
specific --
-- I'm
I'm
9
9 sorry, sir.
sorry, sir.
10
10 THE COURT:
THE COURT: Either way.
Either way. Either way.
Either way.
1
11 THE WITNESS:
THE WITNESS: II don't
don't recall
recall specifically
specifically what
what II
12
12 said.
said. II can
can certainly
certainly read
read it,
it, and
and II can
can describe
describe it
it as
as aa
13
13 big divide
big divide now,
now, sure.
sure.
14
14 BY
BY MR.
MR. BERKOWITZ:
BERKOWITZ:
15
15 @.
Q. Okay. Big
Okay. Big divide
divide meaning
meaning that
that there
there were
were
16
16 disagreements between
disagreements between the
the divisions
divisions about
about whether
whether they
they
17
17 should be
should merged or
be merged or otherwise.
otherwise. Correct?
Correct?
18
18 A.
A. ves.
Yes.
19
19 @.
Q. So the
So the cyber
cyber division itself never
division itself never actually
actually opened
opened
20
20 an investigation,
an investigation, you
you testified.
testified. Correct?
Correct?
21
21 A.
A. Not to
Not to this
this allegation.
allegation.
22
22 Q.
Q. Because you
Because you concluded
concluded pretty
pretty quickly
quickly that
that there
there
23
23 was no
was no hack?
hack?
24
24 A.
A. There was
There was no
no allegation
allegation of
of --
-- that's
that's correct.
correct
25
25 There was
There was no
no allegation
allegation of
of aa hacking
hacking incident
incident nor
nor did
did we
we
440
440
1
1 observe anything
observe anything to
to suggest
suggest that
that there
there are
are any
any facts
facts to
to show
show
2
2 that there
that there was a hacking
was a hacking incident.
incident.
3
3 ©.
Q. How long
How long did it take
did it take you
you to
to figure
figure that
that out?
out?
4
4 A.
A. Not very
Not very long.
long.
5
5 ©.
Q. Like five
Like five minutes?
minutes?
6
6 A.
A. We were
We were --
-- II couldn't
couldn't specify
specify the
the specific
specific amount
amount
7
7 of time.
of time.
8
8 ©.
Q. Less than
Less than an
an hour?
hour?
9
9 A.
A. It was
It was inside
inside of
of aa day.
day. But
But that
that specific
specific piece,
piece,
10
10 it was
it reading through
was reading through the
the narrative.
narrative. There
There was
was no
no
n
11 allegation that
allegation that there
there was
was aa hacking
hacking incident.
incident. And then
And then
12
12 looking at
looking at the
the data,
data, there
there was nothing to
was nothing to suggest
suggest or
or no
no
13
13 facts to
facts to show
show that
that this
this --
-- that
that aa hack
hack had
had occurred.
occurred.
14
14 ©.
Q. Okay. And
Okay. And so
so the
the cyber
cyber division
division had
had what's
what's
15
15 referred to
referred to in
in the
the FBI
FBI as
as "no
"no equity".
equity". Correct?
Correct?
16
16 A.
A. Yes, sir.
Yes, sir. That's
That's correct.
correct.
17
17 ©.
Q. Can you
Can you explain
explain toto the
the jury
jury what
what do
do you
you mean
mean when
when
18
18 you say
you say or
or when you conclude
when you conclude the
the cyber
cyber division
division has
has no
no
19
19 equity in
equity in this
this evidence?
evidence?
20
20 A.
A. sure. So
Sure. So if
if there
there was
was an
an allegation
allegation ofof hack,
hack, then
then
21
21 it would
it would bebe up
up to
to the
the cyber
cyber division
division to
to decide
decide further
further what
what
22
22 do we
do do with
we do with this?
this? Do Do we
we investigate
investigate it?
it? Do
Do we not?
we not?
23
23 Those are
Those are choices
choices wewe would
would have,
have, sort
sort of
of ownership
ownership ofof it,
it,
24
24 because our
because our job
job was
was to
to investigate
investigate hacking
hacking crimes.
crimes.
25
25 But when
But when there's
there's nono --
-- in
in that
that case,
case, we would have
we would have
441
441
1
1 equity.
equity. We would
We would have
have some
some ownership.
ownership. As there was
As there was none,
none,
2
2 we did
we did not
not have
have any
any cyber
cyber equity.
equity. There
There was
was no
no allegation
allegation
3
3 of hacking.
of hacking.
4
4 ©.
Q. You were
You were asked
asked to
to do
do aa technical
technical analysis,
analysis, atat
5
5 least at
least at aa high
high level,
level, and
and later
later we'll
we'll talk
talk more about that?
more about that?
6
6 A.
A. ves.
Yes.
7
7 ©.
Q. And did
And did you
you become
become aware
aware at
at some
some point that the
point that the
8
8 counter intelligence
counter intelligence division
division actually
actually opened
opened an
an
9
9 investigation into
investigation into this?
this?
10
10 A.
A. ves.
Yes.
n
11 @.
Q. Okay. So
Okay. So let's
let's turn
turn to
to collection
collection of
of the
the
12
12 evidence. II think
evidence. think you
you testified
testified that
that you
you learned
learned from
from Nate
Nate
13
13 Batty that
Batty that General
General Counsel Baker had
Counsel Baker had received
received some
some evidence.
evidence.
14
14 Correct?
Correct?
15
15 A.
A. ves.
Yes.
16
16 ©.
Q. Do you
Do you remember
remember ifif you
you said
said it
it was
was on
on September
September
17
17 19th?
19th?
18
18 A.
A. I think
I think so,
so, yes.
ves.
19
19 ©.
Q. Do you
Do you remember
remember where
where that
that happened
happened and
and what
what Nate
Nate
20
20 Batty said
Batty said toto you?
you?
21
21 A.
A. Idon't
I -- II mean
don't -- mean II think
think II was
was in
in Chantilly,
Chantilly,
22
22 probably at
probably at my desk. II don't
my desk. don't remember
remember specifically
specifically what
what he
he
23
23 said to
said to me, no.
me, no.
24
24 ©.
Q. Did he
Did he indicate
indicate toto you
you that
that you
you and
and he
he were
were going
going
25
25 to go
to collect the
go collect the evidence?
evidence?
442
442
1
1 A.
A. At that
At that time,
time, II don't
don't remember.
remember.
2
2 ©.
Q. Okay. What
Okay. What caused
caused you
you to
to go
go collect
collect the
the evidence,
evidence,
3
3 if you
if you know?
know?
1
4 A.
A. I knew,
I knew, through
through mymy experience,
experience, that
that we
we were
were going
going
5
5 to need
to need to
to --
-- II knew
knew --
-- II was
was told
told at
at some
some point that we
point that we had
had
6
6 to provide
to the evidence
provide the evidence to
to Chicago.
Chicago. So So II knew
knew that
that we
we --
--
7
7 the proper
the proper procedure would be
procedure would to collect
be to collect the
the evidence.
evidence.
8
8 Check it
Check it into
into an
an evidence
evidence control
control room
room and
and have
have the
the evidence
evidence
9
9 control room
control room ship
ship it
it out
out to
to Chicago
Chicago so
so that
that there
there would
would bebe aa
10
10 proper chain
proper chain of
of custody.
custody.
n
11 ©.
Q. Do you
Do you remember
remember who
who told
told you
you that?
that?
12
12 A.
A. I --
I -- that
that was
was my own thoughts.
my own thoughts.
13
13 ©.
Q. Who told
Who told you
you that
that the
the evidence
evidence needed
needed to
to go to
go to
14
14 Chicago?
Chicago?
15
15 A.
A. Oh, II think
Oh, think Nate.
Nate. II don't remember.
don't remember.
16
16 ©.
Q. And I'm
And I'm from
from Chicago.
Chicago. YouYou weren't
weren't sending
sending itit to
to
17 || me.
17 Tell the
me. Tell the jury
jury what was in
what was in Chicago?
Chicago?
18
18 A.
A. There was
There was another
another team
team of
of agents
agents involved
involved in
in what
what
19
19 -- all
-- all we knew is
we knew is that
that they
they were
were involved
involved inin some
some sort
sort of
of
20
20 special investigation.
special investigation. And And they
they were
were going
going to
to investigate
investigate
21
21 or look
or look into
into this
this further.
further.
22
22 ©.
Q. So at
So at this
this point,
point, onon the
the 19th
19th or
or the
the 20th,
20th, had
had you
you
23
23 been asked
been asked toto do
do any
any work
work with
with respect
respect to
to the
the evidence
evidence or
or
24
24 just collect
just collect itit and
and send
send it?
it?
25
25 A.
A. It was
It was collect
collect it,
it, assess
assess it
it for
for cyber
cyber equities,
equities,
443
443
1
1 and then
and then look
look at
at it
it from
from sort
sort of
of aa technical
technical point
point of
of view
view
2
2 and give
and give it
it some
some sort
sort of
of high-level
high-level analysis
analysis before
before we
we pass
pass
3
3 it on.
it on.
4
4 ©.
Q. So that
So that would
would have
have been
been Mr.
Mr. Batty
Batty telling
telling you
you
5
5 that?
that?
6
6 A.
A. ves.
Yes.
7
7 ©.
Q. Do you
Do you remember
remember where
where he
he heard
heard it
it from,
from, who
who gave
gave
8
8 him direction,
him direction, because FBI, if
because FBI, if nothing
nothing else,
else, is
is aa
9
9 hierarchical place.
hierarchical place. Right?
Right?
10
10 A.
A. I believe
I believe he
he heard
heard it
it from
from his
his direct
direct oror one
one of
of
n
11 our --
our -- someone
someone in
in our
our chain
chain of
of command,
command, II believe
believe itit was
was
12
12 Deputy Assistant
Deputy Director Sporre,
Assistant Director Sporre, Eric
Eric Sporre.
Sporre.
13
13 ©.
Q. A Deputy
A Deputy Assistant Director, does
Assistant Director, does he
he oversee
oversee aa
14
14 particular side
particular side of
of the
the division?
division? In In other
other words, where is
words, where is
15
15 he in
he in the
the reporting
reporting structure?
structure? Is Is he
he above
above special
special agents,
agents,
16
16 above supervisory
above supervisory special
special agents?
agents?
17
17 A.
A. ALL of
All of us
us would
would be
be special
special agents.
agents. ItIt would
would
18
18 probably be
probably be supervisory
supervisory special
special agents
agents and
and then
then unit
unit chiefs
chiefs
19
19 -- Nate
-- would have
Nate would have been a unit
been a unit chief
chief --
-- then
then it
it would
would
20
20 section chiefs
section chiefs and
and then
then II think
think DAD
DAD is
is one
one level
level above
above that.
that.
21
21 ©.
Q. So relatively
So relatively high
high up?
up?
22
22 A.
A. sure.
Sure.
23
23 ©.
Q. And you
And you and
and Special
Special Agent
Agent Batty
Batty drove
drove on
on the
the 20th,
20th,
24
24 or maybe
or you walked,
maybe you walked, II don't know, or
don't know, or took
took public
public
25
25 transportation, you
transportation, you traveled
traveled from
from Chantilly,
Chantilly, Virginia,
Virginia, toto
444
444
1
1 FBI headquarters
FBI headquarters right
right here
here in
in the
the District.
District. Correct?
Correct?
2
2 A.
A. Yes, that's
Yes, that's correct.
correct.
3
3 ©.
Q. Do you
Do you remember
remember who
who you
you met
met with
with when
when you
you got
got to
to
4
4 FBI headquarters
FBI headquarters relative
relative to
to this
this collection
collection ofof evidence?
evidence?
5
5 A.
A. I believe
I we met
believe we met with Jordan Kelly,
with Jordan Kelly, who
who was
was
6
6 working for
working for the
the executive
executive staffing
staffing unit
unit for
for cyber
cyber division.
division.
7
7 ©.
Q. So you,
So you, Ms.
Ms. Kelly
Kelly and
and --
-- Special
Special Agent Kelly?
Agent Kelly?
8
8 A.
A. she's not
She's not aa Special
Special Agent,
Agent, no.
no.
9
9 ©.
Q. What is
What is her
her role?
role?
10
10 A.
A. I actually
I actually don't
don't remember
remember her
her role
role at
at this
this point.
point.
n
11 ©.
Q. Is she
Is she an
an agent?
agent? Is Is she
she an
an investigator?
investigator? Is Is she
she
12
12 an administrator
an administrator or or is
is she
she aa --
--
13
13 A.
A. I think
I think she
she would
would be
be more on the
more on the administrative
administrative
14
14 side of
side of things.
things.
15
15 ©.
Q. Okay. And
Okay. And what
what did
did the
the three
three ---- what
what did
did the
the
16
16 three of
three of you
you discuss
discuss on
on September
September 20th
20th relative
relative to
to this
this
17
17 evidence?
evidence?
18
18 A.
A. That we
That needed to
we needed to obtain
obtain signatures
signatures for
for three
three
19
19 people who
people had --
who had -- we
we believed
believed had
had been
been in
in --
-- or
or had
had custody
custody
20
20 over this
over this evidence.
evidence.
21
21 ©.
Q. Okay. And
Okay. And what
what happened
happened next
next relative
relative to
to this?
this?
22
22 A.
A. don't remember
I don't remember the
the exact
exact timeframe,
timeframe, but
but II know,
know,
23
23 at one
at one point, Nate had
point, Nate had to
to go
go to
to some
some other
other meeting.
meeting. AndAnd we
we
24
24 -- Jordan
-- Jordan and
and II went
went and
and obtained
obtained the
the signature
signature from
from then
then
25
25 FBI General
FBI General Counsel,
Counsel, James
James Baker.
Baker.
445
445
1
1 ©.
Q. So it
So it was
was the
the three
three of
of you
you meeting.
meeting. When you
When you
2
2 obtained the
obtained the signature
signature from
from Mr. Baker on
Mr. Baker on that
that chain
chain ofof
3
3 custody form
custody form --
--
4
4 MR. BERKOWITZ: And
MR. BERKOWITZ: And let's
let's put
put that
that up,
up, if
if we
we can.
can.
5
5 That is
That is Government
Government Exhibit
Exhibit 282.
262.
6
6 (Whereupon, the
(Whereupon, the exhibit
exhibit was
was published.)
published.)
7 || BY
7 BY mr.
MR. meRkoWITZ:
BERKOWITZ:
8
8 ©.
Q. So in
So in the
the upper
upper right
right hand
hand corner
corner of
of that
that
9
9 document, that's
document, that's you
you getting
getting --
-- Mr.
Mr. Baker
Baker is
is filling
filling itit out
out
10
10 in your
in your presence
presence with
with Ms.
Ms. Kelly
Kelly there?
there?
n
11 A.
A. ves.
Yes.
12
12 ©.
Q. Nobody else
Nobody else in
in the
the room
room to
to the
the best
best of
of your
your
13
13 recollection?
recollection?
14
14 A.
A. correct.
Correct.
15
15 ©.
Q. Although it
Although it indicates
indicates date
date and
and time,
time, 2:30
2:30 p.m.
p.m. onon
16
16 the 19th,
the 19th, that's
that's when
when he
he received
received it,
it, not
not when
when you
you did.
did.
17
17 Right?
Right?
18
18 A.
A. That's correct.
That's correct. II believe
believe it
it was
was backdated
backdated to to
19
19 reflect when
reflect when he
he received
received the
the evidence.
evidence.
20
20 ©.
Q. Some people
Some might think
people might think backdated
backdated isis aa dirty
dirty
21
21 thing, but
thing, it was
but it was appropriate
appropriate toto do
do here
here because
because you
you wanted
wanted
22
22 to be
to accurate?
be accurate?
23
23 A.
A. Correct. It
Correct. It was appropriate to
was appropriate to talk
talk toto the
the person
person
24
24 who received
who received the
the data,
data, when did you
when did you receive
receive it.
it. That's
That's what
what
25
25 goes on
goes on the
the form
form so
so we
we know
know exactly
exactly when
when that
that person
person
446
446
1
1 received it.
received it.
2
2 ©.
Q. And at
And at that
that meeting
meeting did
did you
you say
say --
-- II don't
don't know
know ifif
3
3 you call
you call him
him Mr.
Mr. Baker
Baker or
or Jim,
Jim, whatever you call
whatever you call him.
him. Did Did
4
4 you say
you say to
to him,
him, Where did you
Where did you get
get it
it from?
from?
5
5 A.
A. I don't
I don't remember.
remember. II dodo not
not remember
remember any
any
6
6 conversation in
conversation in the
the room.
room.
7
7 Q.
Q. In that
In that meeting?
meeting?
8
8 A.
A. Correct.
Correct.
9
9 ©.
Q. Okay. And
Okay. And after
after you
you got
got Mr. Baker's signature
Mr. Baker's signature -- --
10
10 A.
A. ves.
Yes.
n
11 @.
Q. -- what
-- what did
did you
you do
do next?
next?
12
12 A.
A. Somewhere in
Somewhere in there
there --
-- II think
think Pete
Pete Strzok
Strzok was
was not
not
13
13 available, and
available, and II think
think at
at that
that point Nate came
point Nate came back
back from
from his
his
14
14 meeting.
meeting. Me Me and
and Nate
Nate went
went to
to Deputy
Deputy Assistant
Assistant Director
Director
15
15 Sporre to
Sporre to obtain
obtain his
his signature.
signature.
16
16 ©.
Q. So that's
So that's going
going to
to be
be the
the third
third one
one down.
down. He He
17
17 indicated that
indicated that --
-- Sporre,
Sporre, who
who was
was the
the one
one who
who sort
sort of
of
18
18 directed you
directed you to
to do
do this
this in
in the
the first
first place,
place, said
said that
that hehe
19
19 received it
received it at
at about
about 55 p.m. Correct?
p.m. Correct?
20
20 A.
A. Yes.
Yes.
21
21 ©.
Q. He indicated
He indicated hehe got
got it
it from
from Mr.
Mr. Strzok,
Strzok, Special
Special
22 || agent
22 strzok?
Agent Strzok?
23
23 A.
A. Correct.
Correct.
24
24 ©.
Q. In the
In the meeting
meeting with
with Special
Special Agent
Agent Sporre,
Sporre, itit was
was
25
25 you, Jordan
you, Jordan Kelly?
Kelly?
447
447
1
1 A.
A. II don't
don't remember
remember if if Jordan
Jordan was
was there
there or
or not.
not.
2
2 ©.
Q. Okay. Who
Okay. Who else
else would
would have
have been
been in
in the
the meeting?
meeting?
3
3 A.
A. Just me,
Just Nate and
me, Nate and Mr.
Mr. Sporre,
Sporre, and
and II don't
don't remember
remember
4
4 || if Jordan
if sordan was
was there
there or
or not.
not.
5
5 ©.
Q. At this
At this time,
time, Mr. Batty comes
Mr. Batty comes back
back into
into the
the
6
6 || picture
picture?
7
7 A.
A. ves.
Yes.
8
8 Q.
Q. At that
At that meeting,
meeting, did you say
did you say to
to Special
Special Agent
Agent
9
9 || seorre, Hey,
Sporre, sey, where
wnere aia tnis come
did this come from?
from»
10
10 A.
A. Yes.
Yes.
un
11 ©.
Q. What did
What did he
he say?
say?
12
12 A.
A. He told
He told us
us that
that it
it came
came from
from aa sensitive
sensitive source.
source.
13
13 ©.
Q. okay. And
Okay. And what
what is
is aa sensitive
sensitive source,
source, to
to your
your
14 ||
14 knowredge?
knowledge?
15
15 A.
A. It's kind
It's kind of
of aa broad
broad --
-- II mean,
mean, it
it could
could be many
be many
16 |
16 aifrerent things.
different things.
17
17 ©.
Q. Could it
Could it be an anonymous
be an anonymous source?
source?
18
18 A.
A. II suppose
suppose that's
that's possible depending upon
possible depending upon the
the
19 |
19 context.
context.
20
20 Q.
Q. You know
You know Mr. Batty has
Mr. Batty has characterized
characterized it it as
as the
the
21 ||
21 evidence coming
evidence coming from
from an
an anonymous
anonymous source.
source. Correct?
Correct?
22
22 A.
A. I'mnot
I'm sure if
not sure if that's
that's what
what Mr.
Mr. Batty
Batty
23 ||
23 characterized it
characterized it as.
as.
24
24 ©.
Q. And do
And do you
you remember
remember ---- let's
let's take
take aa look
look --
-- do
do you
you
25
25 [mot recall
not recall or
or are
are you
you saying
saying itit didn't
didn't happen,
happen, because
because II can
can
448
448
1
1 show you
show you something
something to
to refresh
refresh your
your recollection?
recollection?
2
2 A.
A. I don't
I don't recall.
recall.
3
3 ©.
Q. Okay. Let's
Okay. Let's take
take aa look,
look, just
just for
for the
the witness
witness andand
4
4 read it
read it to
to yourself,
yourself, aa copy
copy of
of your
your 302
302 on
on March 20th --
March 20th -- I'm
I'm
5
5 sorry, March
sorry, 12th, Page
March 12th, Page 2,
2, Paragraph
Paragraph ---- I'm
I'm sorry
sorry Page
Page 6,6,
6
6 Paragraph 3?
Paragraph 3?
7
7 A.
A. This is
This is not
not my
my 302.
302. ItIt is
is aa 302
302 about
about me
me but
but it's
it's
8
8 not one
not one that
that II wrote.
wrote.
9
9 Q.
Q. It's about
It's about you.
you. Correct?
Correct?
10
10 A.
A. ves.
Yes.
n
11 ©.
Q. Okay. So
Okay. So let's
let's take
take aa look
look at
at SH-01,
SH-01, Page
Page 6,
§,
12
12 paragraph 3.
Paragraph 3.
13
13 MR. BERKOWITZ: If
MR. BERKOWITZ: If you
you can
can blow
blow that
that out
out for
for him.
him.
14
14 BY
BY MR.
MR. BERKOWITZ:
BERKOWITZ:
15
15 ©.
Q. And read
And read that
that to
to yourself?
yourself?
16
16 A.
A. ves.
Yes.
17
17 ©.
Q. Okay. So
Okay. So having
having read
read that,
that, does
does it
it refresh
refresh your
your
18
18 recollection that
recollection that Nate
Nate Batty
Batty thought
thought that
that it
it had
had come
come from
from
19
19 an anonymous
an anonymous source
source whereas
whereas you
you thought
thought it
it was from aa
was from
20
20 sensitive source?
sensitive source?
21
21 A.
A. I don't
I don't know
know if
if that's
that's what
what he
he thought.
thought. That's
That's
22
22 how he
how he characterized
characterized itit in
in an
an email
email to
to me.
me.
23
23 ©.
Q. Okay. Now,
Okay. Now, next
next thing
thing that
that happened,
happened, you
you get
get itit
24
24 from Sporre.
from Sporre. DidDid you
you understand
understand that
that Special
Special Agent
Agent Sporre
Sporre
25
25 knew where
knew where itit came
came from?
from?
449
449
1
1 A.
A. I did
I didnot -- I'm
not -- I'm not
not sure.
sure.
2
2 ©.
Q. Not sure
Not sure either way?
either way?
3
3 A.
A. Correct.
Correct.
4
4 ©.
Q. Now, the
Now, the next
next thing
thing that
that happened,
happened, with
with respect
respect to
to
5s
5 || tris --
this -- I1 guess
guess it
it was two thumb
was two thump drives
drives and
ana some
some paper
paper or
or
6 [I
6 sust two
just two thumb
thump drives?
arives?
7
7 A.
A. My recollection
My recollection isis it
it was
was two
two thumb
thumb drives
drives and
and
8 [|
8 some hard
some nara copy
copy paver.
paper.
9
9 ©.
Q. So you
So you then
then go
go where
where and
and to
to get
get whose
whose signature?
signature?
10
10 A.
A. At that
At that point,
point, we
we left
left because
because Mr.
Mr. Strzok
Strzok was
was
11 |
11 unavailable, and
unavailable, and we
we left
left the
the chain
chain ofof custody
custody with
with Jordan
Jordan to
to
12 ||
12 obtain mr.
obtain strzok's signature
Mr. Strzok's signature atat aa later
later date.
date.
13
13 ©.
Q. Okay. So
Okay. So she's
she's the
the one
one who
who got
got Mr.
Mr. Strzok's
Strzok's
14 ||
14 signature. Correct?
signature. correct?
15
15 A.
A. I believe
I believe so,
so, yes.
yes.
16
16 ©.
Q. And at
And at some
some subsequent
subsequent time,
time, did
did you
you talk
talk to
to
17 ||
17 mr. Baker about
Mr. Baker about what
what the
the source
source ofof the
the information
information was?
was?
18
18 A
A. vo.
No.
13
19 ©.
Q. Do you
Do you remember
remember being
being interviewed
interviewed inin connection
connection
20 ||
20 with your
with your trial
trial preparation
preparation yesterday?
yesterday?
2
21 A.
A. Yes.
Yes.
22
22 ©.
Q. And do
And do you
you remember
remember inin that
that trial
trial preparation
preparation
23
23 [telling someone
telling someone in
in Chantilly that Baker
Chantilly that Baker wouldn't
wouldn't tell
tell who
who
24 ||
24 provided the
provided the thumb
thumb drives
drives toto Baker?
Baker?
25
25 A.
A. That's correct.
That's correct. II dodo have
have that
that memory
memory of,
of, after
after
450
450
1
1 meeting with Baker,
meeting with Baker, having
having that
that thought
thought of
of that
that Mr. Baker
Mr. Baker
2
2 would not
would not tell
tell me where the
me where the thumb
thumb drives
drives came
came from.
from. II don't
don't
3
3 have the
have the distinct
distinct recollection
recollection ofof how
how it
it went
went down
down during
during
4
4 the actual
the actual meeting
meeting with
with Mr. Baker.
Mr. Baker.
5
5 ©.
Q. So you
So you --
-- are
are you
you sure
sure that
that at
at some
some point
point during
during
6
6 all of
all of this,
this, Mr.
Mr. Baker
Baker refused
refused to
to tell
tell you
you where the
where the
7
7 information came
information came from.
from. Right?
Right?
8
8 A.
A. I don't
I don't know
know if
if it's
it's that
that simple.
simple. II amam confident
confident
9
9 that II have
that have aa memory
memory of
of telling
telling one
one of
of my colleagues in
my colleagues in
10
10 Chantilly expressing
Chantilly expressing some
some frustration
frustration that
that Mr. Baker would
Mr. Baker would
n
11 not tell
not tell me
me where
where the
the thumb
thumb drives
drives came
came from.
from.
12
12 ©.
Q. You've talked
You've talked about
about this
this aa number
number of
of times.
times.
13
13 Correct?
Correct?
14
14 A.
A. ves.
Yes.
15
15 ©.
Q. In your
In your first
first meeting with Mr.
meeting with Mr. DeFilippis
DeFilippis and
and
16
16 Special Agent
Special Beutler, you
Agent Beutler, you had
had aa fuzzy
fuzzy memory that Baker
memory that Baker
17
17 told you
told you it
it was
was aa sensitive
sensitive source
source kind
kind of
of thing
thing and
and he
he
18
18 could not
could not tell
tell you
you where he got
where he got it.
it. Correct?
Correct?
19
19 A.
A. ves.
Yes.
20
20 ©.
Q. You later
You later reiterated
reiterated that
that you're
you're fairly
fairly confident
confident
21
21 you got
you got aa note
note from
from Baker
Baker when
when trying
trying to
to figure
figure out
out who
who the
the
22
22 source of
source of the
the thumb
thumb drive
drive was.
was. Correct?
Correct?
23
23 A.
A. ves.
Yes.
24
24 ©.
Q. Meaning that
Meaning that Baker
Baker could
could not
not tell
tell you.
you. Correct?
Correct?
25
25 A.
A. Whether he
Whether he could
could not
not tell
tell me,
me, II don't
don't know.
know. He He
as1
451
1 | did
1 aia not
not tell
cern me.
me.
2
2 ©.
Q. And you
And you said
said it
it was
was the
the same
same with Sporre?
with Sporre?
3
3 A.
A. specifically, II do
Specifically, do recall
recall asking
asking Mr. Sporre, and
Mr. Sporre, and
2
4 [| ne said
he sata it
it was from aa sensitive
was from sensitive source.
source.
5
5 ©.
Q. Now, did
Now, did Mr. Batty know
Mr. Batty know where
where it
it came
came from?
from?
6
6 A.
A. I don't
I don't think
think so.
so.
7
7 Q.
Q. If Mr.
If Mr. Batty
Batty knew
knew where
where it
it came
came from,
from, it
it would
would
8
8 || nave made
have mace its
its way
way onto
onto the
the chain
chain of
of custody
custody form.
form. correct?
Correct?
9
9 A.
A. It wouldn't
It wouldn't gogo on
on the
the chain
chain of
of custody
custody form.
form. ItIt
10
10 [| would go
would go into
into aa different
aifferent form.
form. ItIt would
would be
be written
written upup in
in
11 |
11 some form
some form or
or fashion,
fashion, yes.
yes.
12
12 ©.
Q. So the
So the green
green sheet,
sheet, we
we talked
talked about
about that.
that. Right?
Right?
13
13 A.
A. ves.
Yes.
14
14 9.
Q. Explain to
Explain to the
the jury
jury what
what the
the green
green sheet
sheet is.
is. SoSo
15 ||
15 we got
we the chain
got the chain of
of custody
custody form
form which
which we saw, and
we saw, and it
it didn't
didn't
16 |
16 nave aa green
have green sheet.
sheet. Right?
Rigntz
17
17 A.
A. Not in
Not in that
that image,
image, no.
no.
18
18 Q.
Q. What is
What is the
the green
green sheet?
sheet?
19
19 A.
A. A green
A green sheet
sheet is
is you
you collect
collect aa piece
piece of
of evidence
evidence
20 [[
20 and you've
and you've got
got two
two things,
things, the
the chain
chain of
of custody
custody that
that shows
shows
21 ||
21 wno all
who all the
the people
people are
are that
that had
haa custody
custody over
over it.
it. And
And the
the
22 ||
22 green sheet
green sheet has
has some
some additional
additional information
information about
about what
what the
the
23 ||
23 item is
item is and
and where
where you
you obtained
obtained it
it from
from and
and when it was
when it was
24 |
24 obtained.
obtained.
25
25 ©.
Q. So if
So if you
you knew
knew where
where it
it came
came from,
from, you
you would
would have
have
452
452
1
1 filled out
filled out the
the green
green sheet.
sheet. Correct?
Correct?
2
2 A.
A. I did
I did not
not know
know where
where it
it came
came from,
from, and
and II was not
was not
3
3 checking into
checking into evidence,
evidence, soso II would
would not
not have
have filled
filled out
out the
the
4
4 green sheet.
green sheet.
5
5 ©.
Q. Who would
Who would have
have been
been the
the appropriate
appropriate person
person toto fill
fill
6
6 out the
out the green
green sheet?
sheet?
7
7 A.
A. Whoever is
Whoever is checking
checking itit into
into evidence.
evidence.
8
8 ©.
Q. Mr. Batty?
Mr. Batty?
9
9 A.
A. sure.
Sure.
10
10 ©.
Q. Okay. If
Okay. If Mr. Batty knew
Mr. Batty knew where it came
where it came from,
from, he
he
n
11 should have
should have filled
filled out
out aa green
green sheet.
sheet. Correct?
Correct?
12
12 A.
A. That is
That is part
part of
of the
the process
process of
of checking
checking inin
13
13 evidence is
evidence is filling
filling out
out aa green
green sheet
sheet and
and providing
providing it it to
to
14
14 the evidence
the evidence control
control room.
room.
15
15 ©.
Q. Did Jordan
Did Jordan Kelly
Kelly know
know where
where it
it came
came from?
from?
16
16 A.
A. I don't
I don't know.
know.
17
17 ©.
Q. If it
If it were
were aa sensitive
sensitive source,
source, would
would it
it surprise
surprise
18
18 you that
you that Jordan
Jordan Kelly
Kelly knew
knew where it came
where it came from?
from?
19
19 A.
A. I don't
I don't know
know that
that II knew
knew enough
enough or
or know
know enough
enough
20
20 about what
about what Jordan's
Jordan's role
role was
was at
at the
the time
time to
to be
be surprised
surprised oneone
21
21 way or
way or the
the other.
other.
22
22 ©.
Q. Well, you
Well, you said
said she
she was
was administrative.
administrative. Correct?
Correct?
23
23 A.
A. ves.
Yes.
24
24 ©.
Q. Would somebody
Would somebody who
who is
is in
in an
an administrative
administrative role
role
25
25 have more
have more knowledge
knowledge about
about who
who the
the source
source is
is than
than you?
you?
453
453
1
1 A.
A. I don't
I don't know
know enough
enough about
about the
the specific,
specific, like
like what
what
2
2 her connections
her connections werewere to
to the
the various
various people
people involved
involved to
to know
know
3
3 one way
one way oror the
the other.
other.
4
4 ©.
Q. Is it
Is it possible
possible that
that Special
Special Agent
Agent Batty
Batty would
would have
have
5
5 known about
known about itit and
and not
not told
told you?
you?
6
6 A.
A. Anything is
Anything is possible,
possible, but
but II don't
don't think
think that's
that's
7
7 likely at
likely at all.
all.
8
8 ©.
Q. You thought
You thought that
that it
it was
was weird
weird that
that Baker
Baker wouldn't
wouldn't
9
9 share the
share the information
information with
with you.
you. Correct?
Correct?
10
10 A.
A. I did,
I did, yes.
yes.
n
11 ©.
Q. You thought
You thought itit was
was off,
off, didn't
didn't you?
you?
12
12 A.
A. Idid
I did.
13
13 ©.
Q. You thought
You thought that
that it
it was
was very
very troubling.
troubling. Correct?
Correct?
14
14 A.
A. It was
It was frustrating.
frustrating.
15
15 ©.
Q. You said
You said frustrating
frustrating onon the
the stand,
stand, but
but you
you also
also
16
16 thought that
thought that it
it was
was troubling,
troubling, didn't you?
didn't you?
17
17 A.
A. It was
It was troubling,
troubling, yes.
yes.
18
18 ©.
Q. Okay. And
Okay. And you
you told
told Mr.
Mr. DeFilippis
DeFilippis and
and Special
Special
19 || Agent
19 Beutler that
Agent Beutler that on
on March
March 13th,
13th, didn't
didn't you?
you?
20
20 A.
A. If that's
If that's what's
what's inin the
the notes,
notes, II don't remember
don't remember
21
21 the specific
the specific dates.
dates.
22
22 ©.
Q. But you
But you told
told them
them that
that at
at some
some point?
point?
23
23 A.
A. It sounds
It sounds like
like --
-- it's
it's an
an accurate
accurate
24
24 characterization now
characterization now and
and so
so it
it wouldn't surprise me
wouldn't surprise me if
if
25
25 that's what
that's what II said.
said. II haven't
haven't memorized all of
memorized all of the
the
asa
454
1
1 || documents.
aocunents.
2
2 ©.
Q. Okay. Let
Okay. Let me
me just
just refresh
refresh your
your recollection
recollection just
just
3 [| so
3 so we can be
we can ve clear.
clear.
1
4 A.
A. sure.
Sure.
5
5 ©.
Q. SH --
SH -- to
to just
just show
show the
the witness
witness SH-2,
SH-2, aa March
March 13th,
13th,
6 || 2020
6 2020 report
report atat Page
page 1,
1, Paragraph
paragraph 3.3.
7
7 A.
A. So II can
So can see
see that
that that's
that's what's in the
what's in the document.
document.
8 || I don't
8 conc disagree
disagree with
with the
the statement.
statement. Those
Those are
are not
not my
my
3 [| notes.
9 notes.
10
10 ©.
Q. Understood, but
Understood, but when
when someone
someone puts
puts something
something inin
11 || quotes
11 quotes inin aa document
document ---- what
what are
are you
you trained,
trained, when
when you're
you're anan
12 || agent,
12 agent, toto put
put something
something inin quotes?
quotes?
13
13 A.
A. sure. That's
Sure. That's specifically
specifically thethe verbatim
verbatim words
words that
that
14 | the
14 the person
person said.
saia.
1s
15 Q.
Q. Does that
Does that refresh
refresh your
your recollection
recollection having
having read
read
16 | that
16 that you
you said
said that
that or
or not?
notz
17
17 A.
A. IIdon't have aa distinct
don't have distinct memory
memory of
of saying
saying it.
it.
18
18 ©.
Q. okay. But
Okay. But you're
you're saying
saying here
here today
today it
it is
is
19 | troubling?
19 trounringz
20
20 A.
A. Yes.
Yes.
21
21 ©.
Q. Okay. So
Okay. So let's
let's take
take aa look.
look. WeWe talked
talked about
about
22 [| Jordan
22 sordan Kelly
xerry ----
23
23 A
A. ves.
Yes.
24
24 ©.
Q. -- and
-- and Nate
Nate Batty.
Batty. Correct?
Correct? TwoTwo people
people who
who
25
25 [worked with
worked you on
with you on the
the chain
chain of
of custody?
custody?
455
455
1
1 A.
A. ves.
Yes.
2
2 Q.
Q. Now, they
Now, they are
are --
-- are
are you
you familiar
familiar with
with something
something
3
3 called link
called link messages?
messages?
4
4 A.
A. ves.
Yes.
5
5 ©.
Q. And what
And what are
are link
link messages?
messages?
6
6 A.
A. ves.
Yes.
7
7 @.
Q. Explain to
Explain to the
the jury.
jury. II wasn't
wasn't even
even familiar
familiar with
with
8
8 them so
them so --
--
9
9 A.
A. It's just
It's just an
an internal
internal --
-- it
it is
is aa Microsoft
Microsoft
10
10 product. II don't
product. don't know
know that
that it's
it's used
used anymore
anymore but
but may
may have
have aa
1
11 different name.
different name. Now
Now it's
it's an
an internal
internal chat
chat system
system that
that the
the
12
12 FBI uses.
FBI uses.
13
13 Q.
Q. Okay.
Okay. So it's
So it's aa way that FBI
way that FBI agents
agents communicate
communicate
14
14 with each
with each other.
other. Correct?
Correct?
15
15 A.
A. ves.
Yes.
16
16 Q.
Q. It's not
It's not email but it's
email but it's similar
similar to
to that?
that?
17
17 A.
A. It's Instamessage.
It's Instamessage.
18
18 Q.
Q. It's Instamessage.
It's Instamessage. AllAll right.
right. I'd
I'd like
like to
to show
show
19
19 you what
you what will
will be
be marked
marked for
for identification
identification as
as Defense
Defense
20
20 Exhibit 509,
Exhibit 509, and
and II would move for
would move for admission
admission into
into evidence.
evidence.
21
21 MR. DeFILIPPIS: No
MR. DeFILIPPIS: objection, Your
No objection, Your Honor.
Honor.
22
22 THE COURT:
THE COURT: It's admitted.
It's admitted.
23
23 (Defendant's Exhibit
(Defendant's Exhibit 509
509 was
was admitted.)
admitted.)
24
24 (Whereupon, the
exhibit was
was published.)
published.)
25
25 MR. BERKOWITZ: If
you could
could blow
blow up
up the
the first
first
456
456
1
1 four boxes
four boxes down
down to
to 4788.
4788.
2
2 || BY
BY mr.
MR. mERKOWITZ:
BERKOWITZ:
3
3 ©.
Q. This is
This is Link
Link messages
messages onon September
September 20th.
20th. To To be
be
4
4 fair, it's
fair, it's between various people.
between various You are
people. You are not
not on
on here.
here.
5
5 Correct?
Correct?
6
6 A.
A. I do
I do not
not see
see my name on
my name on there,
there, no.
no.
7
7 @.
Q. Ncbatty, do
Ncbatty, you understand
do you understand you've
you've linked
linked with him
with him
8
8 before. Right?
before. Right?
9
9 A.
A. Yes, that
Yes, that would
would be
be Nate
Nate Batty.
Batty.
10
10 ©.
Q. And Jrsmith,
And Jrsmith, is
is that
that Jordan
Jordan Kelly?
Kelly?
n
11 A.
A. I don't
I don't remember
remember that,
that, her
her name
name showing
showing upup as
as
12
12 Smith, but
Smith, I've been
but I've been told
told that
that that
that would
would represent
represent Jordan
Jordan
13
13 Kelly.
Kelly.
14
14 ©.
Q. Do you
Do you know
know whether
whether the
the time
time is
is correct
correct oror
15
15 sometimes it
sometimes it depends
depends where
where it
it comes
comes from
from because
because these
these areare
16
16 after the
after the chain
chain of
of custody
custody reference
reference at
at 12:29?
12:29?
17
17 A.
A. don't know
I don't know if
if those
those times
times are
are correct
correct oror not.
not.
18
18 Q.
Q. It says,
It says, "Jordan,
"Jordan, the
the A/AD has two
A/AD has two thumb
thumb drives.
drives.
19
19 We can
We can come
come pick
pick them
them up
up this
this a.m."
a.m." This
This is
is from
from Nate
Nate toto
20
20 Jordan, "Did
Jordan, "Did the
the A/AD
A/AD do
do aa chain
chain of
of custody
custody with
with the
the person
person
21
21 he got
he the drives
got the drives from?"
from?" Do
Do you
you see
see that?
that?
22
22 A.
A. Yes.
Yes.
23
23 Q.
Q. Is the
Is the A/AD
A/AD Sporre?
Sporre?
24
24 A.
A. ves.
Yes.
25
25 ©.
Q. Okay. Does
Okay. Does this
this appear
appear to
to reference
reference the
the two
two thumb
thumb
457
457
1
1 drives that
drives that we've
we've been
been talking
talking about?
about?
2
2 A.
A. I believe
I believe so,
so, yes.
yes.
3
3 ©.
Q. And the
And the next
next one,
one, the
the third
third one
one down
down is
is at
at
4
4 9/20/16. It
9/20/16. It says,
says, "You
"You got
got the
the signatures
signatures from
from all
all of
of those
those
5
5 people?” That's
people?" That's from
from Batty
Batty toto Jordan
Jordan Kelly.
Kelly. Correct?
Correct?
6
6 A.
A. ves.
Yes.
7
7 Q.
Q. It says,
It says, from
from Jordan
Jordan Kelly
Kelly responding
responding toto Nate
Nate
8
8 Batty, "Sussmann
Batty, "Sussmann toto Strzok
Strzok to
to Sporre,
Sporre, we
we can
can get."
get." Correct?
Correct?
9
9 A.
A. That's what
That's what it
it says,
says, yes.
yes.
10
10 ©.
Q. If you'd
If you'd seen
seen that,
that, you
you would
would have
have asked,
asked, who
who is
is
n
11 Sussmann. Right?
Sussmann. Right?
12
12 A.
A. I don't
I don't know
know what
what II would
would have
have said.
said.
13
13 ©.
Q. In doing
In doing aa chain
chain of
of custody,
custody, would you have
would you have said,
said,
14
14 “Well, II see
"Well, see Strzok
Strzok and
and II see
see Sporre.
Sporre. Who is Sussmann?"
Who is Sussmann?"
15
15 You don't
You don't think
think you
you would
would have
have asked
asked that?
that?
16
16 A.
A. I have
I have no
no knowledge
knowledge ofof the
the name
name Sussmann,
Sussmann, soso
17
17 that's certainly
that's certainly aa possible response II would
possible response have had.
would have had.
18
18 ©.
Q. Mr. Sussmann's
Mr. Sussmann's name
name does
does not
not appear
appear anywhere
anywhere onon
19
19 the FBI
the FBI intake,
intake, the
the custody
custody paperwork,
paperwork, or
or aa green
green sheet
sheet that
that
20
20 you've seen.
you've seen. Correct?
Correct?
21
21 A.
A. Correct. It
Correct. It does not.
does not.
22
22 ©.
Q. All right.
All right. Let's
Let's now
now talk
talk about
about the
the data.
data. YouYou
23
23 were asked
were asked toto do
do two
two things.
things. Right?
Right?
24
24 A.
A. ves.
Yes.
25
25 ©.
Q. First, was
First, was there
there aa hacking.
hacking. Right?
Right?
458
458
1
1 A.
A. correct.
Correct.
2
2 ©.
Q. We talked
We talked about
about that
that before you quickly
before you quickly concluded
concluded
3
3 and you
and you said
said within
within aa day
day that
that there
there was
was no
no intrusion
intrusion and
and so
so
4
4 no cyber
no cyber equity.
equity. Correct?
Correct?
5
5 A.
A. That's correct.
That's correct.
6
6 ©.
Q. And then
And then you
you were asked to
were asked to review
review with
with your
your
7
7 technical background
technical background the
the data.
data. Right?
Right?
8
8 A.
A. That's correct.
That's correct.
9
9 ©.
Q. Do you
Do you remember
remember who
who asked
asked you
you to
to do that?
do that?
10
10 A.
A. It was
It was coming
coming from
from Nate.
Nate.
n
11 ©.
Q. Okay. And
Okay. And tell
tell us,
us, as
as best
best you
you can
can recall
recall ---- so
so II
12
12 think it
think it said
said 12:29,
12:29, you
you and
and Special
Special Agent
Agent Batty
Batty --
-- Special
Special
13
13 Agent Batty
Agent Batty takes
takes control
control ofof the
the evidence
evidence atat 12:29
12:29 according
according
14
14 to that
to that custody
custody sheet.
sheet. Did
Did you
you guys
guys then
then go
go back
back to
to
15
15 Chantilly and
Chantilly and start
start working
working itit up?
up? DoDo you
you remember
remember what
what you
you
16
16 aid?
did?
17
17 A.
A. I think
I think so.
so. II think
think that's
that's exactly
exactly what
what we did.
we did.
18
18 ©.
Q. Explain what
Explain what you
you would have done
would have done just
just so
so the
the jury
jury
19
19 can understand
can understand from
from aa technical
technical standpoint?
standpoint?
20
20 A.
A. sure. So
Sure. So II mean
mean the
the first
first thing
thing we
we did
did was
was just
just
21
21 to read
to read through
through what
what was
was there,
there, just
just get
get an
an idea,
idea, what
what am
am II
22
22 looking at?
looking at? WeWe were
were told
told very
very little
little about
about the
the information,
information,
23
23 if anything
if anything atat all.
all. And,
And, II mean, before you
mean, before you can
can make
make any
any
24
24 sort of
sort of assessment,
assessment, you've
you've got to just
got to just understand
understand what
what you
you
25
25 have. So
have. So it
it was
was reading
reading through
through the
the various
various documents.
documents.
459
459
1
1 ©.
Q. The hard
The hard copy
copy documents?
documents?
2
2 A.
A. I believe
I believe so,
so, yes.
yes.
3
3 ©.
Q. And do
And do the
the hard
hard copy
copy documents contain the
documents contain the DNS
DNS
4
4 data or
data or are
are they
they the
the white
white paper that Mr.
paper that Mr. DeFilippis
DeFilippis showed
showed
5
5 you?
you?
6
6 A.
A. I think
I think it
it was
was both,
both, but
but II don't
don't have
have aa strong
strong
7
7 recollection.
recollection.
8
8 ©.
Q. It's your
It's your recollection
recollection but
but not
not certainty
certainty that
that
9
9 there were,
there were, like
like 18
18 pages
pages of
of DNS
DNS data?
data?
10
10 A.
A. I don't
I don't remember.
remember.
n
11 Q.
Q. Okay. One
Okay. One way
way or
or the
the other?
other?
12
12 A.
A. I know
I know there
there was
was paper.
paper. II know
know there
there were
were thumb
thumb
13
13 drives. II know
drives. know we
we looked
looked at
at the
the various
various documents,
documents, but
but II
14
14 don't have
don't have aa strong
strong recollection
recollection one
one way
way or
or the
the other.
other.
15
15 ©.
Q. Do you
Do you remember
remember when
when you
you plugged
plugged inin the
the thumb
thumb
16
16 drive for
drive for the
the first
first time?
time?
17
17 A
A. Yo.
No.
18
18 ©.
Q. So fair
So fair to
to say
say that,
that, in
in reading
reading even
even the
the white
white
19
19 paper, you
paper, you quickly
quickly started
started having
having scepticism
scepticism about
about it.
it.
20
20 Fair?
Fair?
21
21 A.
A. ves.
Yes.
22
22 ©.
Q. And in
And in fact,
fact, relatively
relatively early
early on,
on, you
you were
were linking
linking
23
23 with Special
with Special Agent
Agent Batty
Batty about
about this.
this. I'm
I'm going
going to
to show
show you
you
24
24 what's been
what's been marked for identification
marked for identification as as Defense
Defense Exhibit
Exhibit
25
25 513, and
513, and I'd
I'd move
move for
for admission
admission ofof 513.
513.
460
460
1
1 (Whereupon, the
exhibit was
was published.)
published.)
2
Honor.
3
3 THE COURT:
THE COURT: So
So moved.
moved.
4
513 was
was admitted.)
admitted.)
5
5 BY
BY MR.
MR. BERKOWITZ:
BERKOWITZ:
6
6 ©.
Q. I'm going
I'm going to
to say
say to
to you
you that
that I'm
I'm old
old and
and II had
had
7
7 trouble reading
trouble reading this,
this, so
so I'm
I'm going
going to
to blow
blow out
out aa particular
particular
8
8 section of
section of it.
it.
9
9 MR. BERKOWITZ: The
MR. BERKOWITZ: The sort
sort of
of third
third chunk
chunk from
from the
the
10
10 bottom, if
bottom, if you
you could
could blow
blow that
that out.
out. We've highlighted
We've highlighted some.
some.
1
11 The highlighting
The highlighting was
was not
not in
in the
the original.
original. Okay? Just to
Okay? Just to be
be
12
12 really clear.
really clear.
13
13 BY
BY MR.
MR. BERKOWITZ:
BERKOWITZ:
14
14 @.
Q. At 9/20,
At 9/20, which is the
which is the same
same day
day that
that you
you picked
picked up
up
15
15 the data.
the data. Correct?
Correct?
16
16 A.
A. ves.
Yes.
17
17 Q.
Q. showing at
Showing at 18:58
18:58 from
from you
you to
to Nate Batty.
Nate Batty. Correct?
Correct?
18
18 A.
A. ves.
Yes.
19
19 @.
Q. It says,
It says, "The
"The more
more II read
read this
this thing,
thing, it
it feels
feels aa
20
20 little 5150ish"?
little 5150ish"?
21
21 A.
A. ves.
Yes.
22
22 Q.
Q. That may
That may be a technical
be a technical term.
term. II think
think II know
know what
what
23
23 it means,
it but could
means, but could you
you tell
tell the
the jury
jury what
what you
you meant when
meant when
24
24 you said,
you said, "it
"it feels
feels aa little
little 5150ish"?
5150ish"?
25
25 A.
A. I specifically
I specifically meant
meant that
that II thought
thought perhaps
perhaps the
the
461
461
1
1 person who
person had drafted
who had drafted this
this document
document was
was suffering
suffering from
from some
some
2
2 || mental disability.
mental disability.
3
3 ©.
Q. So you
So you had
had quickly
quickly concluded
concluded within
within a a relatively
relatively
4
4 short period
short period ofof time
time that
that there
there was
was an
an issue.
issue. Correct?
Correct?
5
5 A.
A. Yes.
Yes.
6
6 ©.
Q. Okay. And
Okay. And you
you at
at that
that time
time had
had not
not reviewed
reviewed all
all
7
7 of the
of the data,
data, had
had you,
you, sir?
sir?
8
8 A.
A. All of
All of the
the data
data --
-- I'm
I'm not
not sure
sure specifically
specifically what
what
9
9 you mean
you mean by
by that.
that.
10
10 @.
Q. Well, you
Well, you said
said that
that --
-- II think
think you
you said
said to
to
n
11 Mr. DeFilippis on
Mr. DeFilippis on direct
direct that
that there
there was
was aa limited
limited amount
amount ofof
12
12 data and
data and you
you reviewed
reviewed it.
it. Correct?
Correct?
13
13 A.
A. We did
We did review
review the
the data
data that
that it
it came
came with.
with. When
When
14
14 you said
you said didn't
didn't review
review --
-- I'm
I'm just
just not
not quite
quite sure
sure what
what your
your
15
15 question is.
question is.
16
16 ©.
Q. Do you
Do you remember
remember when
when you
you reviewed
reviewed the
the actual
actual --
--
17
17 the DNS,
the DNS, the
the 18
18 pages
pages of
of DNS
DNS data,
data, single-space
single-space thousands
thousands ofof
18
18 lines, do
lines, do you
you remember
remember when you reviewed
when you reviewed that?
that?
19
19 A.
A. A specific
A specific time,
time, no.
no.
20
20 ©.
Q. All right.
All right. You
You did
did say
say that
that the
the information
information
21
21 contained an
contained an absurd
absurd amount
amount of
of data.
data. Correct?
Correct?
22
22 A.
A. If that's
If that's how
how it
it was characterized.
was characterized.
23
23 ©.
Q. Your words,
Your four down
words, four at 9/20
down at 9/20 at
at 19:08:12.
19:08:12.
24
24 A.
A. Yes. II see
Yes. see it,
it, yes.
yes. Uh-huh.
Uh-huh.
25
25 MR. BERKOWITZ: You
MR. BERKOWITZ: You can
can take
take that
that down.
down.
62
462
1
1 || BY
BY mr.
MR. eerxowrrz:
BERKOWITZ:
2
2 ©.
Q. Within aa short
Within short period
period of
of time
time you
you had
had essentially
essentially
3 || dismissed
3 aismissed what
wnat was
was in
in the
the white
unite paper,
paper, correct,
correct, in
in your
your own
own
a [| mina2
4 mind?
5
5 A.
A. Yes.
Yes.
6
6 ©.
Q. But you
But you were
were then
then --
-- and
and you
you don't
don't know
know for
for
7 || certain
7 certain byby that
that time
tine whether
whether you
you had
had actually
actually done
done an
an
8 || analysis
8 anarysis ofof the
che data.
ata. correctz
Correct?
9
9 A.
A. Iam
I not quite
am not sure of
quite sure of your
your question.
question.
10
10 Q.
Q. There was
There was the
the hard
hard copy
copy documents
documents and
and then
then ---- that
that
11 || were
11 were words
words inin English
English that
that II can
can understand
understand at
at least
least atat aa
12 || high
12 nigh level,
level, and
and then
then there
there were thousands of
were thousands of lines
lines of
of
13 | numbers?
13 numvers?
14
14 A.
A. ves.
Yes.
1s
15 ©.
Q. Had you
Had you looked
looked at
at the
the thousands
thousands of
of lines
lines of
of
16 || numbers
16 numbers which
which we,
we, II think
think inin this
this courtroom,
courtroom, recognized
recognized areare
17 || what's
17 what's called
called DNS
ows data?
data?
18
18 A.
A. ves.
Yes.
13
19 9.
Q. By that
By that time?
time?
20
20 A.
A. Looked at
Looked at them,
them, yes.
yes. Had
Had II plotted
plotted each
each
21 || individual
21 individual oneone out
out to
to make
make sure
sure they
they matched
matched the
the specific
specific
22 [ summary,
22 summary, I1 don't
don't think
think so.
so.
23
23 Q.
Q. Now, you're
Now, you're not
not aa DNS
DNS expert?
expert?
2
24 A.
A. No, sir.
No, sir.
25
25 ©.
Q. So at
So at some
some point
point the
the next
next day
day you
you get
get asked
asked toto
463
463
1
1 work on
work on an
an analysis.
analysis. Correct?
Correct?
2
2 A.
A. ves.
Yes.
3
3 MR. BERKOWITZ: And
MR. BERKOWITZ: And let's
let's pull
pull back
back up
up our
our
4
4 document DX-509,
document DX-509, and
and we'll
we'll go to Page
go to Page 2.
2. This
This is
is in
in
5
5 evidence. And
evidence. And please go to
please go to the
the sixth,
sixth, seventh
seventh and
and eighth
eighth
6
6 Line.
line.
7
7 BY
BY MR.
MR. BERKOWITZ:
BERKOWITZ:
8
8 @.
Q. Okay. So
Okay. So this
this is
is the
the next
next day
day at
at 12:47,
12:47, 9/21/2016
9/21/2016
9
9 from Nate
from Nate to
to you.
you. Correct?
Correct?
10
10 A.
A. ves.
Yes.
1
11 Q.
Q. It says,
It says, "Tim
"Tim asked
asked if
if we
we would
would write
write aa brief
brief
12
12 summary report
summary report of
of what
what we think about
we think about the
the DNC
DNC report."
report." DoDo
13
13 you see
you see that?
that?
14
14 A.
A. ves.
Yes.
15
15 Q.
Q. Who's Tim?
Who's Tim?
16
16 A.
A. Tim would
Tim would have
have been
been our
our acting
acting section
section chief,
chief, so
so
17
17 it would
it would have been
have been two
two levels
levels above
above me or one
me or one of
of our
our
18
18 direction supervisors.
direction supervisors.
19
19 Q.
Q. And did
And did he
he oversee
oversee aa couple
couple of
of different
different units
units or
or
20
20 just your
just your unit?
unit?
21
21 A.
A. Multiple units.
Multiple units.
22
22 Q.
Q. Okay.
Okay. So he's
So he's within
within --
-- again,
again, he's
he's on
on the
the cyber
cyber
23
23 side.
side. Right?
Right?
24
24 A.
A. ves.
Yes.
25
25 Q.
Q. Okay.
Okay. And among
And among the
the divisions
divisions he
he oversaw
oversaw was
was the
the
464
464
1
1 division that
division that was
was looking
looking into
into the
the DNC
DNC hack.
hack. Correct?
Correct?
2
2 A.
A. ves.
Yes.
3
3 ©.
Q. You weren't
You weren't involved
involved inin that
that investigation.
investigation.
4
4 Correct?
Correct?
5
5 A.
A. Not directly.
Not directly. Very
Very minimal.
minimal.
6
6 Q.
Q. Not --
Not --
7
7 A.
A. Not directly,
Not directly, no.
no.
8
8 ©.
Q. But Special
But Special Agent
Agent Stranahan
Stranahan was
was supervising
supervising that
that
9
9 investigation. Correct?
investigation. Correct?
10
10 A.
A. ves.
Yes.
n
11 ©.
Q. And Nate
And Nate writes back, at
writes back, at 9/21/16.
9/21/16. Correct?
Correct? AndAnd
12
12 he says,
he says, "I
“I can
can do
do it"?
it"?
13
13 A.
A. ves.
Yes.
14
14 ©.
Q. All right.
All right. And
And then,
then, with
with respect
respect to
to Stranahan,
Stranahan,
15
15 he asks
he asks you
you and
and Nate
Nate to
to write
write aa report
report about
about the
the --
-- write
write aa
16
16 summary of
summary of the
the DNC
DNC report.
report. Correct?
Correct? That's
That's what
what it
it says?
says?
17
17 A.
A. That's what
That's what it
it says
says in
in this
this chat,
chat, yes.
yes.
18
18 ©.
Q. And did
And did you
you understand,
understand, sir,
sir, that
that the
the information
information
19
19 had come
had come from
from aa DNC,
DNC, meaning
meaning Democratic
Democratic National
National Committee,
Committee,
20
20 source?
source?
21
21 A.
A. I did
I did not
not understand
understand that,
that, no.
no.
22
22 ©.
Q. Did you
Did you know
know what Nate Batty
what Nate Batty knew
knew about
about it?
it?
23
23 A.
A. I don't
I don't think
think he
he knew
knew anything
anything about
about it.
it.
24
24 ©.
Q. Did you
Did you call
call up
up Tim
Tim and
and say,
say, wait
wait aa second.
second. This
This
25
25 is aa DNC
is DNC report?
report? That's
That's political
political motivation.
motivation.
465
465
1
1 A.
A. Yo.
No.
2
2 ©.
Q. Didn't do
Didn't do anything
anything or
or it
it didn't
didn't occur
occur to
to you?
you?
3
3 A.
A. The first
The first time
time II saw
saw this
this was
was two
two years
years ago
ago when
when II
4
4 was being
was being interviewed
interviewed byby Mr.
Mr. DeFilippis,
DeFilippis, and
and II don't
don't recall
recall
5
5 ever seeing
ever seeing it.
it. II never
never had
had any
any recollection
recollection ofof this
this
6
6 information coming
information coming from
from the
the DNC.
DNC. II don't
don't remember
remember DNC
DNC being
being
7
7 a part
a part of
of anything
anything that
that we
we read
read or
or discussed.
discussed.
8
8 ©.
Q. Okay. When
Okay. When you
you say,
say, the
the first
first time
time you
you saw
saw it
it was
was
9
9 two years
two years ago
ago when
when you
you met
met with Mr. DeFilippis,
with Mr. DeFilippis, that's
that's not
not
10
10 accurate. Right?
accurate. Right? You
You saw
saw it
it on
on September
September 21st,
21st, 2016.
2016.
n
11 Correct?
Correct?
12
12 A.
A. It's in
It's in there.
there. II don't
don't have
have any
any memory
memory ofof seeing
seeing
13
13 it.
it.
14
14 ©.
Q. So he
So he writes
writes back -- or
back -- or he
he continues
continues on.
on. AsAs you
you
15
15 said, it's
said, it's instant
instant message, so he
message, so he pings
pings you
you at
at -47,
-47, -48.
-48. He He
16
16 pings you
pings you 12:47:50
12:47:50 and
and then
then at
at 12:48:05,
12:48:05, he
he says,
says, "I'm
"I'm
17
17 thinking we
thinking we should
should at
at least
least plug
plug the
the thumb
thumb drives
drives into
into
18
18 Frank's computer
Frank's computer and
and look
look at
at the
the files."
files." Right?
Right?
19
19 A.
A. That's correct.
That's correct.
20
20 ©.
Q. Had you
Had you not
not looked
looked at
at the
the thumb
thumb drives
drives before
before
21
21 September 21st,
September 21st, 2016
2016 at
at 12:48?
12:48?
22
22 A.
A. I don't
I don't think
think so.
so. II think
think what
what we
we had
had done
done was,
was,
23
23 to the
to the best of my
best of recollection, is
my recollection, is we reviewed the
we reviewed the
24
24 information in
information in the
the hard
hard copy
copy documents,
documents, and
and II was
was concerned
concerned
25
25 about plugging
about plugging the
the thumb
thumb drives
drives into
into --
-- since
since we
we were
were going
going
466
466
1
1 to be
to turning this
be turning this into
into evidence,
evidence, we
we wanted
wanted to
to make sure
make sure
2
2 that we
that we didn't
didn't alter
alter the
the thumb
thumb drives
drives in
in any
any way.
way. So we
So we had
had
3
3 not plugged
not plugged them
them in
in at
at that
that point,
point, but
but we wanted to
we wanted to make
make
4
4 sure that
sure that what
what was on the
was on the thumb
thumb drives
drives actually
actually matched what
matched what
5
5 we had
we had in
in the
the hard
hard copy
copy papers.
papers.
6
6 Q.
Q. So let's
So let's take
take aa look,
look, two
two more lines down,
more lines down, the
the
7
7 next two
next two lines.
lines. So So after
after Batty
Batty saying,
saying, "We
"We should
should at
at least
least
8
8 plug the
plug the thumb
thumb drives into Frank's
drives into Frank's computer,"
computer,” you
you ultimately
ultimately
9
9 write back
write back at
at 12:51:37,
12:51:37, soso that's
that's you
you writing
writing toto him,
him,
10
10 "Probably not
"Probably not an
an issue,
issue, but
but just
just FYI,
FYI, pretty
pretty sure
sure his
his write
write
n
11 blocker isn't
blocker isn't BU
BU approved."
approved." Right?
Right?
12
12 A.
A. That's what
That's what II wrote,
wrote, yes.
yes.
13
13 ©.
Q. So it
So it appears
appears clear
clear on
on the
the 21st,
21st, you
you and
and he
he were
were
14
14 actually communicating
actually communicating in in this
this chat.
chat. Correct?
Correct?
15
15 A.
A. ves.
Yes.
16
16 ©.
Q. It wasn't
It wasn't like
like it
it sort
sort of
of went
went into
into aa space
space that
that
17
17 you weren't
you weren't paying attention to.
paying attention to. You
You were
were engaged
engaged in
in this
this
18
18 chat with
chat with him.
him. Right?
Right?
19
19 A.
A. Act this
At this point,
point, yes.
yes.
20
20 ©.
Q. And who's
And who's Frank?
Frank?
21
21 A.
A. Frank would
Frank would have
have been another special
been another special agent
agent that
that
22
22 we worked
we within the
worked within the ECOU.
ECOU.
23
23 ©.
Q. okay. And
Okay. And let's
let's just
just go
go to
to the
the last
last entry
entry on
on this
this
24
24 document, which
document, which is
is on
on Page
Page 3,
3, Line
Line 5313.
5313. You
You say
say at
at
25
25 1:07:59, "Frank's
1:07:59, “Frank's write
write blocker
blocker won't
won't work
work for
for thumb
thumb drives.
drives.
467
467
1
1 No USB
No USB input."
input." Correct?
Correct?
2
2 A.
A. That's what
That's what II wrote,
wrote, yes.
yes.
3
3 ©.
Q. So as
So as of
of 1:07:59,
1:07:59, you
you and
and Special
Special Agent Batty had
Agent Batty had
4
4 not opened
not opened the
the thumb
thumb drive
drive in
in the
the computer.
computer. Correct?
Correct?
5
5 A.
A. I don't
I don't think
think so.
so.
6
6 ©.
Q. Do you
Do you remember
remember when
when after
after that
that you
you did?
did?
7
7 A.
A. Ido
I not. II believe
do not. it was
believe it was shortly
shortly after
after that,
that,
8
8 but II don't
but don't remember
remember when.
when.
9
9 ©.
Q. Okay. And
Okay. And do
do you
you remember
remember --
-- and
and so
so --
-- other
other than
than
10
10 reading --
reading -- well, let's do
well, let's this. Do
do this. Do you
you remember
remember when
when it
it was
was
n
11 you actually
you actually did
did the
the analysis
analysis that
that Tim
Tim Stranahan
Stranahan asked
asked for
for
12
12 you to
you to do
do and
and Mr.
Mr. DeFilippis
DeFilippis showed
showed to
to you
you and
and the
the jury?
jury?
13
13 A.
A. The written
The written product?
product?
14
14 ©.
Q. Yeah, the
Yeah, the written
written product.
product.
15
15 A.
A. I don't
I don't remember
remember specifically,
specifically, but
but it
it was
was between
between
16
16 the 20th
the 20th and
and the
the 21st.
21st.
17
17 @.
Q. It was
It was what?
what?
18
18 A.
A. I don't
I don't remember
remember specifically,
specifically, but
but it
it would
would have
have
19
19 been between
been between the
the 20th
20th and
and the
the 21st.
21st.
20
20 ©.
Q. All right.
All right. SoSo Tim
Tim Stranahan's
Stranahan's ---- Nate
Nate Batty's
Batty's
21
21 text linked
text linked toto you
you was the 21st
was the 21st at
at 12:47
12:47 asking
asking you
you to
to do
do aa
22
22 written --
written -- aa brief
brief summary
summary of
of the
the DNC
DNC report.
report. He He said
said he
he
23
23 could do
could do it.
it. SoSo at
at some
some point
point after
after that
that presumably
presumably itit was
was
24
24 prepared?
prepared?
25
25 A.
A. Well, II don't
Well, don't know
know whether
whether there
there was
was aa separate
separate
468
468
1
1 brief summary
brief summary or
or whether
whether or
or not
not he
he was referring to
was referring to the
the
2
2 product that
product that we
we wrote.
wrote. Like, our
Like, our product
product was
was probably
probably aa
3
3 couple pages,
couple let's say.
pages, let's say. So II don't
So don't know
know whether
whether or
or not
not we
we
4
4 were being
were being asked
asked for
for even
even aa shorter
shorter version
version in
in that
that
5
5 statement.
statement.
6
6 Q.
Q. So you
So you think
think there
there might
might have
have been
been aa longer
longer
7
7 version. Have
version. Have you
you seen
seen aa longer
longer version,
version, sir?
sir?
8
8 A.
A. No, I'm
No, I'm saying
saying II don't know if
don't know if there
there was
was aa shorter
shorter
9
9 version.
version.
10
10 Q.
Q. Okay. Do
Okay. Do you
you know
know when
when you
you circulated
circulated the
the
1
11 analysis, the
analysis, the written
written analysis?
analysis?
12
12 A.
A. ves, on
Yes, on the
the 21st,
21st, September
September 21st.
21st.
13
13 Q.
Q. Time?
Time?
14
14 A.
A. I don't
I don't remember.
remember.
15
15 Q.
Q. Okay. Let
Okay. Let me
me show
show you
you what
what we'll
we'll mark as Defense
mark as Defense
16
16 Exhibit 514.
Exhibit 514.
17
17 MR. BERKOWITZ: Which
MR. BERKOWITZ: Which is
is the
the cover
cover email
email which
which
18
18 attaches the
attaches the report
report that
that also
also has
has the
the redaction,
redaction,
19
19 Mr. DeFilippis,
Mr. DeFilippis, on
on the
the ultimate
ultimate page
page and
and ask
ask --
-- I'd
I'd move it
move it
20
20 into admission.
into admission.
21
Honor.
22
22 THE COURT:
THE COURT: So moved.
So moved.
23
23 (Whereupon, the
exhibit was
was published.)
published.)
24
514 was
was admitted.)
admitted.)
25
25
469
469
1
1 BY
BY MR.
MR. BERKOWITZ:
BERKOWITZ:
2
2 @.
Q. So this
So this is
is an
an email.
email. If
If you
you could
could just
just look
look at
at
3
3 the top
the top of
of it
it --
-- from
from Nate
Nate Batty,
Batty, Wednesday
Wednesday September
September 21st
21st
4
4 at 4:46.
at 4:46. Correct?
Correct?
5
5 A.
A. ves.
Yes.
6
6 Q.
Q. So about
So about --
-- between
between three
three and
and four
four hours
hours after
after the
the
7
7 thumb drive
thumb drive at
at least
least hadn't
hadn't been
been plugged
plugged in.
in. Correct?
Correct?
8
8 A.
A. ves.
Yes.
9
9 @.
Q. And it's
And it's to
to Josh
Josh Hubiak.
Hubiak. Can
Can you
you tell
tell the
the jury
jury
10
10 who Mr.
who Hubiak is
Mr. Hubiak is or
or Special
Special Agent
Agent Hubiak?
Hubiak?
1
11 A.
A. I think
I think he's
he's aa special
special agent
agent in
in Philadelphia
Philadelphia
12
12 maybe.
maybe.
13
13 Q.
Q. And Curtis
And Curtis Heide,
Heide, who's
who's he?
he?
14
14 A.
A. A special
A special agent
agent in
in Chicago,
Chicago, II believe.
believe.
15
15 Q.
Q. Is he
Is he on
on the
the counter
intelligence or
or cyber
cyber
16
16 division
division side?
side?
17
17 A.
A. I think
I think he
he was
was on
on the
the counter
intelligence side.
side.
18
18 ©.
Q. And you're
And you're copied
copied on
on this.
this. Correct?
Correct?
19
19 A.
A. ves.
Yes.
20
20 @.
Q. It says
It says "analysis
"analysis of
of Trump
Trump white
white paper.”
paper." Right?
Right?
21
21 A.
A. That's in
That's in the
the subject,
subject, yes.
yes.
22
22 Q.
Q. Attachment is
Attachment is Analysis of Trump
Analysis of Trump server
server white
white paper
paper
23
23 doc.
doc. Correct?
Correct?
24
24 A.
A. That's correct.
That's correct.
25
25 MR. BERKOWITZ: Judge,
MR. BERKOWITZ: Judge, at
at this
this point,
point, I'd
I'd like
like to
to
470
470
1
1 publish aa demonstrative,
publish demonstrative, which
which II can
can pull
pull it
it up.
up. It's
It's
2
2 Sussmann Demonstrative
Sussmann Demonstrative 11 after
after he
he has
has aa chance
chance to
to look
look at
at it
it
3
3 -- don't
-- don't pull
pull it
it yet.
yet. II don't
don't want
want to
to be the one
be the one to
to tell
tell
4
4 you.
you.
5
5 MR. DeFILIPPIS: Objection,
MR. DeFILIPPIS: Your Honor.
Objection, Your Honor. We'd ask
We'd ask
6
6 that he
that he just
just walk
walk him
him through
through the
the actual
actual evidence.
evidence.
7
7 MR. BERKOWITZ: Your
MR. BERKOWITZ: Your Honor,
Honor, II can.
can.
8
8 THE COURT:
THE COURT: Can
Can you
you put
put up
up the
the slide
slide and
and then
then just
just
9
9 populate the
populate the boxes
boxes as
as he
he testifies
testifies to
to each
each email?
email?
10
10 MR. BERKOWITZ: I've
MR. BERKOWITZ: I've shown
shown him
him all
all of
of these
these
1
11 already.
already. They are
They are all
all in
in evidence.
evidence.
12
12 THE COURT:
THE COURT: Okay.
Okay.
13
13 MR. BERKOWITZ: Just
MR. BERKOWITZ: Just --
-- II want
want to
to make sure I'm
make sure I'm
14
14 tracking what
tracking what you'd
you'd like
like me
me to
to do,
do, Judge.
Judge.
15
15 THE COURT:
THE COURT: Ideally, if
Ideally, if you
you were
were doing
doing aa
16
16 demonstrative, you
demonstrative, you would put up
would put up each
each box
box as
as he
he testifies
testifies to
to
17
17 what's in
what's in evidence.
evidence.
18
18 MR. BERKOWITZ: Yeah.
MR. BERKOWITZ: Yeah.
19
19 THE COURT:
THE COURT: To
To expedite
expedite it
it --
-- pick
pick up
up the
the phone.
phone.
20
20 (Bench conference.)
(Bench conference.)
21
21 THE COURT:
THE COURT: Is there
Is there any
any objection
objection to
to any
any of
of the
the
22
22 actual emails
actual emails that
that he's
he's going
going to
to ask
ask him
him about?
about?
23
23 MR. DeFILIPPIS: No,
MR. DeFILIPPIS: Your Honor.
No, Your Honor. Our
Our objection
objection is
is
24
24 just in
just in the
the fact
fact that
that --
-- well,
well, II guess
guess we don't understand.
we don't understand.
25
25 Does Mr.
Does Mr. Berkowitz
Berkowitz intend
intend this
this to
to go
go back
back to
to the
the jury
jury as
as
an
471
1
1 evidence?
evidence?
2
2 MR. BERKOWITZ: No.
MR. BERKOWITZ: No.
3
3 THE COURT:
THE COURT: No.
No. This
This is
is not
not aa compilation
compilation
4
4 exhibit.
exhibit. It's just
It's just aa demonstrative
demonstrative as
as if
if he
he was
was writing
writing it
it
5
5 on aa white
on white board.
board. Right?
Right?
6
6 MR. BERKOWITZ: Correct.
MR. BERKOWITZ: Correct.
7
7 THE COURT:
THE COURT: If
If there's
there's no
no objection
objection to
to any
any of
of the
the
8
8 individual emails
individual emails or
or their
their admissibility,
admissibility, we'll
we'll let
let you
you do
do
9
9 that.
that.
10
10 MR. BERKOWITZ: Thank
MR. BERKOWITZ: Thank you,
you, Your
Your Honor.
Honor.
1
11 (Bench conference
(Bench conference concluded.)
concluded.)
12
12 (Whereupon, the
exhibit was
was published.)
published.)
13
13 BY
BY MR.
MR. BERKOWITZ:
BERKOWITZ:
14
14 @.
Q. II will
will show
show you
you what
what has
has been marked as
been marked as Sussmann
Sussmann
15
15 Demonstrative 1.
Demonstrative 1. SoSo just
just to
to recap
recap real
real quickly
quickly so
so we
we can
can --
--
16
16 THE COURT:
THE COURT: Just
Just to
to be
be clear,
clear, this
this is
is not
not
17
17 introduced into
introduced into evidence.
evidence.
18
18 MR. BERKOWITZ: No.
MR. BERKOWITZ: No. I'm
I'm sorry.
sorry.
19
19 BY
BY MR.
MR. BERKOWITZ:
BERKOWITZ:
20
20 Q.
Q. September 20th
September 20th at
at 12:29
12:29 is
is from
from the
the chain
chain of
of
21
21 custody form
custody form is
is when
when Nate
Nate Batty
Batty received
received the
the thumb
thumb drives.
drives.
22
22 Correct? II can
Correct? can show
show you
you the
the document
document if
if --
=-
23
23 A.
A. sure, yes.
Sure, yes.
24
24 ©.
Q. And September
And September 20th
20th at
at 6:58,
6:58, we
we looked
looked at
at the
the
25
25 5150ish Link
5150ish Link message.
message. Correct?
Correct?
472
472
1
1 A.
A. ves.
Yes.
2
2 ©.
Q. on the
On the 21st,
21st, there
there was
was aa Link
Link message about Tim
message about Tim
3
3 asking if
asking if you'd
you'd write
write aa brief
brief summary
summary of
of what
what you
you thought
thought of
of
4
4 the DNC
the DNC report.
report. Correct?
Correct?
5
5 A.
A. Yes.
Yes.
6
6 ©.
Q. And those
And those are
are combined
combined three
three separate
separate Link
Link
7 || messages
7 just to
messages just to be
be clear?
clear?
8
8 A.
A. Yes, they
Yes, they did
did not
not all
all clear
clear at
at 12:47,
12:47, II don't
don't
9
9 think.
think.
10
10 ©.
Q. And then
And then the
the 21st
21st at
at 1:07,
1:07, you
you say,
say, Frank's
Frank's write
write
n
11 blocker won't
blocker won't work.
work.
12
12 At 4:46
At 4:46 is
is when
when the
the assessment
assessment goes
goes through.
through.
13
13 Correct?
Correct?
14
14 A.
A. ves.
Yes.
15
15 ©.
Q. So between
So between September
September 20th,
20th, 12:29
12:29 and
and September
September
16
16 21st at
21st at 4:46
4:46 was
was the
the extent
extent of
of your
your analysis,
analysis, at
at least
least from
from
17
17 a time
a time standpoint.
standpoint. Correct?
Correct?
18
18 A.
A. ves.
Yes.
19
19 ©.
Q. And during
And during that
that time,
time, how
how many interviews of
many interviews of
20
20 people did
people did you
you conduct?
conduct?
21
21 A.
A. None.
None.
22
22 ©.
Q. How many
How many subpoenas
subpoenas did
did you
you serve?
serve?
23
23 A.
A. Nome. II was
None. not authorized
was not authorized to
to serve
serve any
any subpoenas
subpoenas
24
24 at that
at that point.
point.
25
25 ©.
Q. Did you
Did you do
do any
any search
search warrants?
warrants?
473
473
1
1 A.
A. Absolutely not.
Absolutely not.
2
2 ©.
Q. Other than
Other than looking
looking at
at the
the materials, you did
materials, you did
3
3 [| nothing. Correct?
nothing. correct?
1
4 A.
A. That's what
That's what II was
was tasked
tasked to
to do
do and
and that's
that's exactly
exactly
5s
5 [| wnat we
what we did.
asa.
6
MR. BERKOWITZ: Okay. You
You can
can take
take that
that down.
down.
7
7 || BY
BY mr.
MR. eerxowrrz:
BERKOWITZ:
8
8 ©.
Q. And the
And the analysis,
analysis, which
which we
we went
went through,
through, let's
let's
9
9 || taxe aa look
take 100k at
at it.
it. It's
It's attached
attached to
to Defense
Defense Exhibit
Exhibit 514.
s14.
10 [|
10 t's the
It's the same
same one.
ome. II want
want to
to look
look at
at --
-- II think
think you
you
11 ||
11 criticized, on
criticized, on direct,
direct, three
three things.
things. You
You criticized
criticized the
the
12 ||
12 assumptions. You
assumptions. You said
said they
they jumped
jumped to
to conclusions.
conclusions. Correct?
Correct?
13
13 A.
A. ves.
Yes.
14
14 9.
Q. Criticized the
Criticized the methodology.
methodology. Correct?
Correct?
15
15 A.
A. Yes.
Yes.
16
16 ©.
Q. And you
And you criticized
criticized the
the Trump
Trump server
server as
as being
being too
too
17 ||
17 obvious that
obvious that somebody
somebody would
would call
call aa server
server the
the Trump
Trump server
server
18 ||
18 if you
if you were trying to
were trying to hide
hide that.
that. Right?
Right?
19
19 A.
A. ves.
Yes.
20
20 ©.
Q. You didn't
You didn't say
say anything
anything about
about mental
mental health
health inin
21 ||
21 there. Right?
there. rigne2
22
22 A
A. wo.
No.
23
23 ©.
Q. so jumping
So jumping to
to conclusions
conclusions and
and methodology,
methodology, dodo you
you
24 ||
24 think you
think you would
would have
have been
been aided
aided in
in talking
talking to
to the
the author
author ofof
25 ||
25 the white
the white paper
paper if
if you
you wanted to better
wanted to better understand
understand the
the
478
474
1
1 reasoning behind
reasoning behind their
their methodology?
methodology?
2
2 A.
A. ves.
Yes.
3
3 ©.
Q. And did
And did you
you try
try and
and talk
talk to
to the
the author
author of
of the
the
4
4 white paper?
white paper?
5
5 A.
A. I had
I had no
no capability
capability ofof doing
doing so,
so, because
because II didn't
didn't
6
6 know who
know who was
was the
the author.
author. II didn't
didn't know
know where
where the
the documents
documents
7
7 came from.
came from.
8
8 ©.
Q. So you
So you weren't
weren't able
able to
to do
do that,
that, obviously.
obviously. Right?
Right?
9
9 A.
A. That's correct.
That's correct.
10
10 ©.
Q. And with
And with respect
respect to
to the
the Trump
Trump server
server being
being
n
11 obvious, meaning
obvious, meaning ---- II think
think you
you wrote,
wrote, you
you wouldn't think
wouldn't think
12
12 that somebody
that somebody trying
trying to
to hide
hide the
the server
server would
would call
call it
it the
the
13
13 Trump server,
Trump server, essentially.
essentially. Right?
Right?
14
14 A.
A. That's correct.
That's correct.
15
15 ©.
Q. Did you
Did you ask
ask to
to speak
speak to
to any
any confidential
confidential human
human
16
16 sources about
sources about your
your analysis
analysis of
of whether that was
whether that was something
something
17
17 that somebody
that somebody looking
looking to
to hide
hide contacts
contacts would do?
would do?
18
18 A
A. vo.
No.
19
19 ©.
Q. Do you
Do you know
know whether
whether ---- Special
Special Agent
Agent Sands,
Sands, you
you
20
20 testified about
testified about on
on direct. Right?
direct. Right?
21
21 A.
A. ves.
Yes.
22
22 ©.
Q. She's in
She's in the
the counter
intelligence side
side of
of the
the
23
23 world, and
world, and she
she actually
actually did
did an
an investigation
investigation toto the
the best
best of
of
24
24 your knowledge.
your knowledge. Right?
Right?
25
25 A.
A. ves.
Yes.
475
475
1
1 ©.
Q. Did you
Did you talk
talk to
to her
her about
about whether
whether she
she spoke
spoke with
with
2
2 [| anyone about
anyone about that
that issue?
issue?
3
3 A.
A. Whether she
Whether she spoke
spoke with
with anyone,
anyone, II know
know we
we discussed
discussed
4
4 || whether or
whether or not
not we sort of
we sort of came
came to
to the
the same
same conclusions
conclusions based
based
5 ||
5 on after
on ater she
she initiated
initiated some
some initial
initial investigation
investigation and
and we
we
6 [|
6 were sort
were sort of
of comparing
comparing our
our initial
initial triage
triage with
with her
her
7 ||
7 investigation to
investigation to see
see if
if we
we agreed.
agreed.
8
8 9.
Q. So did
So did she
she --
-- did
did you
you know
know that
that she
she spoke
spoke in
in or
or
9 ||
9 arouna october
around with aa confidential
October with confidential human
human source
source of
of the
the FBI
Fer
10 ||
10 who thought
who thougnt that
that it
it was
was plausible
plausible or
or at
at least
least possible
possible that
that
11 [|
11 a --
a -- somebody
somebody looking
looking to
to hide
hide the
the connection
connection could
could call
call it
it
12 |
12 the Trump
the Trump server?
servers
13
13 A.
A. I did
I did not
not know
know that
that she
she spoke
spoke to
to aa confidential
confidential
14 ||
14 numan source
human source about
about that.
that.
1s
15 Q.
Q. That's something
That's something you
you could
could have
have done.
done. You
You could
could
16 ||
16 nave actually
have actually gone
gone to
to confidential
confidential human
human sources
sources and
ana
17 ||
17 developed more
developed more information
information ifif you
you were
were actually
actually
18 ||
18 investigating. Right?
investigating. Right?
19
19 A.
A. sure, if
Sure, if II were
were investigating.
investigating. Correct.
Correct.
20
20 @.
Q. In fact,
In fact, your
your paper
paper really,
really, while
while it
it was
was
21 ||
21 sxeptical, ultimately
skeptical, ultimately determined
determined that
that the
the conclusions
conclusions inin the
the
22 ||
22 paper that
paper that were
were made may or
made may or may not be
may not be true.
true. Correct?
Correct?
23
23 A.
A. That's true.
That's true. ItIt certainly
certainly could
could have
have been,
been, but
but II
24 ||
24 did not
did not feel
feel that
that the
the conclusions
conclusions that
that were
were made in the
made in the
25 ||
25 paper were
paper were supported
supported by
by the
the data
data that
that they
they provided.
provided.
476
476
1
1 ©.
Q. And so
And so you
you weren't
weren't saying
saying they're
they're not
not true.
true. You You
2
2 are saying
are saying they
they may or may
may or not be
may not true. That's
be true. That's what
what you
you
3
3 wrote. Correct?
wrote. Correct?
1
4 A.
A. I don't
I don't know
know ifif it's
it's that
that simple.
simple. II think
think the
the
5
5 conclusions that
conclusions that they
they came
came to
to II felt
felt were
were not
not --
-- were
were
6
6 completely --
completely -- II just
just disagreed
disagreed with the conclusions
with the conclusions they
they
7
7 came to
came to and
and the
the analysis
analysis that
that they
they did
did based upon the
based upon the data
data
8
8 that came
that came along
along with
with the
the white
white paper.
paper.
9
9 ©.
Q. So you
So you didn't
didn't decide
decide to
to open
open an
an investigation.
investigation.
10
10 Correct?
Correct?
n
11 A.
A. correct.
Correct.
12
12 ©.
Q. It wasn't
It wasn't your
your call
call to
to make?
make?
13
13 A
A. No.
No.
14
14 ©.
Q. But cyber
But cyber did
did not
not open
open an
an investigation.
investigation. Right?
Right?
15
15 A.
A. That's correct.
That's correct.
16
16 ©.
Q. But counter
But counter intelligence
intelligence actually
actually did
did open
open anan
17
18
18 A.
A. I believe
I believe so.
so.
19
19 Q.
Q. They had
They had the
the same
same information
information you
you have?
have?
20
20 A.
A. Yes.
Yes.
21
21 ©.
Q. And the
And the benefit
benefit ofof your
your report.
report. Right?
Right?
22
22 A.
A. Yes.
Yes.
23
23 ©.
Q. And they
And they still
still decided
decided to
to open
open it
it up.
up. Right?
Right?
24
24 A.
A. I believe
I believe so,
so, yes.
yes.
25
25 ©.
Q. And do
And do you
you know
know that,
that, when
when they
they opened
opened upup the
the
477
477
1
1 investigation, they
investigation, they said
said that
that they
they received
received aa referral
referral from
from
2
2 the Department
the Department of
of Justice
Justice detailing
detailing an
an unusually-configured
unusually-configured
3
3 email server
email server in
in Pennsylvania
Pennsylvania belonging
belonging to
to the
the Trump
Trump
4
4 Organization and
Organization and said
said that
that they
they received
received aa white paper that
white paper that
5
5 was produced
was produced by
by an
an anonymous
anonymous third
third party.
party. Were you aware
Were you aware of
of
6
6 that?
that?
7
7 A.
A. I was
I was not.
not.
8
8 ©.
Q. Would it
Would it be strange to
be strange to you
you that
that they
they thought
thought the
the
9
9 referral came
referral came from
from the
the United
United States
States Department
Department ofof Justice?
Justice?
10
10 A.
A. Absolutely.
Absolutely.
n
11 ©.
Q. With respect
With respect toto whether
whether it
it mattered,
mattered, is
is it
it fair
fair to
to
12
12 say that
say that your
your testimony
testimony onon direct was in
direct was in opening
opening anan
13
13 investigation, the
investigation, the level
level of
of the
the investigation
investigation would
would matter
matter
14
14 what the
what the motivations
motivations were
were or
or something
something to
to that
that effect?
effect?
15
15 A.
A. Yes. Motivation
Yes. Motivation ofof who's
who's providing
providing the
the data
data to
to
16
16 you could
you could certainly
certainly color
color whether
whether or
or not
not you
you believe
believe the
the
17
17 data is
data is true.
true.
18
18 ©.
Q. Okay. But
Okay. But you
you didn't
didn't actually
actually open
open an
an
19
20
20 A.
A. That's correct.
That's correct.
21
21 ©.
Q. Without agreeing
Without agreeing that
that there
there were
were political
political
22 || motivations,
22 okay, if
motivations, okay, if there
there were
were political
political motivations,
motivations, whatwhat
23
23 would you
would you have
have done
done differently
differently inin the
the 36
36 hours
hours that
that you
you
24
24 worked on
worked on this?
this?
25
25 A.
A. I nmean,
I from the
mean, from the technical
technical review
review that
that we
we did,
did,
478
478
1
1 nothing.
nothing. We would
We would have
have done
done the
the same
same thing.
thing. We would
We would have
have
2
2 looked at
looked at the
the data.
data. We were
We were asked
asked to
to do
do aa relatively
relatively sort
sort
3
3 of aa triage
of triage or
or aa brief
brief review
review of
of the
the actual
actual data.
data. We would
We would
4
4 have done
have done that
that exactly
exactly the
the same.
same.
5
5 The only
The only thing
thing II would have done
would have done differently
differently is
is II
6
6 would have
would have made sure to
made sure to document
document that
that we
we believed
believed this
this
7
7 information was
information was coming
coming from
from wherever
wherever it
it was
was coming
coming from,
from, and
and
8
8 that would
that would be part of
be part of our
our report.
report. And then so
And then so when
when we
we
9
9 provide that
provide that toto Chicago,
Chicago, that
that whole
whole narrative
narrative goes.
goes. ItIt all
all
10
10 goes together,
goes together, where the data
where the data came
came from,
from, our
our analysis,
analysis, and
and
n
11 then all
then all of
of those
those things
things go
go together
together and
and they
they get
get passed
passed onon
12
12 to Chicago
to Chicago forfor further
further review.
review.
13
13 ©.
Q. And so,
And so, to
to be
be clear,
clear, you
you would not have
would not have changed
changed
14
14 your analysis
your analysis atat all.
all. Correct?
Correct?
15
15 A.
A. I would
I would not
not have
have changed
changed my analysis from
my analysis from the
the
16
16 technical side,
technical side, but
but II would
would have
have documented
documented where
where it
it came
came
17
17 from, yes.
from, yes.
18
18 ©.
Q. You wouldn't
You wouldn't have
have done
done your
your --
-- you
you would
would have
have done
done
19
19 your forensic
your forensic analysis
analysis inin exactly
exactly the
the same
same way. Correct?
way. Correct?
20
20 A.
A. The forensic
The forensic piece or the
piece or the technical
technical review
review would
would
21
21 have been
have been the
the same,
same, yes.
yes.
22
22 ©.
Q. And although
And although you
you were surprised to
were surprised to see
see it
it today,
today,
23
23 it appears
it appears that
that at
at least
least somebody,
somebody, such
such as
as Mr. Batty was
Mr. Batty was
24
24 aware and
aware and you
you were
were aware
aware that
that somebody
somebody was calling this
was calling this
25
25 white paper
white paper aa DNC
DNC report.
report. Correct?
Correct?
479
479
1
1 A.
A. II was
was not
not aware
aware that
that anybody
anybody was calling it
was calling it aa DNC
DNC
2
2 report, and
report, and II don't
don't believe
believe Mr. Batty knew
Mr. Batty knew that
that either.
either.
3
3 ©.
Q. But you
But you saw
saw the
the Link
Link message. Right?
message. Right?
1
4 A.
A. II did
did see
see the
the Link
Link message,
message, yes.
yes.
5
5 ©.
Q. What's your
What's your explanation
explanation forfor it?
it?
6
6 A.
A. II have
have no
no recollection
recollection of of seeing
seeing that
that Link
Link
7 || message.
7 message. Andana there
there is
is --
-- I1 have
have absolutely
absolutely nono belief that
belief that
8
8 either me
either or Agent
me or Agent Batty
Batty knew
knew where
where that
that data
data was
was coming
coming
9
9 from, let
from, let alone
alone that
that it
it was
was coming
coming from
from DNC.
DNC. The
The only
only
10
10 explanation that
explanation that popped
popped oror was
was discussed
discussed waswas that
that it
it could
could
n
11 have been
have been aa typo
typo and
and somebody
somebody was
was trying
trying toto refer
refer to
to DNS
DNS
12
12 instead of
instead of DNC.
DNC.
13
13 ©.
Q. So you
So you think
think itit was
was aa typo?
typo?
14
14 A.
A. II don't
don't know.
know.
15
15 ©.
Q. When you
When you said
said the
the only
only one
one suggesting
suggesting itit --
-- isn't
isn't
16
16 it true
it true that
that itit was
was Mr. DeFilippis that
Mr. DeFilippis that suggested
suggested toto you
you
17
17 that it
that it might have been
might have been aa typo
typo recently?
recently?
18
18 A.
A. That's correct.
That's correct.
19
19 ©.
Q. Okay. You
Okay. You didn't
didn't think
think that
that at
at the
the time.
time. Right?
Right?
20
20 A.
A. IIdid not. II had
did not. had never
never seen
seen it
it or
or had
had any
any memory
memory
21
21 of seeing
of seeing itit ever
ever before
before it
it was
was put
put in
in front
front of
of me.
me.
22
22 ©.
Q. And, sir,
And, sir, isn't
isn't itit possible
possible that
that you
you missed
missed itit
23
23 being aa DNC
being DNC report
report and,
and, now
now that
that there
there is
is aa huge
huge focus
focus onon
24
24 whether there
whether there was
was aa political
political motive,
motive, you're
you're disappointed
disappointed
25
25 that you
that you didn't
didn't actually
actually include
include itit in
in your
your report?
report?
480
480
1
1 A.
A. I don't
I don't think
think that's
that's particularly likely because
particularly likely because
2
2 there were
there were soso many
many other
other opportunities
opportunities for
for Nate and II to
Nate and to
3
3 discuss where
discuss where it
it was
was coming
coming from.
from. And
And we never not
we never not once
once
4
4 discussed that
discussed that we thought it
we thought it was
was coming
coming from
from DNC
DNC or
or that
that
5
5 anyone had
anyone had told
told Nate
Nate it
it was
was coming
coming from
from DNC.
DNC. II think,
think, while
while
6
6 anything is
anything is possible,
possible, II don't
don't think
think that
that is
is particularly
particularly
7
7 likely.
likely.
8
8 ©.
Q. You knew
You knew that
that there
there was
was an
an election
election aa couple
couple
9 || months
9 away. Correct?
months away. correct?
10
10 A.
A. ves.
Yes.
n
11 ©.
Q. You knew
You knew that
that the
the FBI
FBI was
was investigating
investigating issues
issues
12
12 related to
related to Trump
Trump and
and Russia.
Russia. Correct?
Correct?
13
13 A.
A. I don't
I don't remember
remember at
at that
that point what II was
point what was --
-- how
how
14
14 much exposure II had
much exposure had to
to any
any investigation
investigation onon that
that side.
side.
15
15 ©.
Q. And you
And you and
and Special
Special Agent
Agent Batty
Batty at
at least
least talked
talked
16
16 about whether
about whether this
this had
had political origins, didn't
political origins, didn't you?
you?
17
17 A.
A. At that
At that point
point II think
think the
the only
only thing
thing that
that came
came up
up
18
18 was just
was just questioning
questioning the
the motive
motive of
of somebody
somebody providing
providing ----
19
19 like, who
like, who provided
provided this
this report?
report? II don't
don't recall
recall any
any
20
20 discussion about
discussion about political
political motivations.
motivations.
21
21 ©.
Q. Who would
Who would it
it have
have helped
helped if
if the
the allegations
allegations were
were
22
22 true?
true?
23
23 A.
A. It would
It would have
have helped
helped the
the opposing
opposing --
-- it
it would
would have
have
24
24 helped the
helped the democratic
democratic party.
party.
25
25 ©.
Q. And that
And that didn't occur to
didn't occur to you
you at
at all
all that
that that
that
481
481
1
1 motivation
motivation might have been
might have been involved?
involved?
2
2 A.
A. No.
No.
3
3 MR. BERKOWITZ: No
MR. BERKOWITZ: No further
further questions,
questions, Judge.
Judge.
4
4 Thank you
Thank you for
for your
your time,
time, sir.
sir.
B
5 THE WITNESS:
THE Thank you.
WITNESS: Thank you.
6
6 REDIRECT
EXAMINATION
REDIRECT EXAMINATION OFSCOTTHELLMAN
OF SCOTT HELLMAN
7
7 BY
BY MR.
MR. DeFILIPPIS:
DeFILIPPIS:
8
8 Q.
Q. Special Agent
Hellman, you
you were
were cross-examined
cross-examined
9
9 about the
about the notion
notion of
of writing
writing aa 302
302 when
when you
you receive
receive
10
10 evidence --
evidence -- do
do you
you recall
recall that
that --
-- or
or conduct
conduct interviews?
interviews?
1
11 A.
A. ves.
Yes.
12
12 ©.
Q. And II think
And think you
you also
also testified
testified that
that General
General
13
13 Counsel Baker,
Counsel Baker, you
you didn't believe he
didn't believe he is
is aa special
special agent.
agent.
14
14 Right?
Right? He is
He is just
just aa lawyer.
lawyer.
15
15 A.
A. I don't
I don't think
think he
he is
is aa special
special agent,
agent, no.
no.
16
16 Q.
Q. Now, typically
Now, typically at
at the
the FBI,
FBI, between
between the
the lawyers
lawyers and
and
17
17 the agents,
the agents, who
who is
is it
it who
who would
would write
write aa 302?
3027
18
18 A.
A. It would
It would be the agents
be the agents who
who write
write the
the 302s.
302s.
19
19 ©.
Q. And in
And in your
your career
career as
as aa FBI
FBI agent,
agent, have
have you
you ever
ever
20
20 encountered aa situation
encountered situation where
where someone
someone who
who knows
knows where
where to
to
21
21 reach FBI
reach FBI agents,
agents, brings
brings evidence
evidence toto an
an FBI
FBI lawyer?
lawyer? Have
Have
22
22 you ever
you ever encountered
encountered that
that before?
before?
23
23 A.
A. specifically to
Specifically to aa FBI
FBI lawyer?
lawyer?
24
24 Q.
Q. (Nodded head)
(Nodded head)
25
25 A.
A. It's possible
It's but II don't
possible but don't have
have any
any specific
specific
482
482
1
1 recollection of
recollection of that
that happening,
happening, no.
no.
2
2 ©.
Q. Okay. And
Okay. And are
are lawyers
lawyers at
at the
the FBI
FBI trained
trained in in
3
3 writing 302s
writing 302s or
or is
is that
that training
training that
that agents
agents receive?
receive?
1
4 A.
A. As far
As far as
as II know,
know, it's
it's only
only training
training the
the agents
agents
5
5 receive.
receive.
6
6 ©.
Q. And is
And is it
it typical,
typical, the
the practice
practice of
of the
the FBI,
FBI, that
that
7
7 agents take
agents take in
in evidence
evidence as
as opposed
opposed to
to lawyers?
lawyers?
8
8 A.
A. ves.
Yes.
9
9 ©.
Q. Now, when
Now, when you
you testified
testified that
that you
you have
have aa
10
10 recollection after
recollection after meeting
meeting with
with Mr. Baker that
Mr. Baker that you
you told
told
n
11 others you
others you were frustrated you
were frustrated you couldn't
couldn't figure
figure out
out where
where
12
12 this came
this came from.
from. Did
Did you
you testify
testify you
you never
never spoke
spoke toto
13
13 Mr. Baker
Mr. Baker again
again about
about this?
this?
14
14 A.
A. That's correct.
That's correct. II never
never spoke
spoke to
to Mr.
Mr. Baker
Baker after
after
15
15 or --
or == I'm
I'm not
not sure
sure what the conversation
what the conversation was
was during
during that
that
16
16 time, but
time, but II never
never spoke
spoke to
to Mr. Baker again
Mr. Baker again after
after that.
that.
17
17 ©.
Q. So do
So do you
you know
know whether
whether oror not
not Mr. Baker, for
Mr. Baker, for
18
18 example, immediately
example, immediately told
told someone
someone else
else the
the name
name of
of the
the
19
19 person he
person he got
got it
it from
from or
or not?
not? DoDo you
you have
have any
any way
way to to know
know
20
20 that?
that?
21
21 A.
A. Not investigatively.
Not investigatively. I'veI've read
read various
various
22
22 open-source reports,
open-source reports, but
but II didn't
didn't have
have any
any knowledge
knowledge at at the
the
23
23 time.
time.
24
24 Q.
Q. okay. So
Okay. So you
you --
-- all
all you
you know
know is
is that
that you
you went
went to
to
25
25 Mr. Baker's
Mr. Baker's office
office and,
and, you
you think,
think, could
could not
not discern
discern where
where
483
483
1
1 this came
this came from;
from; is
is that
that right?
right?
2
2 MR. BERKOWITZ: II object.
MR. BERKOWITZ: object. Leading.
Leading.
3
3 THE COURT:
THE COURT: Sustained.
Sustained.
4
4 BY
BY MR.
MR. DeFILIPPIS:
DeFILIPPIS:
5
5 @.
Q. What, if
What, if anything
anything dodo you
you know
know about
about information
information
6
6 Mr. Baker shared
Mr. Baker shared with
with anyone
anyone else
else about
about the
the identity
identity of
of the
the
7
7 person who
person gave this
who gave this to
to him?
him?
8
8 A.
A. In my
In my investigative
investigative capacity?
capacity?
9
9 Q.
Q. ves.
Yes.
10
10 A.
A. Nothing.
Nothing.
1
11 Q.
Q. Okay.
Okay. So anything
So anything else
else would
would have
have been
been something
something
12
12 you read
you read more
more recently,
recently, perhaps
perhaps in
in the
the media?
media?
13
13 A.
A. Correct.
Correct.
14
14 Q.
Q. Okay. Now
Okay. Now you
you mentioned
mentioned that
that the
the
15
15 counterintelligence division
counterintelligence division opened
opened an
an investigation
investigation here?
here?
16
16 A.
A. I believe
I believe so,
so, yes.
yes.
17
17 Q.
Q. And the
And the cyber
cyber division,
division, II think
think you
you testified,
testified, did
did
18
18 not open
not open an
an investigation.
investigation. Right?
Right?
19
19 A.
A. That's correct.
That's correct.
20
20 @.
Q. In your
In your view
view of
of the
the data
data in
in the
the white
white paper,
paper, would
would
21
21 it be
it fair to
be fair to say
say you
you were
were skeptical
skeptical or
or not
not skeptical
skeptical of
of
22
22 that data?
that data?
23
23 A.
A. I was
I was very
very skeptical
skeptical of
of the
the data.
data.
24
24 Q.
Q. Now the
Now the counterintelligence
counterintelligence division,
division, when
when they
they
25
25 look at
look at information
information like
like this,
this, are
are they
they looking
looking at
at it
it with
with
484
484
1
1 an eye
an eye towards
towards the
the same
same issues
issues or
or different
different issues
issues from
from the
the
2
2 cyber division?
cyber division?
3
3 A.
A. Um, II think
Um, think they'd
they'd probably
probably be
be looking
looking at
at it
it from
from
4
4 the same
the same vantage
vantage point,
point, but
but if
if you're
you're not
not --
-- you
you don't
don't have
have
5
5 experience looking
experience looking atat technical
technical logs,
logs, you
you may
may not
not have
have the
the
6
6 capability of
capability of doing
doing aa review
review of
of those
those logs.
logs. YouYou might
might rely
rely
7
7 on somebody
on somebody else
else to
to do
do it.
it. And perhaps counterintelligence
And perhaps counterintelligence
8
8 agents are
agents are going
going toto be
be thinking
thinking about
about other
other investigative
investigative
9
9 questions. So
questions. So II guess
guess it
it would
would probably
probably bebe aa combination
combination of of
10
10 both.
both.
n
11 ©.
Q. To what
To what extent
extent did
did you
you try
try to
to capture
capture your
your
12
12 skepticism about
skepticism about this
this data
data in
in your
your written report?
written report?
13
13 A.
A. Um, we
Um, we did
did capture
capture it
it in
in our
our report
report byby saying
saying that
that
14
14 we thought
we thought that
that the
the data
data and
and the
the narrative
narrative ---- II think
think the
the
15
15 words were,
words were, you
you know,
know, had
had some
some questionable
questionable motives
motives oror
16
16 something along
something along those
those lines.
lines.
17
17 ©.
Q. Now, is
Now, is it
it your
your understanding
understanding that
that inin deciding
deciding
18
18 whether and
whether and what
what level
level of
of investigation
investigation toto open
open on
on this
this
19 || matter,
19 that the
matter, that the counterintelligence
counterintelligence division
division ---- the
the idea
idea
20
20 was they
was they would
would take
take into
into account
account your
your written
written report?
report?
21
21 A.
A. ves.
Yes.
22
22 ©.
Q. And if
And if you
you had
had known,
known, for
for example,
example, oror learned
learned ----
23
23 we don't
we don't want
want to
to assume,
assume, but
but if
if you
you had
had learned
learned that
that the
the
24
24 data came
data came from
from someone
someone affiliated
affiliated with
with or
or paid
paid by the
by the
25
25 opposing political
opposing political campaign,
campaign, toto what
what extent
extent would
would you
you have
have
485
485
1
1 noted that
noted that in
in the
the report?
report?
2
2 A.
A. It would
It would be written in
be written in the
the report,
report, absolutely.
absolutely.
3
3 Q.
Q. Why?
Why?
1
4 A.
A. Again, that
Again, that type
type of
of context
context is
is what
what --
-- it's
it's aa data
data
5
5 point that
point that an
an agent
agent or
or really
really any
any investigator
investigator would use to
would use to
6
6 determine how
determine how truthful
truthful they
they believe
believe the
the data
data is.
is. How
How much
much
7
7 stock they
stock they are
are going
going to
to put
put in
in the
the data.
data.
8
8 And you
And you want
want to
to make
make sure
sure that
that you
you are
are relaying
relaying
9
9 the entire
the entire picture, the whole
picture, the whole story
story of
of what
what itit is
is you
you are
are
10
10 looking at.
looking at. SoSo if
if someone
someone else
else needs
needs to
to perform
perform some
some
n
11 additional analysis,
additional analysis, you
you want
want them
them to
to know,
know, Okay.
Okay. Here
Here isis
12
12 the raw
the raw data
data or
or here
here is
is the
the actual
actual data.
data. You
You can
can make
make your
your
13
13 oun decisions
own decisions on
on that.
that. Here's
Here's what we thought
what we thought about
about the
the
14
14 data ourselves.
data ourselves. AndAnd here
here are
are the
the other
other details.
details. AndAnd if
if it
it
15
15 was aa detail
was detail and,
and, Oh,
Oh, it
it came
came from
from this
this place,
place, you'd
you'd make
make
16
16 sure to
sure to put
put it
it in
in there
there so
so that
that they
they could
could assess
assess itit
17
17 themselves.
themselves.
18
18 ©.
Q. And would
And would aa fact
fact like
like that
that have
have made
made your
your analysis
analysis
19 || more
19 skeptical, less
more skeptical, less skeptical
skeptical oror the
the same?
same?
20
20 A.
A. I think
I think it
it would
would have
have made it more
made it skeptical.
more skeptical.
21
21 ©.
Q. And, again,
And, again, is
is that
that --
-- to
to the
the extent
extent that
that was
was your
your
22
22 analysis, would
analysis, would you
you have
have noted
noted that
that in
in the
the report?
report?
23
23 A.
A. ves.
Yes.
24
24 ©.
Q. And based
And based on
on your
your understanding
understanding of of FBI
FBI procedure
procedure
25
25 and FBI
and FBI rules
rules --
-- and
and by
by the
the way,
way, is
is there
there aa FBI
FBI rulebook
rulebook at at
486
486
1
1 || the
the FBI
ror that
that sets
sets out
out the
the way
way you
you are
are supposed
supposed to
to conduct
conduct
2 || investigations?
2 investigations?
3
3 A.
A. There are
There are many, many books.
many, many books.
4
4 ©.
Q. Is there
Is there aa main
main one?
one?
5
5 A.
A. Yes.
Yes.
6
6 ©.
Q. What's that
What's that called?
called?
7
7 A.
A. It's called
It's called the
the DIOG,
DIOG, D-I-O-G.
D-I-0-G.
8
8 9.
Q. And do
And do you
you happen
happen to
to know
know --
-- aa lot
lot of
of acronyms.
acronyms.
3 || Do
9 co you
vou know
know what
wnat that
that one
one stands
stands for?
forz
10
10 A.
A. on, gosh.
Oh, gosh. Um,
Um, sorry.
sorry. II don't
don't remember
remember the
the
1 | acronym.
11 acronym.
12
12 ©.
Q. Okay. So
Okay. So there's
there's an
an FBI
FBI procedure called the
procedure called the DIOG
DIOG
13 || and
13 and that
that sets
sets out
out what?
what?
14
14 A.
A. It's going
It's to set
going to set forth
forth aa wide
wide range
range of
of policies
policies
15 || and
15 and procedures
procedures surrounding
surrounding how
how we can perform
we can perform
16 | investigations.
16 investigations.
17
17 ©.
Q. And II think
And think you
you mentioned
mentioned before,
before, there's
there's
18 || assessment,
18 assessment, preliminary and aa full
preliminary and full investigation?
investigation?
19
19 A.
A. ves.
Yes.
20
20 ©.
Q. Would something
Would something like
like aa political
political motivation
motivation toto
21 || provide
21 provide data,
data, affect
affect an
an analysis
analysis under
under the
the DIOG
DIOG of
of which of
which of
22
22 [those you
those you should
should open?
open?
23
23 A.
A. It could.
It could. It's
It's aa datapoint
datapoint that
that one
one could
could
24 || consider
24 consider when
when you
you are
are determining
determining the
the authenticity
authenticity ofof the
the
25 || data
25 data or
or the
the truthfulness
truthfulness ofof the
the data.
data. Sure.
sure.
487
487
1
1 ©.
Q. And do
And do motivations
motivations ---- to
to what extent do
what extent do
2
2 [| motivations
motivations of of aa provider
provider ofof information
information factor
factor into
into those
those
33 [| decisions?
decisions?
4a MR. BERKOWITZ: Judge,

MR. BERKOWITZ: Judge, II am
am going
going to
to object
object both
both
55 || on asked
on asked and
ana answered
answered and
ana on
on foundation
foundation ---- [inaudible]
[inaudible]
66 COURT REPORTER:
COURT REPORTER: Can you restate
Can you restate your
your objection,
objection,
77 || erease:
please?
88 MR. BERKOWITZ: I'm

MR. BERKOWITZ: I'm going
going toto object
object both
both on
on asked
asked
99 || ana answered
and answered and
ana foundation,
foundation, inin the
the sense
sense that
that he
he was
was not
not
10 ||
10 the one
the one who
who made the decision
made the decision to
to open
open the
the investigation.
investigation.
un
11 THE COURT:
THE COURT: I'll
I'll overrule.
overrule. Just
Just one
one more question
more question
12 |
12 on this.
on enis.
13
MR. BERKOWITZ: Okay.
14 ||
14 BY
BY um.
MR. mERxowrrz:
BERKOWITZ:
1s
15 ©.
Q. In looking
In looking atat the
the DIOG
DIOG and
and deciding
deciding what
what level
level of
of
16 |
16 investigation to
investigation to open,
open, to
to what
what extent
extent might
might motivation
motivation play
play
17 |
17 into that
into that analysis?
analysis?
18
18 A.
A. If someone's
If someone's motivation for providing
motivation for providing you
you data
data
19 ||
19 suggests that
suggests that --
-- depending
depending upon
upon the
the motivation, it could
motivation, it could
20 [[
20 suggest the
suggest the data
data is
is less
less than
than truthful.
truthful. AndAnd if
if it's
it's less
less
21 ||
21 than truthful,
than truthful, youyou may not believe
may not in it
believe in it as
as much or consider
much or consider
22
22 [it factual.
it factual. Andand so
so if
if you
you don't
don't have
have aa factual
factual basis,
basis, you
you
23 ||
23 may not be
may not be able
able toto open
open aa full
full investigation.
investigation.
24
24 ©.
Q. Okay. Now
Okay. Now let's
let's go to issue
go to issue of
of that
that Link
Link message
message
25 ||
25 vou got
you got that
that had
had the
the word
word DNC
onc in
in it.
it.
488
488
1
1 A.
A. ves.
Yes.
2
2 ©.
Q. Now, first,
Now, first, on
on all
all of
of the
the occasions
occasions when
when you've
you've
3
3 spoken to
spoken to me
me or
or any
any member of the
member of the government's
government's team
team inin
4
4 connection with
connection this matter,
with this matter, to
to what
what extent
extent have
have you
you felt
felt
5
5 free to
free to express
express your
your true
true and
and accurate
accurate recollections?
recollections?
6
6 A.
A. At all
At all times.
times.
7
7 ©.
Q. And has
And has anyone
anyone ever
ever suggested
suggested anything
anything toto you
you
8
8 about the
about the way
way you
you should
should testify
testify or
or answer
answer any
any question?
question? To To
9
9 what extent
what extent have
have you
you been
been pressured
pressured to
to come
come to
to any
any
10
10 particular conclusion?
particular conclusion?
n
11 A.
A. Certainly not
Certainly not pressured
pressured to
to come
come to
to any
any conclusion.
conclusion.
12
12 ©.
Q. Now, looking
Now, looking atat that
that DNC
DNC message recalling that
message recalling that
13
13 DNC-related message
DNC-related that you
message that you were
were shown,
shown, to
to what
what extent
extent diddid
14
14 you wonder
you wonder after
after this
this all
all came
came in,
in, where this stuff
where this Stuff came
came
15
15 from?
from?
16
16 A.
A. You mean
You mean after
after II saw
saw the
the message?
message?
17
17 @.
Q. No, I'm
No, I'm sorry.
sorry. After
After the
the Alfa-Bank/Trump
Alfa-Bank/Trump
18
18 information came
information came in,
in, for
for how
how long
long after
after that
that would
would you
you say
say
19
19 you wondered,
you wondered, Where
Where did
did this
this all
all come
come from?
from?
20
20 A.
A. I nmean,
I mean, II probably
probably didn't
didn't really
really think
think about
about itit
21
21 very much
very much until
until maybe 20 --
maybe 20 -- really
really until
until 2020.
2020.
22
22 ©.
Q. okay. But
Okay. But is
is it
it fair
fair to
to say
say that
that you,
you, in
in your
your
23 || mind,
23 never had
mind, never had any
any insight
insight into
into where
where it
it came
came from?
from?
24
24 A.
A. No, that's
No, that's correct.
correct.
25
25 ©.
Q. So when
So when you
you saw
saw that
that message, how surprised
message, how surprised or or
489
489
1
1 unsurprised were
unsurprised were you?
you?
2
2 A.
A. I was
I was very
very surprised.
surprised.
3
3 ©.
Q. And based
And based on
on conversations
conversations you've
you've had
had with
with
4
4 Mr. Batty over
Mr. Batty over the
the years,
years, was
was it
it your
your understanding
understanding from
from
5
5 your interactions
your interactions with
with him
him that
that he
he similarly
similarly didn't
didn't know
know
6
6 where this
where this came
came from?
from?
7
7 MR. BERKOWITZ: Objection.
MR. BERKOWITZ: Objection. Foundation.
Foundation.
8
8 THE COURT:
THE COURT: Sustained.
Sustained.
9 || BY
9 BY mm.
MR. perrireprs:
DeFILIPPIS:
10
10 ©.
Q. The cyber
The cyber division,
division, atat the
the time
time in
in 2016,
2016, to
to what
what
n
11 extent were
extent you aware
were you aware ofof the
the Russian
Russian hack
hack of
of the
the DNC?
DNC?
12
12 A.
A. Iwas
I aware that
was aware that it
it happened.
happened. II don't
don't remember
remember
13
13 the dates
the dates so
so --
-- II was
was aware
aware of
of it
it when
when II was
was working
working there,
there,
14
14 but II was
but was not
not assisting
assisting inin that
that investigation
investigation in in any
any
15
15 substantive matter
substantive or any
matter or any substantive
substantive amount.
amount.
16
16 ©.
Q. Okay. And
Okay. And were
were you
you aware,
aware, one
one way
way or
or the
the other,
other,
17
17 that there
that there was an investigation
was an investigation atat the
the FBI
FBI of
of the
the DNC
DNC hack?
hack?
18
18 A.
A. ves.
Yes.
19
19 ©.
Q. And were
And were you
you aware,
aware, one
one way
way or
or the
the other,
other, whether
whether
20
20 Mr. Sussmann
Mr. Sussmann was
was representing
representing the
the DNC
DNC in
in that
that hack?
hack?
21
21 A.
A. I never
I never heard
heard the
the name
name Sussmann
Sussmann before.
before.
22
22 ©.
Q. Okay. But
Okay. But to
to the
the extent
extent --
-- [mic
[mic feedback]
feedback] -- --
23
23 sorry.
sorry.
24
24 To the
To the extent
extent there
there is
is an
an investigation
investigation of of aa hack,
hack,
25
25 is it
is it common
common oror uncommon
uncommon for
for the
the FBI
FBI to
to communicate
communicate with
with aa
490
490
1
1 || victim
victim ofof the
the hack
nack oror their
their lawyer?
1awyer? Is 1s that
that something
something that
that
22 || happens?
nappens>
33 A.
A. Both. Absolutely.
Both. Absolutely.
41 So if
So if you
you have
have aa victim
victim --
-- II work in San
work in San
55 || Francisco.
erancisco. It's1t's typically
typically aa company.
company. and it's very
And it's very common
common
66 [| for
for us
us to
to either
eitner work
work directly
airectly with the company
with the company or
or with
with
77 || their
their outside
outside counsel,
counsel, their
their attorney
attorney representing
representing them
them or
or
88 [| both.
von.
99 ©.
Q. And when
And when the
the FBI
FBI is
is working
working with
with someone
someone who is
who is
10 [| the
10 the victim
victin of
of aa hack,
nack, what's
what's the
the purpose
purpose of
of that?
that?
un
11 A.
A. It's typically
It's typically toto collect
collect information.
information. The The
12 || primary
12 primary investigative
investigative question
question inin any
any cyber
cyber investigation
investigation
13 | is,
13 is, Who
who did
aia it?
ie?
14
14 You typically
You typically know
know that
that the
the hack
hack occurred
occurred because
because
15 || the
15 the company
company realizes
realizes that,
that, on,
Oh, gosh. Somebody has
gosh. Somebody has broken
broken
16 | into
16 into our
cur network,
network, and
and they
they have
have some
some understanding
understanding ofof what
what
17 || happened.
17 happened. TheThe hackers
hackers took
took this
this data.
data. But
But what
what we
we don't
don't
18 || know
18 know is
is who
who did
aia it.
it.
19
19 Typically when
Typically when we
we are
are working
working with
with aa victim, it's
victim, it's
20
20 [we want
we to collect
want to collect logs,
logs, pieces
pieces of
of digital
digital evidence
evidence so
so we
we
21 || can
21 can put
put those
those pieces
pieces together
together and
and identify
identify who committed the
who committed the
22 | crime.
22 crime.
23
23 ©.
Q. Now, let's
Now, let's suppose
suppose the
the FBI
FBI --
-- let's
let's suppose
suppose you
you
24 || are
24 are working
working with
with aa political campaign. You
political campaign. You have
have occasion
occasion toto
25
25 [talk to
talk to someone
someone who
who is
is representing
representing aa political
political campaign
campaign in in
491
491
1
1 their political
their political capacity.
capacity. Would you view
Would you view those
those two
two
2
2 situations as
situations as different
different from
from one
one another?
another?
3
3 MR. BERKOWITZ: Objection,
MR. BERKOWITZ: Objection, Your
Your Honor.
Honor. Both
Both
4
4 beyond the
beyond the scope
scope and
and lacking
lacking foundation,
foundation, as
as he
he testified
testified he
he
5
5 had no
had no knowledge
knowledge of
of the
the hack
hack investigation.
investigation.
6
6 THE COURT:
THE COURT: I'll sustain
I'll sustain it.
it.
7
7 BY
BY MR.
MR. DeFILIPPIS:
DeFILIPPIS:
8
8 @.
Q. special Agent
Hellman, the
the DNC
DNC hack
hack --
-- so
so you
you said
said
9
9 you didn't
you didn't participate in that
participate in that investigation.
Correct?
10
10 A.
A. AA very
very small
small amount.
amount.
1
11 Q.
Q. Turning back
Turning back to
to your
your paper, your analytical
paper, your analytical paper,
paper,
12
12 if you
if you were to learn
were to learn that
that that
that paper were written
paper were written by
by someone
someone
13
13 who was
who was being
being paid
paid by a political
by a political campaign,
campaign, would
would you
you view
view
14
14 that as
that as similar
similar or
or different to dealing
different to dealing with
with aa lawyer
lawyer for
for aa
15
15 hacked victim?
hacked victim?
16
16 A.
A. Different.
Different.
17
17 Q.
Q. In what
In what respect?
respect?
18
18 A.
A. If I'm
If I'm working
working with
with aa lawyer
lawyer who has aa victim
who has victim
19
19 company, let's
company, let's say,
say, who
who has
has been
been hacked,
hacked, typically
typically that
that
20
20 attorney is
attorney is there
there to
to protect
protect that
that company.
company. And so we
And so are
we are
21
21 working with
working with that
that attorney
attorney toto obtain
obtain information
information that
that we
we can
can
22
22 use for
use for the
the investigation,
investigation, and
and that
that attorney
attorney is
is there
there to
to
23
23 represent the
represent the interests
interests of
of their
their victim.
victim. II think
think that's
that's
24
24 what II got.
what got.
25
25 Q.
Q. Okay.
Okay. Now on
Now on those
those Link
Link messages that we
messages that we saw,
saw, did
did
492
492
1
1 [I you
vou actually
actually collect
collect and
and verify
verify those
those Link
Link messages or their
messages or their
22 || authenticity?
authenticity?
33 A.
A. I did
I did not.
not.
44 ©.
Q. And did
And did you
you have
have occasion
occasion atat any
any point
point to
to look
look
55 || whether
whether those
those timestamps
timestamps were
were authentic
authentic or
or anything
anything about
about
66 [| the
the timestamps
timestamps onon them?
them
77 A.
A. T did
I did not.
not.
88 ©.
Q. Have you
Have you ever heard of
ever heard of something
something called
called UTC
UIC time?
time?
99 A.
A. sure.
Sure.
10
10 Q.
Q. What is
What is that?
that?
un
11 A.
A. UTC --
UTC -- the
the U,
U, II think,
think, stands
stands for
for universal.
universal.
12 || anyway,
12 there are
Anyway, there are various
various different
different time
time zones:
zones: PST,
PST, EDT,
EDT,
13 [| Zulu
13 zulu time,
time, UTC,
utc, Greenwich.
Greenwich. It's
It's aa wide range of
wide range of different
different
14 | time
14 time zones,
zones, but
but UTC
UTC is
is typically
typically one
one that
that can
can be
be used
used if
if you
you
15 || are
15 are trying
trying toto exchange
exchange logs
logs between
between multiple
multiple entities,
entities, it's
it's
16 || useful
16 userur if
if you
you all
all can
can use
use the
the same
same time
time zone,
zone, so
so that
that you
you
17 || don't
17 don't have
have toto make,
make, sort
sort of,
of, aa calculation
calculation inin your
your between,
between,
18 || Oh,
18 on, well,
well, this
this one
one is
is in
in Pacific
Pacific time;
time; so
so that's
that's three
three hours
hours
19 || behind;
19 venind; that
that kind
kind of
of thing.
thing. So So it's
it's aa time
time zone
zone that
that is
is
20 [[ commonly
20 commonly used
used in
in technical
technical logs.
logs.
21
21 ©.
Q. Okay. Do
Okay. Do you
you know
know one
one way
way or
or the
the other
other when
when the
the
22 [[ FBI
22 #81 logs
logs its
its Link
Link messages,
messages, does
does it
it do
do it
it in
in UTC
UTC time
time or
or
23 || some
23 some other
other time?
time?
2
24 A.
A. do not
I do not know.
know.
25
25 @.
Q. Okay. Let's
Okay. let's talk
talk aa little
little bit
bit about
about --
--
493
493
1
1 Mr. Berkowitz asked
Mr. Berkowitz asked you
you about
about this
this statement
statement you
you think
think you
you
2
2 recall from
recall from Mr. Sporre that
Mr. Sporre that the
the information
information may have come
may have come
3
3 from aa sensitive
from sensitive source.
source. DoDo you
you recall
recall that?
that?
1
4 A.
A. Yes.
Yes.
5
5 ©.
Q. When you
When you recall
recall the
the words
words "sensitive
"sensitive source,"
source," did
did
6
6 you have
you have the
the understanding
understanding it
it was
was aa signed
signed up
up --
-- first
first of
of
7
7 all, what
all, what is
is aa confidential
confidential human
human source?
source?
8
8 A.
A. Someone who
Someone who is
is providing
providing information
information to
to the
the FBI
FBI
9
9 and we
and we are
are taking
taking steps
steps to
to protect their identity.
protect their identity.
10
10 ©.
Q. Okay. And
Okay. And is
is that
that aa formalized
formalized procedure
procedure at
at the
the
n
11 FBI when
FBI when someone
someone is
is aa confidential
confidential human
human source?
source?
12
12 A.
A. It is,
It is, yes.
ves.
13
13 ©.
Q. And to
And to what
what extent
extent is
is just
just the
the word
word "source"
"source" oror
14
14 “sensitive source"
"sensitive source" sometimes
sometimes used
used more
more broadly or
broadly or
15
15 differently than
differently than "confidential
"confidential human
human source"?
source"?
16
16 A.
A. sure. It
Sure. It could
could --
-- the
the term
term "sensitive
"sensitive source"
source"
17
17 could just
could just be
be aa common
common term
term for
for you
you obtained
obtained some
some
18
18 information from
information from someone
someone and
and you
you are
are trying
trying to
to protect their
protect their
19
19 identity, but
identity, but they
they may not have
may not have gone
gone through
through the
the formalized
formalized
20
20 process of
process of becoming
becoming a a confidential
confidential source.
source.
21
21 ©.
Q. So when
So when Special
Special Agent
Agent Sporre
Sporre mentioned
mentioned toto you
you that
that
22
22 this information
this information had
had come
come from
from aa "sensitive
"sensitive source",
source”, asas II
23
23 think it
think it was
was your
your testimony,
testimony, how
how did
did you
you take
take that
that phrase
phrase inin
24
24 that context?
that context?
25
25 A.
A. Oh, you
Oh, you mean
mean as
as in
in whether
whether or
or not
not he
he was an
was an
494
494
1
1 | official
orriciar --
--
22 Q.
Q. ves.
Yes.
33 A.
A. I didn't
I didn't know
know whether
whether he
he was -- he
was -- he or
or she
she or
or
42 [| whoever
whoever it
it was, was an
was, was an official
official FBI
FBI confidential
confidential human
human
55s [| source.
source.
66 ©.
Q. Okay. Now,
Okay. Now, if
if you
you knew
knew or
or thought
thought that
that the
the
77 || information
information inin that
that paper
paper had
had been
been received
received from
from an
an actual,
actual,
88 || signed-up,
signed-up, confidential
confidential human
human source,
source, is
is that
that something
something youyou
93 [| would
would have
nave wanted
wanted to
to know?
know
10
10 A.
A. Yes.
Yes.
un
11 ©.
Q. And why
And why might
might that
that be?
be?
12
12 A.
A. I think
I think it
it would
would have
have provided
provided at
at least
least some
some
13 || understanding
13 understanding toto me
me of
of maybe why we
maybe why we were
were being
being told
told we
we
14 || couldn't
14 couldn't know
xnow or
or II couldn't
couldn't know
know who
who the
the person
person was.
was. ButBut it
it
15 || also
15 a1so would
would have
nave given
given me
me some
some understanding
understanding of,
of, Okay.
Okay. This
This
16 || is
16 is sort
sort of
of just
just an
an official
official thing.
thing. It's
It's an
an official
official
17 || process.
17 process. Someone
someone who
who has
has officially
officially been
been signed
signed up
up as
as aa
18 || confidential
18 confidential human
human source,
source, has
has provided this information.
provided this information.
19 | It
19 zt had
nad been documented somewhere.
been documented somewhere. And I'm just
And I'm just not
not the
the
20 [[ person
20 person who is allowed
who is allowed to
to know.
know.
21
21 Q.
Q. Now, do
Now, do confidential
confidential human
human sources
sources --
-- are
are you
you
22 [[ familiar
22 familiar with
with the
the term
tern "handler"?
"handler"?
23
23 A
A. ves.
Yes.
2
24 Q.
Q. What is
What is that?
that?
25
25 A.
A. It's essentially
It's essentially anan FBI
FBI agent
agent whose
whose responsibility
responsibility
495
495
1
1 it is
it is to
to communicate
communicate with
with this
this confidential
confidential human
human source
source and
and
2
2 document their
document their interactions
interactions with
with this
this person.
person.
3
3 @.
Q. And if
And if aa confidential
confidential human
human source
source has
has information
information
4
4 that they
that they think
think is
is of
of interest
interest to
to the
the FBI,
FBI, is
is there
there aa
5
5 particular person
particular who they
person who they are
are supposed
supposed to
to give
give that
that
6
6 information to?
information to?
7
7 A.
A. ves.
Yes.
8
8 MR. BERKOWITZ: Objection,
MR. BERKOWITZ: Objection, Your
Your Honor.
Honor. This
This is
is
9
9 beyond the
beyond the scope.
scope.
10
10 THE COURT:
THE COURT: I'll
I'll overrule
overrule it.
it.
1
11 BY
BY MR.
MR. DeFILIPPIS:
DeFILIPPIS:
12
12 Q.
Q. So when
So when aa confidential
confidential human
human source
source has
has
13
13 information, to
information, to who
who if
if anyone
anyone are
are they
they supposed
supposed to
to give that
give that
14
14 information?
information?
15
15 A.
A. They are
They are supposed
supposed to
to give
give it
it to
to their
their handler.
handler.
16
16 Q.
Q. And in
And in your
your experience
experience as
as an
an FBI
FBI agent,
agent, are
are you
you
17
17 aware of
aware of any
any instances
instances in
in which
which aa confidential
confidential human
human source
source
18
18 directed information
directed information to
to the
the FBI's
FBI's top
top lawyer,
lawyer, its
its general
general
19
19 counsel?
counsel?
20
20 A.
A. It's certainly
It's certainly possible
possible but
but I'm
I'm not
not aware.
aware.
21
21 Q.
Q. Okay.
Okay. Thank you
Thank you very
very much.
much.
22
22 BY THE
BY THE COURT:
COURT: Do you
Do you want
want to
to follow
follow up
up on
on that
that
23
23 last point,
last point, Mr. Berkowitz?
Mr. Berkowitz?
24
24
25
25
496
496
1
1 RECROSS-EXAMINATION
RECROSS-EXAMINATION OF
OF SCOTTHELLMAN
SCOTT HELLMAN
2
2 BY
BY MR.
MR. BERKOWITZ:
BERKOWITZ:
3
3 Q.
Q. Just briefly,
Just sir. Do
briefly, sir. Do you
you know
know who
who Special
Special Agent
Agent
4
4 Tom Grasso
Tom Grasso is?
is?
5
5 A.
A. ves.
Yes.
6
6 Q.
Q. Could you
Could you tell
tell the
the jury
jury who
who that
that is?
is?
7
7 A.
A. He is
He is another
another FBI
FBI special
special agent.
agent.
8
8 ©.
Q. And do
And do you
you know
know whether
whether he
he handles
handles confidential
confidential
9
9 human sources?
human sources?
10
10 A.
A. I don't
I don't know
know if
if at
at this
this point
point in
in his
his career
career he
he
1
11 handles confidential
handles confidential human
human sources.
sources.
12
12 Q.
Q. Are you
Are you aware
aware that
that in
in this
this case
case Rodney
Rodney Joffe
Joffe
13
13 approached Tom
approached Tom Grasso
Grasso with
with information
information relevant
relevant to
to this
this
14
14 investigation in
investigation in September
September of
of 2016?
20162
15
15 A.
A. No, I'm
No, I'm not.
not.
16
16 Q.
Q. Let me
Let me show
show you
you one
one document
document marked 531 for
marked 531 for
17
17 identification. Take
identification. Take aa look
look at
at the
the top
top of
of this
this email.
email.
18
18 MR. BERKOWITZ: Well,
MR. BERKOWITZ: Well, first
first of
of all
all let
let me
me move it
move it
19
19 into evidence.
into evidence.
20
Honor.
21
21 THE COURT:
THE COURT: So moved.
So moved.
22
531 was
was admitted.)
admitted.)
23
23 BY
BY MR.
MR. BERKOWITZ:
BERKOWITZ:
24
24 @.
Q. Let's take
Let's take aa look
look at
at the
the top.
top. It's
It's from
from Curtis
Curtis
25
25 Hiede to
Hiede to Scott
Scott Hellman.
Hellman. Do you
Do you see
see that?
that?
497
497
1
1 A.
A. ves.
Yes.
2
2 ©.
Q. And it's
And it's forwarding
forwarding and
and email
email chain
chain on
on Anonymous
Anonymous
3 || Reporting
3 reporting onon DNS
pNs Data.
pata.
a
4 A.
A. I see
I see it,
it, yes.
yes.
5
5 ©.
Q. He's telling
He's telling you
you to
to "Check
"Check this
this out"?
out"?
6
6 A.
A. Yes.
Yes.
7
7 MR. BERKOWITZ: If
you would
would blow out the
blow out the entire
entire
8 || document
8 document soso that
that the
the witness
witness has
has aa chance
chance to
to see
see it.
it.
5 [| err.
9 BY MR. semxowrrz:
BERKOWITZ:
10
10 ©.
Q. Iam
I going to
am going to focus
focus you
you on
on the
the Tom
Tom Grasso
Grasso line,
line,
11 || sir,
11 sir, from
from Mr.
mr. Grasso.
Grasso. and the date
And the date it
it was forwarded to
was forwarded to you
you
12 [| was
12 was October
october 3rd,
3rd, but
but Mr.
Mr. Grasso
Grasso sends
sends Mr.
Mr. Wierzbicki
Wierzbicki anan
13 || "Anonymous
13 anonymous Reporting
Reporting on
on DNS
DNs Data".
Data". Do Do you
you see
see that?
that?
14
14 A.
A. ves.
Yes.
1s
15 ©.
Q. He says
He says --
-- who
who is
is Special
Special Agent
Agent Wierzbicki?
Wierzbicki?
16
16 A.
A. Dan Wierzbicki
Dan Wierzbicki was
was the
the supervisory
supervisory special
special agent
agent
17 || in
17 in Chicago
chicago atat that
that time.
time.
18
18 ©.
Q. And if
And if you
you will
will take
take aa look
look at
at the
the second
second
19 || paragraph,
19 paragraph, I'm1'm going
going to
to focus
focus you
you on
on the
the third
third and
and fourth
fourth
20 [[ lines.
20 tines. It 1c says,
says, "There
"There isis one
one bit of data
bit of data that
that was
was not
not
21 || provided,
21 provided, and
and that
that is
is the
the IP
Ip address
address of
of the
the person
person of
of
22
22 [interest at
interest at the
the bank.
bank. Here's
Here's the
the additional
additional information
information
23 || that
23 that an
an anonymous
anonymous reporter
reporter requested
requested byby provided
provided to
to the
the
24 [[ FBI."
24 #81." Do po you
you see
see that?
that?
25
25 A.
A. ves.
Yes.
498
498
1
1 Q.
Q. sir, do
Sir, do you
you follow
follow up
up with
with Tom
Tom Grasso
Grasso to
to see
see who
who
2
2 the person
the person was that had
was that had provided
provided the
the additional
additional information?
information?
3
3 A.
A. I am
I am not
not aware.
aware.
4
4 @.
Q. Are you
Are you aware
aware that
that the
the person
person who
who provided
provided that
that
5
5 was Rodney
was Rodney Joffe?
Joffe?
6
6 A.
A. I am
I am not
not aware.
aware.
7
7 MR. DeFILIPPIS: Objection.
MR. DeFILIPPIS: Objection. Asked and answered.
Asked and answered.
8
8 THE COURT:
THE COURT: Overruled.
Overruled.
9
9 BY
BY MR.
MR. BERKOWITZ:
BERKOWITZ:
10
10 Q.
Q. And, sir,
And, sir, do
do you
you know
know who
who Rodney
Rodney Joffe
Joffe is?
is?
1
11 A.
A. Ido.
I do.
12
12 Q.
Q. You didn't
You didn't know
know who
who he
he was
was at
at the
the time.
time. Correct?
Correct?
13
13 A.
A. That's correct.
That's correct.
14
14 @.
Q. Okay.
Okay. You met
You met with
with him
him in
in 2017?
20172
15
15 A.
A. ves.
Yes.
16
16 Q.
Q. In connection
In connection with
with one
one of
of your
your cases?
cases?
17
17 A.
A. Not with
Not with one
one of
of my
my cases,
cases, no.
no.
18
18 Q.
Q. Was he
Was he aa confidential
confidential human
human source
source at
at that
that point?
point?
19
19 A.
A. II don't
don't know.
know.
20
20 Q.
Q. And, sir,
And, sir, you
you knew
knew that
that the
the data
data that
that had
had been
been
21
21 provided in
provided in the
the white
white paper
paper was
was provided
provided by
by aa researcher.
researcher.
22
22 Correct?
Correct?
23
23 A.
A. II don't
don't remember
remember if
if that's
that's what
what it
it said
said in
in the
the
24
24 narrative. II think
narrative. think so,
so, yes.
yes.
25
25 Q.
Q. Do you
Do you remember
remember that
that you
you referred
referred to,
to, in
in one
one of
of
499
499
1
1 your reports
your reports of
of interview,
interview, that
that the
the --
-- when criticizing the
when criticizing the
2
2 report you
report you talk
talk about
about the
the researcher?
researcher?
3
3 A.
A. I don't
I don't remember
remember but it is
but it is certainly
certainly possible.
possible.
4
4 @.
Q. Okay. Did
Okay. Did you
you ever
ever ask
ask to
to speak
speak to
to the
the
5
5 researcher --
researcher --
6
6 A
A. No.
No.
7
7 Q.
Q. ---- who
who prepared
prepared the
the report?
report?
8
8 A.
A. No, II didn't
No, didn't know
know who
who the
the researcher
researcher was.
was.
9
9 Q.
Q. All right.
All right. And you
And you never
never asked
asked Mr.
Mr. Grasso
Grasso who
who it
it
10
10 was that
was that provided this
provided this information.
information. Correct?
Correct?
1
11 A.
A. I don't
I don't remember.
remember.
12
12 MR. BERKOWITZ: Nothing
MR. BERKOWITZ: Nothing further.
further.
13
13 THE COURT:
THE COURT: All
All right.
right. Special
Special Agent
Agent Hellman,
Hellman,
14
14 thank you
thank you very
very much for your
much for your testimony.
testimony. YouYou are
are excused.
excused.
15
15 Please don't
Please don't discuss
discuss your
your testimony
testimony with
with anyone
anyone until
until the
the
16
16 end of
end of the
the case.
case.
17
17 THE WITNESS:
THE Yes, Your
WITNESS: Yes, Your Honor.
Honor.
18
18 THE COURT:
THE COURT: Have
Have aa good
good day.
day.
19
19 THE WITNESS:
THE Thank you.
WITNESS: Thank you.
20
20 THE COURT:
THE COURT: Ladies
Ladies and
and gentlemen.
gentlemen. WeWe are
are going
going to
to
21
21 take our
take our afternoon
afternoon break.
break. ItIt is
is 3:45.
3:45. WeWe will be ready
will be ready to
to
22
22 go at
go at 4:00.
4:00. All
All right?
right?
23
23 (Jury exited
(Jury exited the
the courtroom.)
courtroom.)
24
24 THE COURT:
All right. Who's next
Who's next up?
up?
25
25 MR. DeFILIPPIS: Your
MR. DeFILIPPIS: Your Honor,
Honor, it
it will
will be
be Steve
Steve
500
500
1
1 DeJong, D-e-J-o-n-g.
DeJong, D-e-J-o-n-g.
2
2 THE COURT:
THE COURT: Mr. DeJong.
Mr. DeJong. Okay.
Okay.
3
3 And II want
And want to
to get
get them
them out
out of
of here
here like
like 4:30,
4:30,
4
4 4:45, maybe.
4:45, maybe. So we
So we will
will do
do 45
45 minutes.
minutes. Will you
Will you need
need that
that
5
5 long?
long?
6
6 MR. DeFILIPPIS: Short.
MR. DeFILIPPIS: Short.
7
7 THE COURT:
THE COURT: Have
Have aa seat,
seat, everybody.
everybody.
8
Honor, II would
would suspect
suspect the
the
9
9 direct will
direct will be
be shorter
shorter than
than that.
that.
10
10 THE COURT:
THE COURT: Okay.
Okay. Cross?
Cross?
1
11 MR. BOSWORTH: Short.
MR. BOSWORTH: Short.
12
12 THE COURT:
THE COURT: Short?
Short? Okay.
Okay. Well,
Well, maybe we can
maybe we can get
get
13
13 him on
him on and
and off
off and
and then
then knock
knock off
off after
after that.
that. All right.
All right.
14
14 We stand
We stand in
in recess.
recess.
15
15 (Recess.
(Recess.)
16
16 THE COURT:
THE COURT: Okay.
Okay. Who is
Who is handling
handling the
the direct?
direct?
17
17 MR. DeFILIPPIS: That
MR. DeFILIPPIS: That would
would be
be me,
me, Your
Your Honor.
Honor.
18
18 THE COURT:
THE COURT: Okay.
Okay.
19
Honor, the
the government
government calls
calls
20
20 Steve --
Steve --
21
21 THE COURT:
THE COURT: Well, let's
Well, let's wait
wait for
for our
our jury.
jury.
22
22 MR. DeFILIPPIS: Oh,
MR. DeFILIPPIS: I'm sorry.
Oh, I'm sorry. That
That would
would be
be
23
23 helpful.
helpful.
24
24 (Jury entered
(Jury entered the
the courtroom.)
courtroom.)
25
25 THE COURT:
THE COURT: Welcome back,
Welcome back, everyone.
everyone. Please be
Please be
501
1 seated.
2 Mr. DeFilippis, I think the floor is yours.
3 MR. DeFILIPPIS: Yes, Your Honor. The government
4 calls Steve DeJong.
5 THE COURT: Good afternoon, sir.
6 THE WITNESS: Good afternoon.
7 THE COURT: If you could remain standing and raise
8 your right hand, please.
9 DEPUTY CLERK: Do you solemnly affirm and truly
10 declare the testimony you are about to give will be the
11 truth, the whole truth and nothing but the truth? And this
12 you do under pain and penalty of perjury. If so, please say
13 I do.
14 THE WITNESS: I do.
15 DEPUTY CLERK: Thank you. You may be seated.
16 THE COURT: All right. Please get comfortable
17 there. Make sure you speak into the mic. Okay?
18 THE WITNESS: Hi.
19 DIRECT EXAMINATION OF STEVE DEJONG
20 BY MR. DeFILIPPIS:
21 Q. Good afternoon, Mr. DeJong. Could you just state
22 and then spell your name for the record and the court
23 reporter?
24 A. My name is Steve DeJong, D-e-J-o-n-g.
25 Q. Where do you work?

502
502
1
1 A.
A. I work
I work for
for Neustar
Neustar Security
Security Services.
Services.
2
2 ©.
Q. And briefly
And briefly speaking,
speaking, what
what is
is Neustar
Neustar Security
Security
3
3 services?
Services?
4
4 A.
A. The group
The group II work
work for
for is
is focused
focused on
on DNS,
DNS, hosted
hosted DNS
DNS
5
5 servers and
servers and DDoS
DDoS mitigation
mitigation systems.
systems. WeWe work
work primarily
primarily in
in
6
6 the internet
the internet infrastructure
infrastructure providing
providing services
services for
for our
our
7
7 customers.
customers.
8
8 ©.
Q. Okay. And
Okay. And we
we will
will come
come back
back to
to your
your role
role and
and some
some
9
9 of that
of that terminology,
terminology, but
but what
what is
is Neustar
Neustar more
more broadly?
broadly?
10
10 A.
A. Neustar was
Neustar was aa media data clearinghouse,
media data clearinghouse, data
data for
for
n
11 media, advertising, marketing
media, advertising, and internet
marketing and internet services.
services.
12
12 ©.
Q. So what
So what kinds
kinds of
of specific
specific services
services or
or activities
activities
13
13 does it
does it engage
engage in?
in?
14
14 A.
A. I can't
I can't speak
speak for
for the
the rest
rest of
of Neustar.
Neustar. MyMy group
group
15
15 does DNS
does DNS internet
internet services
services and
and hosting
hosting DDoS
DDoS mitigation.
mitigation.
16
16 ©.
Q. When you
When you say
say DNS
DNS internet
internet services
services and
and internet
internet
17
17 hosting, what
hosting, what does
does that
that mean?
mean?
18
18 A.
A. We provide
We provide aa cloud-based
cloud-based DNS
DNS infrastructure
infrastructure for
for
19
19 large enterprises
large enterprises forfor TLD
TLD operators,
operators, for
for recursive
recursive
20
20 resolvers. We
resolvers. We have
have global
global infrastructure
infrastructure inin data
data centers
centers
21
21 all across
all across the
the world.
world.
22
22 ©.
Q. okay. So
Okay. So is
is it
it fair
fair to
to say,
say, Mr. DeJong, that
Mr. DeJong, that you
you
23
23 provide servers
provide servers and
and infrastructure
infrastructure soso that
that the
the DNS
DNS system
system
24
24 can function?
can function? Is Is that
that fair?
fair?
25
25 A.
A. We provide
We provide services
services and
and infrastructure
infrastructure soso that
that our
our
503
503
1
1 customers can
customers can have
have an
an internet
internet presence.
presence. Correct.
Correct.
2
2 ©.
Q. And what
And what kinds
kinds of
of customers
customers dodo you
you have?
have? IsIs this
this
3
3 individuals? Companies?
individuals? Companies?
4
4 A.
A. Companies. Mostly
Companies. Mostly large
large enterprises,
enterprises, brick
brick and
and
5 || mortar,
5 shops, companies
mortar, shops, companies that
that want
want any
any sort
sort of
of presence
presence onon
6
6 the internet.
the internet.
7
7 Q.
Q. So if
So if aa company
company --
-- if
if any
any company
company wants
wants to
to hire
hire
8
8 you, what
you, what is
is it
it that
that your
your services
services allow
allow the
the company
company to
to do?
do?
9
9 A.
A. The DNS
The DNS service
service itself
itself provides
provides aa system
system for
for
10
10 serving domain
serving domain names
names and
and converting
converting those
those names
names into
into
n
11 addresses.
addresses.
12
12 ©.
Q. So to
So to what
what extent
extent do
do those
those services
services facilitate
facilitate the
the
13
13 web-based activities
web-based activities and
and browsing
browsing of
of aa company?
company?
14
14 A.
A. DNS is
DNS is the
the first
first step
step in
in the
the lookup,
lookup, the
the first
first
15
15 thing when
thing when you
you type
type something
something inin your
your browser,
browser, you
you have
have toto
16
16 give it
give it aa domain
domain toto go
go to.
to. DNS
DNS is
is the
the first
first step
step in
in that
that
17
17 lookup to
lookup to convert
convert that
that name
name to
to an
an address.
address.
18
18 ©.
Q. Okay. In
Okay. In connection
connection toto providing
providing DNS
DNS services
services toto
19
19 companies and
companies and customers,
customers, does
does Neustar
Neustar house
house quantities
quantities of
of
20
20 DNS?
DNS?
21
21 A.
A. Ultra DNS
Ultra DNS keeps
keeps aa large
large amount
amount of
of the
the data
data that
that itit
22
22 collects. We
collects. do that
We do that for
for various
various reasons,
reasons, operational
operational
23
23 telemetry, forensic
telemetry, forensic analysis
analysis in
in terms
terms of
of attack,
attack, and
and just
just
24
24 analytics of
analytics of what
what our
our customer's
customer's behavior
behavior is
is to
to bill
bill them,
them,
25
25 invoice them
invoice them and
and answer
answer any
any questions
questions that
that they
they may have
may have
504
504
1
1 about how
about how the
the internet
internet --
-- how
how their
their service
service is
is being used.
being used.
2
2 @.
Q. Okay.
Okay. So you
So you mentioned Ultra DNS.
mentioned Ultra DNS. Is that
Is that aa part
part
3
3 of --
of —-
4
4 A.
A. That is
That is the
the product
product name.
name. Sorry.
Sorry.
5
5 COURT REPORTER:
COURT REPORTER: Excuse me.
Excuse me. Please let
Please let him
him finish
finish
6
6 his question
his question before
before you
you answer.
answer.
7
7 THE WITNESS:
THE WITNESS: Okay.
Okay.
8
8 BY
BY MR.
MR. DeFILIPPIS:
DeFILIPPIS:
9
9 Q.
Q. That is
That is aa product
product name
name within
within Neustar?
Neustar?
10
10 A.
A. Yes, it
Yes, it was.
was.
1
11 Q.
Q. In providing
In providing services
services to
to its
its customers,
customers, does
does
12
12 Neustar come
Neustar come to
to possess
possess those
those customers'
customers' DNS
DNS data?
data? Is
Is
13
13 that --
that --
14
14 A.
A. Correct.
Correct.
15
15 @.
Q. Okay. And
Okay. And if
if you
you could
could give
give aa ballpark
ballpark --
-- not
not
16
16 that it
that it will
will necessarily
necessarily be
be meaningful
meaningful but what quantities
but what quantities
17
17 of data
of data are
are we
we talking
talking about?
about?
18
18 A.
A. Um, right
Um, right about
about now
now we
we do
do somewhere
somewhere around
around 150
150
19
19 billion DNS
billion DNS transactions
transactions per
per day.
day. That
That works
works out
out to
to around
around
20
20 55 terabytes
terabytes of
of data.
data.
21
21 Q.
Q. per day?
Per day?
22
22 A.
A. per day.
Per day.
23
23 Q.
Q. Does Neustar
Does store that
Neustar store that data,
data, at
at least
least for
for some
some
24
24 period of
period of time?
time?
25
25 A.
A. We store
We store it
it for
for some
some period of time,
period of time, yes.
yes.
505
505
1
1 Q.
Q. If aa person
If is browsing
person is browsing on
on the
the internet
internet andand they
they
2
2 trigger DNS
trigger DNS lookups,
lookups, to
to what
what extent
extent might those be
might those be captured
captured
3
3 in Neustar's
in Neustar's holdings?
holdings?
4
4 A.
A. Assuming they
Assuming they are
are going
going to
to one
one of
of our
our customer's
customer's
5
5 domains, we
domains, we would
would see
see the
the timestamp.
timestamp. We We would
would see
see the
the
6
6 address that
address that was
was being
being resolved
resolved too
too and
and where
where it
it came
came from.
from.
7
7 ©.
Q. And what
And what does Neustar do
does Neustar do with all of
with all of that
that data?
data?
8
8 A.
A. We use
We use it
it for
for forensic
forensic analysis.
analysis. When
When we
we come
come
9
9 under DDoS
under DDoS attack,
attack, we use it
we use it for
for operational
operational analysis
analysis to to
10
10 know that
know that our
our services
services are
are running
running in
in aa globally-distributed
globally-distributed
n
11 fashion. Data
fashion. Data is
is going
going --
-- or
or queries
queries are
are going
going where
where they
they
12
12 need to
need to go.
go. They
They are
are being
being answered
answered in
in aa timely
timely fashion.
fashion.
13
13 We also
We also use
use it
it for
for billing.
billing. We bill our
We bill our customers
customers
14
14 for the
for the number
number ofof queries
queries wewe serve
serve for
for them,
them, and
and then
then wewe
15
15 also use
also use it
it for
for research
research and
and analytics.
analytics.
16
16 ©.
Q. You mentioned
You mentioned aa couple
couple times
times DDoS
DDoS attacks.
attacks. WhatWhat
17
17 is aa DDoS
is DDoS attack?
attack?
18
18 A.
A. When internet
When internet traffic
traffic and
and malicious behavior is
malicious behavior is
19
19 happening, we
happening, refer to
we refer to as
as aa DDoS
DDoS attack
attack or
or aa --
-- some
some form
form of of
20
20 abuse that
abuse that happens
happens against
against either
either the
the customer's
customer's network
network or or
21
21 against our
against our DNS
DNS name
name servers.
servers.
22
22 ©.
Q. And you
And you mentioned
mentioned that
that Neustar
Neustar also
also engages
engages in in
23
23 research and
research and analytics.
analytics. What
What kind
kind of
of research
research and
and
24
24 analytics?
analytics?
25
25 A.
A. Typically what
Typically what we
we are
are looking
looking for
for is
is any
any sort
sort ofof
506
506
1
1 || anomaties in
anomalies in the
tne traffic,
tratfic, abuse,
abuse, detection
detection of
of malicious
malicious
2
2 [| actors, threat
actors, threat actors
actors of
of some
some form,
form, usually
usually in
in terms
terms of
of
3
3 [| expraining wny
explaining a customer's
why a customers queries
queries have
nave gone
gone abnormally
abnormally
4
4 [| nigh or
high or abnormally
abnormally low.
low. Things like
Things like cache
cache poisoning.
poisoning.
5
5 [| things like
Things 1ixe DDoS
boos abuse,
abuse, hijacking
hijacking of
of any
any kind.
kina.
6
6 ©.
Q. Okay. Those
Okay. Those are
are basically bad things
basically bad things that
that happen
happen
7
7 || on the
on tne internet?
internets
8
8 A.
A. some of
Some of them.
them.
9
9 ©.
Q. To what
To what extent
extent does
does Neustar,
Neustar, to
to your
your knowledge,
knowledge, do
do
10
10 || political research?
political research? Is 1s that
that part
part of
of its
its business?
business?
un
11 A.
A. No.
No.
12
12 ©.
Q. Do you
Do you know
know an
an individual
individual named
named Rodney
Rodney Joffe?
Joffe?
13
13 A.
A. ves.
Yes.
14
14 Q.
Q. And who
And who is
is Mr.
Mr. Joffe,
Joffe, as
as far
far as
as you
you know?
know?
15
15 A.
A. Mr. Joffe,
Mr. Joffe, at
at one
one time,
time, was
was the
the CTO
CTO of
of Neustar.
Neustar.
16
16 ©.
Q. And CTO,
And CTO, what does that
what does that stand
stand for?
for?
17
17 A.
A. Chief Technology
Chief Technology Officer.
Officer.
18
18 9.
Q. Let me
Let me ask
ask you,
you, in
in the
the 2016
2016 time
time period,
period, were you
were you
19 |
19 also working
also working atat Neustar?
weustarz
20
20 A.
A. Yes.
Yes.
21
21 Q.
Q. What were
What you doing
were you doing then?
then?
22
22 A.
A. I was
I was working
working onon DNS
DNS operations
operations and
and data
data analysis.
analysis.
23
23 ©.
Q. And in
And in DNS
DNS operations
operations and
and data
data analysis,
analysis, what did
what did
24 ||
24 vou do
you do day
day to
to day?
day?
25
25 A.
A. Kept the
Kept the DNS
DNS servers
servers running,
running, made sure they
made sure they
507
507
1
1 didn't break,
didn't answered questions
break, answered for customers,
questions for customers, things
things of
of
2
2 that nature.
that nature.
3
3 ©.
Q. Okay. So
Okay. So are
are you
you the
the guy
guy at
at Neustar
Neustar who
who has
has
4
4 access to
access to most
most of
of its
its data
data or
or is
is responsible
responsible for
for that
that
5
5 infrastructure?
infrastructure?
6
6 A.
A. I had
I had access
access to
to most
most of
of the
the data
data at
at that
that time,
time,
7
7 yes.
yes.
8
8 ©.
Q. Okay. Now,
Okay. Now, going
going back
back to
to Mr.
Mr. Joffe,
Joffe, when
when did
did you
you
9
9 first get
first get acquainted
acquainted with
with Mr.
Mr. Joffe?
Joffe?
10
10 A.
A. When my
When company was
my company was acquired
acquired in
in 2007/2008
2007/2008
n
11 timeframe.
timeframe.
12
12 ©.
Q. You say
You say "your
"your company,"
company," what
what company
company was that?
was that?
13
13 A.
A. I had
I had aa company
company in
in Seattle
Seattle that
that was
was acquired
acquired byby
14
14 Neustar.
Neustar.
15
15 ©.
Q. In the
In the 2016
2016 time
time period,
period, was
was Mr. Joffe your
Mr. Joffe your boss
boss
16
16 or supervisor?
or supervisor?
17
17 A.
A. In that
In that timeframe
timeframe hehe was the Chief
was the Chief Technology
Technology
18
18 Officer of
Officer of Neustar,
Neustar, soso he
he was
was over
over much of engineering
much of engineering and
and
19
19 technology.
technology.
20
20 ©.
Q. Okay. Now,
Okay. Now, how
how frequently
frequently would
would you
you say
say you
you
21
21 interacted with
interacted him in
with him in 2016?
20162
22
22 A.
A. Probably once
Probably once or
or twice
twice aa month.
month.
23
23 ©.
Q. And what
And what would be the
would be the sorts
sorts of
of things
things that
that you
you
24
24 would deal
would deal with him on?
with him on?
25
25 A.
A. Um, everything
Um, everything from
from operational
operational decisions,
decisions,
508
508
1
1 capacity, planning
capacity, planning for
for our
our network,
network, new
new feature
feature sets
sets that
that we
we
2
2 would be
would be building
building into
into the
the DNS
DNS and
and other
other research
research projects
projects
3
3 that we
that we wanted
wanted to
to work
work on
on or
or explore.
explore.
4
4 ©.
Q. Did there
Did there come
come aa time
time in
in 2016
2016 when
when Mr.
Mr. Joffe
Joffe asked
asked
5
5 you to
you to run
run some
some particular
particular searches
searches over
over Neustar's
Neustar's data that
data that
6
6 related to
related to aa political
political topic?
topic?
7
7 A.
A. ves.
Yes.
8
8 ©.
Q. And tell
And tell us
us about
about that.
that.
9
9 A.
A. So in
So in the
the August/September timeframe, 2016,
August/September timeframe, 2016, he
he
10
10 asked me,
asked me, as
as aa favor,
favor, to
to run
run aa query over our
query over our DNS
DNS data
data logs
logs
n
11 to see
to see if
if we
we saw
saw any
any queries
queries for
for several
several names
names related
related to
to
12
12 political campaigns
political campaigns and
and political
political organizations.
organizations.
13
13 ©.
Q. And was
And was it
it --
-- at
at that
that time
time the
the 2016
2016 presidential
presidential
14
14 election was
election was gearing
gearing up;
up; is
is that
that right?
right?
15
15 A.
A. ves.
Yes.
16
16 ©.
Q. And do
And do you
you recall,
recall, was
was it
it both
both campaigns?
campaigns? One
One
17
17 campaign?
campaign?
18
18 A.
A. I don't
I don't recall
recall at
at the
the time
time what
what it
it was.
was. II think
think
19
19 in retrospect
in retrospect itit was
was mostly
mostly around
around the
the Trump
Trump campaign.
campaign.
20
20 ©.
Q. And what
And what was your reaction
was your reaction when
when he
he asked
asked you
you to
to do
do
21
21 that?
that?
22
22 A.
A. I didn't
I didn't think
think anything
anything ofof it
it at
at the
the time.
time. Quite
Quite
23
23 honestly, we
honestly, we do,
do, as
as II mentioned,
mentioned, wewe do
do research
research frequently.
frequently.
24
24 We have done
We have done research
research for
for any
any number
number of
of behavioral
behavioral projects.
projects.
25
25 So when
So someone comes
when someone comes and
and asks
asks it's
it's like,
like, Okay.
Okay. It's
It's just
just
509
509
1
1 another list
another list of
of domains.
domains.
2
2 @.
Q. Okay.
Okay. So did
So did he
he give
give you
you any
any background
background as
as to
to why
why
3
3 he was
he asking you
was asking you to
to do
do it?
it?
4
4 A.
A. None.
None.
5
5 @.
Q. Did you
Did you ask
ask any
any questions?
questions?
6
6 A
A. No.
No.
7
7 Q.
Q. Why?
Why?
8
8 A.
A. He is
He is the
the CTO
CTO of
of my company.
my company. II don't
don't ask
ask
9
9 questions.
questions.
10
10 Q.
Q. Now, do
Now, do you
you know
know an
an individual
individual named
named Manos
Manos
1
11 Antonakakis?
Antonakakis?
12
12 A.
A. ves.
Yes.
13
13 Q.
Q. Who is
Who is that?
that?
14
14 A.
A. He is
He is aa researcher
researcher at
at Georgia
Georgia Tech.
Tech. II believe
believe he
he
15
15 is aa third
is third degree.
degree.
16
16 Q.
Q. Georgia Tech?
Georgia Tech?
17
17 A.
A. ves.
Yes.
18
18 Q.
Q. Is Georgia
Is Georgia Tech
Tech aa university?
university?
19
19 A.
A. ves.
Yes.
20
20 @.
Q. What relationship,
What relationship, ifif any,
any, did
did Mr.
Mr. Antonakakis
Antonakakis
21
21 have with
have with Neustar?
Neustar?
22
22 A.
A. He would
He would work with us
work with us on
on certain
certain projects. Manos
projects. Manos
23
23 is very
is well-known in
very well-known in the
the research
research community.
community. HeHe would
would work
work
24
24 on several
on several projects with us
projects with us from
from research
research topics,
topics, from
from
25
25 threat hunting,
threat hunting, malware hunting and
malware hunting and other
other things.
things.
510
510
1
1 ©.
Q. And was
And was there
there any
any particular
particular project or projects
project or projects
2
2 in which
in Neustar shared
which Neustar shared its
its data
data with
with Georgia
Georgia Tech
Tech and
and
3
3 Mr. Antonakakis?
Mr. Antonakakis?
4
4 A.
A. Yes, absolutely.
Yes, absolutely.
5
5 ©.
Q. What was
What that?
was that?
6
6 A.
A. We had
We had opportunity
opportunity toto explore,
explore, through
through some
some of
of his
his
7
7 research projects,
research projects, toto be
be able
able to
to do
do deep
deep investigations.
investigations.
8
8 And we
And we had
had given
given him
him access.
access. That
That was in late
was in late 2016
2016 as
as well
well
9
9 where we
where we had
had given
given him
him access
access to
to most
most ofof our
our data
data lake.
lake.
10
10 ©.
Q. And when
And when you
you say
say you
you gave them access
gave them access or
or him
him
n
11 access to
access to most
most ofof your
your data, you mean
data, you mean all
all of
of or
or most of
most of
12
12 Neustar's data,
Neustar's data, all
all of
of the
the terabytes?
terabytes?
13
13 A.
A. The Neustar,
The Neustar, Ultra
Ultra DNS
DNS data.
data. NotNot all
all of
of Neustar's
Neustar's
14
14 data, no.
data, no.
15
15 ©.
Q. Okay. And
Okay. And would
would that
that be
be aa large
large quantity
quantity of
of data?
data?
16
16 A.
A. ves.
Yes.
17
17 ©.
Q. And were
And were you
you --
-- what
what was the point
was the of that
point of that
18
18 information sharing?
information sharing?
19
19 A.
A. As far
As far as
as II know,
know, it
it was
was part of aa deal
part of deal to
to do
do
20
20 research and
research and abuse
abuse detection and malware
detection and malware detection.
detection.
21
21 ©.
Q. Were you
Were you sending
sending Ultra
Ultra DNS's
DNS's internet
internet traffic
traffic and
and
22
22 DNS traffic
DNS traffic on on aa periodic
periodic basis?
basis? On On aa realtime
realtime basis?
basis? HowHow
23
23 did that
did that work?
work?
24
24 A.
A. It was
It was aa periodic basis, once
periodic basis, once aa week
week or
or daily.
daily. II
25
25 can't recall.
can't recall.
s11
511
1
1 ©.
Q. And what
And what quantities
quantities ofof data
data would
would that
that be?
be?
2
2 A.
A. It was
It was parsed-down
parsed-down data
data so
so probably
probably around
around 22 or
or 33
3
3 terabytes of
terabytes of data
data aa day.
day.
4
4 ©.
Q. Okay. So
Okay. So aa lot
lot of
of data?
data?
5
5 A.
A. It was
It was aa lot
lot of
of data,
data, yes.
yes.
6
6 Q.
Q. Were they
Were they paying
paying for
for that
that data?
data?
7
7 A.
A. As far
As far as
as II know.
know. I'mI'm not
not part
part of
of the
the business
business
8
8 side so
side so --
—-
9
9 ©.
Q. And to
And to what
what extent
extent are
are you
you aware
aware of
of or
or did
did you
you
10
10 hear of
hear of any
any government
government contracts
contracts that
that that
that data
data transfer
transfer
n
11 related to?
related to?
12
12 A.
A. Iwas
I not aware
was not aware of
of any
any government
government contracts.
contracts. They
They
13
13 had talked
had talked about
about it,
it, but
but II was not directly
was not directly involved
involved in
in any
any
14
14 of it
of it so
so II can't
can't --
--
15
15 ©.
Q. Okay. Which
Okay. Which government agency?
government agency?
16
16 A.
A. DARPA.
DARPA.
17
17 ©.
Q. Do you
Do you know
know what
what DARPA
DARPA is?
is?
18
18 A.
A. Defense Advanced
Defense Advanced Research
Research Projects.
Projects.
19
19 Q.
Q. Defense research?
Defense research?
20
20 A.
A. projects.
Projects.
21
21 ©.
Q. Okay. Let
Okay. Let me
me show
show you
you what's
what's been
been marked
marked
22
22 Government's Exhibit
Government's Exhibit 111.
111. DoDo you
you recognize
recognize this
this document?
document?
23
23 A.
A. ves.
Yes.
24
24 Q.
Q. What is
What is it?
it?
25
25 A.
A. This is
This is an
an email
email from
from Manos
Manos with
with what appears to
what appears to
512
512
1
1 be aa list
be list of
of DNS
DNS domain
domain names
names and
and IP
IP addresses.
addresses.
2
2 MR. DeFILIPPIS: Okay.
Okay. Your Honor, the
the government
government
3
3 offers Government
offers Government Exhibit
Exhibit 111.
111.
4
4 MR. BOSWORTH: No
MR. BOSWORTH: No objection.
objection.
5
5 THE COURT:
THE COURT: So
So moved.
moved.
6
6 (Government's Exhibit
(Government's Exhibit 111
111 was admitted.)
was admitted.)
7
7 BY
BY MR.
MR. DeFILIPPIS:
DeFILIPPIS:
8
8 Q.
Q. If we
If we look
look just
just at
at the
the header
header line
line of
of that
that email,
email,
9
9 the header
the header information.
information. It's
It's from
from Manos Antonakakis to
Manos Antonakakis to you
you
10
10 copying Rodney
copying Rodney Joffe.
Joffe. Do
Do you
you see
see that?
that?
1
11 A.
A. ves.
Yes.
12
12 Q.
Q. And this
And this was sent when?
was sent when?
13
13 A.
A. August 20,
August 20, 2016.
2016.
14
14 MR. DeFILIPPIS: If
MR. DeFILIPPIS: If we
we could
could go
go to
to the
the body
body of
of the
the
15
15 email.
email.
16
16 BY
BY MR.
MR. DeFILIPPIS:
DeFILIPPIS:
17
17 @.
Q. Could you
Could you just
just read
read the
the email?
email?
18
18 A.
A. "Hey Steve,
"Hey Steve, you
you know
know that
that if
if you
you are
are getting
getting an
an
19
19 encrypted email
encrypted email with
with Rodney
Rodney CCed,
CCed, in
in the
the middle
middle of
of the
the
20
20 night, something
night, something is
is up.
up.
21
21 "I will
"I will need
need you
you to
to pull
pull all
all data
data you
you have,
have, Ultra
Ultra
22
22 DNS, TLDs,
DNS, TLDs, ccTLDs
ccTLDs and
and especially
especially the
the data
data from
from 'Secondary'
'Secondary'
23
23 dataset we
dataset we talked
talked about
about in
in May for the
May for the following
following zones
zones and
and
24
24 IP addresses:"
IP addresses:" DoDo you
you want
want me to go
me to go on?
on?
25
25 Q.
Q. Yeah.
Yeah. What is
What is the
the first
first domain
domain there?
there?
513
513
1
1 A.
A. The first
The first domain
domain is
is trump-email.com.
trump-email.com.
2
2 Q.
Q. Okay.
Okay. And then
And then what
what follows
follows --
--
3
3 MR. BOSWORTH: If
MR. BOSWORTH: If we
we could
could just
just zoom
zoom out.
out.
4
4 BY
BY MR.
MR. BOSWORTH:
BOSWORTH:
5
5 ©.
Q. And then
And then what follows in
what follows in the
the rest
rest of
of that
that email?
email?
6
6 A.
A. So the
So the remainder
remainder of
of the
the email
email appears
appears to
to be some
be some
7
7 more domains, the
more domains, the 29.135.216
29.135.216 is
is aa reverse
reverse mapping
mapping domain.
domain.
8
8 Af-people.ru, just
Af-people.ru, just aa list
list of
of domains
domains that
that goes
goes on
on and
and on
on and
and
9
9 on.
on.
10
10 Q.
Q. Okay. And
Okay. And does
does it
it look
look like
like there
there is
is aa particular
particular
1
11 key word
key word or
or phrase
phrase that
that recurs
recurs throughout
throughout aa lot
lot of
of those
those
12
12 domains?
domains?
13
13 A.
A. The word
The word "alfa"
"alfa" appears
appears in
in many
many of
of them,
them, at
at least
least
14
14 on the
on the first
first page.
page.
15
15 Q.
Q. Okay.
Okay.
16
16 MR. BOSWORTH: Ms.
MR. BOSWORTH: Ms. Arsenault,
Arsenault, if
if we
we could
could scroll
scroll
17
17 through.
through.
18
18 BY
BY MR.
MR. DeFILIPPIS:
DeFILIPPIS:
19
19 ©.
Q. And does
And does that
that continue
continue on
on for
for aa few
few pages?
pages?
20
20 A.
A. I forget
I forget how
how many are in
many are in the
the list
list total.
total.
21
21 THE COURT:
THE COURT: She'll show
She'll show you.
you.
22
22 THE WITNESS:
THE WITNESS: There are
There are international
international domain
domain names
names
23
23 down at
down at the
the end
end and
and debit
debit cards.
cards.
24
24 BY
BY MR.
MR. BOSWORTH:
BOSWORTH:
25
25 Q.
Q. Okay.
Okay.
514
514
1
1 A.
A. Yeah. II can't
Yeah. can't interpret
interpret the
the internationalized
internationalized
2
2 domain names.
domain names. II don't
don't know
know what
what those
those are.
are.
3
3 ©.
Q. Okay. What,
Okay. What, if
if anything,
anything, did
did you
you know
know about
about
4
4 Mr.
Mr. Antonakakis' comment that,
Antonakakis' comment that, "if
"if you
you are
are getting an
getting an
5
5 encrypted email
encrypted email with
with Rodney
Rodney CCed
CCed in
in the
the middle
middle ofof the
the night,
night,
6
6 something is
something is up."
up." What did you
What did you understand
understand that
that to
to mean?
mean?
7
7 A.
A. It's not
It's not uncommon
uncommon for
for us
us to
to get
get research
research requests
requests
8
8 and data
and data requests.
requests. Rodney
Rodney was
was well-known for working
well-known for working at
at all
all
9
9 hours, 24/7,
hours, 24/7, depending
depending onon what
what time
time zone
zone he
he happened
happened toto be
be
10
10 in. It
in. It was
was not
not uncommon
uncommon for
for us
us to
to get
get these
these requests.
requests.
n
11 It was
It was aa little
little uncommon
uncommon that
that it
it would come from
would come from
12 || manos,
12 Manos, but it wasn't
but it wasn't unexpected
unexpected that
that it
it would
would come
come from
from
13
13 Rodney in
Rodney in the
the middle
middle of
of the
the night.
night.
14
14 ©.
Q. And how
And how common
common or
or uncommon
uncommon was
was it
it for
for you
you to
to get
get
15
15 requests on
requests on political
political subjects?
subjects?
16
16 A.
A. Unless it
Unless it was
was an
an actual
actual customer
customer that
that was
was involved
involved
17
17 in politics,
in probably not
politics, probably not very
very likely
likely at
at all.
all.
18
18 ©.
Q. Now, you
Now, you mentioned before this
mentioned before this tasking
tasking you
you got
got
19
19 relating to
relating to --
-- II think
think you
you said
said some
some Trump-related
Trump-related things
things in in
20
20 the summer
the summer or
or fall
fall of
of '16?
'16?
21
21 A.
A. Uh-huh.
Uh-huh.
22
22 ©.
Q. was this
Was this related
related toto that?
that?
23
23 A.
A. don't recall
I don't recall that
that this
this was related. It
was related. It was
was part
part
24
24 of that.
of that. II think
think that
that list
list came
came --
-- this
this list
list came
came before
before
25
25 that initially,
that initially, butbut they
they quickly
quickly turned
turned into
into two
two lists
lists that
that
s15
515
1
1 || were
were roughly
zougniy the
the same
same topic.
topic. They
They were related.
were related.
2
2 ©.
Q. Okay. Now
Okay. Now let
let me
me direct
direct your
your attention
attention to
to
3 [| Government
3 covernment Exhibit
Exnibit 1600,
1600, what's
what's been
been premarked.
premarkea.
1
4 Is this
Is this aa document
document that
that you
you provided
provided to
to the
the
5s || government?
5 government2
6
6 A.
A. Yes, it
Yes, it is.
is.
7
7 9.
Q. And what
And what isis it?
it?
8
8 A.
A. This is
This is aa list
list ofof domains
domains that
that II used
used to
to seed
seed aa
9 || job,
9 sob, aa script,
script, purring tne data.
pulling the data. Soso you
you will
will see
see that
tnac
10 || several
10 several ofof the
the domain
domain names
names in
in this
this list
list overlap
overlap with
with the
the
1 | previous
11 previous exhibit.
exnibit.
12
12 o.
Q. oxay.
Okay.
13
13 A.
A. And there
And there are
are some
some others
others on
on that.
that.
14
Honor, the
the government
government offers
offers
15 | Government's
15 covernment's Exhibit
Exnibit 1600.
1600.
16
16 MR. BOSWORTH: No
objection.
17
17 THE COURT:
THE COURT: So So moved.
moved.
18
1600 was
was admitted.)
admitted.)
19 || BY
19 BY mm.
MR. perrireers:
DeFILIPPIS:
20
20 @.
Q. I'm sorry,
I'm sorry, Mr.Mr. DeJong.
Dedong. Did
Did you
you prepare
prepare this
this list
list
21 || or
21 or was it given
was it given toto you?
you?
22
22 A.
A. I think
I think what
what II did
did here
here was
was combined
combined the
the list
list to
to
23 || the
23 the previous
previous email
email with
with Manos, along with
Manos, along with some
some other
other domains
domains
24 || that
24 that I1 had
nad been given on
been given on aa list,
list, and
and came
came up
up with
with this.
this. So so
25
25 [this would
this would bebe the
the complete
complete list
list of
of domains
domains that
that were
were
s16
516
1
1 related.
related.
2
2 ©.
Q. And what
And what was the purpose
was the of preparing
purpose of preparing this
this list?
list?
3
3 A.
A. So that
So that II didn't
didn't have
have to
to type
type them
them all
all by
by hand
hand
4
4 into the
into the script.
script.
5
5 ©.
Q. And when
And when you
you say
say "a
"a script,"
script," what is aa script?
what is script?
6
6 A.
A. So what
So what II had
had was
was aa small
small program
program that
that queried
queried all
all
7
7 of the
of the data
data that
that we
we had.
had. Looking
Looking for
for instant
instant occurrences
occurrences of
of
8
8 these names.
these names.
9
9 Q.
Q. So would
So would that
that be
be all
all of
of the
the terabytes
terabytes of
of Neustar's
Neustar's
10
10 data?
data?
1
11 A.
A. ves.
Yes.
12
12 Q.
Q. Was that
Was that DNS
DNS data?
data?
13
13 A.
A. Yes.
Yes. II was
was restricted
restricted to
to DNS
DNS data
data only.
only.
14
14 ©.
Q. And would
And would that
that include
include all
all of
of Neustar's
Neustar's customers?
customers?
15
15 A.
A. Just the
Just the queries, the data
queries, the data that
that we
we saw.
saw. ALL of
All of
16
16 Ultra DNS
Ultra DNS customers.
customers.
17
17 Q.
Q. Okay.
Okay. Now, turning
Now, turning your
your attention
attention to
to what's
what's been
been
18
18 marked as
marked as Government Exhibit
Government Exhibit 1602.
1602. Do you
Do you recognize
recognize that
that
19
19 document?
document?
20
20 A.
A. ves.
Yes.
21
21 Q.
Q. What is
What is it?
it?
22
22 A.
A. That would
That be the
would be the header
header of
of one
one of
of my
my scripts.
scripts.
23
23 Q.
Q. Okay.
Okay.
24
Honor, the
the government
government offers
offers
25
25 Government Exhibit
1602.
517
517
1
1 MR. BOSWORTH: No
objection.
2
2 THE COURT:
THE COURT: So So moved.
moved.
3
1602 was
was admitted.)
admitted.)
4
4 BY
BY MR.
MR. DeFILIPPIS:
DeFILIPPIS:
5
5 ©.
Q. So, Mr.
So, Mr. DeJong,
Dedong, what
what are
are we looking at
we looking at here
here atat aa
6
6 high level?
high level?
7
7 A.
A. So at
So at aa high
high level
level this
this is
is the
the beginning
beginning ofof aa
8
8 small program
small program that
that would go through
would go through days
days in
in order,
order, iterate
iterate
9
9 through all
through all of
of the
the days in aa month.
days in month. And
And if
if you
you scroll
scroll to to
10
10 the next
the next page,
page, you
you will see that
will see that it's
it's looking
looking for
for DNS
DNS
n
11 responses where
responses where one
one of
of those
those names
names appears
appears in
in the
the list
list ----
12
12 appears in
appears in the
the data.
data.
13
13 Q.
Q. When you
When you say
say "one
"one of
of those
those names,"
names," what
what dodo you
you
14
14 mean?
mean?
15
15 A.
A. From the
From the previous list they've
previous list they've been
been moved
moved into
into
16
16 this script.
this script. YouYou can
can see
see the
the list
list of
of domains.
domains. So So
17 || acfactoring.com,
17 AcmmM.com, afpeople,
ACfactoring.com, ACIMM.com, afpeople, you
you know
know that
that list.
list.
18
18 ©.
Q. Now, do
Now, do you
you prepare
prepare --
-- was
was this
this the
the only
only script
script
19
19 you prepared
you prepared inin response
response to
to Mr.
Mr. Joffe's
Joffe's request
request oror did you
did you
20
20 prepare others?
prepare others?
21
21 A.
A. I probably
I probably would
would have
have split
split --
-- that
that original
original listlist
22
22 into multiple
into multiple but
but they
they would all be
would all be the
the same
same thing
thing where
where II
23
23 would just
would just replace
replace the
the domain names in
domain names in each
each individual
individual list.
list.
24
24 ©.
Q. And what
And what was the purpose
was the purpose ifif any
any of
of breaking
breaking them
them
25
25 up any?
up any?
s18
518
1
1 A.
A. To go
To go faster.
faster.
2
2 9.
Q. Okay.
Okay.
3
3 Now, how
Now, how did these scripts
did these scripts work?
work? Did you
Did you then
then
4
4 program them
program them to
to run
run over
over all
all of
of Neustar's
Neustar's data
data continuously?
continuously?
5
5 A.
A. No. So
No. So II would
would gogo --
-- it's
it's programmed
programmed toto go back
go back
6
6 in time.
in time. And
And look
look at
at historic
historic data
data over
over aa period of aa
period of
7 || momen.
7 month. andAnd I1 just
just set
set it
it up
up to
to run
run aa month
month at
at aa time.
time.
8
8 ©.
Q. So going
So going how
how far
far back?
back?
9
9 A.
A. I don't
I don't recall
recall exactly
exactly how
how far
far back
back in
in time
time II
10
10 went. II know
went. know it
it was
was at
at least
least three
three months, but II don't
months, but don't
n
11 recall how
recall how long.
long.
12
12 ©.
Q. And as
And as you
you would
would get results of
get results of this
this data
data --
-- II
13
13 assume you
assume you got
got results?
results?
14
14 A.
A. ves.
Yes.
15
15 ©.
Q. And then
And then what did you
what did you do
do with that?
with that?
16
16 A.
A. So if
So if you
you scroll
scroll toto the
the very
very bottom of this
bottom of this
17
17 script, you'll
script, you'll see
see that
that at
at the
the end,
end, any
any data
data that
that is
is
18
18 collected is
collected is put
put into
into aa very
very --
-- into
into aa single
single file,
file, moved
moved
19
19 into aa compressed
into compressed file
file format
format and
and then
then sent
sent upstream,
upstream, sent
sent
20
20 to aa different
to different directory.
directory.
21
21 ©.
Q. And who,
And who, if
if anyone,
anyone, did
did you
you share
share the
the data
data with?
with?
22
22 A.
A. As each
As each month
month completed,
completed, II shared
shared it
it with
with
23 [| me.
23 goefe.
Mr. Joffe.
24
24 ©.
Q. How, if
How, if at
at all,
all, did
did he
he respond
respond oror react
react when
when you
you
25
25 would share
would share the
the data?
data?
s19
519
1
1 A.
A. “Thank you."
"Thank you." II don't
don't recall.
recall. II mean, he just
mean, he just
2
2 acknowledged receipt,
acknowledged receipt, basically.
basically.
3
3 ©.
Q. And did
And did you
you ever
ever get any further
get any further insight
insight into
into why
why
4
4 he was
he doing it
was doing it or
or what he was
what he doing with
was doing with it?
it?
5
5 A.
A. No. II mean,
No. mean, no,
no, II didn't.
didn't.
6
6 Q.
Q. Did you
Did you ever
ever ask?
ask?
7
7 A.
A. I thought
I thought about
about it
it but,
but, no,
no, II didn't.
didn't.
8
8 Q.
Q. Why did
Why did you
you decide
decide not
not to
to ask?
ask?
9
9 A.
A. Inmean,
I it's not
mean, it's not my business.
my business. II have
have aa day
day job.
job.
10
10 II have
have other
other things
things that
that II am
am working
working on.
on.
1
11 Q.
Q. Let me
Let me show
show you
you what's
what's been
been marked
marked Government
Government.
12
12 Exhibit 717.
Exhibit 717. Is
Is this
this an
an email
email from
from Mr.
Mr. Joffe
Joffe to
to you?
you?
13
13 A.
A. ves.
Yes.
14
14 MR. DeFILIPPIS: The
MR. DeFILIPPIS: The government
government offers
offers Government
Government
15
15 Exhibit 717.
Exhibit 717.
16
16 MR. BOSWORTH: No
objection.
17
17 THE COURT:
THE COURT: So
So moved.
moved.
18
717 was admitted.)
was admitted.)
19
19 BY
BY MR.
MR. DeFILIPPIS:
DeFILIPPIS:
20
20 Q.
Q. What are
What are we looking at
we looking at here?
here?
21
21 A.
A. This is
This is in
in response
response to
to an
an email
email that
that II sent
sent to
to
22
22 him, which
him, which was -- it
was -- it looks
looks like
like just
just aa file
file that
that contains
contains --
--
23
23 contains some
contains some of
of the
the data.
data. And his response
And his response was,
was, "Thank
"Thank
24
24 you.
you. Surprised September
Surprised September is
is empty.
empty. II am
am seeing
seeing normal
normal data
data
25
25 in other
in other sensors."
sensors."
520
520
1
1 ©.
Q. So when
So when you
you said,
said, "September
"September isis empty,"
empty," what
what would
would
2
2 [| that mean?
that mean>
3
3 A.
A. Given the
Given the file
file naming
naming convention,
convention, itit would
would mean
mean
4
4 [| that the
that the second
second file
file that
that I1 sent
sent to
to him,
nim,
5 ||
5 trumpemai12016-09.tgz, would
trumpemail2016-09.tgz, have been
would have been an
an empty
empty file.
file.
6
6 ©.
Q. Meaning there
Meaning there were
were no
no results?
results?
7
7 A.
A. No results.
No results.
8
8 ©.
Q. And what
And what about
about the
the first
first file?
file?
9
9 A.
A. It would
It would have
have been
been 2016-06,
2016-06, soSo that
that would
would have
have
10 [|
10 been June,
been June, I1 guess.
guess. II don't recall, what
don't recall, what was
was in
in any
any of
of
11 ||
11 those files,
those files, ifif it
it was
was empty or not.
empty or not.
12
12 ©.
Q. when you
When you say,
say, "I
"I am
am seeing
seeing normal
normal data
data in
in other
other
13 ||
13 sensors.” wnat
sensors." does that
What does that mean?
mean?
14
14 A.
A. Ultra DNS
Ultra DNS is
is not
not the
the only
only source
source of
of DNS
DNS
15 ||
15 information. So
information. so I1 am
am assuming
assuming that
that Mr.
mr. Joffe
Joffe had
had other
other
16 |
16 sources of
sources of DNS
pNs information.
information.
17
17 ©.
Q. 1 apologize.
I apologize. II said
said "you".
"you". That
That was
was Mr. Joffe
Mr. Joffe
18 |
18 that wrote
that wrote that?
that?
19
19 A.
A. ves.
Yes.
20
20 Q.
Q. Did you
Did you know
know what he meant
what he meant byby that?
that?
2
21 A.
A. No. II assumed.
No. assumed. Sorry.
Sorry.
22
22 ©.
Q. I'd like
I'd like to
to show
show you
you what's been marked
what's been as
marked as
23 [|
716. IsIs this
this another
another email
email from
from you
you to
to
20 [[
24 mr. Jotser
Mr. Joffe?
25
25 A.
A. ves.
Yes.
521
521
1
Honor, the
the government
government offers
offers
2
716.
3
3 MR. BOSWORTH: No
objection.
4
4 THE COURT:
THE COURT: So
So moved.
moved.
5
716 was admitted.)
was admitted.)
6
6 BY
BY MR.
MR. DeFILIPPIS:
DeFILIPPIS:
7
7 Q.
Q. If we
If we go
go to
to the
the bottom
bottom email
email in
in that
that chain,
chain, which
which
8
8 is dated
is dated September
September 14,
14, 2016
2016 --
--
9
9 A.
A. Uh-huh.
Uh-huh.
10
10 Q.
Q. -- what
-- what is
is it
it that
that you
you say?
say?
1
11 A.
A. I said
I said --
-- II sent
sent him
him aa file,
file, trumpemail-2016-07.
trumpemail-2016-07.
12
12 And
And II said,
said, "Well,
"Well, July
July finished."
finished."
13
13 Q.
Q. What did
What did you
you mean by that?
mean by that?
14
14 A.
A. So as
So as II mentioned,
mentioned, that
that script
script would
would work
work over
over aa
15
15 month of
month of data
data and
and it
it takes
takes quite
quite aa bit of time.
bit of time. And
And it
it
16
16 takes quite
takes quite aa bit
bit of
of time.
time. SoSo II would
would check
check on
on it
it
17
17 periodically to
periodically to see
see if
if aa month
month had
had finished,
finished, and
and July
July had
had
18
18 finished.
finished. So II sent
So sent it
it off.
off. And the
And the second
second --
-- the
the first
first
19
19 email was
email was for
for August,
August, which
which meant that August
meant that had finished.
August had finished.
20
20 @.
Q. Okay. So
Okay. So these
these are
are both
both emails
emails from
from you
you to
to
21
21 Mr. Joffe?
Mr. Joffe?
22
22 A.
A. ves.
Yes.
23
23 Q.
Q. And both
And both sending
sending him
him data?
data?
24
24 A.
A. ves.
Yes.
25
25 Q.
Q. If we
If we then
then go
go to
to the
the attachment
attachment to
to this
this email,
email,
522
522
1
1 which is
which is --
-- appears
appears to
to be data spread
be data spread over
over multiple, sort of
multiple, sort of
2
2 partial pages.
partial pages. Looking at
Looking at this
this first
first page
page here,
here, what
what are
are we
we
3
3 looking at?
looking at?
4
4 A.
A. So this
So this would
would have
have been
been --
-- this
this appears
appears to
to be
be one
one
5
5 line out
line out of
of aa sample
sample return
return dataset.
dataset. SoSo the
the first
first field
field
6
6 there would
there would give
give the
the date
date and
and then
then aa timestamp.
timestamp. TheThe 46
46
7
7 would be
would be our
our sensor
sensor location
location where
where Ultra
Ultra DNS
DNS saw
saw it.
it. And
And
8
8 then the
then the destination
destination address,
address, which
which is
is aa Ultra
Ultra DNS
DNS name
name
9
9 server address.
server address. And
And then
then the
the source
source address,
address, which
which is
is where
where
10
10 it came
it came from,
from, and
and then
then the
the type
type and
and then
then what
what it
it was
was looking
looking
n
11 for, which
for, which is
is mail1.trump-email.com.
maill.trump-email.com. And And then
then how
how we
we
12
12 responded, what
responded, our answer
what our answer was, which was
was, which was
13 || maili.crump-email.com
13 mail1.trump-email.com -- -- [indiscernible]
[indiscernible] ---- of
of 3600
3600 and
and an
an
14
14 address of
address of 66.216.133.29
66.216.133.29 and
and that
that is
is repeated
repeated with
with different
different
15
15 timestamps.
timestamps.
16
16 ©.
Q. Do you
Do you recall
recall how
how long
long you
you ran
ran these
these scripts
scripts for?
for?
17
17 A.
A. Idon't
I know. II don't
don't know. recall how
don't recall how long
long they
they took.
took.
18
18 ©.
Q. Did you
Did you ever
ever stop
stop them
them at
at some
some point?
point?
19
19 A.
A. Iwas
I given aa --
was given -- probably until II hit
probably until hit the
the current
current
20
20 time, basically.
time, basically. II would
would have
have stopped
stopped when
when II ran
ran out
out of
of
21
21 history to
history to run
run through.
through.
22
22 Q.
Q. okay.
Okay.
23
23 I'd like
I'd like to
to direct
direct your
your attention
attention to
to what has been
what has been
24
24 marked as Government
marked as Government Exhibit
Exhibit 719.
719. IsIs this
this an
an email
email from
from you
you
25
25 to Mr.
to Joffe dated
Mr. Joffe dated July
July 18th
18th of
of 2017?
2017?
523
523
1
1 A.
A. "I have
"I have 44 jobs
jobs that
that look
look specifically
specifically for
for trump
trump
2
2 data."
data." Yes.
Yes.
3
Honor, the
the government
government offers
offers
4
719.
B
5 MR. BOSWORTH: No
objection.
6
6 THE COURT:
THE COURT: So
So moved.
moved.
7
719 was admitted.)
was admitted.)
8
8 BY
BY MR.
MR. DeFILIPPIS:
DeFILIPPIS:
9
9 Q.
Q. So again,
So again, Mr.
Mr. DeJong,
DeJong, this
this is
is an
an email
email from
from you
you to
to
10
10 Mr. Joffe dated
Mr. Joffe dated July
July 18th.
18th.
1
11 (Alarm)
(Alarm)
12
12 A.
A. Child alarm.
Child alarm. Sorry.
Sorry.
13
13 Q.
Q. This is
This is from
from you
you to
to Mr.
Mr. Joffe
Joffe dated
dated July
July 18th?
18th?
14
14 A.
A. ves.
Yes.
15
15 ©.
Q. And that's
And that's 2017?
20172
16
16 A.
A. ves.
Yes.
17
17 ©.
Q. And what
And what do you say
do you say to
to Mr.
Mr. Joffe?
Joffe?
18
18 A.
A. "I have
"I have 44 jobs
jobs that
that look
look specifically
specifically for
for trump
trump
19
19 data.
data. ClntID" --
ClntID" --
20
20 THE COURT:
THE COURT: You don't
You don't need
need to
to read
read the
the whole
whole body.
body.
21
21 THE WITNESS:
THE WITNESS: All right.
All right.
22
22 BY
BY MR.
MR. DeFILIPPIS:
DeFILIPPIS:
23
23 Q.
Q. And, again,
And, again, to
to what
what --
-- how
how did
did this
this relate
relate to
to the
the
24
24 prior emails
prior emails and
and the
the project
project that
that you
you mentioned?
mentioned?
25
25 A.
A. So these
So these were the four
were the four jobs
jobs that
that II had
had set
set up
up
524
524
1
1 || specifically
specifically in
in response
response to
to their
their previous
previous request
request that
that
2 [| we've
2 werve looked
1ooked at.
at.
3
3 Q.
Q. Did you
Did you ever
ever hear
hear or
or learn
learn whether
whether Mr.
Mr. Joffe
Joffe
4
4 || shared
shared this
this data
data with
with anyone,
anyone, including
including the
the government?
government?
5
5 A
A. wo.
No.
6
6 Q.
Q. Did you
Did you ever
ever talk
talk about
about this
this project or this
project or this task
task
7 || with
7 with anyone
anyone other
other than
than Mr. Joffe:
Mr. Joffe?
8
8 A
A. wo.
No.
9
9 ©.
Q. And other
And other than
than this,
this, can
can you
you think
think of
of any
any occasion
occasion
10 || in
10 in which you were
which you were asked
asked to
to do a political-related
do a political-related search
search of
of
11 || Neustar's
11 meustar's data?
daar
12
12 A.
A. We had
We had done
done other
other searches
searches based
based on subpoenas,
subpoenas,
13
13 based on
based on Court
Court orders.
orders. Based on
Based on other
other projects going on.
projects going on. II
14
14 don't recall
don't recall specifically
specifically that
that it
it was
was related
related to
to any
any
15
15 specific political
specific political organization.
organization.
16
16 Q.
Q. And to
And to what
what extent
extent are
are you
you aware
aware of
of new
new Neustar
Neustar
17
17 || working
working with
with or
or supporting
supporting or
or providing
providing services
services to
to any
any
18
18 political campaign?
political campaign?
19
19 A.
A. I am
I am not
not aware
aware of
of that
that at
at all.
all.
20
20 Q.
Q. Okay.
Okay. Thank you.
Thank you.
2
21 CROSS-EXAMINATION
CROSS-EXAMINATIONOFSTEVEDEJONG
OF STEVE DEJONG
22 || BY
22 BY wr.
MR. sosworma:
BOSWORTH:
23
23 Q.
Q. Good afternoon,
Good afternoon, Mr.
Mr. DeJong.
DeJong.
24
24 A.
A. Good afternoon.
Good afternoon.
25
25 Q.
Q. If you
If you don't
don't like
like my questions, you
my questions, you can
can let
let the
the
525
525
1
1 alarm go
alarm go off
off again.
again.
2
2 We've never
We've never met
met before.
before. Correct?
Correct?
3
3 A.
A. Correct.
Correct.
4
4 @.
Q. I will
I will be
be brief.
brief. You were
You were asked
asked questions
questions about
about
5
5 the data
the data that you
that you gathered
gathered in
in 2016.
2016.
6
6 A.
A. Uh-huh.
Uh-huh.
7
7 Q.
Q. Correct?
Correct?
8
8 A.
A. ves.
Yes.
9
9 ©.
Q. And you
And you just
just pulled the data.
pulled the data. Correct?
Correct?
10
10 A.
A. Correct.
Correct.
1
11 Q.
Q. You didn't
You didn't analyze
analyze the
the data.
data. Right?
Right?
12
12 A.
A. Correct.
Correct.
13
13 Q.
Q. You are
You are an
an engineer?
engineer?
14
14 A.
A. Correct.
Correct.
15
15 Q.
Q. Do you
Do you know
know who,
who, if
if anyone,
anyone, analyzed
analyzed the
the data that
data that
16
16 you pulled?
you pulled?
17
17 A
A. No.
No.
18
18 Q.
Q. No idea?
No idea?
19
19 A
A. No.
No.
20
20 @.
Q. Do you
Do you have
have any
any idea
idea whether
whether other
other people
people were
were
21
21 pulling data
pulling data for
for Mr.
Mr. Joffe?
Joffe?
22
22 A.
A. specifically, no,
Specifically, no, II do
do not
not know.
know.
23
23 Q.
Q. Well, we
Well, we saw
saw that
that one
one email
email where
where you
you made
made
24
24 reference to
reference to data
data he
he was
was seeing
seeing from
from other
other places.
places.
25
25 A.
A. Correct.
Correct.
526
526
1
1 ©.
Q. Did he
Did he have
have access
access to
to data
data to
to DNS
DNS data
data beyond
beyond what
what
2
2 || weustar had
Neustar had in
in its
its holdings?
holdings?
3
3 A.
A. ves.
Yes.
4
4 ©.
Q. And you
And you know
know that?
that?
5
5 A.
A. Yes.
Yes.
6
6 ©.
Q. Okay. And
Okay. And you
you had
had no
no idea
idea that
that whether
whether the
the data
data
7
7 || vou were
you were pulling
puiring was
was going
going to
to go
go to
to the
the New
wew York
vork Times
Times or
or
8 ||
8 anywnere else.
anywhere ese. Right?
rignez
9
9 A.
A. Correct.
Correct.
10
10 ©.
Q. You talked
You talked about
about Ultra
Ultra DNS
DNS before.
before. WhoWho founded
founded
1 [|
11 viera DNS?
Ultra ons?
12
12 A.
A. Rodney Joffe.
Rodney Joffe.
13
13 Q.
Q. How did
How did Ultra
Ultra DNS
DNS become
become part of Neustar?
part of Neustar?
14
14 A.
A. Neustar acquired
Neustar acquired Ultra
Ultra DNS
DNS in
in 2006/2007,
2006/2007, something
something
15 [|
15 1ike that.
like tnac.
16
16 ©.
Q. And do
And do you
you know
know whether
whether Mr.
Mr. Joffe
Joffe is
is
17 ||
17 weri-respected within
well-respected the DNS
within the prs field?
fiera?
18
18 A.
A. He is
He is very
very well-respected.
well-respected.
13
19 Q.
Q. He's an
He's an expert
expert in
in DNS
DNS technology.
technology. Correct?
Correct?
20
20 A.
A. Yes.
Yes.
21
21 ©.
Q. Do you
Do you know
know whether
whether Mr.
Mr. Joffe
Joffe did
did business
business with
with
22
22 [the U.S.
the u.s. government?
government?
23
23 A.
A. ves, he
Yes, he did.
did.
24
24 ©.
Q. And what
And what at
at aa high
high level
level can
can you
you say
say about
about that
that
25 ||
25 business?
business?
527
527
1
1 A.
A. Research projects.
Research projects. As As II mentioned earlier, the
mentioned earlier, the
2
2 || oamea project.
DARPA project. He He worked on --
worked on -- from
from his
his biography
biography II know
know hehe
33 [| workea closely
worked closely on
on the
the Conficker
conficker project
project to
to combat
compat the
the
44 [| conficker malware.
Conficker malware. He's
He's worked
worked onon other
other government-related
government-relatea
55s || eer investigations.
FBI investigations.
66 ©.
Q. Fair to
Fair to say,
say, to
to your
your knowledge,
knowledge, hehe had
had aa good
good
77 || zerationsnip with
relationship with the
the government
government inin 2016?
20162
88 A.
A. Tomy
To knowledge, yes.
my knowledge, yes.
99 ©.
Q. Do you
Do you know
know if
if he
he ever
ever received
received any
any awards
awards oror
10 [|
10 nonors in
honors in connection
connection with
with that
that work?
work?
un
11 A.
A. Yes. He
Yes. He was awarded an
was awarded an FBI
FBI Service
Service Award
Award at
at one
one
12 |
12 point.
point.
13
13 ©.
Q. You talked
You talked about
about the
the access
access that
that Neustar has to
Neustar has to
14 ||
14 data. and
data. you said
And you said --
-- and
and tell
te1l me if this
me if this is
is right
right --
-- the
the
15 ||
15 weustar process
Neustar process is
is 150
150 billion DNS responses
billion DNS responses aa day.
day. Right?
Right?
16
16 A.
A. Correct.
Correct.
17
17 ©.
Q. And that's
And that's roughly
roughly one-tenth
one-tenth ofof 11 percent or more
percent or more
18 ||
18 of global
of global DNS
ons data?
dataz
19
19 A.
A. Probably around
Probably around that,
that, yes.
yes.
20
20 ©.
Q. And Neustar
And Neustar made
made aa lot
lot of
of money selling that
money selling that data.
data.
21 ||
21 correct?
Correct?
22
22 A.
A. I don't
I don't know
know that
that Neustar,
Neustar, inin 2016,
2016, was
was selling
selling
23 ||
23 that data
that data at
at all.
all.
24
24 ©.
Q. Does Neustar
Does Neustar provide DNS data
provide DNS data to
to anyone?
anyone?
25
25 A.
A. For research
For research purposes, yes.
purposes, yes.
528
528
1
1 ©.
Q. And what
And what about
about Ultra
Ultra DNS?
DNS?
2
2 A.
A. I'msorry.
I'm Could you
sorry. Could you rephrase
rephrase the
the question?
question?
3
3 ©.
Q. Does Ultra
Does Ultra DNS
DNS provide
provide DNS
DNS data
data to
to customers?
customers?
1
4 A.
A. We provide
We provide itit to
to our
our customers,
customers, inin terms
terms of
of
5 || answering
5 answering questions
questions that
that they
they may
may have.
nave.
6
6 ©.
Q. And you
And you were
were asked
asked some
some questions
questions about
about whether
whether
7 || ve.
7 sore asked
Mr. Joffe asked you
you to
to run
run other
other searches
searches ----
8
8 A.
A. Un-hun.
Uh-huh.
9
9 ©.
Q. -- on
-- on DNS
DNS data.
data. And you said
And you said that
that Mr.
Mr. Joffe
Joffe asked
asked
10 || you
10 you to
to run
run queries
queries about
avout aa range
range of
of current
current events;
events; is
is that
that
1 | right?
11 rignez
12
12 A.
A. occasionally, yes.
Occasionally, ves.
13
13 Q.
Q. And the
And the requests
requests didn't just relate
didn't just relate to
to politics.
politics.
14 | Correct?
14 correct?
15
15 A.
A. Yo.
No.
16
16 Q.
Q. For example,
For example, Mr. Joffe asked
Mr. Joffe asked you
you to
to gather
gather data
data
17 || relating
17 relating toto power companies during
power companies during aa hurricane.
hurricane. Right?
Right?
18
18 A.
A. Correct.
Correct.
13
19 ©.
Q. It wasn't
It wasn't unusual
unusual toto get
get aa request
request from
from Mr.
Mr. Joffe
Joffe
20 [[ looking
20 100king for
for data?
data?
2
21 A.
A. Not at
Not at all.
all.
22
22 ©.
Q. And regarding
And regarding the
the data
data that
that you
you were
were talking
talking about
about
23 || that
23 that Mr.
mr. Joffe
Joffe asked
asked you
you for
for in
in 2016,
2016, II think
think there
there was
was one
one
24 [| email
24 email in
in 2017,
2017, did
did you
you work with Mr.
work with Mr. Sussmann
Sussmann toto gather
gather that
that
25 | data?
25 qatar
529
529
1
1 A
A. No.
No.
2
2 Q.
Q. Did you
Did you talk
talk with
with Mr. Sussmann in
Mr. Sussmann in connection
connection with
with
3
3 that data?
that data?
4
4 A
A. No.
No.
5
5 Q.
Q. Did Mr.
Did Mr. Joffe
Joffe ever
ever mention
mention Mr.
Mr. Sussmann
Sussmann in
in
6
6 connection with
connection the data?
with the data?
7
7 A
A. No.
No.
8
8 Q.
Q. To your
To your knowledge,
knowledge, was
was Mr.
Mr. Sussmann
Sussmann involved
involved in
in
9
9 any way
any way in
in gathering
gathering that
that data?
data?
10
10 A
A. No.
No.
1
11 Q.
Q. Was Mr.
Was Mr. Sussmann
Sussmann involved
involved in
in any
any way in analyzing
way in analyzing
12
12 the data,
the data, to
to your
your knowledge?
knowledge?
13
13 A
A. No.
No.
14
14 Q.
Q. In fact,
In fact, you
you never
never --
-- you
you hadn't
hadn't even
even heard
heard of
of
15
15 Mr. Sussmann
Mr. Sussmann until
until this
this investigation.
Correct?
16
16 A.
A. Correct.
Correct.
17
17 Q.
Q. And those
And those emails
emails and
and other
other documents
documents you
you reviewed,
reviewed,
18
18 Mr. Sussmann wasn't
Mr. Sussmann wasn't copied
copied on
on any
any of
of them.
them. Correct?
Correct?
19
19 A
A. No.
No.
20
20 MR. BOSWORTH: No
MR. BOSWORTH: No further
further questions.
questions.
21
21 MR. DeFILIPPIS: Nothing
MR. DeFILIPPIS: from the
Nothing from the government,
government, Your
Your
22
22 Honor.
Honor.
23
23 THE COURT:
All right. Ladies and
Ladies and gentlemen
gentlemen --
--
24
24 excuse me,
excuse me, Mr. Joffe --
Mr. Joffe -- Mr. DeJong.
Mr. DeJong. Thank you
Thank you very
very much for
much for
25
25 your testimony.
your testimony. You are
You are excused.
excused. Please don't
Please don't discuss
discuss your
your
530
530
1 ||
1 testinony with anyone until the case is over. Okay?
testimony with anyone until the case is over. Okay?
2
2 THE WITNESS:
THE WITNESS: OfOf course.
course.
3
3 THE COURT:
THE COURT: Have
Have aa good
good day.
day.
4
4 ALL right.
All right. Obviously
Obviously it's
it's been
been aa long
long day
day for
for me,
me,
5|
5 and I'm
and I'm sure
sure it's
it's been
been aa long
long day
day for
for you
you all
all as
as well.
well. we
We
6|
6 are going
are going to
to wrap
wrap up
up for
for the
the day,
day, and
and dismiss
dismiss you
you until
until
7|
7 tomorrow morning
tomorrow morning at
at 9:00.
9:00.
8 As always,
As always, no discussions about the case.
case. No
9 case.
research about the case. I should have asked this favor
And I favor
10 || yesterday
10 yesterday but
but II will
will ask
ask you
you aa favor
favor in
in addition
addition to
to my
my
11 | instructions.
11 instructions. YouYou know,
know, obviously
obviously COVID
COVID cases
cases have
have been
been
12 | going
12 going up
up in
in our
our region.
region. We
We have
have taken
taken all
all of
of the
the
13
13 that we can to limit
precautions that limit the
the risk.
risk. We have these
14 | plexiglass
14 plexiglass barriers up. Everyone
barriers up. Everyone is
is wearing
wearing masks.
masks. We
We are
are
15 || trying
15 trying to
to distance
distance folks
folks as
as much as we
much as we can.
can.
16
16 But II made
But this request
made this request of
of the
the lawyers,
lawyers, and
and II will
will
17 || make
17 it of
make it of you.
you. We
we are
are all
all in
in the
the same
same pod
pod now.
now. So
So it's
it's
18
18 important that we do all
very important all that we can to stay
stay healthy
19
19 trial.
during the duration of the trial.
20 just as
So just as you
you go about into the world and go back
21
21 || nome and, you know, try to limit your contacts with folks
home and, you know, try to limit your contacts with folks
22
22 |[ and --
and == I'm
I'm not
not telling
telling you
you to
to be
be aa hermit,
hermit, but just be
but just be aware
aware
23
23 || of your
of your environment
environment and
and our
our collective
collective obligation
obligation to
to each
each
24
24 || other to
other to stay
stay safe
safe and
and to
to get
get through
through this
this trial.
trial. okay?
Okay?
25 a great evening and we will

Have a will see you tomorrow.
tomorrow.
531
531
1
1 (Jury exited
(Jury exited the
the courtroom.)
courtroom.)
2
2 THE COURT:
All right. So we
So we will
will start
start with
with
3
3 Ms. Fine
Ms. Fine tomorrow.
tomorrow. Is that
Is that still
still the
the order?
order?
4
4 MR. DeFILIPPIS: Yes,
MR. DeFILIPPIS: Yes, Your
Your Honor.
Honor.
5
5 THE COURT:
THE COURT: And
And then
then Mr. Elias afterwards.
Mr. Elias afterwards. Is
Is
6
6 that still
that still the
the order?
order?
7
Honor, we just slightly
we just slightly
8
8 modified the
modified the order.
order. It's Ms.
It's Ms. Fine,
Fine, Ms.
Ms. Seago,
Seago, Mr. Elias,
Mr. Elias,
9
9 followed by
followed by Tom
Tom McMahon,
McMahon, followed
followed by
by James
James Baker,
Baker, if
if we
we get
get
10
10 to it.
to it.
1
11 THE COURT:
THE COURT: That would
That be ambitious
would be ambitious for
for one
one day.
day.
12
12 Right?
Right?
13
13 MR. DeFILIPPIS: It
MR. DeFILIPPIS: It would,
would, Your
Your Honor.
Honor. We
We sort
sort of
of
14
14 overestimated for
overestimated for today
today as
as well.
well.
15
15 THE COURT:
All right. Then we
Then we can
can chat
chat about
about
16
16 Mr. Steele
Mr. Steele in
in the
the morning.
morning. I've started
I've started to
to review
review the
the
17
17 materials that you
materials that you all
all have
have submitted.
submitted. II would
would like
like to
to
18
18 spend aa little
spend little more time with
more time with them
them and
and ask
ask questions
questions before
before
19
19 we get
we get to
to that.
that. Anything
Anything else?
else?
20
20 MR. DeFILIPPIS: Not
MR. DeFILIPPIS: from the
Not from the government,
government, Your
Your
21
21 Honor.
Honor.
22
22 THE COURT:
THE COURT: Mr. Berkowitz?
Mr. Berkowitz?
23
23 MR. BERKOWITZ: [inaudible]
MR. BERKOWITZ: [inaudible]
24
24 COURT REPORTER:
COURT REPORTER: II can't
can't hear
hear you,
you, sir.
sir.
25
25 MR. BERKOWITZ: II don't
MR. BERKOWITZ: don't usually
usually have
have that
that problem
problem
532
532
1
1 || with
with my
my voice
voice but
but I1 apologize.
aporogize.
2
2 THE COURT:
THE COURT: Remember,
Remember, Counsel,
Counsel, we
we are
are also
also feeding
feeding
3
3 [ens
this.
4
4 MR. BERKOWITZ: It's
MR. BERKOWITZ: It's aa good
good lesson
lesson to
to me.
me.
5
5 THE COURT:
THE COURT: I'm
I'm sorry.
sorry. IfIf you
you are
are not
not in
in front
front ofof
6 || the
6 the mic, nobody in
mic, nobody in the
the media room or
media room or the
the overflow
overflow room
room isis
7 || going
7 going to
to hear
near anything.
anything.
8
8 MR. BERKOWITZ: So
MR. BERKOWITZ: So one
one of
of the
the witnesses,
witnesses, Judge,
Judge,
9 || that
9 that we
we intend
intend toto call
call in
in our
our case
case in
in chief
chief is
is Robby
Robby Mook.
Mook.
10 [| wr.
10 Mr. Mook was originally
Mook was originally on
on the
the government's witness list
government's witness list and
and
11 [| he
11 ne was
was prepared
prepared toto testify
testify this
this week.
week. HeHe has
has aa vacation
vacation
12 || planned
12 planned to
to Spain,
spain, leaving
leaving Saturday
saturday and
and going
going through
through
13 || Memorial
13 wemorial Day.
pay.
14
14 His lawyer
His lawyer asked
asked us
us whether
whether wewe could
could ask
ask to
to have
have
15 || him
15 nim called
called out
out of
of order.
order. II know
know that's
that's aa little
little bit
bit
16 | unusual.
16 unusual. II dodo want to be
want to fair and
be fair and represent
represent Mr.
Mr. Mook
Mook knows
knows
17 || he's
17 he's under
under subpoena
subpoena and
and would
would cancel
cancel his
his vacation
vacation if
if hehe has
has
18 | to.
18 co.
19
19 THE COURT:
THE COURT: Right.
Right.
20
20 MR. BERKOWITZ: But
MR. BERKOWITZ: But if
if we
we could
could take
take him,
him, even
even onon
21 || Friday,
21 Friday, we
we would appreciate it.
would appreciate it. WeWe asked
asked the
the government.
government.
22 [[ And
22 And I1 understand
understand they
they get
get to
to try
try their
their case
case how
how they
they want,
want,
23 || but
23 but we
we do
do have
have third
third parties
parties here
here who
who are
are really
really not
not
24 || connected
24 connected toto anybody.
anybody. And
And we would expect
we would expect it
it to
to be
be aa
25 || relatively
25 relatively tight
tight thing.
thing. TheThe sort
sort of
of extenuating
extenuating
533
533
1
1 [| circumstances
circumstances here
here is
is he
he was
was on
on their
their list.
list. They
They met
met with
with
2 [| him
2 him several
several times.
times. They
They know
know what
what he's
he's going
going to
to say.
say.
3
3 THE COURT:
THE COURT: Mr.
Mr. DeFilippis,
DeFilippis, dodo you
you want
want to
to tell
tell meme
4 [| what
4 what you
you think
think now
now or
or wait
wait until
until the
the morning?
morning?
5
Honor, just
just briefly.
briefly. While
While
6 || we
6 we are
are certainly
certainly sympathetic
sympatnetic to
to Mr.
Mr. Mook's situation, we
Mook's situation, we had
haa
7 || all
7 a1 planned
planned on
on not
not sitting
sitting Friday.
Friday. The
The government
government ----
8
8 THE COURT:
THE COURT: You
You hadn't
hadn't gotten
gotten mymy okay
okay to
to not
not sit
sit
3 || on
9 on Friday.
Friday.
10
Honor, II think
think in
in addition,
addition,
11 [| the
11 the complication
complication with
with Mr.
Mr. Novick's
Novick's testimony
testimony isis sort
sort ofof
12 || putting
12 putting witnesses
witnesses out
out of
of order.
order. And
And we
we think
think for
for the
the jury
jury
13 || to
13 to have
nave aa defense
defense witness
witness to
to be
be plopped
plopped inin the
the middle
middle ofof the
the
14 | government's
14 government's case,
case, it
it will
will ruin
ruin the
the sequence
sequence and
and we
we think
think
15 || make
15 make it
it more
more difficult
aifficult for
for the
the jury
jury to
to follow
follow the
the story.
story.
16
16 Again we
Again we are
are not
not unsympathetic,
unsympathetic, butbut our
our preference
preference
17 || would
17 would be
be to
to do
do the
the government's case in
government's case in aa discrete
discrete fashion.
fashion.
18
18 THE COURT:
THE COURT: Okay.
Okay.
19
19 When does
When does he
he leave,
leave, Mr.
Mr. Berkowitz?
Berkowitz? Mr. Mr. Mook.
Mook.
20
20 MR. BERKOWITZ: We've
MR. BERKOWITZ: We've been
been informed
informed byby his
his counsel
counsel
21 || that
21 that he
ne leaves
leaves on
on Saturday.
saturday.
22
22 THE COURT:
THE COURT: How
How long
long is
is the
the trip?
trip?
23
23 MR. BERKOWITZ: My
MR. BERKOWITZ: My recollection,
recollection, andand II will
will
24 || confirm
24 confirm this,
this, is
is it's
it's through
through Memorial
Memorial Day.
Day. ItIt was
was
25 || represented
25 represented as
as aa 10-day
10-day vacation.
vacation.
534
534
1
1 THE COURT:
THE COURT: Okay.
Okay. We will
We will be
be back
back on
on this.
this. All
All
2
2 right.
right.
3
3 MR. BERKOWITZ: That's
MR. BERKOWITZ: That's it.
it.
4
4 THE COURT:
THE COURT: We
We are
are adjourned.
adjourned.
5
5 (Proceedings concluded
(Proceedings concluded at
at 4:48
4:48 p.m.)
p.m.)
6
6
7
7
8
8
9
9
10
10
1
11
12
12
13
13
14
14
15
15
16
16
17
17
18
18
19
19
20
20
21
21
22
22
23
23
24
24
25
25
535
535
1
1 CERTIFICATE
C E R T I F I C A T E
2
2
3
3 I, Lorraine
I, Lorraine T. Herman, Official
T. Herman, Official Court Reporter,,
Court Reporter
1
4 do hereby
do hereby certify
certify that
that the
the above
above and
and foregoing
foregoing is
is aa true
true and
and
5s
5 || accurate
accurate transcript
transcript of
of my stenographic notes
my stenographic notes and
and is
is aa
6 || complete
6 complete transcript
transcript of
of the
the proceedings in the
proceedings in the above-entitled
above-entitled
7 || matter
7 to the
matter to the best
best of
of my
my ability.
ability.
8
8
9
9
10
10
un
11
12
12
13
13 [| ways,2022
May 18, 2022 I/s/ —
DATE
DATE Lorraine T. Herman,
Lorraine T. Herman, RER,
RPR, CRC
CRC
14
14
15
15
16
16
17
17
18
18
19
19
20
20
2
21
22
22
23
23
2
24
25
25

Sussmann Trial 517 Afternoon

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Sussmann Trial 517 Afternoon

Uploaded by

Copyright:

Available Formats

IN THE

May 17, 2022

4a MR. BERKOWITZ: Judge,

88 MR. BERKOWITZ: I'm

2 Mr. DeFilippis, I think the floor is yours.

3 MR. DeFILIPPIS: Yes, Your Honor. The government

4 calls Steve DeJong.

5 THE COURT: Good afternoon, sir.

6 THE WITNESS: Good afternoon.

7 THE COURT: If you could remain standing and raise

8 your right hand, please.

9 DEPUTY CLERK: Do you solemnly affirm and truly

10 declare the testimony you are about to give will be the

12 you do under pain and penalty of perjury. If so, please say

14 THE WITNESS: I do.

15 DEPUTY CLERK: Thank you. You may be seated.

16 THE COURT: All right. Please get comfortable

17 there. Make sure you speak into the mic. Okay?

18 THE WITNESS: Hi.

19 DIRECT EXAMINATION OF STEVE DEJONG

21 Q. Good afternoon, Mr. DeJong. Could you just state

24 A. My name is Steve DeJong, D-e-J-o-n-g.

25 Q. Where do you work?

25 a great evening and we will

You might also like