UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF ARIZONA

_________________

United States of America, )

) CR-18-0422-PHX-SMB

Plaintiff, )

)

vs. ) Phoenix, Arizona

) October 3, 2019

Michael Lacey, ) 9:21 a.m.

James Larkin, )

Scott Spear, )

John Brunst, )

Andrew Padilla, )

Joye Vaught, )

Defendants. )

_____________________________ )

BEFORE: THE HONORABLE SUSAN M. BRNOVICH, JUDGE

REPORTER'S TRANSCRIPT OF PROCEEDINGS

EVIDENTIARY HEARING ON MOTION TO COMPEL

Official Court Reporter:

Christine M. Coaly, RMR, CRR

Sandra Day O'Connor U.S. Courthouse, Suite 312

401 West Washington Street, Spc 37

Phoenix, Arizona 85003-2151

(602) 322-7248

Proceedings Reported by Stenographic Court Reporter

Transcript Prepared by Computer-Aided Transcription

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 1 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

2

A P P E A R A N C E S

FOR THE GOVERNMENT

U.S. ATTORNEY'S OFFICE

By: Mr. Kevin M. Rapp

Mr. Andrew C. Stone

Ms. Margaret Wu Perlmeter

Mr. Peter Kozinets

40 North Central Avenue, Suite 1200

Phoenix, Arizona 85004

U.S. ATTORNEY'S OFFICE

By: Mr. Reginald E. Jones

1400 New York Avenue, NW, Suite 600

Washington, D.C. 20530

FOR THE DEFENDANT LACEY:

LIPSITZ GREEN SCIME CAMBRIA

By: Mr. Paul John Cambria, Jr.

42 Delaware Avenue, Suite 120

Buffalo, New York 14202

HENZE COOK MURPHY, PLLC

By: Ms. Janey Henze-Cook

Mr. Tom Henze

722 East Osborn Road - Suite 120

Phoenix, Arizona 85014

FOR THE DEFENDANT LARKIN:

BIENERT MILLER & KATZMAN, PLC

By: Mr. Thomas Henry Bienert, Jr.

Ms. Whitney Z. Bernstein

903 Calle Amanecer, Suite 350

San Clemente, California 92673

FOR THE DEFENDANT SPEAR:

FEDER LAW OFFICE, PA

By: Mr. Bruce S. Feder

2930 East Camelback Road, Suite 160

Phoenix, Arizona 85016

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 2 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

3

FOR THE DEFENDANT BRUNST:

BIRD MARELLA BOXER WOLPERT NESSIM

DROOKS LINCENBERG & RHOW, PC

By: Mr. Ariel Neuman

Mr. Gary Lincenberg

1875 Century Park E Suite 2300

Los Angeles, CA 90067

FOR THE DEFENDANT PADILLA:

DAVID EISENBERG, PLC

By: Mr. David S. Eisenberg

3550 North Central Avenue, Suite 1155

Phoenix, Arizona 85012

FOR THE DEFENDANT VAUGHT:

JOY BERTRAND, ESQ., LLC

By: Ms. Joy M. Bertrand

P.O. Box 2734

Scottsdale, Arizona 85252

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 3 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

4

I N D E X

WITNESS PAGE

J. PATRICK CULLEN

Direct Examination by Mr. Stone 14

Cross-Examination by Mr. Cambria 32

Cross-Examination by Mr. Newman 45

Redirect Examination by Mr. Stone 53

WILLIAM GERKEN

Direct Examination by Mr. Stone 56

Cross-Examination by Mr. Bienert 88

Cross-Examination by Mr. Newman 125

Redirect Examination by Mr. Stone 141

MATTHEW FROST

Direct Examination by Ms. Perlmeter 150

Cross-Examination by Ms. Bernstein 202, 209

Voir Dire Examination by Ms. Perlmeter 208

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 4 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

5

P R O C E E D I N G S

COURTROOM DEPUTY: Criminal case 2018-422, United

States of America versus Michael Lacey and others.

Will the parties please announce.

MR. STONE: Good morning, Your Honor. Andy Stone,

Peggy Perlmeter, Kevin Rapp, Peter Kozinets, Reginald Jones,

and Special Agent Richard Robinson with the IRS for the

government.

THE COURT: Okay.

MR. CAMBRIA: Good morning, Your Honor. Paul Cambria

on behalf of Michael Lacey who is present.

MS. BERNSTEIN: Good morning, Your Honor. Whitney

Bernstein and Tom Bienert on behalf of Mr. Larkin who is

present.

Also seated next to me at counsel table is Tami

Loehrs, our expert. And behind me is Tony Thomas, our

paralegal.

MR. NEUMAN: Good morning, Your Honor. Ariel Neuman

and Gary Lincenberg on behalf of John Brunst who is present.

MR. EISENBERG: Good morning, Your Honor. David

Eisenberg on behalf of Andrew Padilla who is not present. We

would waive his appearance.

MR. FEDER: Bruce Feder for Scott Spear who is

present.

MS. BERTRAND: Good morning, Your Honor. Joy Bertrand

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 5 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

6

for Joye Vaught. I would ask that her appearance be waived as

well today.

THE COURT: And does the government have any objection

to the appearance of Andrew Padilla and Joye Vaught being

waived?

MR. STONE: No objection.

THE COURT: Okay. Their appearance is waived.

Okay. We're set for an evidentiary hearing on the

motion to compel.

Just so we're clear, I guess the issue for me is the

technical description of what the defense is requesting or what

the government has. There wasn't an issue regarding the

context in which this computer system plays in this case. I

was a little concerned that the scope of the hearing might be

misunderstood because there was an issue with the subpoena sent

to Carl Ferrer, which I guess was withdrawn before I had to

rule on the motion to quash. So I just wanted to, I guess,

state that so that it was clear that I don't really want any

evidence surrounding anything other than the servers, how they

work, what information is there, and how to produce usable data

or how it's not available.

So it's the defense motion, so I was going to have

them go first.

MR. BIENERT: Your Honor, Thomas Bienert for Defendant

Larkin. If I can address just so at least Your Honor

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 6 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

7

understands, because I totally hear what you're saying, but I

think it gets a little muddled, depending on what Your Honor's

concern is.

As I see it, and obviously government counsel can tell

me if they disagree, there is sort of three, I would think,

components that we would need -- or at least I assumed we would

be addressing. One is what was the capability of the system,

I'll call it, before it was shut down; then it would be what

was done or not done in terms of how it was retrieved; and then

what is the status of it since it's been taken, both in terms

of technically, does it work, and ancillary to that, whatever

the government says it works to do, what can you see or not

see, and how different or not different is that from what it

used to be able to show before it was seized. That's how I was

sort of envisioning it.

So, obviously, we agree -- we, obviously, the

technical part is a big part of this, but I also assumed,

although if Your Honor doesn't think we need to address it, we

won't, that part of it is sort of, I'll call it the factual

evidence of what procedurally the system allowed you to do, and

that's different, potentially, than the technical folks. That

tends to be people who were familiar with the system because

they worked on it at Backpage. And so those are the two things

that we at least thought would be relevant.

And just so Your Honor will know, because it raises an

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 7 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

8

issue, there has been a lot that's happened in the last few

days. We designated Carl Ferrer, because from what we knew and

understood, and still believe, he is the one person who has the

biggest wealth of information about the system, what it was

designed to do, how it worked, and how it was used at Backpage,

and what, if anything, you can do with it now.

We also believe, as an aside, that he, because of his

extensive cooperation with the government on it, he was

available to testify, and should be.

We then subpoenaed a couple of other people that we

didn't know if we would be available to get them or not, two

people who we understand would have at least some information

about the system, how it worked before, and at least one

witness, Ms. Martin, who I think may be in court today, but I'm

not sure, apparently is still working with the government and

the system, so she might be able to tell us what it was like

before and what it's like now.

And, finally, we subpoenaed Tamara Nickels who could

tell us what it was like before.

Once we had information that Ms. Nickels was going to

testify, which was all the way through, we got the word she

would last week, we talked to her on the phone, or others did,

and then we had a two-hour meeting with her yesterday, we

withdrew the subpoena to Carl Ferrer because we don't need to

bring him if we can otherwise get it, and we can avoid that

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 8 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

9

whole issue about whether he's waived and we can force him on

the stand, et cetera.

But there is a wrinkle. Since our two-hour meeting

with Ms. Nickels yesterday, we got an e-mail about ten o'clock

last night that she's now invoking the Fifth Amendment. I will

tell Your Honor that while we were in our meeting, which was

about fifteen minutes after our witness list went to the

government with her name on it, while we were in the meeting

with her and her counsel, her counsel said, oh, the

government's calling me. Did you send her a witness list? We

said, yeah. She said, I'll talk to them later. We don't know

what happened from there, but I do think that the circumstances

are such that the government somehow conveyed that it might be

problematic if she testified.

So that was -- of the three witnesses, the one that we

thought we had, she's apparently not going to be here, although

we are going to want to address whether she should be allowed

to testify or ordered to testify.

Number two, Ms. Martin, we were told through an

investigator that indicated that she now works for the

government. She used to work for Backpage. She now works for

the government and she would not -- she was subpoenaed but she

would not be appearing. And that was that. She wouldn't talk

to us. I don't know if she's here or not, but we do not have

her available, potentially, because apparently she is now

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 9 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

10

working for the government as a former Backpage employee

helping them with something to do with Backpage documents. We

don't know what that is.

So with all that as one circumstance, we may need to

revisit with you, Your Honor, the whole Carl Ferrer issue,

because if we can no longer call the witness who as of last

night was going to testify on these procedural issues, then we

would believe that we should be able to call Mr. Ferrer. So

with that as one big link in several things that have happened

in the last few days, we certainly think we should go forward

today with whatever we can, but we are potentially going to

want to ask to do supplemental submissions to Your Honor or

information depending on what happens today.

THE COURT: Okay. Well, the reason that I think that

first part is not -- obviously, it's relevant to the case but

not relevant to this hearing, is that there is no question that

before the Web site was seized, it was a fully operational Web

site. You've already discussed all the things it could do, all

the things it helped you with in defending other cases, it's

been briefed ad nauseam in other pleadings, so I have a wealth

of information about that.

The question is whether the government has an

obligation to disclose it as is, or I guess as it was, whether

the government has an obligation to preserve it as it was, and

now that it hasn't been preserved as it was, what their

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 10 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

11

obligation is now and if they've met that. So that's why I

don't think that first part is particularly important for this

hearing.

MR. BIENERT: Well, understood. Then I will take it

we'll focus on the technical components, and we'll obviously --

no pun intended, by the way -- we'll obviously address it as we

go after that what our thoughts are and get feedback from Your

Honor on the others.

THE COURT: All right.

MR. BIENERT: And then, finally, I thought we had an

agreement. The government had sent us an e-mail saying they

thought it made sense for them to put on their witnesses first

and we were okay with that, and we told them we were okay with

that.

THE COURT: Well, I'm okay with that if you guys have

decided that's the most efficient way to do that.

MR. STONE: We do think it's most efficient, Your

Honor. And the government's prepared to call our first

witness. And as we stated in our prehearing memorandum, we do

anticipate on calling three witnesses that will address what

Your Honor's concerns were with respect to the technical

aspects of the Web site.

MR. NEUMAN: Your Honor, before we call the witnesses,

just one issue. We've been getting disclosures, Jencks

disclosures from the government for the past few days. This

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 11 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

12

morning I was handed five CDs. I don't have the capability of

opening them. Apparently, there is more Jencks material on

them. Just another issue that we're going to have to address

once we see what's here. Apparently, it's e-mails related to

some of the witnesses that they intend to call. Not suggesting

we don't go forward right now, but it adds to the things that

may require further supplemental briefing or submissions to the

Court, so I wanted to make the Court aware of that.

THE COURT: Okay.

MR. STONE: Your Honor, may I just be heard for

30 seconds on that issue?

THE COURT: It's not an issue for today.

MR. STONE: Okay.

THE COURT: So, no.

MR. STONE: The government will call, as its first,

FBI Special Agent Forensic Examiner J. Patrick Cullen.

THE COURT: Okay.

MR. FEDER: I'd like to invoke the witness rule, Your

Honor.

THE COURT: Okay. The rule has been invoked, so if

you have other witnesses in the courtroom, can you exclude

them.

MR. STONE: Does that include experts?

THE COURT: No.

MR. STONE: Okay. Then I don't think we need anyone

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 12 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

13

-- we have one other witness, Mr. Gerken, who is going to speak

about the servers. He ran the company that managed the

servers. He's a fact witness. Do you have issues with him

leaving or staying in?

MR. CAMBRIA: I would request that he leave, Your

Honor.

THE COURT: Okay.

MR. STONE: That's fine. Your Honor, just for --

MR. BIENERT: I don't know if Ms. Martin is here, if

she is, she's a potential witness and shouldn't be in the room.

THE COURT: Is Ms. Martin here?

(No response.)

MR. BIENERT: Okay.

MR. STONE: Finally, Your Honor, our final witness is

Matt Frost who has been designated as an expert, so we would

ask that he remain.

THE COURT: That's fine.

J. PATRICK CULLEN,

called as a witness herein, having been first duly sworn, was

examined and testified as follows:

THE COURT: And the exhibits that have been submitted,

are you guys stipulating to those for the purposes of today's

hearing or not?

MR. STONE: We haven't spoken about any stipulations.

We've exchanged exhibits just this morning. I anticipate with

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 13 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

14

this witness just some photos of -- I don't anticipate they'll

be an objection because defense counsel has provided me the

same photos so...

THE COURT: Okay.

MR. STONE: Or at least some of the same photos.

DIRECT EXAMINATION

BY MR. STONE:

Q. Sir, could you please introduce yourself.

A. My name is J. Patrick Cullen.

Q. Where do you work, Mr. Cullen?

A. With the Federal Bureau of Investigation.

Q. How long have you worked with the FBI?

A. Fifteen years.

Q. And what is your current title?

A. I am a special agent forensic examiner.

Q. Did you have to be certified to become a forensic examiner?

A. Yes, I did.

Q. When did that certification occur?

A. I was certified in 2015.

Q. Before you were a forensic examiner, what were -- what was

your job title with the FBI?

A. So I was a special agent working computer hacking crimes.

Q. What type of -- what type of crimes did you work when you

were a special agent?

A. So computer hacking, computer intrusion type crimes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 14 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

15

Q. Currently what are some of your duties with the FBI?

A. So as a forensic examiner, I'm involved in the imaging of

media, cell phones, computers, GPSs, you name it, the

processing of those items, the analysis of those items, and

then the review and recording of those items.

Q. Do you have an approximation of how many electronic media

items you have imaged over the years?

A. So I checked yesterday. I had about 520 items.

Q. And you've been involved in numerous seizures of electronic

media as well?

A. Yes, I have.

Q. Do you have an estimate or an approximation of how many

seizures you've been involved in?

A. So total search warrants is about 95 as of last month.

Q. Many of those had electronic media?

A. Actually, all of those would have had some electronic

media.

Q. Are you familiar with this matter?

A. Yes, I am.

Q. How are you familiar with it?

A. So I was asked to travel from Phoenix to Tucson to

participate in a search warrant at a business called Login,

L.L.C.

Q. Do you remember the date of that search warrant?

A. April 6th or 8th.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 15 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

16

Q. April 6, 2018?

A. Yes.

Q. Did you have any role in the investigation leading up to

April 6, 2018?

A. I did not.

Q. Why were you asked to go to Login data center on that day?

A. So they were expecting to -- to seize and return to Phoenix

a number of computers, so they asked for someone from our

office to have computer forensic knowledge to come down and

assist with that.

Q. That's within your role and duties with the FBI?

A. Yes.

Q. Okay. On April 6, 2018, why don't you walk us through what

you did that day.

A. So we -- we being the search team -- went to a business

called Login, L.L.C., in Tucson. It's a hosting company where

you can have your servers co-located in. We made contact with

someone at the front desk and told them that we were there to

execute a search warrant. They put us in contact with Login

CTO, a guy named Ehud Gavron. So Mr. Gavron eventually showed

up. We showed him the search warrant and told him what we were

there to do.

He told us he needed to make contact with a company

called DesertNet. And it's my understanding that DesertNet was

the creator and the keeper of that system that we were looking

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 16 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

17

to seize, so we waited for representatives to show up. Mr. Wil

Gerken showed up, along with one of his system administrators.

Q. Who is Wil Gerken?

A. Wil Gerken was the chief technology officer for DesertNet.

Q. What did you understand him -- or how did you understand

his knowledge to be with respect to the servers that you were

there to seize?

A. Well, so I understood that his company was the one that

maintained those servers and he had intimate knowledge of how

they were put together and how they worked.

Q. Did you speak with Mr. Gerken at that time?

A. Yes, I did.

Q. And do you remember what was -- what that conversation

entailed?

A. So we, again, we showed him the search warrant. We told

him that we were there to power down the servers and to take

them back to Phoenix. I can't remember if he made a call at

that point or he had already called someone and he was told to

cooperate.

So they walked us into the server facility. So you

have to understand it's a row of servers that belong to

Backpage, as well as other companies. They pointed out which

servers belonged to Backpage. We asked him what type of

operating system they were running. He told us it was a

version of FreeBSD, which is a Linux/Unix operating system.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 17 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

18

Q. You asked him what type of operating system they were

using?

A. Yes.

Q. And you said FreeBSD?

A. FreeBSD.

Q. Does BSD stand for anything?

A. It probably does but I'm not aware of what that is.

Q. Okay. And what did that mean to you when you learned about

the operating system?

A. So it meant that it's a Linux operating system, which is

specialty in the FBI, and that it would be beneficial for us to

have someone with knowledge of that system to help us power it

down.

Q. Do you have specialized knowledge about Linux systems?

A. I have knowledge of Linux but I do not have a certification

in analyzing Linux systems.

Q. Okay. You mention that when you were there, there were

racks of servers at Login data center?

A. Yes.

Q. And did Mr. Gerken show you the servers that belonged to

Backpage?

A. Yes, he did.

Q. Were there other servers at the data center that belonged

to other companies?

A. Yes, there were.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 18 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

19

Q. So I'd like to show the witness what has been marked as

Plaintiff's Exhibit Number 1. And it's on the screen as well.

Do you recognize this image, sir?

A. Yes, I do.

Q. What is it?

A. So it was a picture of the first row of servers at Login,

L.L.C.

Q. And there are a number of other pictures in the exhibit

folder in front of you, Exhibit Number 1. Have you looked at

all those photos previously?

A. Yes.

Q. Do you recognize those photos?

A. Yes, I do.

Q. What are those photos of?

A. Those are photos taken during the search warrant of the

servers in the racks at Login, L.L.C.

Q. And you recognize that because you were there that day?

A. Yes.

MR. STONE: Your Honor, move to admit Exhibit 1 and

move to publish.

MR. CAMBRIA: No objection.

THE COURT: And I don't hear any objection, so

Exhibit 1 will be admitted.

Yes, you can publish.

MR. STONE: Thank you.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 19 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

20

BY MR. STONE:

Q. So we're looking at the first page of this. Could you just

describe this photo briefly?

A. So that would be servers racks. And it was the first row

of servers that we encountered that belonged to Backpage.

Q. Page number two of this exhibit, what -- what are we

looking at?

A. So you're looking at a couple of things. One, you're

looking at the individual cabinets. There are four of them.

The servers that are inside the cabinets, the back of them.

And at the top, it's kind of blown out, but you see an A and

you can see a D, it's A, B, C, and D, that's the way we label

each of those individual cabinets with a letter.

Q. When you say we, you mean the FBI?

A. The search team of the FBI.

Q. Next photo?

A. Again, that's the front of the servers in the cabinet.

Q. And there is -- within the server it almost looks like

disks or hard drives. Is that what we're looking at?

A. That's correct.

Q. Can you kind of point at it?

A. So where the red circle is there, that's an example. Those

are all individual hard drives that make up that server.

Q. The next photo.

A. Again, the front of some servers, and actually the rear of

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 20 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

21

a couple servers at the top.

Q. Is this another picture of the servers?

A. Yes.

Q. What are the numbers there for?

A. So when we seize items from a search warrant, each item

gets a number, an item number, so that's what the number one,

number two, and so on represent.

Q. A closer picture of servers one and two?

A. Yes.

Q. Other equipment that was Backpage's that was set to be

seized?

A. Yes.

Q. And now we're on page 8 of Exhibit 1. And there is other

placards that represent additional servers; is that right?

A. That's correct.

Q. What are we looking at on page number 9 of the exhibit?

A. So that is -- that is a picture that was taken after one of

the servers had been powered down and pulled from the rack or

the cage that it was -- it was installed in.

Q. Additional servers up to 23?

A. Yes.

Q. Up to 28 on page 11?

A. Yes.

Q. Page 12 has the placard 29?

A. Yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 21 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

22

Q. A closer photo of it?

A. Yes.

Q. And then 30 and 31?

A. Yes.

Q. Okay. Do you have a recollection of how many servers were

powered off and seized that day?

A. Well, there were 31 total servers seized, most of them were

running. There were some of those small ones that you saw

sitting there, they were just sitting there, so I think it was

like six to eight of those were not powered on.

Q. Okay. In all your years and experience of shutting down

electronic media, is there an optimal way to shut down a

computer or a server so that you best maintain the integrity of

the data that's located on the electronic media?

A. Yes, there is.

Q. Could you describe that method?

A. So in some instances it's called a soft shutdown or it's

called a regular shutdown. If you think of your Windows

computer where you go to the start menu, power, and shutdown,

you notice when you do that it takes anywhere from 15 seconds,

upwards of a minute to actually turn off. What's happening in

the background is programs that are running, files that are

being written at that time, they finish, and then it gracefully

shuts down those processes as it's shutting down the computer

system. It does that as the best way to preserve the file

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 22 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

23

system from being corrupted.

Q. And that's opposed to, I suppose, just yanking a power cord

out; is that right?

A. That's correct.

Q. Is that referred to a hard shutdown?

A. That's a hard shutdown.

Q. And what is the danger of conducting a hard shutdown?

A. So the danger is always -- well, one of the dangers is that

you may have corruption in the file system, you may have

corruption in individual files. The only time that we actually

consider a hard shutdown anymore -- well, one of the only times

is if there is a risk of data being erased at that time, then

you would pull the plug, but due to the risk of corrupting

files and the file system structure, we prefer to do the soft

shutdown if possible.

Q. Okay. Now, how did you shut down the servers at Login data

center on April 6, 2018?

A. So as we spoke to Mr. Gerken and he told us that he was

told to cooperate, and he had an individual with him, a system

administrator, we asked him if they would actually conduct the

orderly shutdown of the servers, and they agreed to do that for

us.

Q. Would you have been able to do a soft shutdown or an

orderly shutdown without Mr. Gerken's assistance?

A. It would have been very difficult, if not impossible for

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 23 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

24

us.

Q. Why?

A. We didn't have the password at that time.

Q. Mr. Gerken was the individual with the password because

DesertNet was managing those servers; is that right?

A. Yes.

Q. How long did it take to -- for the servers to shut down in

this soft shutdown manner?

A. That process took probably 20 to 40 minutes.

Q. And you were there and observed it?

A. Yes.

Q. Did you have an understanding of whether these servers in

Tucson were the universe of servers that ran Backpage.com?

A. So I understood, um, at the time that I arrived and was

speaking to representatives of DesertNet, that there was a

backup set of servers or a mirrored set of servers in

Amsterdam.

Q. Were those servers that were also managed by DesertNet?

A. Yes.

Q. Did DesertNet also conduct a soft shutdown of the servers

in Amsterdam?

A. Yes, they did.

Q. Were you able to observe the soft shutdown of the servers

in Amsterdam?

A. Yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 24 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

25

Q. Okay. After the servers were shut down in an orderly

manner, what did you do next?

A. So after they were shut down and representatives from

DesertNet disconnected all the connections that you saw in that

first photo, they would slide it out of the rack partway, and

then our people, our searchers would come and retrieve it, take

it over, take photos of it, package it up for transportation

and stage them for moving to Phoenix.

Q. When they unplugged the cords, did that harm or affect the

integrity of the data that was on the servers?

A. No, because the computers were already shut down at that

point.

Q. Why did the government take the servers that day? Why not

just leave the servers up and running and leave the Web site

going?

A. So I don't know the reason for that. In my capacity, I am

given a service request, in this case it was to go to Tucson,

shut down servers and bring them back to Phoenix, so the why

behind that, I don't know.

Q. You have testified that you said that you have been a part

of something like 95 seizures of electronic media; is that

right?

A. Yes.

Q. And you have forensically imaged or copied electronic

media, is it 500 times or so?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 25 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

A. Yes.

Q. What is the reason in those cases that the FBI seizes

electronic media and then makes a forensic image?

MR. CAMBRIA: Object to the relevance here, Your

Honor. He indicated he didn't know why in this particular

case.

THE COURT: The objection is overruled. The question

was not related to this case.

THE WITNESS: So could you repeat the question,

please?

MR. STONE: Yes.

BY MR. STONE:

Q. In all your experience, why is it that the government

seizes electronic media and makes a forensic image of the

media?

A. So the -- the thing as an examiner that you're most

concerned about is preservation of the data, preservation of

the digital evidence. Digital evidence is very fragile, in

that if it continues to run, if people continue to access it,

things can change on there. So our preferred method is to

power down the servers or the computers, like was done in this

case, because we know at that point in time it -- it is in a

state that it was on the day we seized it. And so the next

thing that we do, eventually sometime down the road, is when we

begin the imaging process, we actually take steps to ensure

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 26 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

27

that we don't do anything to write data to those servers so

they're still in the same condition they were when we received

them.

Q. When you say write data, what does that mean? Is that

W-R-I-T-E?

A. Yes.

Q. What does that mean?

A. So the way computers interact with hard drives is they

write data in and they read data, read and write. So any time

you write something to a computer hard drive, you change it.

So we wanted to make sure we're not making those changes,

that's what I mean by, it's called write protection.

Q. When it -- the servers are orderly shut down and unplugged,

that ensures that that evidence is frozen, essentially; is that

right?

A. That's a good analogy.

Q. But you would agree with me that, let's say -- let's take

an example of a computer, the FBI seizes a computer and it's

part of a criminal case and that information needs to be

disclosed to defendants. It would be much easier for defense

or anyone else to actually receive a computer so that they can

look around and understand what data was contained on the

computer?

MR. CAMBRIA: Object to the leading, Your Honor.

THE COURT: The objection is overruled.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 27 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

28

BY MR. STONE:

Q. How come the FBI doesn't do that?

A. So to answer your first part of the question, it would be

much easier to just browse the desktop or browse the Windows

Explorer to look for evidence, that's correct.

But every time you do that, every time you open a

folder, every time you open a picture, you're changing the

evidence. And so if the objective is to say, this evidence

that we seized is in the same state, you know, every time we

look at it, we verify it, we make sure it hasn't changed, it's

kind of like a continuum of maximum evidence preservation on

this side versus, in your example, convenience on this side.

They really are at odds with each other and you have to try to

balance the needs of everyone involved in preserving the

evidence and getting the evidence out of those systems.

Q. Have you received forensic images and forensic copies of

electronic media before?

A. Yes, I have.

Q. Are you able to analyze those forensic images?

A. Yes, I am.

Q. How are you able to analyze those?

A. So it depends on, well, a couple things, one, the size.

Sometimes an image will fit on one hard drive. So if that's

the case, I'm able to just connect that hard drive to a write

protection device, connected it to my exam computer and use

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 28 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

29

software, forensic software to review it.

Sometimes you receive multiple hard drives because

it's such a large dataset, you know, I mean, a four terabyte

hard drive, if you have a dataset that's 40 terabytes, it's not

going to fit on one. And in that case I have -- the FBI has a

forensic network, we have like 360 terabytes of storage raw, so

obviously not that open, but I'm able to copy those files to

that file system in the folder and then tell my evidence -- my

software to say, those are the ones you want to look at, and it

mounts those virtually, if you will, and I'm able to analyze

them from putting them on my server.

Q. Are there -- well, I'll come back to that.

So I guess the short answer to the question is when

you receive a forensic image of electronic media, you're able

to analyze the data that's on that image?

A. Yes, I am.

Q. Beyond your role of helping shut down the servers in the

Tucson data center, have you had any other activities or have

you been involved at all in this matter?

A. Yes, I have.

Q. In what capacity?

A. Um, there were some servers that were seized by the FBI in

Dallas, there were five of those, I believe, and they were

turned, they were sent to Phoenix. Um, I was asked to image

those servers, and then I also did some personal devices,

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 29 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

30

laptop computers, desktop computers.

Q. You imaged those servers which means you made a copy of

those servers; is that right?

A. A forensic copy, yes.

Q. How did you make the copies?

A. So in this particular case, we have a tool developed by the

FBI that's called a Linux boot CD, because with a server one of

the things is you have all those hard drives that you saw

earlier, um, they can actually be in what's called a RAID, its

a redundant array of disks. So you can have ten drives that

make up one volume, so those ten drives, you know, ten two

terabyte drives make up one 20 terabyte volume. And the

software does two things. It allows me to boot forensically,

so it boots off of the drive not off of the suspect computer,

and all those hard drives that are in that particular device,

it mounts them in a read only capacity. And we talked about

read/write, I don't want to write anything to them, so it's a

forensic tool allowing me to see the data that exists, if you

will, in the pool of data.

Q. And what's the -- what's the copy called? Is it an E01?

What does E01 stand for?

A. So an E01 is a format called the EnCase format and so it's

a forensic standard copy that we use.

Q. Is that what you used in this case --

A. Yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 30 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

31

Q. -- with respect to the Dallas servers?

Now, are you familiar with something called an FTK

Imager, an FTK Imager software?

A. Yes, I am.

Q. What is that?

A. So FTK Imager is a software that we use to do a couple of

things. One, you can open these E01 image files and browse the

corresponding file tree. Um, the other thing that we do is we

use FTK to sometimes image drives.

Q. Does FTK work with all operating systems?

A. It -- it does not.

Q. Which operating system does it work with and which does it

not work with?

A. So I am certified to work on Windows and Mac computers. It

definitely works with those, except for the newer Macs, it

doesn't work with the brand new Macs. It will work with some

Linux operating systems like EXT3, that's a file system, and

EXT4, but there is a host of other ones it won't know what to

do with it when you point it at it.

Q. What about the servers that you imaged from Dallas, would

an FTK -- FTK Imager software work with those servers?

A. It did not. It could not read the file.

Q. Why is that?

A. It must have been in a format probably like -- a lot of

these servers are in the Z file servers, ZFS file server, and

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 31 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

32

it doesn't work with them.

Q. So with respect to the data that was seized on this -- on

the servers both in Tucson and Amsterdam, is it your

understanding that the integrity of the data was maintained

throughout this seizure?

A. Yes.

Q. Why is that?

A. Due to the way it was shut down, the soft shutdown that we

talked about earlier.

Q. And do you have an understanding of -- if someone had the

appropriate tools and the appropriate know-how, would they be

able to then access the data that is produced off the copies of

those servers?

A. Yes.

MR. STONE: Just a moment, Your Honor.

That's all I have, Your Honor.

THE COURT: Okay.

Who is going first?

Mr. Cambria, cross.

MR. CAMBRIA: Yes. Good morning.

CROSS-EXAMINATION

BY MR. CAMBRIA:

Q. Good morning, agent.

A. Good morning.

Q. Before you, you should have Defendant's Exhibit 101. Do

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 32 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

33

you have that there?

It's on its way.

A. Yes.

Q. Yes. Do you recognize that?

A. Yes, I do.

Q. Have you seen that before?

A. Yes, I have.

Q. And the whole exhibit, if you just review it and tell me

whether you're familiar with that?

A. Yes, I am.

MR. STONE: I don't believe we have a copy of this

exhibit.

MR. CAMBRIA: They were here.

BY MR. CAMBRIA:

Q. Yes, sir?

A. Yes, I am.

Q. All right.

MR. CAMBRIA: And I would offer this in evidence, Your

Honor.

MR. STONE: Take a second to look at it.

I'm not sure what the foundation or the relevance is

of this. It appears to be a search warrant that's sworn out by

another agent.

THE COURT: Is this the search warrant that you were

participating in?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 33 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

34

THE WITNESS: Yes.

THE COURT: Are there any other search warrants in

here?

MR. CAMBRIA: No.

MR. STONE: No objection. I see that. Thank you.

THE COURT: Exhibit 101 will be admitted.

BY MR. CAMBRIA:

Q. Now, were you familiar, at least generally, with the

indictment in this case?

A. I was not.

Q. Were you told of the nature of the charges in this case?

A. I was not.

Q. Did you work with Agent Fryberger?

A. When.

Q. Well, in connection with this search.

A. So the first time I actually spoke to Agent Fryberger was

after the briefing which took place right before the search was

executed.

Q. All right. And did she conduct the briefing?

A. Yes, she and Agent Tolhurst.

Q. All right. Was there a discussion there about the goal of

the search being to access these servers, and, more

particularly, the information that they contained?

A. So the discussion I had with Agent Fryberger after this was

-- after the briefing was, so your request to the computer

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 34 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

35

response team that I'm part of is to seize these servers; is

that correct? And the answer was yes.

Q. All right. And you had, for example, this search warrant

with you at the time that you executed it, did you not?

A. Yes.

Q. Including attachment B, is that true?

A. Yes.

Q. All right. And attachment B describes basically the nature

of what's the object of the seizure, does it not?

A. Yes, it does.

Q. And, for example, under A, evidence of who used, owned,

controlled the computer at the time the things described in the

warrant were created, edited or deleted, such as logs, registry

entries, configuration files, browsing history, et cetera,

true?

A. Yes.

Q. All right. And that was the goal, to seize this -- to

seize these servers to ultimately capture that information,

true?

A. Yes.

Q. All right. And, in addition to that, you were told that

the focus was also to capture evidence of who accessed the

computer, you who used it, chronologically who used it, et

cetera, true?

A. Yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 35 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

36

Q. All right. So you knew of a discrete category, if you

will, of information that supposedly was on this computer, on

these computers?

A. Say that again, please.

Q. Well, you understood the focus was to gather information

concerning the historical use of the data in the computers,

true?

A. Yes.

Q. All right. And, as a matter of fact, in this warrant, if

we turn to the affidavit of Fryberger, there is a

representation in there -- and this would be on the third page

of the affidavit, if you will, they're not numbered but it's

the third page of the affidavit, Roman numeral four.

A. Where it says facts in support of probable cause?

Q. No. It says -- under four it says, the server -- servers

contain current and historical content of the ads that were

posted on Backpage. Servers contain all versions of an

advertisement that a user attempts to post on Backpage. If an

ad is stripped of certain words or if a photograph is removed,

the server will maintain the original form of the ad. The

server also maintains user payment information.

Did you see that?

A. Yes, I do.

Q. And that was a representation, according to this document,

made to the court at the time they obtained the warrant, was it

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 36 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

37

not?

A. Presumably, yes.

Q. And, in addition, was there not a representation made that

steps would be taken to preserve the evidence in its original

form? If you look at page 4, it says there, three to four

anticipated mirror copies or images of such evidence will be

made, if the failure to do so could otherwise alter the

original evidence, correct?

A. Yes.

Q. All right. So you knew that steps had to be taken so as

not to alter the form of the original evidence; is that

correct?

A. Yes.

Q. All right. And you weren't certified in Linux, were you?

A. I was not.

Q. Not. So Mr. Gerken is called and he is the individual who,

as far as you knew, had knowledge of the working of this

system, correct?

A. Yes.

Q. And, at that time, did you have a particular protocol that

you informed Mr. Gerken you wanted him to follow in order to

preserve the evidence in its original form?

A. So the protocol that I had --

Q. The question was a yes or no question.

A. Then the answer to that was -- okay. Yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 37 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

38

Q. All right. And did you say to him, sir, it is important

that we handle these computers such that we do not alter the

original form of the information they contain?

A. I don't recall saying those words to him.

Q. Well, did you ask him to explain a -- I'm sorry. Strike

that.

Did you inform him of any particular kind of

information that was the focus of the warrant?

A. We provided him a copy of the search warrant.

Q. All right. Well, the search warrant has a list there that

we went through of what is hoped will be found, correct?

A. Yes.

Q. Do you know whether or not he read it?

A. He did take the time to look through it.

Q. And did you discuss with him, do you understand,

Mr. Gerken, for example, that we need to do this in such a way

that we're going to preserve all of this?

A. Yes.

Q. All right. And did -- at that point in time, what did you

say to him?

A. So I asked him, I said, we need your assistance in powering

these servers down to preserve the integrity of the servers.

Q. The integrity of the servers. Okay. But you didn't call

any particular kind of information to his attention?

A. I did not.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 38 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

39

Q. All right. And did you inquire of him as to whether or not

he actually had the expertise necessary to do this?

A. Yes.

Q. Did you ask him whether or not he had ever done it before?

A. Whether he had powered down servers before?

Q. No, whether or not he had ever had a massive number of

servers like this where he had to power them down and preserve

the evidence inside of them?

A. I don't recall him speaking of that.

Q. Now, did you ask him at that time if he could do a

schematic of the servers and their configuration so that they

could be reconfigured and operate in their normal functional

way?

A. I did not.

Q. Was there anything preventing you from doing that?

A. From having a schematic or from asking or --

Q. From asking or doing one?

A. No, there was not.

Q. You could have made on the spot a mirror image of these and

left them there, could you not?

A. Um, I could not have in this case.

Q. And why is that?

A. Because I was dictated by the case agents telling me they

were to be seized and brought back to Phoenix.

Q. All right. But it was certainly possible for you to have

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 39 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

40

made a mirror image of these and left them there intact, was it

not?

A. It could have been possible for that to happen, yes.

Q. And if that would have happened, then the evidence would

have still been preserved in its original form, would it not

have?

A. The copies that we would have made would have been the

original form, yes.

Q. Well, and the servers that you would leave behind, because

you made mirror images of them, would still be available to be

functional as originally configured, true?

A. Yes, but they would be changing.

Q. Well, you say they'd be changing because they'd be

evolving, true?

A. They would be changing because they were running, yes.

Q. All right. But you would have already made a mirror image,

would you not?

A. Yes.

Q. So you would have been able to freeze in time, as of the

time of your mirrored image, as to what was happening in the

computers, true?

A. That is possible, yes.

Q. And then you would know the difference if anything changed

after that, correct?

A. Yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 40 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

41

Q. But if you would have mirrored them on the spot, you would

have also preserved in the original functioning manner the

servers, correct?

A. I'm not sure I understand what you're asking there.

Q. If you mirrored the servers --

A. Okay.

Q. -- and then left the servers configured, the servers that

are left configured would have been in their original

evidentiary form, would they not?

A. Yes, with the exception they would not have had

connectively to the internet or the domain servers.

Q. Okay. But as far as operating them, if they were

reconnected to the internet, they would be operational, would

they not?

A. Yes, assuming the domain servers were operational as well.

Q. All right. And you could have conferred with Mr. Gerken to

make sure that that happened, could you not have?

A. Yes.

Q. And you know in the past the FBI has, in fact, gone into

establishments and made mirror images and left behind with a

read only format, if you will, the computers as they found

them, true?

A. Um, I have never done that before, but I assume that's been

done in some cases, yes.

Q. Well, you know that that's been done, have you not?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 41 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

42

A. I do not. I don't have knowledge of that.

Q. All right. But you say you assume so because it's clearly

doable, is it not?

A. Yes, it's possible.

Q. All right. So in order to fulfill the representation to

the magistrate who originally issued this warrant, you were to

take steps to allow these computers to have an original

evidence form, were you not?

A. Yes.

Q. Now, as we sit here today, the application for the warrant,

if you look at the bottom of the page 4, double I, that, sir,

says, further, because investigators cannot anticipate all

potential defenses to the offenses in this affidavit, and as

such cannot anticipate the significance of the evidence that

has been lawfully seized pursuant to the warrant, it's

requested that -- and here you say that you take custody of

the -- you say here retain by law enforcement until the

conclusion.

Do you recall -- do you see that statement?

A. I do see that statement.

Q. So there was a realization, was there not, that the

information in these servers was absolutely important to the

defense of the case as well, correct?

A. Yes.

Q. Now, so no mirror image taken and no schematic done. Any

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 42 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

43

other steps that you asked Gerken to take so that he could

readily reassemble these, if necessary, so that they could be

in their original evidentiary form?

A. There were none.

Q. Now, I want to ask you an additional question as follows.

Yesterday, I believe it was yesterday, the government made a

submission to the Court. And I want to read to you the

representation they made to the court, and I want to ask you

whether or not you agree with this or disagree with it.

On page 7 of the United States prehearing memo for

this hearing, the government says, beginning at line -- or

folio 21, reassembling a fully functioning version of the Web

site that operates just like the live version would be a

difficult, technologically challenging task, because links and

references to files and data within the servers were referenced

based on the way that the servers were networked when the Web

site was operational. Restoring the Web site to functional

state is not as simple as connecting any three servers of the

appropriate types. Rather, the IP internet protocol address of

the different servers as they were configured at the time would

need to be rediscovered and the organization and

interrelationship of the various system components would need

to be reconstructed. There would be a need to programmatically

merge various system components and have them work together in

concert to pull data from the right places at the right times

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 43 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

44

to make the Web site look exactly as it would have appeared to

outside users and internal administrators when the Web site was

operational. This is a technologically complex task that would

likely involve considerable time and cost to accomplish.

Do you agree with that?

A. Yes.

Q. So that which I just read characterizes the current state

of the computer constellation, if you will, that has been

seized in this case, true?

A. Yes.

Q. And that clearly is not the original form that the evidence

that you seized was in, correct?

A. I'm not sure I would agree with that.

Q. Well, okay. Well, you couldn't just go in and start

searching on the various -- on the -- on the items you seized,

could you?

A. As far as searching how, with Web browser?

Q. Searching -- searching -- just reasonably searching?

A. You could with -- they have -- it's a database, so you can

search through a database.

Q. Well, I'm talking about fully functional, reasonably and

fully functional. It's no longer reasonably or fully

functional, is it?

A. So is -- is it running as a Web site right now? The answer

is no.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 44 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

45

Q. Okay. And you took no steps with Gerken to try to fill in

all of the things that the government pointed out in their

submission that would be necessary to reassemble this server in

its original evidentiary form, correct?

A. Yes.

MR. CAMBRIA: That's all.

CROSS-EXAMINATION

BY MR. NEUMAN:

Q. Good morning, Agent Cullen.

A. Good morning.

Q. Just want to go back. I think you said that you have been

involved in 95 search warrants and imaged approximately 520

devices, right?

A. That's correct.

Q. And a device is a hard drive, for instance?

A. Hard drive, cellular phone, GPS.

Q. Ever been involved in the seizure of a Web site before?

A. The seizure, no.

Q. Okay. Are you familiar with the seizure of the Silk Road

Web site?

A. I am not, other than what I've read on -- on the internet.

Q. Okay. Are you aware that in that case the FBI seized the

servers but left a read only version of the Web site running

for the prosecution, defense, and court to have access to?

A. I am not aware they did that.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 45 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

46

Q. Do you know what a read only version of a Web site is?

A. Is it would be nothing that could be written to.

Q. Okay. And is that something that is possible to create if

you have the right information?

A. I would assume so if it's been done before. I have never

done that before.

Q. You don't have the expertise --

A. No.

Q. -- to do that?

A. That's correct.

Q. Okay. And, in this case, there was no discussion, it

sounds like, about maintaining the servers or the hard drives

in such a way that a read only version could be created after

the seizure, right?

A. That's correct. There was no discussion.

Q. When you talked to Agent Fryberger, the affiant at the

briefing, it sounds like the instructions were, seize the

servers -- or power them down and seize the servers, right?

A. That's correct.

Q. So pointing you back to the affidavit in front of you, and

this is a bit of what Mr. Cambria was asking you, but I don't

think he asked you about this in particular. I'm looking at

paragraph VIii. I think it's on page 5 of the affidavit. It

says -- and I can read it to you in case you can't find it.

A. Please do.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 46 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

47

Q. Contextual information necessary to understand the evidence

will -- and I'm going to skip -- and I'll try to establish

admissibility will also be sought by investigative agents.

Now, contextual information in the case of a Web site,

would that include the internet protocol addresses of the

different servers as they were configured at the time?

A. The servers talking to each other or --

Q. Yes.

A. Yes. And we actually had a list of that. Someone had

gotten that from Backpage.

Q. Okay. So you, the government, have a list of the IP

addresses of the different servers as they were configured at

that time?

A. They had a list of all the internal IP, the non routable IP

addresses.

Q. I just want to make sure we're --

A. Yes.

Q. I'm not a tech guy. I want to make sure we're talking the

same language. I'm actually reading from the government's

submission yesterday that Mr. Cambria read to you as well, it's

page 8, line 2. They say, one of the things they would need to

give the defense what they're asking -- what we're asking for

is the IP addresses of the different servers as they were

configured at that time.

A. Okay.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 47 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

48

Q. Is that what you're telling the Court --

A. So --

Q. -- the government has?

A. -- the night before, or a couple days after we had a list

on Excel of IP addresses. I don't know if it was server

specific or which servers they belong to, but we did have

something.

Q. So, to be clear, it sounds like you don't actually know --

A. That's correct.

Q. -- whether this information was obtained, right?

A. That's correct.

Q. And on the day of the search, you didn't do anything to

obtain the IP addresses of the different servers as they were

configured at that time, right?

A. That's correct.

Q. And, to your knowledge, neither did anybody else who was at

the search site on that day, correct?

A. They did not.

Q. I'm sorry?

A. They did not.

Q. And it would have been easy enough to ask Mr. Gerken for

that information on that day, correct?

A. Yes.

Q. You chose not to?

A. Yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 48 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

49

Q. Okay. What about information about the -- in terms of the

Web site again -- we're not talking about a computer. I want

to -- let's differentiate for a moment, because you talked with

the prosecutor about a computer and how you, you know, you take

one hard drive, you plug it in somewhere, you can look at that

data pretty easily, an image of that data. We're talking

about, you said 31 servers, how many hard drives?

A. Oh, hundreds.

Q. Okay. So not something you just plug into a computer?

A. Right.

Q. Okay. So different, sort of apples and oranges when we're

talking about seizing a cell phone or a computer and talking

about servers with hundreds of hard drives that have

interrelationships, right?

A. I don't know if I would answer yes to that, because it's

still the same process of acquiring the image and analyzing the

image.

Q. Sure in terms of actually getting the image of the data --

A. Uh-huh.

Q. -- but in terms of viewing that and how those

interrelationships work, if you're talking about a hard drive

on a computer and hundreds of hard drives, that's going to be

different, right?

A. It could be different, yes.

Q. Okay. And, in this case, again, going back to what the

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 49 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

50

government says, they would need to give the defense what it

needs to do -- to defend this case, again, page 8, line 3 of

their submission, Document Number 759, they said they would, in

addition to the IP addresses of the different servers as they

were configured at that time, they would also need the

organization and interrelationship of the various system

components.

Now, do you know what that means?

A. I have not seen that. I do not know what they're referring

to there.

Q. Okay. Did -- well, let me ask you. Does it mean how the

servers might be connected, which server plays what role, for

instance, one is the database server, one is an image server,

one is a Web site server, that would potentially --

A. Yes. I would say yes to that.

Q. Okay. Let me finish my question just so we have a clear

understanding of what we're talking about.

A. Okay.

Q. Those different roles of the servers and how they interact

with each other, that would be this interrelationship of the

various system components, right?

A. Yes.

Q. So we're in agreement.

And on the day -- and that would also be, going back

to the affidavit, the contextual information necessary to

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 50 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

51

understand how this system works, right?

A. That could be part of it, yes.

Q. Okay. And, again, the Agent Fryberger told the magistrate

that that information would be sought. It sounds, from what

you're saying, that there was no effort made that day by you or

any other agents to obtain information about the

interrelationship of the various system components?

A. As far as the IP addresses and the connections, that's

correct.

Q. We already talked about the IP addresses.

A. Uh-huh.

Q. We already said nobody made any effort to find that that

day. Now I'm talking about the roles of the servers, right?

So there is a Web site server, there is an image -- I don't

know if you even know this about this case, do you know that,

that there is different roles -- there is different roles?

A. Yes, I know that.

Q. So you know that there is different roles for different

servers, and those different roles are necessary to work

together to create the Web site, right?

A. Yes.

Q. Okay. And on the day of the search, my question is, it

sounds to me like there was no effort made to identify those

different roles of the servers, right?

A. Yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 51 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

52

Q. Okay. There was no effort, correct?

A. There was no, yes.

Q. And there was no effort made to identify the

interrelationship of the different servers, right?

A. Yes.

Q. Okay. And, again, presumably, and we'll talk to him in a

minute, but, presumably, you could have asked Mr. Gerken about

that, right?

A. Yes.

Q. He would have been the one with the most knowledge about

that, right?

A. That's correct.

Q. Okay. So when we see those pictures -- and I don't want to

touch the government's computer here -- but when we see those

pictures of the servers with the different numbers on them and

such, that's not noting, for instance, number 25 is the

database server, and number 32 is the image server? All that

is, is saying this is the picture of number 25. This server

we're designating as number 25 going forward. When I make an

image of number 25, that's the one I'm talking about, right?

A. That's correct.

Q. Okay. We're not talking about how these servers are

connected, what the IP address is, what the relationship is,

what the interrelationship is, none of that, right?

A. That's correct.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 52 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

53

Q. And none of that information was sought that day, correct?

A. It was not.

Q. Okay.

MR. NEUMAN: That's all I have for now. Thank you,

Your Honor.

THE COURT: Is there anyone else?

Okay. Redirect.

MR. STONE: Briefly, Your Honor.

REDIRECT EXAMINATION

BY MR. STONE:

Q. Special Agent Cullen, there was discussion from Mr. Cambria

about imaging the servers at Login data center. Do you

remember that?

A. Yes.

Q. Did you have any sense of how much data was contained

within the servers on that day?

A. As far as having a number, no, but looking at the number of

hard drives that were in those servers, it was immense.

Q. Walk us through what it would take to image a server.

You've imaged two servers from Dallas in this case, right?

A. Yes.

Q. How long did it take to image those servers?

A. A week for each server.

Q. Here there was 31 servers, correct?

A. Right. And it would have been slower doing an on-scene

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 53 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

54

image.

Q. What would you have needed to have done?

A. I would haven, one, needed a lot of storage, which we

didn't have. I would have also needed Linux experts to be

there to image on scene, because it's a very specialized way,

and time. That -- that large of population we would have been

there for months, potentially. It would have been a long time.

Q. Multiple months to image the servers on site?

A. Yes.

Q. You discussed the process of making a forensic image or a

copy of certain electronic media, including two servers in this

case. Let me ask you. If information wasn't contained on the

original electronic media, wasn't on that computer, would the

information be on the copy?

A. It would be -- no, it would not be.

Q. If it's not on the original, it's not going to be on the

copy?

A. That's correct.

Q. Fairly simple.

Mr. Neuman asked you a number of questions about

interrelationships and IP addresses and conducting additional

work to ensure that everything remained networked and together,

correct?

A. Yes.

Q. Do you know if you need all of that connectivity to access

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 54 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

55

information that was contained on the Web site?

A. The -- no, you do not.

Q. Why not?

A. Because it's contained in a database. That's how the

server maintains all of its data is inside of a database.

Q. So if information was contained on the Web site, assuming

you have the know-how, would you be able to see that

information that's on a copy of the database?

A. Yes, you would.

Q. If you had the appropriate know-how and you had the

appropriate servers; is that correct?

A. If you had the appropriate know-how and the images. The

servers are irrelevant at that point if you have the images.

Q. If you had copies of the servers which we're calling

images?

A. Yes.

Q. Did your actions that day help preserve the integrity of

the data that was on Backpage.com?

MR. CAMBRIA: Object to that.

THE COURT: The objection is overruled.

THE WITNESS: Yes.

MR. STONE: No further questions.

THE COURT: All right. You may step down.

MR. CAMBRIA: May I please, Your Honor? I have a

follow-up on what he asked.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 55 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

56

THE COURT: No. You may step down.

THE WITNESS: Thank you.

THE COURT: Your next witness.

MR. STONE: Next witness the government calls is

William Gerken.

WILLIAM GERKEN,

called as a witness herein, having been first duly sworn, was

examined and testified as follows:

DIRECT EXAMINATION

BY MR. STONE:

Q. Good morning, sir. Could you please introduce yourself.

A. William Gerken.

Q. Where do you work, Mr. Gerken?

A. DesertNet.

Q. What is DesertNet?

A. We're a software and hosting providing company.

Q. Is that a company that you founded?

A. Yes.

Q. When did you start DesertNet?

A. DesertNet, L.L.C., started in '96. We started a little bit

earlier at Tucson Weekly before we were a company in '94/'95.

Q. Did you start working after you took some college classes

and studied in computer programming?

A. Yes.

Q. So if you could talk briefly about how you got your start

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 56 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

57

and how DesertNet came to be.

A. Sure. I was hired by Tucson Weekly to help put their

newspaper on line. This is pretty early on. There wasn't

really software that could really help a newspaper go on line,

so wrote some software to do that.

Q. What year or years did you do that?

A. This is -- this is probably '95.

So they were -- they were fairly early on being on the

internet at the time. And we -- I was getting them on line

probably in a couple of hours, not really having anything else

to do, so we got a little entrepreneurial and decided we could

do this for other newspapers so developed the software more and

started helping other newspapers get on line and host them as

well and then spun off to a company.

Q. So you started working with different newspapers and

weeklies and then you started DesertNet?

A. Precisely.

Q. Was one of the newspapers or publications that you worked

with the New Times?

A. Yes.

Q. When did you start working with the New Times?

A. Um, I am having to guess, but I think around '98, '99,

somewhere around there.

Q. What was your role in working with the New Times?

A. Similar to what I have just described. We had some

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 57 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

58

software that could help with getting their newspapers to put

together their Web sites. They saw some efficiencies with that

and wanted to use it and we wanted to work together and started

to.

Q. Is that still a publication you work with today?

A. It is, yes.

Q. I'm sorry, do you have a title at DesertNet currently?

A. Chief Technology Officer.

Q. Is there a president or CEO or someone who is above you

within the organization?

A. There is not.

Q. Part of your work at DesertNet, do you host servers for

other companies?

A. Yes.

Q. Where do you host the servers?

A. Currently at Login in Tucson, which is a data center in

Tucson.

Q. Do you know roughly about how many servers you're currently

hosting at Login data center?

A. Yeah, in the ballpark of 50, you know, possibly a few more.

Q. Are you familiar with a Web site Backpage.com?

A. Yes.

Q. How are you familiar with the Web site?

A. We provided some hosting and software services for

Backpage.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 58 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

59

Q. Did that relationship that you had with Backpage, did that

stem from your original relationship working with the New

Times?

A. Yes.

Q. How did that come to be?

A. We had been working with New Times for quite some time.

And at one point they approached us and asked if we could help

them put together a classifieds site. And we had done some

classified work with some other publications and we saw some

ways we could help each other. And they gave us specifications

for the classified site they wanted to put together and we

helped build that and then ultimately host it.

Q. So short answer maybe is you helped build the site and

hosted the site?

A. Yeah, that would have been a shorter answer, yeah.

Q. Did you host the site throughout the time that Backpage.com

was on line?

A. Yes. The portion of the site that we're involved with,

yes.

Q. Now, I think you said there was some software involved in

the work that you did for Backpage. Who helped -- who from

DesertNet worked on that software, developed it?

A. I was the primary lead developer on that, some other

coworkers as well.

Q. So safe to say you're intimately familiar with the workings

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 59 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

60

of that Web site, Backpage.com?

A. The software, yes.

Q. But it's also true that you -- your company, DesertNet, was

hosting the servers for Backpage at Login data center; is that

right?

A. That's true.

Q. Were you hosting servers anywhere else?

A. Yes.

Q. Where?

A. Switch data centers in Amsterdam.

Q. So given your experience with the Web site, is there

anyone, in your mind, who would be better equipped to answer

questions about how the Web site was managed than you?

A. No. I think I'm the person for that.

Q. How about how data was retained on -- on the Web site?

A. How the data was stored in the database?

Q. Correct.

A. Yes.

Q. Are you also able to speak to how the servers were set up

that ran the Web site?

A. Yes, their roles, yes.

Q. As compared to anyone who actually worked at Backpage, is

it your understanding that you would have more knowledge about

how the servers were set up than any employee of Backpage?

A. Yes. For that question, yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 60 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

61

Q. And that's because DesertNet was managing these servers?

A. Correct.

Q. Both in Tucson and in Amsterdam?

A. Correct.

Q. Let's talk about the configuration of the servers that

helped run the Web site.

I know it's been a number of months, but do you have

an approximation of how many servers were in Desert Net's

control in the Tucson data center?

A. Yes.

Q. With respect to Backpage?

A. Yes. You're asking for the quantity?

Q. What's the approximation?

A. Forty.

Q. Do you have an understanding, again, an approximation, of

how many servers were in the data center in Amsterdam?

A. Again, an approximation, 20.

Q. Okay. Let's talk about the roles of the various servers in

Tucson.

Were there -- was there a server called a database

server, database servers that were within the Tucson data

center?

A. Yes.

Q. Okay. Do you have a recollection of how many database

servers?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 61 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

62

A. My memory is approximately four.

Q. And what was the setup of those four servers? Did all four

servers have unique information saved on them?

A. No.

Q. How was that set up?

A. All four servers would have the same information on them.

The nuance is that one would be what we would call the master

server, it's where data would get written to, where the others

would replicate that information and reads would happen from

there.

To give you an example, if somebody is posting an ad,

the ad that -- the data that they're posting gets saved to that

master server. If somebody is viewing an ad, the data that is

being retrieved to view that ad comes from the replicated slave

servers.

Q. So what's the purpose of having the three replicated or

slave servers?

A. Efficiency and performance, performance. Yeah.

Q. Helps run the Web site faster?

A. Exactly. It's -- by splitting it up that way, you'll get

maximum performance on the Web site.

Q. But in terms of actual data, as long as you had the master

database server, you wouldn't need the replicated servers

because it's all the same information that's contained it on?

A. That's correct. They're redundant.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 62 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

63

Q. All right. What about image servers? Were there image

servers hosted by DesertNet?

A. Yes.

Q. Now, explain the function of an image server.

A. Images are not -- they're large files. They are not as

efficient to store them in a database. It increases the size

too much. It's better to have a very simple system where you

can save images on disk and then just simply retrieve them with

pointers. The image servers facilitated that.

Q. How many image servers, to the best of your recollection,

were under Desert Net's control that were related to Backpage?

A. In Tucson?

Q. In Tucson.

A. Approximately three.

Q. Was there any redundancy among those three?

A. Yes. They're completely redundant to each other.

Q. Each one contained the same images?

A. Yes.

Q. All right. So you've talked about four database servers

and three image servers, but there certainly were quite a few

additional servers. What were those other servers?

A. Yes. The majority of them would be Web servers.

Q. What's a Web server?

A. A Web server on its simplest of forms is you have a URL,

the page that you're requesting, and the Web server facilitates

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 63 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

64

getting that page and delivering it to you.

In their case, the same type of thing. If a reader

wanted to see a bicycle ad on Backpage, there would be a URL to

that bicycle ad. Let's say it's Phoenix, and the ad's number

5, 523, we'll say, the Web server would receive that URL. They

would run a little program that would know which database to go

to, Phoenix; which image it is, which ad to go to; whatever

number I just said. It would fetch that information, it would

grab the images. It would marry it with a display template and

serve it back to the user.

Q. Was there any unique information that would be stored on

the Web servers with respect to ad data, let's say?

A. For ad data, no.

Q. So, seemingly, they were workhorses that married up

information from the ad along with the image and then displayed

it for the user or whoever is looking at the Web page?

A. Yeah, that's succinctly correct.

Q. Are there other machines, maybe something called the load

balancer?

A. Yes.

Q. What's that?

A. There are servers that we would call helper servers. The

load balancer is the primary one. Load balancer, basically,

happens right before that Web server, so when two the URL is

being accessed, the system can say, go to one of these

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 64 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

65

particular servers, this one doesn't have as much usage on it

right now. It's to spread the usage over multiple servers.

Q. Also for efficiency?

A. Entirely for efficiency. Efficiency and redundancy, I'll

add, so.

Q. Okay. What about the servers in Amsterdam? I think we

talked about the universe of the servers in Tucson. Anything

we left out of Tucson before we go to Amsterdam, actually?

A. No, that covers it.

Q. Okay. Now, looking at Amsterdam, was there any redundancy

between Tucson and Amsterdam?

A. Yes. Yes. It was designed to be a fail over site that

both of them -- at the backhoe or a fire took out Login, for

example, it could fail over to Amsterdam and vice versa.

Q. So they were the same?

A. They were the same.

Q. If one -- if there was a natural disaster in Tucson, then

the Web site could shift to Amsterdam and that could continue

to run the site without any interruptions?

A. Correct.

Q. So within the data center in Amsterdam, did you have the

same types of servers that we just went over, the database

server, the image servers and Web servers?

A. Yes, exactly.

Q. Were they similar in that there was a master database

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 65 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

66

server and then three replicated or slave servers?

A. Yeah. I'm not positive on the quantity, but similar in the

design. There would be a master and some replicated.

Q. Setting aside the quantity, it would be a similar setup?

A. Yes.

Q. And the master database server, just so we're clear, in

Tucson and the one in Amsterdam, were those similar?

A. They were. They're designed to be identical.

Q. They were identical?

A. Yeah.

Q. How about image servers in Amsterdam and image servers in

Tucson?

A. They were designed to be identical.

Q. Were you aware of any servers that were stored in Amsterdam

that were not under Desert Net's control?

A. Pertaining to Backpage?

Q. Pertaining to Backpage.

A. Yes. I believe, I hear that their credit card transaction

system was in Amsterdam as well.

Q. Does that have a name?

A. They were -- they refer to it as PPI.

Q. Payment processing island?

A. Yes.

Q. And those were not under Desert Net's control?

A. That's correct.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 66 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

67

Q. But with respect to the ad data, those were contained on

the servers within Desert Net's control; is that correct?

A. Correct.

Q. If you would, maybe you could walk us through what happens

when a Backpage user uploads an ad and how that information

moves through the system and to the servers.

A. Sure. The user would -- I'll stick with my bicycle ad. A

user would run a post on a bicycle ad for a bicycle they're

selling. They would fill out a form in their browser. It

would have the title, ad body, other information about the

bicycle, images. Once they finished filling that out, seeing a

preview of it, they would click to save it, to post it. When

they go to post it, that information would get written to the

master database server for that market to create an ad record

for it. Images would go out to the image servers. There would

also be a record of those images in the master database server.

That's predominantly what would happen.

If there was a transaction to occur, some money to

exchange hands, there would be, prior to that save, after the

user previewed and decided to push through, it would hand off

to PPI to do a credit card transaction, for example. I

couldn't speak to that, but I know that we would get back a

success or a failure out of that which would then let

everything save the ad, save the images and such.

Q. And all that information then would be saved, most of the

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 67 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

68

ad data information would be on the database server and the

images on the image server; is that right?

A. That's correct. I wouldn't say most, I would say all.

Q. All, all of the ad data goes to -- and is saved on the

database server and then the image is moved to the image

server?

A. Correct.

Q. You mention that it -- if there was a payment involved, it

would go to PPI and then information would come back to the

server's controlled by DesertNet; is that right?

A. Correct.

Q. And there is information, though, that was stored with

respect to some of the payment, like the ad price or date and

timestamps or transactional approval data, would that all be

stored on the databases controlled by DesertNet?

A. That type of information really would be on PPI. There

would be some very basic rudimentary information, such as a

real generic invoice just for statistic purposes that would be

on the DesertNet managed Backpage database, but the accounting

information would be on the PPI.

Q. But some of the basic functions would be saved on the Web

site controlled by DesertNet? I'm sorry, on the servers

controlled by DesertNet?

A. Correct.

Q. Okay. How many servers would be needed to access the

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 68 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

69

universe of the information with respect to the ad data that

was contained on Backpage.com?

A. Just the information, just --

Q. Just the information?

A. A master database server or a database server. The

database is specifically on that server, the image server. All

of the content related to the ad, the ad title, headline, user

who posted it, are on those too.

Q. Two servers and you're able to access all the ad

information?

A. Yes.

Q. So let me ask you. If you had a forensic copy of the

master database server and a forensic copy of an image server,

setting aside convenience and know-how, would you be able to

access the information that was on the Web site before it was

seized?

A. I'm not familiar with the term forensic copy. Is it just a

copy?

Q. I'll represent to you that it's just a copy --

A. Okay.

Q. -- of the two servers.

A. Then, yes.

Q. You mentioned the -- I think you mentioned there were

multiple databases located on the database server, the master

database server; is that right?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 69 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

70

A. That's correct.

Q. Would you talk a little bit about what types of databases

were on that particular server?

A. Yes. Primarily two types, one that the majority of

databases, or what I would call a market database, there would

be a unique database for the UK, a unique database for

Australia, a unique database for Arizona, that type of thing.

So they would be geographically divided up into unique

databases. That's one type.

The other types, internally we refer to it as central.

That stores some different information. It's trying to -- it

stores a subset of the ad across all of those market databases.

So it's a mechanism for an advertiser or somebody to see ads

across all of them.

Q. So if you were accessing information saved in the central

database, let's say for a particular user, what would you be

able to access?

A. You would have pointers to ads they posted. You would have

some information about the user itself, like their e-mails,

some IPs, things like that, but the -- it -- it -- I'm using

the word pointers because the market databases are really where

you want to get the ad content from. It's just a convenience

that the central one is telling you where they all are.

Q. Markets database, I believe you just testified were split

off into maybe geographical locations. A Phoenix, for example,

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 70 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

71

may have had its separate market database?

A. It did.

Q. New York; Washington, D.C., other examples?

A. Both correct, yes.

Q. And if you looked in the central database, you could find a

subset of ads or you could find where a user had posted

different ads among the different geographical regions; is that

correct?

A. That's correct.

Q. And then you could go to the market databases for the

particular region and find all the information about the ads

posted?

A. Correct.

Q. Have you ever heard the term versioning?

A. Yes.

Q. What does versioning mean to you?

What does versioning mean to you?

A. To me, um, preserving earlier copies of -- let me give

you -- let's go to an example to me. If a writer is writing a

story and they create a headline and a story, they save it,

that version is saved. The next day they open it, they tweak

the headline a little, maybe change some ad copy, they save it.

There is now two versions. They can make some more

modifications and it's keeping that history of the versions

that they've made before.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 71 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

72

Q. Let's then focus on Backpage.com. Would versioning mean

different versions of an ad that was posted, what you just

described?

A. There weren't.

Q. Okay. When you say there weren't, what does that mean?

A. Backpage didn't use versioning. You'd have to take

effort -- it takes effort and steps to set up a versioning

system. It's not just something that natively happens with the

software they were using.

Q. Those efforts and steps were not taken for Backpage.com?

A. No.

Q. So if I am a user and I posted an ad on Monday and I

changed it the next day, what's saved on the Web site?

A. The version that you changed the next day. It's the latest

one. You might tweak that headline a dozen times to help sell

your bicycle, the last one saved is the one that's saved.

Q. Was that always the case throughout the lifespan of the Web

site?

A. Yes.

Q. So let's go back in time to 2015, would you be able to

search on the Web site and find different versions for the same

ad?

A. No.

Q. How about with images, is that the same situation for

images?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 72 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

73

A. Images are a little different. The images are stored

separately so they don't necessarily get overwritten. An image

could be removed by a user. They don't like the picture of

their bicycle any longer, they remove it. It would still have

an existence on the image server, it would be detached but

there would be a marker, a trace to it. They could add more

images, same thing. So the images do have a little bit of an

independent lifestyle. I wouldn't go as far as calling it

versioning, it's just that previous copies -- or different

images, really, you know, as you're uploading new images,

you're not really replacing. They're new images.

Q. All right. I want to focus your attention on the day that

the Web site was shut down. Do you remember that day?

A. I do.

Q. Where were you?

A. I was at home at the start.

Q. You receive a phone call?

A. I did.

Q. From?

A. From Ehud Gavron who is -- I think his title is president.

He runs Login data centers.

Q. And what did you learn from Mr. Gavron?

A. He let me know that the FBI was there with a warrant to

seize the Backpage servers.

Q. At some point did you make your way down to the data

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 73 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

74

center?

A. Yes. Yes. And I should get down there, which I did,

within a half hour, probably.

Q. Who did you meet with at the data center once you arrived?

A. I don't remember all of the agents that were there, but I

think there were about six of them.

Q. Generally, you met with some law enforcement agents?

A. I met with law enforcement agents, yes, and also the two

principal owners of Login data centers were there as well.

Q. Were you shown any documentation?

A. I was shown the warrant.

Q. Did you take a look at the warrant?

A. I did.

Q. Read through it?

A. I did.

Q. What happened next? And I can ask a more direct question.

Did you speak with anyone at Backpage during that

morning?

A. Yes, I did. I called them when I heard about the warrant

was there. I wanted to let -- inform them as well. I believe

I spoke to Carl Ferrer, but I'm not 100 percent sure it was

Carl. It was a while ago and it was a little nerve racking.

Q. What you did learn from the call, whether it was with

Mr. Ferrer or someone else?

A. It was a very short and simple call. Cooperate was really

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 74 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

75

the one word that I was told.

Q. Did you?

A. Yes.

Q. What or how did you cooperate?

A. Oh, went down there, read the warrant. The agents knew

that we hosted many newspapers and they were considerate of

that, and they wanted us to be there -- us being primarily

myself -- to be there to identify the servers, help them

remove -- point to what the servers were so that they could

remove them.

Q. There were other servers in that data center that didn't

belong to Backpage?

A. Correct.

Q. So you showed law enforcement where the Backpage servers

were?

A. We did.

Q. What did you do next?

A. We properly logged into them, shut them down so that they

would come to a resting state, a soft shutdown, essentially,

let them know it was ready to be removed.

Q. What does a soft shutdown mean, in your eyes?

A. It's mainly -- it's -- probably the easiest way of thinking

about it is the opposite of a hard shutdown is where you just

pull the power cable off of a server and it just stops. That

could be damaging.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 75 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

76

Q. How can that be damaging?

A. If there are rotational hard drives, they could be in the

middle of writing data, that loss of power could cause data

corruption, it could even damage the disks.

Q. Soft shutdown, on the other hand, does what?

A. Soft shutdown avoids that. It makes sure all the writes

are finished. It also -- there is other information that could

be in RAM, it's all dealing with the writes. It lets

everything come to a resting state and then you power it down.

Q. So soft shutdown helps prevent the possibility of damaging

the integrity of the data?

A. Exactly.

Q. What about the servers in Amsterdam? Did you do anything

with those servers that day?

A. Yes.

Q. What did you do?

A. It was later in the day. We were asked to shut those down

as well, and remotely logged in to them and did the same soft

shutdown on them.

Q. Any issues that you encountered with either the soft

shutdown in Tucson or Amsterdam?

A. Any issues?

Q. Any issues out of the ordinary or anything that would lead

you to believe that the integrity had been somehow damaged?

A. No.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 76 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

77

Q. So I want to talk a little bit about recreating the Web

site as it looked before the seizure.

A. Okay.

THE COURT: Counsel, before you start a new area,

let's take a short recess. It's 11 o'clock. Ten minutes.

MR. STONE: That's fine, Your Honor. Thank you.

THE WITNESS: Thank you.

(Recess taken, 11:00 a.m. - 11:11 a.m.)

CONTINUED DIRECT EXAMINATION

BY MR. STONE:

Q. I think we just we finished talking about the shutdown of

the servers both in Tucson and Amsterdam.

A. I believe so.

Q. Okay. All right. I want to talk about now what it might

take to recreate the Web site as it was constituted before the

seizure. That's where we were.

Already you've already testified that the information

that one would need is contained on one database server and one

image server, correct?

A. Correct.

Q. And you also talked about that there were a lot of Web

servers and some helper servers that help make the Web site

look the way it did before the seizure?

A. Correct.

Q. Now, if we were to give you a database server, an image

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 77 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

78

server, and a Web server, could we just plug them all in and

make the Web site run the way it did pre-seizure?

A. I wish it was that simple. No.

Q. Why not?

A. There is a lot that goes into the full site, domains is a

key thing, Phoenix.Backpage.com means something to those

servers. It knows to use the Phoenix database so it has to

respond to that URL. There are other nuances about the --

posting ads would be quite difficult with just those three

servers to actually distribute everything back through it.

Reading would be easier.

Q. Okay. I want to save what you -- the last part of what you

said, but originally you were one of the people, if not the

lead developer, tasked with getting Backpage.com off and

running; is that correct?

A. That's correct.

Q. And for you right now reconstituting the Web site as it was

before would be a difficult task; is that true?

A. It would be.

Q. Now, you mentioned -- I think you mentioned that something

would be easier at the end of your previous answer. Was that

-- did I hear that correctly?

A. You did, yes.

Q. What does that mean?

A. It's really the scope of your question of getting Backpage

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 78 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

79

functioning again is -- does that mean taking ads from users,

reading everything? Does it only mean displaying the ads and

some tools that were used, or does it mean simply just fetching

specific ads based on IDs? There is kind of a couple tiers

there.

Q. Why don't you go through the tiers as you just testified

to.

A. Yes. I'll start on the bottom. With just the database

server and an image server, all of the data for an ad is there.

So it is possible to query those databases, to pull up the

information you need for an ad and to also retrieve the images

that you need for that ad. What you get is all of the data in

a raw format, you know, no -- it wouldn't look like a Web page,

it would just be the text.

Q. And if someone was given a copy of the database server and

a copy of the image server, would they have the capabilities to

run these manual queries that you just talked about?

A. They could. I'll add a little bit more to that, that there

are other nuances about the file system that I think are

worthwhile of pointing out.

Q. Okay. Let's leave aside the other nuances, but we'll get

back to them.

But assuming that you had the know-how, would you be

able to access the data that was contained on the Web site?

A. Yes. Yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 79 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

80

Q. And as you move up the tiers, presumably, the top tier

would be reconstituting the entire Web site?

A. Yes, precisely.

Q. Is there any difference between this top tier of the Web

site and this bottom tier of manual queries in terms of

accessing and analyzing the information?

A. Conveniences.

Q. In term --

A. It's the same data.

Q. It's the same data?

A. The same.

Q. So setting aside convenience, is there any difference

between the bottom and the top?

A. It's the same data, so no.

Q. So if you got the Web site totally backed up and running,

had all the interconnectivity, IP addresses, the domain name

service, everything up and running, it might be more convenient

to look at the data, but there wouldn't be any additional data

than just what you could obtain from the manual queries?

A. Yeah, if we're defining data as the ad --

Q. Yes.

A. -- then --

Q. Ad data.

A. Then I agree with that statement.

Q. Okay. Now, let's talk about the nuances in terms of

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 80 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

81

accessing the manual queries. What are those?

A. Nuances are the person accessing it would need to be

skilled minimally with SQL, so that's structured query language

of how they would query the database to find things. They

would need to have a familiarity with the schemas themselves to

know where everything is.

The other nuance I was getting into was the file

system, you know, it -- your question sounded like there would

be copies of the database, and if that's the case, then the

file system is not relevant, but if it's actually the servers

themselves, then navigating and getting around the file system

of finding things has relevance.

Q. I think that's important to ask you a couple follow-ups.

If someone is given just a copy of the server, then you

testified that the file systems would be important?

A. Yeah. They would need to have -- the person would need to

have knowledge of how to find their way around the file system,

find where the databases are, be familiar with the operating

system and some partitioning that it used to find everything.

Q. Just so we have names, what is the file system that is

important in the data that we're talking about here?

A. The file system is known as Z, like in zebra, FS, Z file

system.

Q. So if someone just had a copy of the server, they would

need to be conversant in ZFS?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 81 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

82

A. They would need to be conversant in it. There is another

thing that they would need to be a little bit more conversant

in.

Q. What is the other thing?

A. The operating system is FreeBSD, you know, it's the word

free, and boy, Sam, dog, BSD. And it's a Unix-based operating

system similar to Linux, but it's not Linux. And that skill

set would need to be there and then one more. On FreeBSD. We

employed something called jails. They're essentially -- you

can think of them as virtual machines. They're kind of virtual

partitions. So that we could have a group of databases in one

jail, another group of database in another jail and be able to

move them from server to server if we needed to. It's a

convenience but necessary to understand.

Q. So if I'm understanding you correctly, someone who just has

a copy of the server would need to have knowledge about ZFS,

FreeBSD, and the jail system that you just talked about?

A. Yes, correct.

Q. And that's just to access the database?

A. That is just to get to the data.

Q. Once you have access to the database, what would you need

to -- what knowledge would you need to know?

A. That's a good question. Once you're there, then it's SQL

and understanding the schema.

Q. What if it was -- the initial part of getting to the

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 82 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

83

database was eliminated, meaning if all the databases were

copied and sent over to someone, would that eliminate some of

these steps that you've just discussed?

A. Yes, it would get rid of that whole first layer of

FreeBSD --

Q. I'm sorry. I interrupted.

A. -- FreeBSD, ZFS, jails, that would be eliminated. There

would just be the data.

Q. And you're talking about SQL, or S-Q-L, at that point?

A. Exactly.

Q. And that's a type of database?

A. It's one of the most common ways to query a database.

Q. So, again, if someone is given just the databases, if they

were proficient in working with SQL, they would be able to

access the information that was contained on the Web site

before it was seized?

A. Yes.

Q. And information, we're talking about the ad data.

All right. I think I interrupted you. You, I

believe, were talking about certain levels, one being the

manual query, the top one being creating the whole Web site

again. What are these two -- one or two that are hanging out

in the middle?

A. You kind of split that first one into two by getting rid of

that, the ZFS and getting rid of that hurdle, so that was one.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 83 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

84

We'll give that one one. Just the copy of the databases and

the images now, so get rid of all that Unix stuff, that becomes

an easier one. So that one should really be here.

The other two that I was alluding to before is one is

the site's fully working, it's taking ads again, it's doing

everything it did. The other one is more that I would call the

site in a read only mode, and that's specifically being able to

see the ads as they were before, in the same presentation as

they were before, and using similar tools as were used before

by administrators. The big difference is that there -- the

data is not changing, and that's easier than having the writes

working again.

Q. What would it take to put the site into a read only that

you just described? What actions would be needed?

A. There are challenges. There -- another name that their

system used is something called GYRO Base. It's just,

essentially, a programming language, application language that

helped marry the design of the site with the data, smoosh the

two together and give the user what they want. GYRO Base is

what fulfilled that. So getting GYRO Base up and running again

so that those same design templates can function as they did

before and query the database as it did before is that read

only layer, and it's some specialized skill.

Q. The only benefit to that method of viewing the data would

be that it looks prettier; is that right?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 84 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

85

A. I would say looks the same but looks prettier, yes. Yeah.

Q. The data doesn't change, how you are digesting the data

changes, in terms of the form?

A. That's absolutely correct, yes.

Q. Were you aware of any retention policy for the data on

Backpage.com?

A. I'm aware there was one. I don't know the specifics of it

though. I don't recall it.

Q. Don't know the specifics, but when you say there was one,

what is your understanding of what the policy did to the data

on the Web site?

A. All right.

MR. BIENERT: Objection, Your Honor. Calls for

hearsay.

THE WITNESS: Pardon?

THE COURT: The objection is overruled.

MR. STONE: You may answer.

THE COURT: As the question was phrased.

THE WITNESS: Can you repeat the question?

MR. STONE: I'll try.

BY MR. STONE:

Q. I believe you testified that you were aware of a retention

policy --

A. Yes.

Q. -- for the data?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 85 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

86

MR. BIENERT: Object on foundation, or at least ask

that he lay one before we get into the details.

THE COURT: Can you finish the question?

MR. STONE: Okay. That was one question. I was going

to go to the next one.

THE COURT: Okay. The objection is overruled for

whether or not he is aware of.

THE WITNESS: Okay.

BY MR. STONE:

Q. In your awareness of that policy, what did that mean for

the data that was on the Web site?

A. As ads would expire, with my bicycle ad, it eventually

expires and has little to no value, so it would -- it would be

removed after a certain period of time. And, you know, they

had policies of removing ads based on time that the ad was

expired. It keeps the database lean.

Q. So if a Web site continued to run, your understanding is

certain ads would be deleted?

A. That's -- expired ads, generally.

Q. Expired?

A. Yeah.

Q. Removed from the database?

A. Yes.

Q. What about a schematic of how the servers were set up in

the Tucson data center, were you aware if one existed?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 86 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

87

A. No, we didn't really have one like that. Each role -- we

had processes that could create each role of a server. It had

been around for quite some time and was evolving, so we didn't

have a drawing.

Q. Now, I want to ask just a few questions. And for these

questions I want you to assume that the databases have been

copied and given to a forensic examiner of the Web site, along

with a copy of an image server. Okay?

A. Okay.

Q. Would you be able to, once you had copies of the databases

and a copy of the image server, search the data for ads that

were posted on the Web site?

A. Yes.

Q. Would you be able to search the data to determine how many

ads were posted in each category?

A. Yes.

Q. Could you determine within those categories how many

non-adult ads were posted?

A. Yes.

You know, I'm going to pause you for a second. The --

you're not talking about over the lifetime of the entire

system?

Q. No. Good question and good clarification. I'm talking

about as the Web site existed the day it was seized.

A. The ads that were in the database, then my answers are

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 87 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

88

still all yes.

Q. So with a copy of the databases and a copy of the image

server, are you able to access all ad data that existed on the

Web site the day it was seized?

A. Yes.

MR. STONE: Just a moment, Your Honor.

No further questions, Your Honor.

THE COURT: Okay. Cross.

MR. BIENERT: Thank you, Your Honor.

CROSS-EXAMINATION

BY MR. BIENERT:

Q. Hi, Mr. Gerken. My name is Tom Bienert and I represent

James Larkin.

Let me just do a bit of an overview. The reality is

at the time that you showed up on, I think it was April 6,

2018, when you got called down to the location and the search

warrant was occurring --

A. I can't confirm that date, but it was in early April. It

might have been the 5th.

Q. Okay. On the day that you showed up --

A. Yeah.

Q. -- the system was working and functioning when you got

there, right?

A. Correct.

Q. And there are about 40 different components or servers. Is

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 88 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

89

that the right term?

A. Yes.

Q. And is it true that separate and apart from whether one

server would contain, for example, text data and another server

would contain image data and another server might have

administrative data, the configuration of how all this was put

together was integral to the operation of the Web site?

A. The site that was live, yes.

Q. Yes.

A. Yes.

Q. And there were a lot of features that one who worked at

Backpage, for example, could find or look for on the site by

using the system when it was operating and configured, correct?

A. Correct.

Q. Now, obviously, we'll get to a little more detail in a few

minutes, but on that day the servers were shut down and the

components were taken away by federal authorities, right?

A. Yes.

Q. And that was about a year-and-a-half ago, ish, a year ago

last April?

A. Correct.

Q. And you've had a lot of correspondence with people from the

government about questions and other issues related to those

servers and the way it all worked over the last year and five

months or so, right?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 89 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

90

A. Yes.

Q. Has the government ever taken you to the location where

they have the components?

A. No.

Q. And -- well, you answered it, but let me finish so we have

a good record.

Has the government ever taken you to any location

where they actually have the gizmos, the components, and asked

you to take a look at them?

A. Still no.

Q. Okay. And so, obviously, the government has never asked

you to come and hook it up for them, has it?

A. Correct, they have not.

Q. And I am assuming the government has never taken you

anywhere and asked you to look at some imaged or different

system that they set up that they indicated they think contain

the same capability as the original system, right?

A. Could -- could you ask that again?

Q. Right. I mean, if I'm following the government's

questioning, a lot of the questions were about what the system

that you had put together and were operating or hosting for

Backpage, what it was like and how it worked, right?

A. Correct.

Q. But then towards the end they asked you questions about,

well, what if we were going to set up a different system, not

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 90 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

91

that one, but just do something different to try to get the

same information? Do you remember the latter part of the

question?

A. Yeah.

Q. The government has never taken you anywhere and asked you

to look at another variant of the system with some of the

components but set up differently than you had it to see how it

operates, right?

A. A variant of the system, no.

Q. So as you sit here now, you have no idea whether the

government has or doesn't have any put together system that

allows it to take out any of the information that had been on

the system the day it was seized?

A. Do I know if they do?

Q. Right.

A. I can only assume.

Q. And why do you assume?

A. They have had the data for a year-and-a-half.

Q. You would think that by this time they would be able to

show you things that came from the system in working order,

right?

A. We're tell --

Q. I'll move on.

A. I just need some clarity sometimes on if you're talking

about the actual data or the Web site, because they are

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 91 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

92

different things.

Q. Okay. So just to be clear, I am not a techie, so I will

try to refer to what the overall operating system, or the IT

system, I'll refer to as the system.

A. Okay.

Q. And then I guess different components or things like data

or images or subcomponents, I'll try to be more precise with

them. Okay.

So right now I'm just talking about a working system.

So, to be clear, as you sit here now, the government has never

showed you or showed you anything that they claim came from a

currently operating version of the system under their control?

A. No.

Q. So on the particular day of the search -- and I'll

represent to you it was April 6th. That sounds about right,

time wise?

A. Yes.

Q. You got called. About how long do you think it was from

the time you got first called that they needed you to go down

to Login, to the facility, and when you think you would have

gotten there?

A. I would say it was within the hour, probably close to the

hour.

Q. So it was about an hour by the time you got there. And at

the time you got there, did it appear that the agents were

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 92 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

93

waiting for you and it had not yet started doing anything to

retrieve the items?

A. I can't say what they did before I met them, but they were

in a conference room when I met them.

Q. But once you got there and you looked at them, everything

was intact?

A. Right.

Q. It didn't look to you like any of the Backpage servers had

been removed or unplugged or the like, right?

A. Correct.

Q. So they were waiting for you, right?

A. Correct.

Q. And is it -- based on your discussions with them, did you

indicate that you were knowledgeable about the system and had

some understanding of how it was put together and worked?

A. I may have.

Q. You were knowledgeable about the system and how it was put

together, at least from a technical standpoint, right?

A. Correct.

Q. You were able to, if you had been asked, to help them

understand the connectivity aspects of the IT system, if they

had asked, right?

A. Yes.

Q. Did they ask you to explain any of the connectivity issues?

A. I don't recall that question.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 93 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

94

Q. You don't recall ever giving them that information, right?

A. On that day, no, I don't recall.

Q. Had they asked you, would you have given them the

information?

A. Yes.

Q. Because you were being cooperative, right?

A. Correct.

Q. Did anyone indicate to you, from the government when they

were doing the search, that it was important to them to try to

take apart the system in a way that they could put it back

together and get it operating with the same functionality that

it had when they got there?

A. No.

Q. From your experience, would it be possible to take the

Backpage system that was at Login hosted by DesertNet on that

day and shut it down and move it to a different location and do

it in a way so that when you got to the different location, you

could make it all work the same way?

A. Is the question is it possible?

Q. Yes.

A. Yes.

Q. And is it true that you had experienced not long before the

day of the search of moving a system, taking it down and

setting one up?

A. Yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 94 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

95

Q. Did it involve Backpage?

A. Oh, yes, it did.

Q. So not only did you know how to do it, but as of the date

of the search, you had done it before for the Backpage system,

right?

A. Correct.

Q. And you were able to get it back together and make it all

work properly, right?

A. Correct.

Q. If the goal of the agents was to disassemble the system in

a way that it could then be reassembled in functioning working

order like it was when they got there, what steps, from your

perspective, do you believe you would have wanted taken?

A. From my perspective, I'm a type of person that documents,

so I would have documented.

Q. I'm sorry. Say that again.

A. I'm the type of person that documents things, so I would

have documented what each server's role was and how it was

connected.

Q. How it was what?

A. How it was connected.

Q. Connected to the other components?

A. Uh-huh.

Q. And other than documenting things, what, if anything else,

would you have recommended or could you have done to make it

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 95 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

96

likely it could be reconnected?

A. When I said -- it's a pretty broad question there. If we

were to do it ourselves, if we were asked to do it, we would

have worked with setting it up in another facility and kind of

leapfrogged it across, so to speak, brought over certain

pieces, got it functioning, brought over the rest.

Q. So it would have been a step-by-step process?

A. It would have been a step-by-step process is the short

answer.

Q. And is it true on the day of the search it would have been

possible to take the system off line so it was no longer

visible to the public as a Web site but the system was still

intact and it could still be used, for example, by Backpage or

federal authorities, or you?

A. Yeah, possible, yes.

Q. But you weren't asked to do that, right?

A. I was not.

Q. Now let's talk a little bit about the Login facility where

the servers were. Was it a secured facility?

A. Depends on your definition of security, but I consider it

secured.

Q. Well, was it a locked building?

A. Yes.

Q. Was it a building that people from the public like me or

others who didn't have authority to be there couldn't just walk

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 96 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

97

into?

A. To the actual data center?

Q. Right.

A. No.

Q. Was the area where the servers and other components were

contained, did that room or area also have the ability to be

locked?

A. Yes.

Q. Could the servers themselves be locked in place where they

were?

A. Yes.

Q. Is it true that the room and the facility at Login had

video cameras to monitor what was going on in the room?

A. They do have security cameras. I couldn't answer beyond

that.

Q. But there are cameras there?

A. There are cameras there, yeah.

Q. From your perspective, would it have been at least feasible

to take the Backpage system off line, secure it, lock it up in

the place where it was and work on it and use it in a read only

capacity for some period of time as of April 6th going forward?

A. The question is: Is it feasible?

Q. Yeah.

A. Yes.

Q. Did anybody from the government at the time of the search

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 97 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

98

ever ask you about how feasible or difficult or easy that would

be?

A. No.

Q. Now, you were asked questions by government counsel about

the types of searches or things that you potentially could do

if someone with the right experience and information could

reconnect the components of a data server, an image server, and

I forget if there was something else necessary?

A. We mentioned a Web server as well, but we could stick with

yours, yeah.

Q. And you talked about some of those things. But let me just

talk a little bit about what the system could do and ask you

how difficult or hard it would be to start anew and make a new

system do those same things.

A. Okay.

Q. You already went over the fact that with the right

equipment, the right expertise, and the right components, data

server, image server, one could pull up images of an ad that

was on the server as of that date, right?

A. Correct.

Q. To the degree that one wanted to do searches for what would

be, I guess, sometimes referred to as administrative data,

about the ad, the user, similarities or patterns, things like

that, would one be able to readily obtain that type of

information simply by having the data server and the image

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 98 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

99

server?

A. You said a lot in that question, but all of the data is in

the database, so, ultimately, yes.

Q. Would there be a need for other equipment and/or components

to help do searching features to allow the different components

to work together to do searches, for example?

A. Can you rephrase it?

Q. Right. I mean, is it as simple as someone turns on the

data computer and the image computer and they're plugged in

together and someone can just immediately, without any other

components, software or hardware, do all these different type

of searches I mentioned, or might you need other components and

software?

A. Well, if you have a specific -- I'm not referring to you --

but if you have a specific question, like you need to fetch

this specific ad, then you have all of the pieces to get you

that ad. I'm not sure if I answered your question though.

Q. Well, I think you did generally. I'm going to try to make

it a little more specific.

MR. BIENERT: Your Honor, I have a couple of exhibits

and I -- since we haven't done it before, is your preference

that I just give the official one and one for the Court to the

clerk and then the other parties?

THE COURT: Yes.

MR. BIENERT: Is that how you want me to do it?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 99 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

100

I'm going to hand madam clerk the Defense Exhibit 103.

And I've got two copies there, one for the clerk and one for

Your Honor.

Do we want a third copy for the witness or is the

official one for the witness?

THE COURT: Well, if you have another copy, then she

can mark it while the witness is --

Oh, she's already marked it. The tag is already on it

so she can just give it to the witness.

BY MR. BIENERT:

Q. Okay. When it gets placed in front of you, sir, I'm going

to ask you to take a look at Exhibit 103.

A. Okay.

Q. Just look at each page and then I'm going to ask you some

questions about it.

A. Okay.

Q. Do you recognize what this document is, not necessarily the

particular document, what type of document it is?

A. Yes, I do, not the particular.

Q. What do you recognize it to be?

A. I recognize the first half to be an ad, an advertisement in

an administrative mode, so an administrator is looking at the

ad. The second half I recognize as a page in an interface

called the object editor.

Q. And just so I'm clear --

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 100 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

101

THE COURT: I'm sorry, what was it called?

THE WITNESS: The object editor.

THE COURT: Okay. Thank you.

BY MR. BIENERT:

Q. And, just for the record, am I accurate, sir, that the

first part you're referring to as an ad is the first three

pages of Exhibit 103?

A. That is correct.

Q. And the, quote, object editor is the last two pages which

has sort of a blue background and field?

A. That is correct.

Q. Is this information that one could retrieve from the

Backpage system when it was operational and hosted by

DesertNet, this type of information?

A. Yes.

Q. And if we can focus first on the first three pages, which

is what you were calling an ad, if we turn to the second page,

and if you can just tell me, first of all, do you recognize

what the information in the yellow box in the middle where it

says administrative data, do you recognize that format and what

that is relative to these documents?

A. Yes.

Q. What would that be?

A. Data that is not shown to the public.

Q. I'm sorry?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 101 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

102

A. Sorry. Data that is not shown to the public. It's

information associated with this ad but not shown to the

public.

Q. Okay. So in order to retrieve this type of information, it

has to be a search that is able to yield things that are more

than just the publically available photo or text content on the

Web site, right?

A. That the search has to request for information to display

this, yes.

Q. Right. And this is something that you configured as part

of the capabilities of the Backpage system to be able to do

this type of search feature, right?

A. Correct.

Q. And this is something that, at least as you understood it,

folks that worked at Backpage, at least in certain departments,

would regularly do from their own workspace to access this type

of information, right?

A. I can say the information existed, you know, you could get

to it. I don't know how they used it, yeah.

Q. So you know the technical side, but you don't know the day

in, day out, how it's really done at Backpage side at the

business, right?

Okay. So if we look at the administrative data box,

and if we just look at some of the entries there, it indicates

that this -- about three or four lines down you see it says,

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 102 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

103

paid ad and it says yes?

A. Yes.

Q. And is it accurate, obviously, that this is information one

could get by doing a search on the system when it was operating

to find out if an ad was paid and how much it cost?

A. Correct.

Q. And then if you look right below that, it says, view all

ads by this user on this site.

Do you see that?

A. Yes.

Q. What does that template do or access if one were to hit it

when it was operating?

A. When it was operating, if you would click on that, it would

essentially do a search for this particular user on this

particular site, which appears to be Portland.

Q. Okay. So let's break that down. First of all, when you

say this site appears to be Portland, you made a reference

before to there is the master servers, and I forget what you

called them, you said there were other servers that relate to

different locations?

A. It's -- actually, I was referring to market databases, I

think, what you might be referring to.

Q. Yes.

A. So, in this case, this market database, I'm going by

memory, it's probably Maine and Portland would be -- had been

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 103 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

104

in there.

Q. So within a bigger database there are sub databases within

the servers that are different regions of the country or areas

of the country where Backpage ads are posted?

A. Yeah. I wouldn't use the term sub database, but, yes,

there are separate.

Q. Okay. So when it says, this template, view all ads by the

user on this site would allow you to see other ads by this

person, so the system had the ability to go back and look for

other things relative to this same exact user, right?

A. Yes.

Q. And I see, on this one at least, there is a number three

next to that. Do you know what that means?

A. Its intention is that there are three other ads by that

user in this site.

Q. And is it your understanding that one -- by hitting that

template, one could see the three other ads?

A. Yes.

Q. And see similar information that we're seeing here about

those three ads, right?

A. Correct, if they then viewed those three ads.

Q. In other words, the system had the -- I'm sorry?

A. This would probably be one of the three so.

Q. Right. Okay.

And then if we go down, there is a template about four

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 104 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

105

or five lines below that, it says, report this ad to the NCMEC,

N-C-M-E-C.

Do you see that?

A. I do.

Q. Do you know what that references?

A. Yes. It was a -- I believe it pulled up a form that let

them report this particular ad to the NCMEC.

Q. What did you understand that entity to be?

A. Oh, the -- I don't recall what the acronym is, but it's the

National Center, I think, for Missing and Exploited Children.

Q. So it was a template to see if someone had reported this ad

as, potentially, involving an underage person?

A. Yes.

Q. And then if we go down to the bottom, there is information

about invoices, the bottom of that administrative data box,

right?

A. Yes.

Q. And I note that there are two different references, one for

$7 on the 29th and one for $7 on the 28th of 2014.

Do you see that?

A. Yes, I do.

Q. And so is it accurate that the system, when it was

functioning, when you had it hosted, would allow one to see

data involving payment history for more than one payment and

over more than one static time frame, in other words, over

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 105 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

106

time?

A. Yes. You know, I did want to clarify, as I did when I was

asked the question before, it wasn't an accounting system, but

it did have some basic invoicing.

Q. And was it your understanding that somehow the system could

configure to other servers which you weren't hosting here in

Arizona that could involve, I think it was PPI or other types

of payment information?

A. I didn't quite follow the question in there. Sorry.

Q. Was I accurate that when you were explaining earlier when

government counsel was questioning you, you said that there was

also contained somewhere in Backpage's server systems

information about payment, PPI or different types of payments

for ads?

A. Yes. I mean, we didn't administer those servers so I can't

really tell you what it had, but there is that other system,

yes.

Q. But was it your understanding that the way the system was

configured at least, wherever that server was, it would allow

someone working at Backpage to access, not just ad, photo, and

text information, but payment information?

A. That's my understanding.

Q. All right. And if we look at the right-hand side of this

box, it gives a name, this one says DGGFF, and a phone number

and an e-mail.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 106 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

107

Do you see that?

A. Yes, I do.

Q. Was the system searchable by all of those items? You could

search the name, the phone number, and the e-mail as well?

A. Technically, this is a search that you're seeing. It's a

query that's displaying those, so the answer is yes.

Q. Well, I guess the question I have is if we're looking at

one ad, was it your understanding that the system, when it

operated, if someone wanted to see if the same person with the

same designated name had other information in the system from

ads at different times, could they search that as well?

A. Yes.

Q. Now, if we go to the bottom, the bottom half of the page

where it says deleted images, administrators only, right above

two photographs, do you see that?

A. Yes, I do.

Q. What is your understanding of what that is?

A. My understanding is that there are two images that were

once associated with this ad and were removed for whatever

reasons identified here.

Q. Okay. And if we look above the ad on the left, which

appears to be -- it's the photo of the lady from behind, right

above it, it says, deleted by system.

Do you see that?

A. Uh-huh.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 107 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

108

Q. What does that mean?

A. I would actually need to look at the code again to answer

it completely accurately, but what it seems like to me is some

type of an automated deletion.

Q. Was it your understanding that there were filters and

things on the system that would automatically delete certain

types of material from ads?

A. Was it my understanding that?

Q. The IT system had filters or other types of automated

mechanisms to delete certain types of things from ads?

A. Yes.

Q. And then if we look to the next picture to the right of

that, which is the photograph looking at the lady from the

front, it says, deleted by BP 48.

Do you see that?

A. I do.

Q. What did you understand that to mean?

A. I understood it to mean a user account, a staff user

account.

Q. So BP 48, that designation would be some employee of

Backpage?

A. Yes. I answered that with slight hesitancy because I don't

know for sure it would be a singular person.

Q. Okay. So at least this ad, exhibit -- or this

administrative data in Exhibit 103 does have a memorization of

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 108 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

109

images that were deleted from the ad?

A. That's correct.

Q. And that's something that the system, when operating, could

do, right?

A. That's correct.

Q. So if there were ever a question, if anyone was raising

concerns about whether Backpage was or wasn't callously or

recklessly posting a picture that was inappropriate because it

may have involved someone who was under age or doing something

illegal, the system had the ability to do searches about

particular people, I should say users, ads and the like, to

basically investigate different data points to get an

understanding of what happened?

A. Did the -- was the system capable of doing that is the

essence of your question?

Q. Yeah.

A. Yes.

Q. And, in fact, that was a feature that you put in -- well,

strike that.

That was a feature that you understood was used on a

daily basis at Backpage, right?

A. I believe it was.

Q. Now, when we go to the last two pages of Exhibit 103, which

is the object editor, if I'm saying it right?

A. Correct. You're saying it correct.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 109 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

110

Q. And you if could just explain to us, in essence, what this

is and how the information on here is different, if at all,

from the photos, to the degree that -- well, that's a bad

question. Just explain to us, if you can, what the object

editor information is in general.

A. Yeah. The object editor, essentially, is -- these are

queries into the database that are pulling up the field and

values that are already in the database. It's an

administrative interface so that an administrator can see the

values in a clean way, and in some cases, you know, review

them. That's pretty much it.

Q. Is it accurate that it is a fairly challenging, I think is

the word you used earlier, enterprise to get a system like

Backpage's up and running so that one could, among other

things, be able to do the types of searches for the types of

administrative data that we are looking at in this exhibit?

A. Is the question did I say it was challenging, yes.

Q. And it's something that requires expertise, right?

A. Yes.

Q. And not just general expertise in the field, but actual

knowledge and understanding of a lot of particular information

of that business or that system, in other words, their domain

names, what they're doing, what they're trying to achieve, how

they want to configure, that sort of stuff, right?

A. Correct.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 110 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

111

Q. And as government counsel said, no one knew that

information, at least on the technical side, better than you,

because you put it together, right?

A. For -- well, these are ultimately queries, you know, these

are ultimately questions and searches. They're pre-prepared

searches. And I do have some knowledge of the requests of what

these pre-prepared searches were.

Q. Now, so on the day of the search itself, no one from the

government asked you to help them take down the system in a way

that would ensure or make more likely that the system could be

put back together in the same functionality it had before,

right?

MR. STONE: Objection. Asked and answered.

MR. BIENERT: I'm segueing. I'll move on.

THE COURT: Your objection is overruled.

BY MR. BIENERT:

Q. But let's talk about since that time. Is it true that in

the four or five months after the search and the items were

taken, you received a lot of inquiries from government

investigators, FBI or IRS agents who were in the techie side,

trying to understand the system they had seized from Backpage?

A. The data, yes.

Q. And is it fair to say there are dozens, if not hundreds, of

pages of exchanges between you and them when you're trying to

answer their questions?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 111 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

112

A. I can't tell you a page count. I don't know that, but,

yes, there were multiple questions.

Q. And these exchanges -- here's what I'm going to do.

MR. BIENERT: Your Honor, may I approach?

THE COURT: Yes.

MR. BIENERT: I'm not offering to admit, but this is

the Jencks materials that were sent to us, I think, two days

ago.

MR. STONE: They were sent a week ago, but, yes, they

would be the Jencks material.

MR. BIENERT: They were sent by mail on Friday night,

Your Honor. We got them just recently.

BY MR. BIENERT:

Q. I'm going to direct you to a couple of e-mails.

So to make it a little easier for you, I'll just

represent those are various things, many of which involve you,

some don't, but at the bottom facing you there should be some

little tabs.

A. There are.

Q. So I'm going to direct your attention to a -- should have a

blue tab on it at the bottom -- and I'm going to direct your

attention to a May 9 dated document. This is just to refresh

your memory. I'm going to ask you questions from it, and if

you can do it without looking, fine.

MR. STONE: Counsel, could you give a Bates number,

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 112 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

113

please?

MR. BIENERT: It's Bates 00457.

MR. STONE: Thank you.

MR. BIENERT: And it's May 9th.

THE WITNESS: Okay. I have that page.

BY MR. BIENERT:

Q. So is it true, sir, that as of May 9th of this year, so a

year and a month after the items were taken, you started

hearing from and getting correspondence from an IRS special

agent named Richard Robinson asking you to clarify various

things about how the Backpage server system works?

A. Yes.

Q. And is it true that on or around May 9th, you basically got

an e-mail from Mr. Robinson, or Agent Robinson, that basically

said, hey, you and I met last year at Login data center, and

he's reminding you of when you all met at the search. And then

he goes on to say, hey, I have a bunch of questions about the

Backpage server.

MR. STONE: Your Honor, are we refreshing recollection

here, are we impeaching? I'm not sure what the purpose of the

document --

MR. BIENERT: I'm asking him if that's what happened,

if he remembers or not.

THE COURT: The objection is overruled.

You can answer the question.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 113 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

114

THE WITNESS: Yes.

BY MR. BIENERT:

Q. And did he then, as of May 9th, start asking you a bunch of

questions about the server, starting then and lasting until the

end of May?

A. I can't confirm the dates, but, yes, we did have

conversations.

Q. If we go to the next tab, which would be green, and I'll

just --

MR. BIENERT: Government, it's Bates 000403.

BY MR. BIENERT:

Q. Is it true, sir, that Agent Robinson, on May 14th of this

year, e-mailed you back after another exchange, and indicated

that he appreciated you trying to answer things, even if it was

just from memory, because your memory was far more reliable on

these high-level concepts than the guesses that he and other

lay people had on how this system worked?

A. Is it true that I was asked that question?

Q. That he said that to you in an e-mail.

A. It's written here, yes.

Q. Is the reality, sir, that what you realized in May of this

year when you were getting these e-mail exchanges from Agent

Robinson, is he didn't understand how the Backpage server

system worked?

A. Did I have that conclusion?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 114 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

115

Q. Yeah.

A. I don't think I had that conclusion. I had the conclusion

that he had questions.

Q. Did you appreciate at the time that it was clear that he

didn't have the system up and running?

MR. STONE: Objection. Calls for speculation.

THE WITNESS: Yeah, it doesn't feel --

THE COURT: The objection is overruled.

THE WITNESS: I'm sorry. Did you say overruled? I'm

sorry.

THE COURT: Yes. So you can answer it if you

understood.

THE WITNESS: Yeah, I didn't understand what they

actually had, I really didn't.

BY MR. BIENERT:

Q. Well, you certainly had no understanding as of May 9th of

this year that they had a system that was operating and could

deliver the information that the Backpage server used to be

able to provide when it was operating in your facility, right?

A. I hadn't been told that they had that.

Q. I'm sorry?

A. I hadn't been told that they had such a system.

Q. And is it true that in the May -- in around May 14th he

asked you questions about central backup servers and how things

worked, and basically once you explained it to him, he

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 115 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

116

indicated that you had cleared up a key misconception that he

had about how the system operated?

A. It does say that here, so I'm just going to say yes.

Q. Well, does that sound right, the gist of what I'm saying?

In other words, as you sit here now, June, July, August,

September, it was four months ago, is it an accurate -- strike

that.

Do you have a recollection that as of four months ago

in May you were getting a series of e-mails from Agent Robinson

basically saying, I have a lot of concerns and confusion about

how the system works and you were trying to help him?

A. Yeah, I would express it differently, that I had questions

about the system, yeah.

Q. And if we go to the yellow tab.

MR. BIENERT: Government counsel, May 21, Bates

000401.

BY MR. BIENERT:

Q. Is it true that as late as May 21, 2019, among the

questions that Agent Robinson was trying to understand and have

you explain to him were how many of each type of server they

even had seized from the Tucson center and the Amsterdam

center?

A. Yes, I believe that was questions. Yes.

Q. And is it fair to say that what you were telling him during

all of these exchanges was to the effect of, I'll tell you the

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 116 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

117

best I can, but given that it's been so long, I don't really

have good recall of a lot of this?

A. That's true.

Q. Now, there is no doubt, sir, that on April 6th of 2018 when

they waited for you for an hour to start taking down the

servers, you could have told them then how things were

configured and answered any questions about how this stuff

needed to be understood and put together to function, right?

A. Correct.

Q. But by being asked the questions 13 months later, you're

not sure about a lot of it, are you?

A. Yeah. I have to take some assumptions, yes.

Q. Is it true, sir, if you go to the red tab, Exhibit 000380,

or Bates 380, sorry, that on May 29, 2019, you had a final

correspondence with Agent Robinson where he had asked you to

actually look at his description and roles of Backpage Web site

servers to use in the declaration to file in court, and he was

having you look at copies of it to tell him if what he had was

right?

A. Yes. I think it was more that he was asking me to correct

if it was wrong.

Q. And you went through several drafts with him of the

document, right?

A. I don't remember several. I think maybe one.

Q. Okay. At least one then?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 117 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

118

A. I think. You know what, I'm not 100 percent sure, but,

yeah.

Q. Okay. And if you go to the draft that he had you review,

is it true that as part of the draft he had you review, part of

the language that he had you look at -- and this is on the --

A. The second right there.

Q. -- the fourth page in. It ends in 383 at the bottom right.

There is a paragraph, third paragraph down where he asks you to

review language that said, because links and references to

files and data within the servers were referenced based on the

way that the servers were networked when the Web site was

operational, restoring the Web site to a functional state would

not necessarily be as simple as connecting any three servers of

the appropriate types.

Do you see that?

A. Yes.

Q. Now, he ran that language by you, correct?

A. Yes.

Q. And you agreed that that was accurate, right?

A. Yes.

Q. So, just to be clear, when counsel basically says, so if

you got the boxes, if you got the data box and the image box,

you could basically get what you need, it's a lot more

complicated than that, isn't it?

A. It -- it's complicated, certainly. The distinction is

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 118 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

119

definitely Web site versus data. It's an important

distinction.

Q. Is it true that Agent Robinson asked you to confirm, and

you did, additional language that said, even though any one of

the database servers and image servers contain data for all

Backpage.com ads at the time the site was taken down,

simulating the function of the Web site would require extensive

time and expertise, if possible at all?

A. Is the question do I agree with that statement?

Q. Yeah.

A. Yes.

Q. I mean, you told them back in May that you agreed with that

statement, right?

A. Yeah.

Q. And you still agree with it now, right?

A. I do. We're talking about the site not the data, but yes.

Q. Well, we're talking about the function of the system even

in a read only capacity, right?

A. The write is what gives me the most amount of hesitance,

writing the data. Reading is less than impossible, it's a

lower level, but, yes, the essence is it's complex.

Q. Now, as you sit here right now, you have no knowledge at

all as to whether all of these things that I just went over

with you that the system could do back when it was functioning,

including the things in Exhibit 103, you have no knowledge

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 119 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

120

right now as to whether the government has any capability to

replicate those things, do you?

A. I don't -- I don't know. Yeah.

MR. BIENERT: And I'm just conscious of time. I've

got a little more, Your Honor. I'm going to keep going. I

just didn't know if you wanted a breaking time or have one?

THE COURT: I was going to break at 12:15.

MR. BIENERT: Perfect.

THE COURT: Okay.

BY MR. BIENERT:

Q. There has been a lot of talk about how difficult or not

difficult, or challenging or not challenging it would be. You

have been talking to the government or for a while, you've been

dealing with this issue in the last several weeks, what do you

believe would be the time and cost involved in going to

wherever they keep the gizmos that were the system, the

Backpage system, and getting it all up and running the way it

did as of April 6, 2018?

A. Everything running? I mean, everything?

Q. Not so it could be public, everything running so it was in

the condition it was when they took it and would have all the

features it had then, but not a feature that allows people to

post new ads. We're not trying to make a live Web site, I'm

just talking about -- so do you remember there was a question

asked of you whether -- well, strike that.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 120 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

121

The question would be what do you think would be the

time and money for all of us in this room that are relevant to

this case to have the ability to go on the Web site and search

for things that we think are relevant to this case of the

nature that we went over with you?

A. Being -- trying to be very specific, as I am, I would want

to get clarity of the scope, and I just want to give you some

clarity. Having this page working is clarity of scope. Having

this page working and all of these elements is clarity of

scope. So if that's the question, I could be able to get you

an estimate on that. If it's open ended, it's harder to be

able to --

Q. Well, let me take those two and add just a couple more.

A. Okay.

Q. What if someone wanted to check and run a search or

configure things to see how many referrals to NCMEC, the child

abuse entity, did Backpage make in a certain time frame? So

that was something that was capable when the system was

running, right?

A. I don't remember that specific query. I do remember ads

being flagged with NCMEC, but not that specific data query. I

just don't remember that one.

Q. Okay. Well, one way or the other, would one, when it was

operating, be able to take a time frame and either run a report

or do a survey to find the number of referrals to NCMEC based

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 121 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

122

on the data?

A. If it previously did that, it could do it again. If that

answers your question.

Q. Okay. Similarly, what about a system that would be able to

show what moderation terms were in play and on how many ads was

moderation utilized? That was a feature that could be done --

A. Yeah.

Q. -- back when it was running, right?

A. The first part, yes. The second one of how many ads were

moderated, period, I believe there were counts for those too.

Q. Okay. So just to kind of, I guess for ease of where we are

now -- and I'm certainly not saying this is exhaustive -- but

if we just take those four components, the ability to do the

two things that I've gone over with you and you highlighted,

and those two other features that I just mentioned, how much

time and how much money would you estimate it would take,

assuming that the government gave you access to the components?

A. In my head, I'm just walking through how we'd have it --

you're saying access to the actual servers by the components?

Q. There is an assumption there, but, yes, sir.

A. You know, I -- I wouldn't want to estimate anything other

than a few months of time, you know. For simple questions, I

could estimate something in days or hours, but you're asking --

a lot of the items that you're asking for are reports, full

functionality of the object editor I heard in there, the pages

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 122 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

123

that these go to when you click on, it's pretty much getting

the site up to a read only level.

Q. Right. And that's really what I'm looking for, a read only

level.

A. Yeah. You know, and I -- I wouldn't want to estimate less

than a couple of months and at least a couple of people during

that time.

Q. And how much money, both in terms of time and components,

do you believe that project ballpark would be?

A. I would say somewhere between 30 and $50,000.

Q. Okay. Is this a good --

A. That's a really -- that's -- that scope was really loose.

I would want to -- you know, if you had a full scope written

out.

Q. I guess the challenge would be to come up with what was the

system capable of when it was operating if it were then just

placed off line but in a read only, and that's the thing we

would be seeking to be able to accomplish?

A. Right.

Q. And would you be somebody who, assuming you could find your

notes and look at things to kind of remind yourself of what you

had designed and functioning back in April of last year, is

that something that you would have information that you think

you could sketch out as to what all those things were to help

us arrive at what the scope was?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 123 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

124

A. Yeah, I think I'm probably the most appropriate for that.

MR. BIENERT: I see it's 12:15, Your Honor. Is this a

good breaking point? I thought you said you wanted to break at

12 --

THE COURT: I did. Mr. Stone looks like he's --

MR. STONE: I would just say, if he's done, I only

have about five minutes, we can be done with the witness.

MR. NEUMAN: I have some questions.

THE COURT: Okay. We're going to recess for lunch, so

you're going to have to come back. Sorry.

So we'll break for an hour and we'll get started at

about 1:20. Thank you.

(Lunch recess, 12:15 p.m. - 1:21 p.m.)

THE COURT: We're back on the record with counsel and

the parties present.

MR. BIENERT: The one thing I was going to do, I would

move at this time into evidence Exhibit 103.

MR. STONE: No objection.

THE COURT: Okay. 103 will be admitted.

MR. BIENERT: Thank you.

MR. NEUMAN: May I proceed, Your Honor?

THE COURT: Yes.

MR. NEUMAN: Thank you.

CROSS-EXAMINATION

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 124 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

125

BY MR. NEUMAN:

Q. Good afternoon, Mr. Gerken.

A. Good afternoon.

Q. I want to focus on a different area, but before I get to

it, you were asked by the prosecutor about the document

retention or data retention policies, you said you were aware

that there is some policy but you didn't know the details of

it, right?

A. That's correct.

Q. Are you also aware -- so you don't know, for instance,

excuse me, you don't know how long data was kept on the

Backpage servers, correct?

A. No.

Q. And are you aware that during the course of Backpage's

existence in the years leading up to this seizure in April of

2018, that there was -- Backpage was involved in significant

amounts of litigation?

A. Yes, I believe so.

Q. And are you aware that, as to all of that litigation, or

most of it, litigation holds were put in place, such that data

was retained for much longer than what might be otherwise a

data retention policy?

A. Yes.

Q. Okay. And do you know how long that data was retained or

do you not know that either?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 125 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

126

A. No, I wouldn't know the specifics.

Q. But you're generally aware?

A. Yeah.

Q. Thank you. So what I'd like to focus on is what we've been

talking about this read only version, versus the two server

version, I'll call it. Okay?

A. Okay. That works.

Q. Because that's really what this hearing, in some ways, is

about.

A. Okay.

Q. And just starting with the read only version, you said you

testified that now it would take you potentially a couple of

months and some tens of thousands of dollars to create a read

only version at this point, right?

A. Correct, a similar system.

Q. A similar system.

Now, first of all, that is assuming that all of the

data was imaged correctly, right?

A. True.

Q. So if some of the images that the government has or has

provided to the defense are not imaged correctly, makes it even

harder, right?

A. Yes.

Q. Same thing when we're talking about these two server

versions, right, if some of that data -- and we'll get into

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 126 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

127

specifics -- was not imaged correctly, what we were talking

about, accessibility to data and such, sort of goes out the

window, right?

A. Yes.

Q. Okay. Now, on the day of the search the government had

told the judge that they were going to seek contextual

information necessary to understand the evidence. It sounds

like you were not asked for any contextual information such as

IP addresses of the various servers and the like, right?

A. Um, I don't recall being asked that, no.

Q. Okay. And you were not asked about the interrelationship

of the various system components, correct?

A. At the time of the seizure, no, I don't recall that.

Q. Okay. And at the time of the seizure, it sounds like you

had that information readily in hand, correct?

A. True, yes.

Q. Could have provided it upon request, essentially?

A. Yes.

Q. Now, assuming that the data is all intact, it would take

you several months to create a read only version. If you had

been asked on April 6, 2018, to create a read only version,

before anything was taken apart, how long would it have taken

you, approximately?

A. Before anything was taken apart?

Q. Before -- when they walked in the door, disconnected it

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 127 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

128

from the internet, right, because we don't want the public

accessing it, posting to it, we don't want it changing, right,

but it's -- everything -- the servers are still in, nobody from

the government has touched it, how long would it take you --

have taken you at that point to create a read only version,

approximately?

A. The main thing that wouldn't function would be domains, so

a day or two.

Q. A day or two?

A. Yeah.

Q. And if you were asked to create two versions at that point,

one for the prosecution and one for the defense, essentially,

double that time, maybe four days?

A. Two versions, like split it off into two?

Q. Two read only copies.

A. Two read only copies. Um, I probably feel more comfortable

saying a couple weeks in that case.

Q. Okay. Couple meaning about two weeks?

A. Yes.

Q. Okay. And what would the cost have been at that point

having in hand all of the interrelationship data and IP

addresses and stuff, significantly less than your estimate now?

A. Yes.

Q. Would have been a pretty different story, essentially,

right?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 128 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

129

A. It would have been.

Q. Okay. And, again, at that point there wouldn't have been

any question about the integrity of the data, meaning whether

these images contained all the data accurately, because it

would have still been housed at DesertNet at that point, right?

A. Correct. Your --

Q. I'm sorry.

A. Your scenario is assuming nothing was shut down, correct,

just disconnected from the internet?

Q. Disconnected from the internet so that the public no longer

has access. You go to Backpage.com and you get some sort of

error, right?

A. Yes.

Q. That's easy to do, right? Maybe -- in fact, it might be

worth just explaining -- I keep hitting these -- that it would

be relatively easy to disconnect the Web site from the internet

such that the public could no longer access it but still

maintain the various functionality as we've talked about on the

back end, right?

A. Yes, that's correct.

Q. That's very, very easy?

A. Very easy.

Q. That's, in fact, how you build a Web site, you build it up

without it being connected to the internet, and the very last

thing you do is hit the switch so the public can access it?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 129 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

130

A. Could be. In my case probably not, but, yes. Yeah.

Q. Okay. I'm no expert.

A. It works. Your definition works.

Q. All right. Fair enough.

Now, we talked a little bit about the difference --

the difference between the read only version and the two server

version when we were looking at Exhibit 103, which was this ad

and the back end -- what I'll call the back end, or

administrative data, I think you called it the object editor?

A. Yes.

Q. Okay. That would all be accessible in this same format in

a read only version, right?

A. In the scenario you painted, yes.

Q. I'm asking even if -- even if today you were able to

recreate a read only version --

A. Yes.

Q. -- you would have access to that?

A. Yes.

Q. Okay. And in the two server version, this format, at

least, is not available, correct?

A. The data is available?

Q. This format.

A. Correct.

Q. All right. Because I want to talk about format, because

while the government has asked you about putting aside

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 130 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

131

convenience, I want to focus on convenience for a little bit,

actually. Okay?

A. Okay.

Q. So this, as we said, this object editor would be available

in a read only version. This object editor doesn't take any

expertise to read, does it, in your opinion?

A. Expertise to read, I'm not sure I --

Q. If I look at this object editor, I don't need to know MySQL

language, do I?

A. Correct.

Q. I don't need to be familiar with the jail system, right?

A. Correct.

Q. I don't need to know ZFS, right?

A. Correct.

Q. I can probably do it as a lawyer, right?

A. Correct.

Q. Okay. If I want to get at this data on this two server

system, I got to have at least some of that expertise, you said

at least the MySQL stuff, right?

A. That's true.

Q. And, potentially, depending on how things are arranged,

ZFS, FreeBSD, jail, all of that expertise, potentially, as

well, right?

A. I agree.

Q. And, again, all of that is assuming that the data is imaged

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 131 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

132

accurately?

A. Correct.

Q. The two server version --

MR. NEUMAN: Your Honor, I would like to show the

witness --

BY MR. NEUMAN:

Q. Well, in fact, before I do that, and just to make the point

a little clearer, Mr. Gerken, the back end administrative data

that we were talking about, the object editor and such, to your

knowledge, Carl Ferrer didn't have any expertise in MySQL and

such, right?

A. To my knowledge?

Q. Yeah.

A. No.

Q. And, to your knowledge, the other folks who were accessing

this data while they worked at Backpage and actually using it

in real time, they were using this object editor version not

some other version, right?

A. Correct.

Q. Okay. Now, it's not as simple to say that you just need

two servers, right, because each server is made up of how many

hard drives, potentially?

A. That's -- that's a hard one to remember. Many. We'll say

often more than 10.

Q. Often more than 10. Sometimes more than 20?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 132 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

133

A. Potentially, yes.

Q. Okay. And each one of those has several thousand paths

that connects those hard drives to make the server work, right?

A. Could you rephrase that?

Q. Well, those hard drives, those 10 or 20 hard drives, or

more, potentially, that make up a server, they have to be

connected in a certain way for that data to be accessible,

correct?

A. Yes.

Q. So if the government, when they took those servers, pulled

out the individual hard drives, didn't necessarily keep track

of what went where, and then said, okay, here's all the hard

drives from that server, it's not the same thing as what they

took from DesertNet, is it?

A. They were intact when they were removed.

Q. And it would make a difference if some of those hard drives

were pulled out, the order wasn't notated anywhere of what --

how they were pulled out, and then during the course of the

imaging process, some of -- at least some of those images were

corrupted, that would be a very different scenario, correct?

A. Yes.

Q. So if you were to understand, if somebody was to testify

that images of hard drives taken from a database server are, in

fact, corrupted and not accessible, even having all of the

expertise that you described, all those questions that the

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 133 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

134

prosecutor asked you about access to the data being the same

and so on and so forth, again, out the window, right?

A. If the data is corrupt, it's not accessible.

Q. Okay. Now, you talked about the difference between the two

server version and the read only version, and one of the things

you said is that the two server version, theoretically, has all

the data there, assuming it was imaged correctly, but it's in

raw form. And by raw form do you mean CSV form?

A. No. It would be in the database.

Q. Okay.

A. So it would be the text or whatever integer decimal,

whatever type of data it was, it would be in that native state,

and that would be --

Q. What does the native state look like to some of us who

don't have computer expertise?

A. Like an Excel spreadsheet.

MR. NEUMAN: Your Honor, I have Exhibit J. It was

already filed. It's Document 64311. I don't know if you want

me to mark it as an exhibit or we can just -- I'm fine using it

as -- however the Court wants me to.

THE COURT: No, but, I'm sorry, can you repeat the

number?

MR. NEUMAN: It's Exhibit J to the -- well, Document

Number 64311.

THE COURT: 643.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 134 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

135

MR. NEUMAN: I have a copy for the Court.

COURTROOM DEPUTY: We can make it Defendant's Exhibit

104.

THE COURT: Do you want to make it an exhibit?

MR. NEUMAN: May be easier.

THE COURT: So it will be 104.

MR. NEUMAN: May I proceed, Your Honor?

THE COURT: Yes.

MR. NEUMAN: Okay.

BY MR. NEUMAN:

Q. Mr. Gerken, do you have that in front of you?

A. I don't believe I do.

Q. I'm sorry. I wasn't sure where we were in the process.

A. Yes.

Q. Do you have that now?

So looking at what is, I guess, 104, is this what you

mean by the raw form in an Excel spreadsheet for a particular

ad? Does this look like what that would be?

A. Yes.

Q. So doesn't look like the Web site, what we think of as a

Web site, Exhibit 103, they don't necessarily go together, but,

effectively, am I right, that 103 is what it would look like in

a read only version, if that existed, and 104 is what that same

ad or a similar ad looks like now in the two server version?

A. Yes, 104, Exhibit J --

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 135 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

136

Q. Yes.

A. -- the two server is the raw format and that's how it would

look like. The read only, which would be getting the system

working again, would look like the exhibit in your right hand.

Q. And let me ask you, if you even had this 104 data for every

ad and you were able to pull it out, how long might that take,

or how long -- do you know how long it takes to pull this for a

particular ad or no?

A. If you had this database and you wanted to just pull out

one ad?

Q. Yeah.

A. Once you knew the schema, that's just a single query.

Q. There is no way, is there, to turn Exhibit 104 and make it

look like Exhibit 103, correct?

A. No way?

Q. Well, no way unless we start recreating the read only

version at least, right?

A. Or an equivalent, I would say.

Q. Or an equivalent. Fair enough. But as -- if I represent

to you that as things stand we only have the two server

version, I can't turn this into this, 104 into 103, right?

A. Not without doing more work.

Q. Okay. And that work would be extensive?

A. Yes, it would range what a developer would charge to do

that.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 136 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

137

Q. I didn't mean -- I didn't say expensive, I said extensive.

A. Oh, I thought you said --

Q. Either way?

A. Yeah, it would be extensive.

Q. Okay. And in terms of the queries that were available --

I've lost my exhibits -- in Exhibit 103 with the object editor,

to run those queries would potentially take much more time and

expertise, right?

A. Yes, more time.

Q. Well, let me ask you this. You agreed with me before that

even I, or any other lawyer, could probably run the queries

through the 103 object editor, right?

A. Technically, you wouldn't be running a -- a query is what's

producing this, but if you were reading this in the

application, you wouldn't be using SQL.

Q. Fair enough. But if I want to go see the other three ads

by the user on this site, I could just click a button on the

read only version, right?

A. That's correct.

Q. Whereas in the two server version, I've got to have an

expert familiar with all these other computer languages run

whatever they have to run to go find those other ads, right?

A. Yes. They would need to execute that specific instruction,

which is what that would be.

Q. And it still won't look like this or the other ads --

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 137 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

138

A. No.

Q. -- that come up from that user won't show up in this format

either, right?

A. No.

Q. Okay. So when we talk about setting aside convenience,

would you agree with me that if -- comparing the two server

version to the read only version, that the read only version is

more easily searchable and manipulable, would you agree with

that, for a non expert?

A. Yes.

Q. Okay. And would you agree with me that the -- given the

ease with which a read only version can be searched, converting

the Web site into this two server version has, at least to some

degree, degraded the searchability?

A. By a non expert.

Q. Yes.

A. Yes.

Q. Okay. Well, and it's not just that, right, because before

somebody could pull up these ads in the format that they looked

like, and now, at least assuming we have this two server

version, they can't, right?

A. They would not look like that, correct.

Q. So it's not just the utility, in terms of searching, but

also the utility in terms of displaying that has changed,

correct?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 138 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

139

A. Correct.

Q. So, for instance, if -- let's just say somebody says that

they took a picture of an ad on the Web site with a phone,

right --

A. Uh-huh.

Q. -- and I want to, as the lawyer in this case, show what

that ad actually looked like, let's say it was, had been

changed at some point after that picture was taken, in the read

only version I could do that, correct?

A. Correct.

Q. Now, in the two server version I can't do that, right?

A. You would have the same data. It would not look the same.

Q. I want to be able to show a judge or a jury what the Web

site looked like. Okay. That's what I'm trying to do.

A. Yep.

Q. I can't do that with the two server version, right?

A. Two server version by itself, no.

Q. Okay. And so if they have -- if the government has an

expert who says, I looked at all these ads and they were all

obviously for prostitution, and I want to challenge that expert

by showing her ads from the actual Web site, I can't do that

anymore with the two server version, right?

A. You can't show this.

Q. That's right.

A. The ad.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 139 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

140

Q. Okay. The convenience that we talk about, right, we

said -- the prosecutor said, setting aside convenience, the

convenience that we're talking about is, one, the ability of a

non expert to access this data, correct?

A. Correct.

Q. So if I'm sitting in the middle of a trial and I need to

access a Web page or a witness is on the stand, in the read

only version I could do that, in the two server version, I

can't do that, right?

A. Again, I'd qualify saying, you would still have the same

data but it would not look the same.

Q. Okay.

MR. NEUMAN: Just one second, Your Honor.

THE COURT: All right.

BY MR. NEUMAN:

Q. And, Mr. Gerken, I think just to make sure we're all on the

same page here, everything we're talking about assumes that the

data was imaged correctly, right? If the -- if the data is not

imaged correctly at this point, meaning for whatever reason it

was corrupted after the government took it, we don't know what

is, potentially, accessible and what's not accessible at this

point, right?

A. Correct.

Q. Okay.

MR. NEUMAN: I have nothing further. Thank you, Your

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 140 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

141

Honor.

THE COURT: Is there anyone else?

(No audible response.)

THE COURT: Redirect.

MR. STONE: Thank you, Your Honor.

REDIRECT EXAMINATION

BY MR. STONE:

Q. Exhibit 103, Exhibit 104, those are the two exhibits

Mr. Neuman was just asking you questions about, assuming

they're for the same ad, what data is different in 103 than

104?

A. No data should be different.

Q. It's the exact same?

A. It should be, yes.

Q. There were a lot of questions about, hey, why couldn't the

government have just taken the servers off line and left the

servers in place at the data center in Tucson. Do you remember

those questions?

A. I do.

Q. Is it true that even if the servers are off line, if they

continue to run, scripts continue to run?

A. That's true.

Q. Does the data then change if it continues to run?

A. Yes.

Q. So even if it were off line, if the servers continued to

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 141 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

142

run, it would be difficult to determine what evidence existed

on April 6, 2018, and anything after that date, because the

machines would still be active?

A. Yes, if the machines were allowed to be active, yes.

Q. Any idea what it costs per month to house the Backpage

servers at the data center?

A. Oh, I don't recall the number. It was a lot. Um, you

know, upwards of 30,000.

Q. Mr. Bienert went through Exhibit 103 in detail with you.

And if you turn to the back pages, then there were a number

of -- there is a number of information boxes in what was

referred to as an object editor; is that correct?

A. Correct.

Q. And I think you mentioned that the information here are

simply queries; is that right?

A. That's true.

Q. So what do you mean when you say that?

A. This is a representation of all of the invoice data on this

particular page. This invoice data may be stored in different

tables in the database, potentially even in different

databases. This is pulling together all of those pieces to

provide a representation of all of the invoice data for their

users, staff.

Q. And if you had the databases right now, would you be able

to obtain the same information?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 142 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

143

A. Yes.

Q. If defendants sent you a list, sent you, Mr. Gerken, a list

of categories of information that they would want to see in

terms of queries to run in the database, would you be able,

just off a database server, to run those queries and provide

that information?

A. Yes. If the database server had these particular databases

and we could see the schema again, or I could see the schema

again, yes.

Q. Again, assuming that nothing is corrupted and that the

master database server was provided in full?

A. Yes.

Q. Mr. Bienert asked a lot of questions about the read -- sort

of setting up a read only site; is that right?

A. Yes, correct.

Q. And you answered it would take some time and it would cost

some money, 30 to $50,000 maybe is about the estimate you gave?

A. Right.

Q. And I just want to be clear. When you're answering those

questions, that was just related to how the data would be

presented; is that right?

A. Well, both, actually. Yes, the majority of that was how

the data would be presented, but we'd also need to get the

databases set up, get the images, you know, all of your basics

that you would need just for the two server version.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 143 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

144

Q. All right. Let's assume you have the two servers in place

and you have the databases and you have all that information.

When he was asking you questions about it would take two to

three months and it would cost this amount of money, that was

to write whatever code you would need to make the presentation

of the data prettier, basically?

A. In this similar format to Exhibit 103.

Q. And would it -- strike that.

But if someone just asked you for the information, not

how it looked, but just the information, would you be able to

provide it if you had the --

A. Yes.

Q. -- database servers?

A. Yes.

Q. And that's not just someone like you who could provide it,

I think you testified that somebody who was familiar with SQL

and SQL databases would be able to access that information; is

that right?

A. That's correct.

Q. There is also the image server and there are pointers, I

believe you testified, that would show what image goes to which

ad; is that right?

A. Correct.

Q. So if somebody had that information, they'd be able to

recreate at least what data was on the ad and what pictures

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 144 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

145

were on the ad, correct?

A. Yes.

Q. And, again, I think Mr. Bienert was talking about

connecting components and -- and putting things together before

you would even be able to access the database. That's not

quite right, is it?

A. Um, it's one way to do it.

Q. But if you're just running the manual queries, you don't

need to attach anything, you just need the database?

A. Correct.

Q. And there was some questions about IP addresses to

reconnect the servers to access the data. Same question. If

you had the database, you wouldn't need any IP addresses or

anything to access the data?

A. That's also correct.

Q. Sir, has anyone from the defense contacted you to ask for

assistance in accessing the data?

A. To actually ask for assistance?

Q. Asking for your assistance to access it?

A. Um, there was one conversation, yes.

Q. Was that recent?

A. Recent.

Q. Within the last week?

A. Yes. Assistance is a strong word, though, you know, it was

a conversation.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 145 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

146

Q. A general conversation about --

A. Yes.

Q. -- maybe what you knew?

A. Yes.

Q. As it related to this hearing.

MR. STONE: No further questions.

THE COURT: Okay. I have one, maybe two questions for

you.

Because you talked about an image server.

THE WITNESS: Yes.

THE COURT: And in the image server, if you wanted to

get an image off of it, an actual picture, do you get the

picture or do you get just the data that says it's a picture?

THE WITNESS: It's a good question. You would get the

picture. You would get the file, or the JPEG.

THE COURT: So you would get --

THE WITNESS: You get the file of --

THE COURT: -- where you see an actual image?

THE WITNESS: Yes, you would.

THE COURT: Okay. Because Exhibit 104 doesn't have

any --

THE WITNESS: No it doesn't.

THE COURT: -- pictures. So this is just data from

the data portion?

THE WITNESS: It is. I didn't look through every page

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 146 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

147

here, but in here will be what they referenced as pointers to

the image, which might be just a URL, direct URL to the image.

It could be a numeric value to the image, so there is some --

there is something in here that tells you that's the image.

THE COURT: And it tells you where to go in the image

server to find it?

THE WITNESS: That's correct.

THE COURT: Okay. Then in the --

THE WITNESS: Yeah. And they are URLs.

THE COURT: Okay.

THE WITNESS: I'm seeing them.

THE COURT: Thank you.

I think in cross-examination there was a scenario

where you would be asked to move the whole database off line.

THE WITNESS: Uh-huh.

THE COURT: And you said that could be done.

THE WITNESS: When he was asking to move it to another

facility, was that the question?

THE COURT: Right.

THE WITNESS: Yes.

THE COURT: And it's off line. Once you reconnect it

and it's running, is it affecting the data?

THE WITNESS: It's a good question. The clarity on

it, um, I don't recall who mentioned fronds or scheduled

events, and there was some discussion of retention --

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 147 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

148

THE COURT: Right.

THE WITNESS: -- as time goes by, ads expire,

retention policies kick in, so old ads might get deleted. Some

ads may actually have the opposite, they may come live. They

might have been scheduled. There is a way to avoid that

though, which I think is the heart of the question you might

have.

THE COURT: And what's that?

THE WITNESS: To put the file system also in a read

only mode, have the databases in a read only mode, disable

those processes as well, find them and disable them. But the

read only mode should take care of it. It really means you

can't write, can't change.

THE COURT: So if you're in read only and you're

running all these searches and pulling up things, that doesn't

affect the data.

THE WITNESS: No, it doesn't. It can't. It's read,

it's literally collecting information, not allowed to -- to

change it or edit it, delete it, add to it, all those are

writes, so you can't do that.

THE COURT: And so if it's in read only, then the

retention process, if it existed, whatever it was, would stop?

THE WITNESS: It would error. It would fail, correct.

Yeah.

THE COURT: Okay.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 148 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

149

THE WITNESS: It couldn't -- the answer is, yes, it

would stop.

THE COURT: But then if it errors, isn't that

affecting the data?

THE WITNESS: It's not. It's just the, um, pointing

out that it tried to run and it couldn't run.

THE COURT: Okay. Does anybody have any follow-up

questions based on what I asked?

MS. BERNSTEIN: Just one, Your Honor.

FOLLOW-UP QUESTIONS

BY MS. BERNSTEIN:

Q. So, Mr. Gerken, if I'm understanding the read only

description that you just gave to the judge correctly, it

freezes the data in time exactly as it existed the moment you

put it into read only mode?

A. That is correct.

MS. BERNSTEIN: Thank you.

THE COURT: Okay. I don't see any other questions.

You may step down.

THE WITNESS: Thank you.

THE COURT: Thank you.

Your next witness.

MS. PERLMETER: Thank you Your Honor. The government

calls Matthew Frost.

MATTHEW FROST,

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 149 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

150

called as a witness herein, having been first duly sworn, was

examined and testified as follows:

DIRECT EXAMINATION

BY MS. PERLMETER:

Q. Good afternoon. Please introduce yourself.

A. My name is Matthew Frost.

Q. And what do you do and where do you work?

A. I work for the FBI as a computer -- sorry, information

technology specialist, forensic examiner, in Pocatello, Idaho.

Q. And how long have you had the job -- job duties of an

information technology specialist, forensic examiner?

A. Just over ten years.

Q. And have you been working in that capacity the entire time

you've been with the FBI?

A. As a full-time employee, yes. I had a -- I was a -- I had

an internship with the FBI that was unpaid, and then I was a

temporary part-time employee as a transcriptionist while I was

in -- at ISD.

Q. What is your educational background?

A. I have a bachelor's in economics, with a master's degree in

-- an MBA, master's in business administration, with an

emphasis in information assurance.

Q. And what do you do currently for the FBI as a forensic

examiner?

A. I conduct forensic examinations. So we take digital media,

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 150 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

151

when the request comes in, a case agent asks for a piece of

media, a server, cell phone, hard drive, a server to be

examined, and then with valid legal authority I conduct the

examination, create images, extract data, and then present

reports and findings back to the requestor.

Q. Have you taken any Linux specific courses that help you

perform your job duties?

A. Yes, I have. I have taken a couple Unix forensics courses

within the FBI, and then I have taken outside vendor Linux

training.

Q. Do you have any certifications?

A. Yes. I am a certified Linux forensics practitioner.

Q. Do you hold other certifications as well?

A. Yes, sorry.

Q. That's okay, but you do have some certifications that are

specific to Linux?

A. Yes.

Q. Do you have any teaching experience in the Linux/Unix area?

A. Yes, I have conducted several training -- trainings within

the FBI. I have traveled and taught new examiners the tools

and techniques of Linux examinations, as well as web-based

training where I create training on a specific topic, um, like

RAID or ZFS or image mounting, and I presented that to a webbased audience within the FBI.

Q. And have you testified in court regarding your work done as

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 151 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

152

a forensics examiner for the FBI?

A. Yes, I have.

MS. PERLMETER: And, Your Honor, Mr. Frost's resume is

on the docket under 4222 if the Court wants to review his other

work history.

THE COURT: All right.

BY MS. PERLMETER:

Q. Mr. Frost, this afternoon I want to break down your

testimony into, basically, four main areas. First I'd like to

talk about your work and the FBI's work in retrieving the

Backpage related servers from Amsterdam; second, I wanted to

talk to you about the forensic images that you made of the

servers that were later disclosed, the servers that came from

both Tucson, as well as Amsterdam; third, I would like to ask

you some questions about computer hardware and software that is

related to the Backpage servers; and then, lastly, I would like

for you to demonstrate for the Court how a person can access

the data that has been extracted from the Backpage servers.

Okay?

A. Yes.

Q. So let's start with the investigation. When were you, when

did you become involved in the Backpage investigation?

A. I received a request in April or early May of 2018 to come

to Phoenix, Arizona, to look at some servers that had been

seized.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 152 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

153

Q. And so when you were asked to assist in this case, were the

Backpage servers already shut down?

A. Yes, they were.

Q. All right. Did you have any involvement in this case when

the Web site was live and running?

A. I did not.

Q. So what did you do to familiarize yourself with this case?

A. I came to Phoenix and I met with the case agents. They

briefed me on the background of the case and the servers they

had seized. And that's the familiarization I received.

Q. Do you know why you were asked to help with the

investigation of this case?

A. Yes. A call -- a request came out for a Linux/Unix

forensic examiner to come look at the servers. They were

identified as being in the category of Linux/Unix.

Q. And during that first visit to Phoenix to meet with the

case agents, were you able to preview any of the servers that

had been seized from the Tucson facility?

A. Yes, I had.

Q. And what were you able to learn from that preview?

A. I learned that there was lots and lots of data, many, many

servers. And I, not knowing the architecture of the network or

what the roles of each of the servers, we just picked servers

based on, this server looks like it will hold a lot of data, so

I will pull this out and preview it in a forensic manner in a

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 153 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

154

read only mode so that the data integrity would be preserved.

And I looked at the systems with an initial tool to see if I

could see the data.

Q. And with that initial tool that you used, were you able to

see the data?

A. I was not. I could see the physical drives but I couldn't

see the logical data inside those drives.

Q. And so what is the difference between a physical drive and

the logical data that you were unable to see?

A. Physical drive is the hardware that once it's connected to

a computer it's presented as a physical drive, and then

depending on what operating system, how it interacts with the

physical drive, if it can mount or look at the data inside the

drive, the logical drive, the file system, the data.

Q. Did you then use other tools to help you to see the logical

data in these servers?

A. Yes. Having looked at the physical drives, I looked at the

hex value of the data inside the physical drive, so not the

file system, but the hex value or the -- the raw, raw data, and

it was determined that it was a ZFS file system. I saw

indicators that it was a Z pool and a ZFS file system, so then

I got ZFS specific tools to look at it.

Q. All right. So I will come back to ZFS and Z pools later

on, but at this point in this first meeting with the case

agents, during your preview were you able to identify the

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 154 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

155

master base server as well as the server that contained the

images?

A. I was able to identify a database server and image -- or

servers that were image servers.

Q. And, at this point in time, the servers in Amsterdam were

still in Amsterdam?

A. Correct, powered down but in Amsterdam.

Q. So then fast forward to June of 2018. Were plans made for

the FBI to travel to Amsterdam in an attempt to retrieve those

servers?

A. Plans were made to travel to Amsterdam, not to initially

retrieve them, but to verify what was there on those servers.

Q. Was this June 8, 2018, the first time the FBI was able to

travel to Amsterdam to view the information and equipment that

was being housed out there?

A. Yes.

Q. Okay. Prior to going out, what was the plan, what was the

plan for this trip?

A. Because I had traveled to Phoenix and I saw all the servers

and I was quite overwhelmed with the number of servers, it was

just voluminous in nature, planning to go to Amsterdam I had

been informed that there were two -- two copies of the data, so

one was in Tucson and one was in Amsterdam, so knowing we had

two copies, I had made plans and had consulted other forensic

experts with the plan to go to Amsterdam and verify what was on

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 155 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

156

those servers, verify we could match up database servers, image

servers, and then isolate those servers from the internet so

they could be left exactly how they were intact in an

enterprise environment that we could then, through technology,

access through encrypted channels so that no one else could

access the data but us.

Q. So before going out to Amsterdam, it was the plan of the

FBI to potentially isolate the servers so that they could be

remotely accessed by the FBI from the United States?

A. Yes.

Q. Okay. Did that happen?

A. It did not.

Q. Okay. So what happened?

A. We -- when we flew to Amsterdam, we met with the Dutch

national police, the high techs crimes unit. We met with them

and presented the legal authority to MLAT for us to request

information from their government as the United States, it's

us, not me. We presented with them the legal authority and

then our plan for how we wanted to -- what we wanted to do with

the data. When we presented that plan to the high tech crimes

unit, the lead investigator, or lead examiner, he had to

consult with the prosecutor to see what would be allowed under

Dutch law.

Q. So when you arrived in Amsterdam, did you have a meeting

with members of the Dutch police?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 156 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

157

A. Yes.

Q. Okay. And when I say you, I mean you and members of the

FBI?

A. Yes.

Q. Did you have any meetings with the Dutch prosecutor?

A. We did not.

Q. So after meeting with the Dutch police, were you able to

move forward with your plan as you guys had discussed?

A. No, we were informed, again, by the Dutch national police

that the -- that they -- he didn't see a way, after consulting

the prosecutor, that they could allow the servers to stay in

Amsterdam live knowing what the servers contained. They wanted

the servers down and out of the racks.

Q. So what did -- what did FBI -- what did the FBI do to

adjust to that?

A. Well, I should further note that we were -- we were guests

in the country, in the Netherlands. We -- I can't just walk in

the data center and say, we're the FBI, give us those servers.

We have to request the Dutch to do it and then they have to

follow their legal proceedings and rules and laws.

So since we couldn't keep them in a running or live

state, disconnect from the outside world, they said they had to

seize them. So with their assistance, they seized the servers,

some of the servers, and took them into Dutch custody.

Q. Did the FBI explore the possibility of imaging all of the

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 157 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

158

servers in the data center on site at the switch center?

A. Again, when the Dutch national police -- we told them the

Tucson servers were very large, there was many, many terabytes

of data, maybe even a petabyte of data, they said there is no

way we can image that on scene, so we'll just seize the servers

and then you can image them when you get them.

Q. So, after hearing that, did you identify nine servers for

the Dutch to seize?

A. Yes, we did.

Q. And then did you get to walk out with them that day or did

they have to go through the Dutch legal process?

A. Yes, the nine servers identified, the database servers,

image servers, and a backup appliance were retained in Dutch

national police, and they took control of them and we had to

wait for them to turn them over to us. The process took

several months to work through their legal system before they

got turned over to the U.S. government and then shipped to my

office.

Q. What did those nine -- what types of servers were those

nine servers?

A. Um, types of them, they were Dell servers or their

functionality?

Q. Functionality.

A. They were database servers, servers containing the image

sets from the ads on Backpage and a backup appliance.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 158 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

159

Q. Okay. All right. So after traveling to Amsterdam, you

returned back to the United States. Do you continue working

with the servers that were taken from Tucson while you await

the return of the servers from Amsterdam?

A. Yes. Two of the servers from Tucson were shipped to my

office, a database server and an image server.

Q. And then did you -- did you make mirror image copies,

forensic copies, we've heard several terms today, so that you

could see what was contained within those servers?

A. Yes. I made a hash -- or image copies and then hash

verified, verifying the image matched the original drive.

Q. And then were you communicating with anyone at DesertNet at

this time to get some information about how these -- what may

be on these servers?

A. Yes. I reached out to Wil Gerken at DesertNet, made a few

telephone calls and many e-mails back and forth where I asked

questions and he provided additional information.

Q. Okay. So, ultimately, you were able to make image copies

of two servers, the master database server, as well as an image

server that were seized from the Tucson facility?

A. Yes.

Q. And how long did that take you?

A. That process took several weeks, maybe even a month to

image all the drives and verify them.

Q. And then when the servers from Amsterdam came to you, did

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 159 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

160

you also image a copy or create a forensic image of the master

database server as well as the images server?

A. Yes, I did.

Q. And then did you provide -- were those copies eventually

provided to the defense?

A. Yes. I made discovery copies that I shipped to Phoenix.

Q. Okay. In addition to that, did you do anything else that

would assist defense in accessing and understanding the data?

A. Um, with the -- the image copies I created, I had, during

this time frame, I had also extracted the database files in a

SQL dump format, as they were MySQL SQL databases, I conducted

a SQL dump or extracted databases from the servers, copied them

to separate hard drives and then provided those to Phoenix that

were intended for discovery purposes.

Q. Did you participate in a conference call in February of

2019 with members of the prosecution, with other FBI agents, as

well as defense representatives?

A. Yes, I did.

Q. And what was the topic of that phone call?

A. They -- I was requested to help on a conference call based

on my knowledge of the servers and what we would be providing

to the defense for discovery. During that time, I explained

that there were Linux slash Unix servers and that I was

providing hard drives that would be in EXT4 format, because I

was working in Linux environment.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 160 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

161

I also explained the -- the structure of the servers,

that there was the physical server, the physical drives, then

there was a Z pool, then there was the operating system,

FreeBSD, and there were jails on top of that. I remember

specifically the -- someone from the defense side asked, so can

I just plug these hard drives into my laptop? And I said, no,

it takes numerous hard drives to recreate one server and your

laptop wouldn't be able to read the hard drives in the native

form. And, um, during that call -- so it was recommended the

expert be brought on to assist the defense in recreating, but I

said you can go through that lengthy process and quite complex

process to reconstruct the servers, or I've also already

extracted the databases and you can work off the databases I've

provided also.

Q. So you provided image copies of the Backpage servers, but

in addition to that did you put on a single standalone hard

drive the master database of the Backpage servers?

A. Master database and all the other databases.

Q. And did you put in it a SQL format so that they could

access it more quickly, as opposed to going through the

original imaged copy?

A. Yes.

Q. Other than the question from the defense representative

about whether they could just plug that hard drive into their

laptop, were there any other questions asked of you that day

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 161 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

162

about the discovery process?

A. I don't think so. They may have asked how many or how

much, and I said it was upwards of 50 drives, 50 terabytes of

raw data.

Q. Did anyone from the defense side of this phone call appear

to understand or at least be familiar with SQL databases and

ZFS files?

A. As I was talking about it, there was a male voice on the

line that resonated that he heard of EXT4 or these other

components and that he said, I at least heard of it, yes.

Q. After that phone call, a month or two later, did members of

the defense team travel to you or travel to your facility in

Idaho to physically inspect the servers?

A. Yes, they did.

Q. And during that visit, did anyone -- when was that visit?

A. I believe it was April 2018.

Q. During that visit were there any additional questions

about --

A. Maybe March.

Q. Maybe March or April of 2018?

A. Yes.

Q. Spring of 2018?

A. Yes.

Q. During that visit, were there any additional questions

about how to use the database, maybe what types of software or

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 162 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

163

forensic tools could be used to help them understand the data

in the databases?

A. I wasn't, um, specifically asked any questions about that.

One question that was asked was if they could take pictures,

and we said, no, we're an FBI facility, and we could provide

pictures.

Q. I want to show you what's been marked as Exhibit Number 6.

Mr. Frost, do you know what this is?

A. The document, yes.

Q. Okay. What does this document describe?

A. It describes a process I went through with pictures of

copying forensic disk images, E01 or expert witness format,

EnCase formatted image copies, to standalone hard drives. In

some cases multiple images fit on a single hard drive and

sometimes it didn't. It also explains there is an E01 text

file which states information about the tool I used to create

the image, when I did it, the hash verification log files

included in that. So it shows the picture 23 is a database

server from Tucson that I had received, and it just goes

through pictures showing that the image copies were created,

put in the hard drive, EXT4 file system, and then also there

was a database extraction done, database exported files in the

SQL format, they were also provided on the hard drive.

Q. So can you walk us through, when you're making a forensic

image of the servers, what do you do and then in what format do

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 163 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

164

they come out in?

A. The -- in this particular case, I powered on the server to

a boot disk, which is an operating system contained only in RAM

on the system, so no data on the actual server is changed. And

then I can query information about the disks, it was a Linux

based tool, so it gave me drive letters from SDA, SCSI device

A, SDB, SDA, or SDC, et cetera, all the way through the 24th

letter in the alphabet, V, maybe, whatever 24 is. There were

24 drives in the server. So I selected a drive with an imaging

tool, FTK Imager Command Line, so it's a Linux based tool. I

selected the device SDA to be imaged with a forensic tool hash

verification, and told it to copy that to our network that I

attached a network attached storage device to the back of the

server so I could write all these images to one location. Then

later after the images have been created and verified, I copied

them to the individual hard drives for discovery.

Q. Okay. So when you image data, do you do it in accordance

to FBI protocol?

A. Yes. We use industry standard tools, everything is hash

verified with matching hash values.

Q. So when you produced the forensic disk in E01, expert

witness format, is that industry standards?

A. Yes, it is.

Q. Okay. And then explain how we get from that to the EXT4

file system.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 164 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

165

A. Yes. So, like I said, I created the image files, and once

they were created and verified, they were sitting on our

network storage, so then I attached another computer by a

forensic work station with a standalone hard drive and a doc.

I put the hard drive in. I connected to my Linux system. I

then formatted the hard drive EXT4 so my Linux system could

write to the disk. Then I copied the image files off the

server onto the disk, once again, verifying the device once it

was on the standalone hard drive. I do another hash

verification. So the E01.txt file would then be --

When I put it on the standalone drive, the EO1 text

file would then be updated with the new verification and the

hash would be, again, printed in the text file and the date

timestamp would be associated with that also.

Q. Okay. And then what is the interplay between the EXT4 file

system and the ZFS file system?

A. In this case, nothing. EXT4 was how the hard drive was

formatted, that's the file system that stores it. ZFS is how

the servers were formatted.

Q. Uh-huh.

A. And their file system.

Q. And so would this blue area over here, the database

exported files in SQL format, is this piece of what you -- is

this what you extracted onto a single standalone hard drive?

A. Yes, the database extractions and the SQL format --

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 165 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

166

Q. Okay.

A. -- were copied out.

Q. Is this single standalone hard drive, is the information

that you placed on there also available in the 56 hard drives

that were also provided to the defense?

A. Yes. The images -- the image copies, the forensic copies

of the server that was used to extract the database were also

provided, so I had the forensic images on the hard drives, then

I had the database that were separate.

Q. So why -- since the information is here in the 56 hard

drives, why did you also export it into a separate standalone

hard drive in SQL format?

A. Just because the difficulty in accessing the database

files, once I had access to them, I extracted them and then I

provided them so that they could more easily review the data,

as I mentioned in the phone call.

Q. Okay. And that's the February 2019 phone call when you

explained to them what they would be receiving and the format

in which they would be receiving it?

A. Yes.

MS. PERLMETER: Okay. The government moves Exhibit

Number 6 into evidence.

THE COURT: Any objection?

MS. BERNSTEIN: No objection.

THE COURT: Exhibit 6 will be admitted.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 166 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

167

BY MS. PERLMETER:

Q. Now, as you became aware, were you provided copies of

victim ads as they correlated to the superseding indictment

that were obtained by -- that were obtained before the Web site

was shut down?

A. Yes, I had.

Q. Okay. Did you use the information on those ads to kind --

and then go back into the database as it is available now to

see if the corresponding data is there?

A. Yes, I did.

Q. And then -- so what did you do?

A. I connected to the database files and then ran SQL queries

based on information from the ads, specifically it was the

posting ID. I did a search for the posting ID and located the

ad that contained that posting ID from Backpage, and then I

extracted or copied those files off in an Excel spreadsheet

type format, CSV.

Q. So with that information, with both sets of information,

the way the ads looked while the Web site was still running and

with the information in the Excel spreadsheet type format, are

you able to compare that the -- the information as it exists in

both formats to verify that it's the same information?

A. Yes. One distinction I would make is the requested ads,

some of the ads had the exact same posting ID but they were

dated differently. There may have been slightly different

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 167 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

168

versions of the text in the ad, but with the database I had

access to for Backpage, I only had the last version of the ad,

so with the object ID, whatever the final one was the date the

servers were taken down, that is the one I was able to extract.

I couldn't extract every single version that they provided and

some cases there were multiple.

Q. But you were able to confirm both images or both sets of

pictures were the same?

A. Yes.

Q. And e-mails on both ends were the same?

A. I don't believe the requested ads had e-mail information in

them, but the posting IDs and the data matched.

Q. Okay. And the pending aspects of the sets of information

that was provided when the ad was originally posted, if it was

available, it was also consistent?

A. Yes.

Q. So after you make a forensic image, I think you mentioned

it, but do you take any steps to verify that the image is

complete and not a corrupted file and is actually an exact copy

of the original?

A. Yes. Again, the industry standard forensic tools do hash

verifications, so at any time I could pull up the image files

and re-verify that they're the exact same as when I originally

created them and matching the hash of the original device they

were taken from.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 168 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

169

Q. And have you also worked off of the imaged files to verify

that they are not corrupted?

A. Yes. When I created the image files and copied them over,

I verified -- or hash verified them once again.

Q. Okay. Now, I want to start asking you some questions about

the different types of hardware and software that are involved

and that have been kind of mentioned today, and I want to start

with just the basics.

What is a server?

A. A server is -- it can be any computer system. A server is

more a role in functionality, as in it serves out information

so that multiple people can access it at a time or people can

view or put data onto that server.

Q. And is a hard drive a piece of storage media where data --

that stores data on a computer?

A. Yes.

Q. And then can a server have multiple hard drives?

A. Yes.

Q. So -- and we've already mentioned briefly somewhat that

there are different operating systems in existence; is that

right?

A. Yes.

Q. Microsoft Windows being one popular operating system.

What is the operating system that the Backpage servers

were using?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 169 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

170

A. They were running FreeBSD.

Q. Okay. What is that?

A. FreeBSD is an open source or free operating system,

FreeBSD. BSD is -- it used to stand for Berkeley -- Berkeley

something distribution, I can't remember, but it's changed a

little bit since it was originally introduced in the mid '90s

to -- it's a Unix file system, so different from the Linux.

Q. So if you have Windows-based forensic tools or forensic

tools that are meant to be used with a Windows operating

system, will they also work with a FreeBSD operating system?

A. Windows tools cannot read the FreeBSD information, no.

Q. So if you're trying to gather information from an operating

-- from the FreeBSD operating system, what kind of tools do you

have to use?

A. You have to use Unix slash Linux forensic tools that can

read and interact with the FreeBSD operating system.

Q. Is one analogy possibly you can't play an MP3 file through

Microsoft Word?

A. Yes.

Q. What is a database?

A. Database is a storage container for data. There are

different types of databases, but it's just a large container

to store data that can be easily retrieved and queried.

Q. What is a relational database?

A. Relational database is one type of database. Often SQL

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 170 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

171

databases are relational databases. And a relational database

is made up of tables with columns and rows inside the table, so

one database, one relational database might have multiple

tables.

A good analogy is if you had a university where they

have professors, students, classes and times those classes are

stored, each table would include information about the

students, another table would include information about the

professor, another table would include information about the

classes, and then, you know, what times they are, those classes

are offered. So as you populate this table, one student might

have a class from one professor at a certain time and you could

-- these tables are interrelated, so they're relational

database, because the information can all be grouped together

to form different queries about which student takes which class

at what time.

Q. So, for example, if the student table, it might possibly

contain information like name of the student, phone number,

e-mail address, birthday, social security number, things like

that?

A. Correct.

Q. And there would be a separate table, perhaps, for the

different professors, and then maybe a separate table for the

different courses that the university offered?

A. Yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 171 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

172

Q. And then could you relate the tables with amongst --

against each other to compare and contrast the information that

you would like?

A. Yes.

Q. How is that -- is that being used -- is that being seen

here in relation to the Backpage Web site?

A. Yes. So the database is the MySQL, the SQL database used

by Backpage was a relational database. So you have one

database with different tables inside that database, and each

table had columns and rows with different information.

Q. So what is MySQL?

A. MySQL is -- it's a program. It's the application that runs

the database, the database software, so this software can be

run on, you know, different computers, servers, but it is one

type of database.

Q. A database management system?

A. Yes.

Q. And is it publically available?

A. Yes, MySQL is free to download.

Q. And what is SQL, S-Q-L?

A. SQL is the structured query language, that's how you

interact with the database or request information, put

information, move information.

Q. Okay. So is it the -- is it a database management

language?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 172 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

173

A. Yes, it could be seen like that.

Q. Okay. And what is Heidi S -- HeidiSQL, Heidi S-Q-L?

A. HeidiSQL is another piece of free software that can be

downloaded from the internet that is used to look at database

data and interact with it in a more user-friendly format than

what resides in SQL itself.

Q. And have you used MySQL and HeidiSQL to look at the data

that comes from the database servers?

A. Yes.

Q. What are file systems?

A. File system is -- so the operating system is what runs the

computer. The file system is how the operating system

interacts with the data on the computer.

Q. Okay. So it is the interface between the computer and the

storage device?

A. Yes.

Q. And what was Backpage using?

A. For the file system?

Q. Yes.

A. It was ZFS.

Q. Okay.

A. Or the Z file system.

Q. And is this a system that Windows-based forensics tools can

be used to extract information?

A. No. Windows-based tools can't read ZFS, Z pool, or any of

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 173 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

174

the data.

Q. Okay. What is -- a couple more things here. What is a

RAID?

A. RAID is a -- it's a redundant array of either independent

disks or inexpensive disks. It's a -- it's often employed in

servers where you have multiple drives, but the storage based

on, if you want quick access, you can create two copies and

read from and write from them independently, or you can do it

for security so that your data doesn't get corrupted. You have

spares and extra drives. And the data is striped or it's put

across all the drives, so if you lose one drive, you could

replace it and the data will rebuild itself and it won't lose

any data if a drive fails.

Q. What is a Z pool?

A. A Z pool is how the ZFS file system handles -- so the ZFS

file system, unlike normal operating systems, the file system

and the volume manager are integrated. So when I talked

earlier about the hardware, that's the hard drive. So when you

connect a hard drive to an operating system, it needs a volume

manager to tell it, you just connected a hard drive, what do

you want to do with it? With ZFS, the volume manager and the

operating system are all one and the same. So you -- where you

can have RAID with ZFS, there is actually Z RAID built in, the

ZFS operating system is built with security and integrity built

into the Z pool, so you can add disks, remove disks in any

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 174 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

175

order. The Z pool are the pool of drives. You could have one

pool, two pools, multiple pools that can grow exponentially

based on how much data you need. You can do file system

snapshotting, you can do all sorts of functionality with the

file system in relation to the hard disks and the drives stored

on it.

Q. And was Backpage using the Z pool?

A. Yes, they were.

Q. And so, in doing so, does it matter -- does it -- is there

any particular significance in which hard drive may have been

loaded first or turned on first and which ones came

subsequently after?

A. No. With the Z pool, when you interact with the Z pool, it

-- you can query -- well, you put all -- if all the drives are

there, it will power up, if it's not there, it may say, I'm

missing this drive. I'm operating in a degraded capacity. But

it would tell you which drives they're missing, which drives

you have. If you have the whole pool, half pool, it would give

you that information about the pool. Doesn't matter if I

connect drive one over here or drive one over here first or

last, if I've got all the drives, the pool just builds itself.

Q. And are you familiar with EnCase?

A. Yes, I am.

Q. What is that?

A. EnCase is an industry standard forensic suite tool to do

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 175 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

176

forensic examinations.

Q. Is it applicable towards which operating system?

A. EnCase runs on Windows.

Q. Would it be able to work on Linux based systems?

A. Yes. EnCase has some functionality to read some Linux file

systems.

Q. And then how about, what is FTK?

A. FTK is a forensic toolkit provided by AccessData. It's

another forensic suite.

Q. And is it -- which operating system is it used for?

A. FTK, the forensic toolkit runs on Windows also.

Q. Can it be used to look at data running under the Linux

operating system?

A. Again, it has some functionality with some Linux operating

systems, but not all of them.

Q. And so when you say some functionality, what does that

mean? Does it mean you can see part of it and not all of it or

what does that mean?

A. It depends on the file system. If it's an EXT2 file

system, yes, it can read it; if it's an EXT3, yes; EXT4 you

have partial interactivity, as in it may tell you there is some

folders there, but it might give you weird counts on file size

because it can't quite interpret the data correctly. The --

I'm sorry. Did that answer your question?

Q. To be able to ensure that you are properly reading and

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 176 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

177

interpreting data that comes off of a Linux operating server,

would you -- would EnCase or FTK be your tools of choice?

A. No, they would not.

Q. What would you use?

A. I would use native operating system tools or forensic tools

specifically designed for Linux and Unix forensics.

Q. And are these tools publically available?

A. Yes, they're all free. Any of the Linux open source tools

are free to download.

Q. Let's move forward and talk about how you search for

information with the data servers that you have now. Okay?

As part of your responsibilities in this case, are you

asked to search for certain pieces of data? Do you get

requests from other law enforcement agencies, state

prosecutors, federal prosecutors to search for ads that may

have been on Backpage before the takedown?

A. Yes, I do.

Q. And what do you do in those cases?

A. When a request comes in, I look at the request and see what

information they're requesting, then I take the information,

like an e-mail address or a phone number or a posting ID, and I

then query the database for information related to that request

specifically, and I search the database they have specified, or

marketplace.

Sometimes they request all databases to be searched,

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 177 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

178

and I can conduct that search, or a specific market like

Phoenix, and I conduct the search just on the Phoenix server.

Then once the ads are located or any ad data related to the ad,

I extract the ad and any related user data, the images,

information about the images, if there is invoices, anything

related to the ad in that aspect, I extract that and then

provide it back to them on optical media.

Q. And have you done that for the ads that are related to this

case like we discussed earlier?

A. Yes.

Q. Okay. Have you created a PowerPoint presentation to

explain to other people how the database works?

A. Yes, I did.

MS. PERLMETER: Okay. And can you pull up Exhibit

Number 9?

May I approach the witness, Your Honor?

THE COURT: Yes.

BY MS. PERLMETER:

Q. Mr. Frost, I'm going to hand you Exhibit Number 9.

Is Exhibit Number 9 a copy of the PowerPoint

presentation that you created to help explain the data as it

exists on the server?

A. Yes. It's a disk that contains the PowerPoint.

Q. And then did you review it this morning to make sure it

actually is a copy?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 178 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

179

A. Yes. I initialled the disk.

MS. PERLMETER: Move to admit Exhibit Number 9 into

evidence.

THE COURT: Any objection?

MS. BERNSTEIN: I'm sorry, what is Exhibit Number 9?

MS. PERLMETER: It's a PowerPoint presentation that he

created that shows the informational data.

MS. BERNSTEIN: I think -- I don't know anything about

this. I don't know if the foundation or the authentication is

laid for it.

MS. PERLMETER: So it is also marked as a PDF file in

Exhibit Number 5 which has the Bates stamps.

MS. BERNSTEIN: I'm not sure that that either lays the

foundation or authenticates it.

THE COURT: Well, he did lay the foundation that he

looked at it, and it's the PowerPoint that he created, he

checked it this morning and initialled the disk, so foundation

is laid.

But, I'm sorry, what you followed up with was

Exhibit 5?

MS. PERLMETER: Yes. So Exhibit 9 is -- that is the

PDF version of the PowerPoint and it is Bates stamped for the

defense to cross reference. The actual file and PowerPoint

format is Exhibit Number 9.

THE COURT: Okay. The objection is overruled.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 179 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

180

MS. PERLMETER: And, Your Honor, would it be okay if,

at this point, the witness stepped down to access the

PowerPoint off his computer? And, at this point, he's going to

be testifying off files that he has on his computer.

THE COURT: Yes.

THE WITNESS: So I just noticed it's HDMI here. I

could actually bring it up here, if you guys prefer.

MS. PERLMETER: Okay. Do you want me to do that?

THE COURT: If it's just as easy, then bring it up

here.

THE WITNESS: Yes.

BY MS. PERLMETER:

Q. Okay. So is this an excerpt of some of the data that you

have reviewed, specifically, is it as to the Phoenix

marketplace?

A. Yes, it is.

Q. Okay. And when you -- what was your purpose in creating

this PowerPoint? What were you trying to explain to others?

A. I was trying to explain to my supervisor the process I went

through to reconstruct an ad.

Q. Okay. So why don't we go to the next slide and --

A. Yes.

Q. And, tell us, what are we looking at here under name, and

it seems like it's going down now in alphabetical order.

A. Yes. So we see on the left-hand side there is a PHX

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 180 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

181

underscore Backpage, on the -- that's the database I've

connected to. On the right-hand side we have the tables that

are associated with that database.

Q. So ad is an example of a table?

A. Yes.

Q. And ad count is another table?

A. Yes, it is. Each of these are tables with -- contained

within the PHX underscore Backpage database.

Q. And through the next few slides are you just showing all of

the tables that were available in the Phoenix Backpage

marketplace?

A. Yes. Would you like me to click through those?

Q. And so are you familiar with what information some of these

tables contain?

A. Yes, I am.

Q. Can you give us some examples?

A. Yes. If I skip back. So the first one you mentioned is

ad, the ad table, that's the table that contains all of the ads

that are currently in the PHX underscore Backpage database.

Another one would be category at the bottom, that's one of the

fields within the ad database. This is where they started to

relate to each other.

Image, image would be another one. That's the

information about the images that were uploaded to the ads, and

those tables are correlated or related and they have pointers

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 181 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

182

back to each other.

Q. And so do you take the information from one table to help

you get to other information that may be contained on other

tables?

A. Yes.

Q. And are there also tables related to invoices?

A. Yes, invoice tables right there also.

Q. Okay. And is this an example of the way the relational

database works?

A. Yes, it is.

Q. And as you -- as you go through these slides, how would you

explain to someone how to make sense and analyze and understand

the data as it was available back on April 6, 2018?

A. Yes. Would you like me to just go through the

presentation?

Q. Uh-huh. Yes.

A. Okay. So if you select the ad database for Phoenix, this

is what a shortened version database looks like. These are the

-- going this way are the rows. Each one of these rows

signifies a new ad in the database.

As we go across this way, these are all columns that

have different pieces of the ad and different data about the

ad. This is shortened. There is 91 total fields, but that

wouldn't fit across the screen. I just took a screen shot of

the first portion.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 182 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

183

Q. And is this a capture in time at the moment the Web site

was powered down?

A. Yes. So any ads in the system are ads that would have been

on the day it was shut down.

Q. So the status column second from the right, where it says,

expired live, expired live, is that -- would that signify which

ads might have been live at the moment of the shutdown and

which ads might have expired?

A. Yes.

Q. Okay. Let's go to the next slide.

So can you explain to us how you relate the tables and

the information together?

A. Yes. So right here the, object ID, objid here that's

circled in the green box, is the -- what Backpage would refer

to as the posting ID. On the far right-hand side you see a

column marked user, that signifies the user or the unique

identifier for the user that posted this specific ad.

So on this one -- so if we're looking at ad with

object ID, objid 3723546, we see there on the lower left-hand

corner, we see it was posted by a user with unique ID 30414033.

Here I point to the user table. The user table,

because now we've identified a user ID, and now I'm going to go

to the user table to find out more information about that user

ID.

So here is the user table from the PHX underscore

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 183 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

184

Backpage database, and we see information here as we go across,

again, the objid. So each -- each row in the relational

database has to have a unique number identifier. These can't

be duplicated within the database itself or it would be a

broken pointer. So objid carries over for multiple fields.

We'll see that is the unique identifier for this piece of

information. As we saw before, the objid for the ad table was

the unique identifier for the ad specifically. Now the objid

up here is the unique ID --

Sorry about that.

The -- sorry. Back to user database. The objid here

is the unique identifier for the user. So in this case you see

a user with e-mail address, Wil at DesertNet. So if I want to

get information about Wil, I can search for his e-mail address

and find out what his user ID was. I can use that information

to find ads he had posted, which we'll see in just a minute.

So here I'm searching for user database for user

30414033. That was the user identified that posted that ad in

the first ad table in the lower left-hand corner. So I do that

as MySQL query right there. So I select star from user where

objid equals 30414033, the database then returns that

information associated with that unique number, if it's there.

In this case, we find that the objid is, again, listed there,

and it was -- has an e-mail associated with

Scottsdalegirlz@gmail.com.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 184 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

185

Q. So when you get a request from law enforcement to pull all

ads that could be associated with, for example,

Scottsdalegirlz@gmail.com, this is the process you would go

through?

A. Yes. I would a run a query similar to this instead of

objid, because if I didn't know the objid, I would search for

select star from user where e-mail equals

Scottsdalegirlz@gmail.com.

Q. So there are different ways to search depending on the

information that you have?

A. Yes.

Q. All right. I'm sorry. Keep going.

A. So now we go back to the ad database and we're searching

for user 30414033, again, that's the e-mail or the address the

Scottsdale girls that we just located based on the objid of the

first ad. So we had one ad that sent us to a user. Now from

the user I did a query to select star from ad to give me

everything from the ad table where user, the user column in the

database in the table equals 30414033.

So now we see right here there is 72 ads. So, again,

91, that's how many columns there are going across, and the 72

represents how many unique ads were posted by that specific

user.

Q. Okay.

A. So that was the original ad we searched for was the

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 185 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

186

3723546. And from here now we've located the user and the ad,

so the next step would be go to the images associated with this

ad, and to do that we go to image table in the PHX underscore

database.

Q. So, at this point, you've been working with information

from the master database, or like at least the Phoenix Backpage

database?

A. Yes.

Q. And the images are on a separate server?

A. The images themselves are but we're still piecing together

an ad, so now we're going to the image table in the PHX

underscore database to find out information about the images

associated with that ad specifically.

Q. Okay. So you're basically going step-by-step to get the

information you need relating back and forth between the

tables?

A. Yes.

Q. Okay.

A. Up here we see the SQL query I ran, select star from image,

image table where at equals 3723546. So this would give us all

of the images that were uploaded to that one specific ad. In

this case, we see there are five of them.

Q. And from here does that -- is that the pointer directing

you where to go to find the actual pictures themselves?

A. Yes. So there is a couple more steps still. So this is

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 186 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

187

just a zoomed in version of the large path. The large path is

one of the columns in the image table for this specific ad, and

it gives us this piece of information here, which is another

unique identifier for the image itself. It also gives us the

image file names, so there is the name of the image file that

was uploaded.

So from here I would use this unique ID, that's just

telling us you go to that slash and that's the unique

identifier. That's the number. There they are.

Okay. So now I go to the images database, which is a

separate database from the PHX underscore Backpage database.

And here I do a select star from uploaded image. Uploaded

image is the table inside the images underscore Backpage

database. And I search for the objid 6889523. Again, so there

we search for one specific object ID, or one specific image.

And this can be done at bulk. I don't have to do a single

query, I could do hundreds, or if not thousands of queries all

at once.

So we search that database. There is the information

we search for again. So now we locate the path name you see

I've highlighted in red over there.

So now this is zoomed in just on the column of path

name. So here we see the entire path, so from here I see it's

image 12009082009. Here's the file structure for -- that

points me to the exact location of the image file that ends in,

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 187 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

188

dash, dash, large dot JPG, that I could go to and then I would

copy out that image file to put with the other ad data I have

extracted along the way.

Q. So you just said you have to look in different places, but

all of the information is the same and it's there, you just

kind of have to know where to look for it?

A. Yes. This is just a simplified step-by-step walking

through the process of putting all the information together.

Q. Okay. And what information do you have to know to be able

to run these queries? Do you have to be familiar with SQL?

A. Yes. You would have to have familiarity with the SQL

language to run the queries to find the information you want,

and familiar with the databases and how it stores the data to

piece it all back together.

Q. Can you -- is there anything else you would like to tell us

about this PowerPoint you prepared?

A. I think that's it.

Yes. Questions?

Q. Can you also now show us, or give us a live demo on how you

can query for searching things off the Backpage servers or off

the databases?

A. Yes, I can.

Q. So you didn't bring all of the databases with you. Did you

extract a small portion of it onto a virtual machine to be able

to make this presentation in court today?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 188 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

189

A. Yes, I did.

So I extracted a -- from the database I extracted, I

copied one of them to my laptop. On my laptop that's running

Windows 10, I have VMware Workstation, which is a

virtualization software that allows me to run virtual machines.

Inside my host operating system of Windows, I could run Linux

operating systems.

So --

Q. So for purposes of your demo today, are we going to be

talking about information that is contained within the

Washington, D.C., database?

A. Yes. I have extracted -- if you see right here, the HUP

001982-IDA underscore Backpage dot SQL, um, that tells me that

the evidence item that I've labeled in my lab HQP 001982, I

extracted IAD underscore Backpage, which is the Washington,

D.C., marketplace.

Q. And which programs or tools are you using to be able to run

this demo?

A. So the operating system here is Mint, which is a Linux

distribution, again, free to download that I downloaded the

MySQL application, and I'm running the service to host the

server on the system. I then took this file, the dot SQL

format, if you see that, and I imported it into the MySQL

server running on this virtual machine.

Over here in this window, you see that that is the --

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 189 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

190

that is the dot SQL file that I've opened up in a text editor,

because a SQL file in the SQL database, it's all just text. So

as we saw before, everything is text. This information tells

me the host, the server version, the OS version. As you see,

all this information here --

Is there a way to zoom in on this thing?

COURTROOM DEPUTY: No.

THE WITNESS: Okay. This information here matches up

with FreeBSD. It tells us information about the server. It

tells us right here the table is IAD underscore Backpage, and

then here's the table of information, you'll see LBID create

date, again, all of those categories we saw all the table

information is stored in this single text file it's about SQL.

BY MS. PERLMETER:

Q. And are you able to ingest it or import it into another

tool so it becomes a little bit more user friendly?

A. Yes. So I -- if we step back out of my virtual machine and

go to my host operating system of Windows, I have the program

HeidiSQL, that's another free program I downloaded from the

internet that interacts or it's a database for SQL servers.

Q. So here are we able to see the same tables that may be

available and different types of information?

A. Yes.

Q. Okay. So what -- if I were to ask you if you could run a

query to see how many ads -- how many automobile ads may have

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 190 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

191

been posted on the Washington, D.C., database?

A. Yes, but my laptop sat idle, so I just have to reconnect to

the database if you can give me just one second.

Here you can see I'm connecting to host IP

19216843128, that's the IP address of the virtual machine

running on my computer.

Okay. So now I've connected. We see HON underscore

Backpage, I connected two different databases. But there is

the IAD we spoke of before.

And your request was for automobiles?

Q. Yes. So if you wanted to know how many automobile ads may

have existed in Washington, D.C., on April 6, 2018, how would

you do that?

A. So I would go down to the section table to get information.

I double click on it. It brings it up here. I click data.

This gives me the object ID or the unique identifiers

associated with the different fields.

Your request was for --

Q. You know what -- yes, it's for automobiles, but before we

go there, yes, can you tell us about the different -- what does

this ID column tell us?

A. Yes. The ID columns tells us which category the ads were

loaded to, whether it was employment services, real estate

rentals, buy/sell, musician, adult, community, dating,

automotive places. And then the far right-hand side, that's

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 191 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

192

the unique identifier I would use to search for a specific ID.

Q. Okay. So we're doing a search for automobiles, but one

could also do a search for jobs, things for sale, things for

trade, dating, and perhaps even adult ads?

A. Yes.

Q. Okay. All right. So how do we go about finding the

automobile ads?

A. So for automobile, the objid that's -- I'm going copy it

here. I'm going to go to my query field. Select star from ad

where section equals. Paste that number in. So there is our

unique -- the unique ID for our automobile based on the section

table.

Now we run the query. And there it gives us 2,883

unique ads under the section automobile.

Q. Okay. So at the time the Web site was shut down, there

were roughly 2,800 automobile related ads on the Washington,

D.C., database?

A. Yes.

Q. Okay. And if you could just walk us through here. What

are these other fields and what kind of information does it

provide?

A. Yes. So here -- before where we saw the shortened version

from my PowerPoint, now we're able to look at every single

category. And I could query -- I could ask for specific

information, instead of the star which is giving me everything,

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 192 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

193

I could change that and ask for a specific field, like give me

the users or the ad.

Let me scroll across here. We see there is a category

and section right here by section. Again, we search for the

section, so you noticed all the section references are the

exact same we searched for based on relational database model.

Going across, we see the user field right here, so

this gives us all the users that posted each -- each ad. And,

again, each row is a unique ad.

Going across from here, contact phone numbers, white

list, header, title, ad, so now -- if I was interested in this

ad, the second ad, I can double click and it gives me all of

the text that would have been in the body of the ad itself.

Q. So you can find not only the title of the ad, but all of

the text that is within the body of the ad, such as how many

miles may have been on the car, what year the car is, how much

the seller is asking for, anything that the user may have

provided?

A. Yes, any information they put in their advertisement would

be in the ad field.

The next ad -- or the next column would be has image.

And so if we went to an ad, where we see on this one it is,

yes, that it has images, so then I would know to go look at the

images table and look for the images associated with that ad.

I was going to continue going across, if you'd like me

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 193 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

194

to. Region, age, price, salary, here's IP address. Again,

more -- more of the 91 fields. Search, the tier, the online

price, ad price, pay type, approval code. Here we get some of

the invoice information.

Q. So when -- when the defense was asking Mr. Gerken about the

administrative data that wouldn't be made available to the

public -- are you familiar with what I'm talking about?

A. Yes.

Q. The stuff in the yellow box? Is that information available

here in this database?

A. Yes. So all this information wouldn't have been displayed

if you clicked on the ad. This is everything about the ad in

the ad table.

Do you want me to continue explaining, talking?

There is a violation field with information about said

violations. There is a moderation tab with moderation log.

Q. And then there is a central server update?

A. Yes. Yes, where we can see not all ads are uploaded to

central.

And that's the end of the ad table.

Q. Okay. And then, I guess, slightly differently, if you were

approached and said, hey, I am investigating a case. I'm

looking for some information from a particular e-mail. I'd

like to know if this particular e-mail address has posted any

ads. Would you be able to see, just with the e-mail alone, if

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 194 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

195

that e-mail address has ads associated to it in any other

categories: Buy, sell, trade, employment, adult, et cetera?

A. Yes. With an e-mail address, I could do a query for that

e-mail address, and then from the user look at all ads they

posted.

Q. Okay. So why don't we try sexy young girl at live dot com,

so it's sexy, underscore young, underscore girl, at live dot

com, and see if there are any ads in the Washington, D.C.,

database?

A. Underscore girl?

Q. Underscore girl.

A. At Gmail dot com?

Q. Live dot com.

A. Sorry about that.

So now I'm going search star from user where e-mail

equals that e-mail address.

Yes. So we see there is the e-mail. There is a

unique ID. And this -- so this is a user table. This would be

the information about the user on the PHX underscore back IED

database.

Q. Now you're free to go forward from here if you wanted to

get more information about what ad was posted, or perhaps how

many ads or where in which categories, what would you do?

A. So then I would take the object ID here, copy it and do a

select star from ad where user equals that user.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 195 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

196

So now we see the user ID was 890121. So if we go

over to the user column, which is right here, we see the same

user and we see there were 42 unique ads on the IED databases

at the time of seizure.

Q. And then could you go -- could you then go a step further

and see what category this person's ads were posted in?

A. Yes. So, again, those columns are here somewhere. Where

is column?

Category and section are here, so we can search the

category or the section. So section is 4381, category is 4443,

if we can remember those, 4381. So then I would go to the

section table and look at the data, and it was 4381 was the

section, which is adult. Adult is the ID for the section.

Q. Okay. So we know that this particular ad from sexy young

girl at live dot com was in the adult section?

A. Yes.

THE COURT: Counsel, I'm going to stop you there so we

can take a break. We'll break for about ten minutes.

(Recess 3:12 p.m. - 3:23 p.m.)

THE COURT: And before you get started, I know that

some of you are worried about the time, so at 4:30, 4:45, then

we'll talk about that.

Go ahead.

CONTINUED DIRECT EXAMINATION

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 196 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

197

BY MS. PERLMETER:

Q. Mr. Frost, after you're done researching the database and

pulling the information that you need, how do you then transmit

that to the requester?

A. For -- if we're talking this specific one with this user

ad, I'll grab the ads and then the images, and from this thing

we just right click, export rows, and then I export them in the

Excel CSV format. In this case I'm just exporting to --

MS. BERNSTEIN: I'm sorry, Your Honor, I can't hear

the witness. If he could --

THE WITNESS: Yes. So I right click, click export

grid rows, brings up this dialogue box, including column names.

And this is including everything, like a minimizer, I could get

select information if I wanted to, ads. And then I click okay.

And it saves it out to that Excel file. Then I would take that

Excel file right here, again, we see it contains the same

information, they're just scrunched down from Excel, but we

still see the user information, that same user we searched for.

I would take this information, the CSV and the images, copy

them to an optical disk and then ship it to the requester.

BY MS. PERLMETER:

Q. So the person who requested the information would be able

to review the information without having -- without needing to

know SQL or being able to run queries?

A. Correct.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 197 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

198

Q. I want to move on.

Did you have an opportunity to review a declaration

that was prepared by a Tami Loehrs which is on the docket as

7171?

A. Yes, I did.

Q. And in part of that declaration did she say that the

government did not meet industry -- or minimum industry

standards for the electronic data seized and that the data is

completely unusable in its current form?

A. Do I remember reading that? Yes.

Q. Yes. Do you agree with that statement?

A. I do not.

Q. Why not?

A. I used our industry standard forensic tools for Unix

forensics, I copied them out, hash verified them and provided

them on media that was related to Unix/Linux and the exam was

in that realm.

Q. And did you just provide a demonstration today about how

one would use the data?

A. Yes.

Q. Did you also read Ms. Loehrs's opinion that most of the

data acquired by the government was not produced in an industry

standard format and is not forensically sound because it was

created with an unknown program and then the person wasn't

informed what program was used? I'm summarizing, but did you

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 198 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

199

read that?

A. Yes, I did.

Q. So do you agree with that statement or disagrees?

A. I disagree.

MS. BERNSTEIN: Objection, Your Honor. I think that

misstates the declaration.

MS. PERLMETER: Yeah. And I said I summarized.

THE COURT: Objection overruled.

MS. BERNSTEIN: I wouldn't agree that's a summary.

THE COURT: Well, the objection is overruled.

THE WITNESS: I disagree.

BY MS. PERLMETER:

Q. I'm sorry?

A. Yes, I disagree with that statement.

Q. And why do you disagree?

A. Could you read the -- could we rephrase the statement?

Q. Okay. Well, was the information created with unknown

programs?

A. Oh, um, no, it was not.

Q. Okay. What programs did you use to access this

information?

A. The standard Unix/Linux forensics imaging tools with hash

verification, industry standard for a Unix/Linux examination.

Q. And were the programs that you used and the programs that

the defense might need to also conduct their examinations, was

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 199 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

200

that information conveyed to them in the conference call that

occurred in February of 2019?

A. Yes. I informed them the architecture of the servers, the

differing levels, then I provided a separate, more easily

accessible SQL format that they could just ingest into a SQL

format as I demonstrated today on my laptop.

Q. And the tools they might want to consider using, are they

publically available?

A. All of them are publically available, free to use open

source tools.

Q. Are the image files you have created forensically for

forensic purposes, are they corrupt?

A. All of them were hash verified to -- as in they match the

exact copy when I created them. And when I moved them to the

hard drive, then I verified it after I copied them to the

standalone hard drives.

Q. Do you also recall reading that the integrity of the data

has been destroyed in a number of ways?

A. I do.

Q. Do you agree with that?

A. I do not.

Q. How come?

A. Again, the data and the integrity thereof was preserved in

industry standard expert witness file format E01 image files,

and, again, hash verified to match the original.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 200 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

201

Q. And then I just kind of want to clarify the timeline a

little bit. The conference call that you participated in with

the defense team, members of the government and the case

agents, was that in February of 2019?

A. Yes, it was.

Q. Okay. And then at some point was it some point after when

the defense came and did a physical inspection of the servers

that were located in Idaho?

A. Yes.

Q. Okay. So the phone conversation happened first, and then

the inspection in Idaho happened second?

A. Yes.

Q. Okay. Has there also, or have you provided testimony

related to your work on the Backpage databases in court?

A. Yes. Yes.

Q. Explain -- I mean, have you explained in court or have you

testified about the databases, about how they relate to each

other and how the data is extracted?

A. Yes. In this court today and also in federal court in New

York and in Maryland.

Q. And then did one of your colleagues also provide similar

testimony?

A. Yes, in New York federal court again.

Q. This was testimony that was provided within the last year?

A. Yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 201 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

202

Q. Now, you have also heard discussions about -- today about

reconstituting the Web site to the exact same way that it was

on April 6th, perhaps a closed version where it would not be

accessible to the outside world, and you've also heard about

using two servers to pull the world of information related to

the ads to be able to see the information that may have been on

any particular ad.

No matter how you look at it, is the information

different depending on the platform in which the viewer looks

at it?

A. No. Again, the data is the data.

Q. Okay. Is it in -- is the data that you have -- that has

been provided in this case, is it functional?

A. Yes. As I demonstrated, it's easily accessible,

functional, and readable.

Q. And it is usable by someone who is able to understand how

the data should be used and which tools and programs may be

needed to be able to use it?

A. Absolutely.

MS. PERLMETER: I have no more questions.

THE COURT: Cross.

THE WITNESS: Did you want this back?

THE COURT: You can just leave it right there.

THE WITNESS: Okay.

CROSS-EXAMINATION

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 202 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

203

BY MS. BERNSTEIN:

Q. Good afternoon, Mr. Frost.

A. Good afternoon.

Q. Do you have Exhibit 103 up there?

A. Is that this?

THE COURT: No.

BY MS. BERNSTEIN:

Q. I don't believe so.

THE COURT: Traci is going to get it for you.

THE WITNESS: I do now.

BY MS. BERNSTEIN:

Q. And I'm going to put this on the ELMO, if that can be

displayed, please.

Let me know once you've had an opportunity to flip

through all the pages that make up that exhibit.

A. I have.

Q. Now, I think one of the last things you just testified to

was that no matter what format you're viewing this data in, the

information is all the same; is that correct?

A. The data is the same, yes.

Q. The data is all the same. So what changes is the ability

to use the data, the ability to understand it?

A. Is that a question?

Q. I can rephrase.

In your own words, what would be the difference

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 203 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

204

between the multiple screens that you just walked us through in

various programs and what we're looking at right here on

Exhibit 103?

A. Um, I would call this a user friendly format.

Q. Okay. And I have to admit, I didn't understand a lot of

the MySQL, HeidiSQL, FreeBSD things that you were saying, but I

can understand this. Does this -- is it a fair

characterization that this is also an attorney friendly format?

A. I would say if an attorney can read a spreadsheet, the data

in this is the same, so I would think you could read both of

them and get the same information out of them.

Q. Okay. Well, let's talk about that for a second.

We referenced -- she referenced the February call that

we had earlier this year, correct?

A. Yes.

Q. And in that call I had asked if you would send us samples

of the ads, correct?

A. Yes, I believe so.

Q. And you provided us with samples of the exported CSV file

that you created, correct?

A. Yes, I did.

Q. Did you actually create the CD that was sent to us?

A. I don't know which one you received. I created copies and

sent them to my Phoenix FBI division.

Q. There is some notation on here.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 204 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

205

MS. BERNSTEIN: May I approach the witness and see if

this is his initials?

THE COURT: Yes.

THE WITNESS: Nope.

BY MS. BERNSTEIN:

Q. Okay. Okay. So you -- I just want to recap that. You

sent us a -- you created the samples -- you create samples of

the CSV file of ads that were in the indictment, correct?

A. Yes, I did.

Q. And you provided that to the government?

A. Yes.

Q. And the government provided that to us, presumably, as far

as you know?

A. Yes.

Q. I want to show the witness what I'm marking as Defense

Exhibit 120.

If you can unbind that and take a look at that for me.

MS. PERLMETER: Your Honor, just for organization, can

we have a list of the exhibits that the defense intends to use

for this witness right now and then for any other witness later

on?

THE COURT: Do you have a list?

MS. BERNSTEIN: I don't, unfortunately, but we can

endeavor to do that in the future.

THE COURT: Okay. At the end of the day I'll ask you

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 205 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

206

to get them a list.

BY MS. BERNSTEIN:

Q. Did you get a chance to flip through that?

A. Yes, I flipped through some of the pages.

Q. And do you recognize this?

A. Yes. It appears to be a printout of the Excel spreadsheets

that I produced.

Q. And the Excel spreadsheets that you produced is the export

that you made of your recreated database of the ads; is that

correct?

A. Not a recreated database, but an extraction of the data

contained in the database that I put on optical media.

Q. So the data -- well, I'm sorry. Is this a fair and

accurate depiction of the spreadsheet that you made, printout

of it?

A. I mean, it's a printout, it's spread over multiple pages.

I mean, on the -- when you look at it digitally, it's much more

concise and consolidated and easily viewed.

Q. Is there anything different between the digital

representation and this representation, as far as you know?

A. Just how you space and format. You could change box sizes,

shrink them, expand them.

Q. But the information contained therein is an accurate and

fair depiction of your chart?

A. Yes, if you printed off what I produced, then yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 206 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

207

MS. BERNSTEIN: So I would move Exhibit 120 into

evidence at this time.

THE COURT: Any objection?

MS. PERLMETER: Well, I just have some questions,

because there is page numbers, and some of the pages they're

not numbered in order. It goes up to -- I'm skimming through,

since it was just provided moments ago -- looks like it goes up

to 400 and then it drops back down to the single digits, then

there is some pages that don't have any page numbers. There

is -- there is some pictures, there is Excel spreadsheets. I'm

not sure what this exhibit represents.

THE COURT: Who prepared this?

MS. BERNSTEIN: This was a printout of the

spreadsheets that were given to us by the government.

That's what the witness just identified it as as well.

THE COURT: Well, you asked him if it appears to be.

When you printed it off, did it come with these

numbers?

MS. BERNSTEIN: Yes, Your Honor.

THE COURT: So do you want to ask the witness some

voir dire?

MS. BERNSTEIN: I'm sorry?

THE COURT: I'm asking if they want to voir dire the

witness.

MS. PERLMETER: Sure. Yes, Your Honor.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 207 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

208

VOIR DIRE EXAMINATION

BY MS. PERLMETER:

Q. Mr. Frost, regarding Defense Exhibit 120, while it may

generally look like a printout of the spreadsheet data, can you

say at this point in time whether it came from the same source,

if it's a combination of different Excel spreadsheets, or if

it's a combination of pieces of paper printed from different

sources?

A. The optical media I produced that had the extractions from

the ads would have had multiple spreadsheets, so if they

printed out each of the individual spreadsheets, then the

numbering might be different, so it's -- I mean, I can only

assume it's everything. I didn't look through all the pages,

but, again, I produced an optical media with digital content

and this is a printout.

Q. Do you think this is the information that you provided to

the defense in that CD she showed you?

A. I could assume so. Without looking at the CD I created and

comparing every ad, then I am willing to assume it is based on

what it looks like.

Q. If you had more time to, perhaps, take the actual CD and

then compare it with the printed versions of the information,

would you be able to state with more certainty whether or not

it was the same?

A. Yes. On the CD I have each of the spreadsheets labeled,

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 208 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

209

images, ads, user information organized so I can go to the user

table and find out what user posted which ads, or I can go to

the ads table or the invoices and they're organized that way.

This way I would have to search through and figure out which

table is what.

THE COURT: Let me interrupt. Let me ask you this.

As a generality, if you took something from the CD you produced

and printed it out, would it generally have this format?

THE WITNESS: Yes. Based on, you know, if -- in Excel

you can spread a column way out or scrunch it way down, but it

would have rows and columns then look similar to this.

THE COURT: Okay. So here's my problem. He obviously

hasn't looked at the exhibit before. But I think Exhibit 120

could be admitted for demonstrative purposes but not for the

truth of what the actual data is that is contained within here.

MS. BERNSTEIN: That's fine. Thank you, Your Honor.

THE COURT: Do you have any objection you want to

state on the record?

MS. PERLMETER: No, Your Honor.

THE COURT: All right. Exhibit 120 will be admitted

for that purpose.

CONTINUED CROSS-EXAMINATION

BY MS. BERNSTEIN:

Q. So I want to draw your attention back to what I have on the

screen, which is Exhibit 103.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 209 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

210

A. Yes.

Q. Are you able to see -- is that on your screen?

A. Yes, it is.

Q. Okay. And so we've heard a lot of testimony today about

how the information is all the same, no matter the format in

which it's produced, correct?

A. The data is the same?

Q. That the data and the information is the same no matter the

format in which it's produced?

A. Correct.

Q. And you've heard that testimony because you've been sitting

in this courtroom this entire day as well?

A. Yes.

Q. Okay. In Exhibit 103, which is up on the screen, I can

see -- I'm going to move it up a little bit. Do you have the

physical paper there as well so you can look at whatever you

want?

A. I do.

Q. Okay. So I'm going to scroll this up a little bit. And do

you see where, down here, where it says deleted images,

administrators only?

A. I do.

Q. And then underneath it says, click to restore or fully

remove the deleted image?

A. Yes, I see that.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 210 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

211

Q. And then down below there is also the option to keep

deleted, restore, or remove?

A. Yes.

Q. Can you show me where I could find that information in

Exhibit 120?

A. In here?

Q. Yes, please.

A. Yes, so we could go and pull up the images table, or images

database -- is this ad from this information?

Q. Can you tell me how I could even tell that?

A. Yes. So in the images table --

Q. Well, I'm sorry to cut you off, but can you do that for me?

Can you see if the ad that I'm showing you is in this -- is in

Exhibit 120?

A. If I look through all of them, I could look for the posting

ID and then find it, yeah.

Q. And can you show me how I would do that? Is there a

specific page you would start at or what would you do?

A. I would open the spreadsheet in my computer and search for

the posting ID in Excel.

Q. Okay. And where is the posting -- well, let me -- your

Excel spreadsheet, it has 91 columns, if I remember correctly?

A. Yes, it does.

Q. So that's 91 separate pieces of information, correct?

A. Ninety-one columns, yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 211 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

212

Q. What does each column represent?

A. It's a field that could contain information.

Q. And what else could it convey, if not information?

A. It could be blank or empty.

Q. What would that signify if it were blank or empty?

A. That there was no information in that field.

Q. So each of the 91 columns on your spreadsheet pertain to

different pieces of information, correct?

A. Yes. Some of them have data, some of them may have been

blank or zero.

Q. And all 91 pieces -- all 91 separate columns of information

is contained succinctly in Exhibit 103; is that correct?

A. From the 91 columns?

Q. Yes.

A. No. Again, there was additional tables with additional

information. So you have a lot more information than is

displayed here.

Q. I'm sorry, which one has more information?

A. The database has more information than is just displayed

here.

Q. Such as?

A. It doesn't have the hash of the images, whereas you have

the hash of the images uploaded in the database. I don't see

many date timestamps. I see a posted date, but there is a

modified date, create date. Again, there is much more

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 212 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

213

information in the database than the smaller version here. So

if you wanted all the information, the database would have it,

here, again, is a subset of what all the information is.

Q. So if I'm understanding what you're saying, there is

information in the database that is different than the

information that is in the administrative report that existed

when the Web site was live?

A. It appears the administrative report is a smaller set of

all the data about a particular ad.

Q. And you indicated that one of the distinctions is the hash

values for the images?

A. You asked for differences. I don't see anything where it

says hash value in the image and the name, whereas -- and the

database we can find what the hash of the image is, so when I

pull out a hash or pull out the image, I can then hash it and

verify and say, yep, the database says this number, that's the

number I got. This image is the exact image that I extracted

that was uploaded that is in the table. And I don't see that

information in the admin view that we're viewing now.

Q. Can you tell me which column of your 91 correlates to the

hash value of the images that you're talking about?

A. So the, again, so the 91 columns, that's just the ad

information. There are additional tables that I showed before.

There is the image table. There is the uploaded image table.

And these are additional tables, additional information from

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 213 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

214

the relational database I discussed earlier that convey

information about the ad.

Q. Okay. Then let me limit our conversation to just the table

that we just looked at, for what felt like hours, with 91

columns on the top. Is there -- and that represents 91

different pieces of information. Am I understanding your

testimony that those 91 pieces of information are not what is

contained in the object editor and administrative data of the

ad when it was live?

A. Some of this data is from the ad table, some of it, like

the -- like the e-mail is from the user table, which is

separate from the ad table. So the administrative view is

pulling from additional tables that I referenced earlier, but

not all of them are in the ad table with the 91 columns we

looked at specifically.

Q. I'm not sure I understand that. I'm going to leave it

alone for a moment and I'm going to show you what I'm marking

right now as Defense Exhibit 121. And this is Exhibit K of the

motion to compel. It's already in the record at docket 623-12.

A. I've reviewed the data, or the document.

Q. I'm sorry?

A. I've reviewed the document.

Q. I'm sorry. I've been having trouble hearing you, so I

apologize. Maybe if you could -- yeah. Thank you.

Do you see what I have up on the screen?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 214 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

215

A. Yes.

Q. And does this appear to you to be a list of multiple

changes and modifications with different dates and times by

different users that was made to an ad?

A. I could see it says last modified Wednesday, earlier change

Monday, Monday, Monday, June, Sunday, yes.

Q. Now, is it your testimony that this information is

available in Exhibit 120 or Exhibit 104 or -- is it available

in Exhibit 120 or 104?

A. I would have to look up this specific ad information and

look through all the tables to see which table -- or what date

timestamp. Since I didn't create this, I don't know what

earlier change is referencing what column, what cell. I mean,

there is -- there is many timestamps, so where these are

pulling from, I don't know.

Q. Me neither.

I'm going to show you Exhibit 104. Do you have that

in front of you as well?

A. I do.

Q. Okay. On Exhibit 104, what I have just put up on the

screen, do you see where it has a creation date?

A. Yes.

Q. It has a last modified date?

A. Yes.

Q. And it has a last edit user column?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 215 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

216

A. Yes.

Q. It doesn't appear to have iterations of moderations or

edits to the ad, does it?

A. In this particular field, no.

Q. Are you aware of all 91 fields in your chart?

A. Ninety-one fields, yes, but the databases are massive and I

haven't looked through every single one of them and every date

timestamp.

Q. Well, I'm not asking you if you have looked at every one

and the date and timestamp. I'm asking you if the charts

you've created contained the information that was available

when the Web site was live, which included all iterations of an

edit to an ad, date, time, and user. Are you familiar with

whether your chart contains that information?

A. My information that I produced contains the information of

the ad in the database where I pulled the data from.

Q. Yes. I've heard you say that. But what I'm asking you is

if your database -- if your charts, excuse me, contains all

versions and edits to an ad by date, time, and user?

A. The information I extracted does not.

Q. Okay. Thank you.

MS. PERLMETER: Your Honor, just maybe to clarify

things. I don't know if the defense is trying to suggest that

the ad data in Exhibit 121 is the same ad as in Exhibit 120 or

if she is just asking questions generally, because -- but if

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 216 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

217

she wants to make the link that 120 and 121 are from the same

ad, then I think that foundation should be laid before the

witness is asked if it's the same ad.

THE COURT: I understood it to be a general question,

not specific to any one ad.

MS. BERNSTEIN: It was, Your Honor. And I don't think

the witness had confusion when answering the questions.

THE COURT: Is that your understanding as well?

THE WITNESS: That just in general this ad -- or we're

talking -- she asked if the ad tables -- only the ad table, 91

rows, contained this information. And my ad table does not

contain this information.

MS. BERNSTEIN: Yeah, that's all. Thank you.

BY MS. BERNSTEIN:

Q. Mr. Frost, you never worked at Backpage.com, correct?

A. Correct.

Q. You never saw the Web site while it was live, correct?

A. Correct.

Q. You never worked at DesertNet?

A. I did not.

Q. You were never otherwise involved in the creation of the

Backpage IT system?

A. Correct.

Q. You were never involved in the maintenance of those

systems?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 217 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

218

A. I was not.

Q. You have corresponded and spoken extensively with

Mr. Gerken who was the -- is the CEO of DesertNet; is that

correct?

A. Yes, I have.

Q. You have also corresponded and spoken extensively with

Chris Kempel who is the former CTO of Backpage?

A. Yes, I have spoken to Chris Kempel also.

Q. Mr. Gerken and Mr. Kempel have told you most of you what

know about the functioning Backpage.com systems?

A. They gave me an overall picture, yes.

Q. And that overall picture emerged when?

A. Once I had received the servers and started to analyze the

data is -- I was asking questions to enhance the speed of my

review of the data to get access to the ads and images.

Q. In April of 2019 you provided Special Agent Robinson with

189 pages of e-mails between you and Wil Gerken; is that

correct?

A. Yes, I did.

Q. I'm sorry?

A. Yes, that is correct.

Q. And those e-mails spanned five months?

A. I don't remember time frames, but I provided the e-mails to

Special Agent Robinson.

Q. Okay. You seized these servers in April of -- or not you

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 218 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

219

personally, but the government seized these servers in April of

2018, correct?

A. Yes.

Q. You began communicating with Mr. Gerken when?

A. Maybe when I was in Phoenix the first time in late April,

early May, maybe when I was in Pocatello, I don't remember the

exact time frame, but it was spring-ish before -- summer before

I went, or in that time frame.

Q. And that's 2018, April, May of 2018?

A. Yes.

Q. Okay. And you provided Special Agent Robinson with these

e-mails in April of 2019, correct?

A. Correct.

Q. And had you communicated with Mr. Gerken continuously

throughout that time?

A. Off and on.

Q. Okay. Have you reviewed those e-mails?

A. I have not.

Q. Okay. Did you ever write a report or a summary of what you

learned from Mr. Gerken?

A. No.

Q. You never provided the information you learned from

Mr. Gerken to the defense, did you?

A. Everything I received from Mr. Gerken was in my e-mail and

I forward that on with -- knowing they would go to defense.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 219 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

220

Q. Do you know when it arrived to the defense?

A. I do not.

Q. Would it surprise you to learn it was Monday last night and

we have a disk of some I haven't had a chance to review yet?

A. If that's the date it happened, then --

Q. And, again, these are your communications from April of

2018 --

MS. PERLMETER: Objection. Calls for speculation as

the date of disclosure.

THE COURT: The objection is overruled.

BY MS. BERNSTEIN:

Q. These are your communications from April of 2018

continuously through April of 2019 when you provided them to

Special Agent Robinson?

A. Yes. It would have been an e-mail I sent or received from

Mr. Gerken during that time frame.

Q. Okay. I want to talk about the information that you got,

the demonstrative that you gave us of your systems and how you

got this data.

What tool did you use to extract the information from

the servers that you had?

A. The HeidiSQL was the tool I used to extract the databases

and the ads, if that's what you're asking.

Q. Let me back up all the way up.

You fly out to Phoenix, and at some point what arrives

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 220 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

221

in Pocatello are servers and hard drives, correct?

A. Yes.

Q. What did you do with the servers and hard drives?

A. I imaged the hard drives contained on the servers.

Q. How did you do that?

A. With Linux forensic software.

Q. What program?

A. FTK Imager Command Line.

Q. You used FTK Imager for them?

A. It was one of them. I could have used another imaging

tool, but primarily it was FTK Imager Command Line.

Q. Okay. And when you image a drive, the acquisition data

actually denotes the tool that you use to image it; is that

correct?

A. If you're talking FTK Imager, when used Imager, it creates

that text file that includes that information, yes.

Q. And what is ADIS?

A. If I could see it in context?

Q. Yes. Just one moment.

Do you see where it says acquired using?

MS. PERLMETER: Can we get this marked as an exhibit?

MS. BERNSTEIN: Sure. This will be Defense

Exhibit 122.

MS. PERLMETER: Can I have a copy, please?

THE COURT: Isn't this -- we've seen this before.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 221 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

222

MS. BERNSTEIN: It's a screen shot of the presentation

we've just watched.

THE COURT: Yeah.

MS. BERNSTEIN: But, sure.

BY MS. BERNSTEIN:

Q. Do you see where I'm pointing?

A. Yes, I'm sorry. A screen shot of which presentation?

Q. Of the information that -- when you go into a drive, what

you see when you go into that drive?

A. Oh, okay.

Q. And all I'm trying to establish, you indicated that you

weren't sure what -- I think I said it wrong -- but you

indicated you weren't sure what ADI3 was, so I'm just trying to

establish what program that is that you used to image the

drive?

A. That's AccessData Imager 3, version 3-ish.

Q. And is that FTK, AccessData Imager?

A. Yeah, FTK Imager.

Q. So FTK Imager is the tool that you used to get into the

servers and the hard drives that you received?

A. To create the images?

Q. Correct.

A. Yes. I used AccessData Command Line Imager tool to create

images of the physical drives from the servers.

Q. Did you use any other tools?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 222 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

223

A. Yes.

Q. What other tools?

A. I used additional Linux boot CDs, um --

Q. Linux boot CDs?

A. Linux boot CDs, yes, a bootable CD that runs Linux tools.

Q. Is there a specific program name associated with that?

A. Um, the CD is a compilation, so the FBI has one that the

FBI program is produced, it's a cart boot media. That is one

tool I use. The primary tool I use for imaging would be the

FBI's forensic boot or Linux boot media.

Q. The primary tool that you used for imaging is the FBI's

forensic Linux boot media?

A. Yes.

Q. Okay. Is that a proprietary FBI program?

A. The CD is a compilation of the tools that are available on

Linux that the FBI has packaged together on one distribution.

Q. Can I go get that FBI Linux boot CD?

A. It's law enforcement only but you could get all the tools

on there. They're open source and free.

Q. And were there any other programs that you used to image

the drives and the servers that you received into 2018?

A. Without reviewing all of the dozens of log files that have

been associated with those images, I can't say exactly, but

that was the primary tool I used to image them.

Q. The primary tool you used was the FBI compilation CD, you

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 223 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

224

also used FTK; is that correct?

A. So FTK Imager is a software package on the boot CD.

Q. So the tool you used is the FBI CD?

A. Um, if you're talking tools specifically to do the imaging,

that would be the software package, AccessData Imager, which

was running off of a CD from the cart boot media.

Q. Well, I am. I'm trying to understand exactly what it is

that you did with the drives because I can't view them, and so

I want to understand what programs you used to be able to view

them. And it sounds to me like the program you're saying you

used is an FBI compilation of Linux tools that's on an FBI law

enforcement only disk?

A. The tool specifically is AccessData Command Line Imager,

which can be downloaded from AccessData for free. It's a free

tool.

Q. That's also known as FTK?

A. FTK is a forensic toolkit. Again, the company, AccessData,

has lots of forensic tools. One of them is FTK, one of them is

FTK Imager, Windows -- the Windows version, there is Access --

FTK Imager Command Line.

Q. Do you have your forensic tools with you today?

A. I certainly don't.

Q. Okay. And what would you do after you imaged a drive?

A. Once a drive was imaged, I do hash verification of that

drive.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 224 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

225

Q. And can you explain -- is a hash verification, is it fair

to say that a hash verification is sort of like a digital

fingerprint?

A. Yes.

Q. It confirms that the data is identical, what you have

extracted or what you've imaged off a drive is identical to

what exists on the drive?

A. From the original, yes.

Q. And when did you begin imaging these drives?

A. After they arrived. The drives I started with would have

been the two servers I received from Phoenix. And that would

have been a time frame after I was in Phoenix and once they

were shipped to me some time early summer of 2018.

Q. Is a record of this kept anywhere?

A. Yes. So every single image I created has a file that is

saved within the image file. So if you pull up the image

itself, and the FTK Imager we had a screen shot of, the data is

encapsulated inside the image itself, as well as in a text

file. So if you had the image, you could pull up the metadata

associated about the image file that was created, you also have

the text file that will tell you all the information, when it

was imaged, how long it was imaged, when it was verified, how

long it took to verify.

Q. Okay. So I'm putting back up Defense 122. Does this

indicate the date when you imaged this hard drive, for example?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 225 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

226

A. Yes. So I see image information acquisition started. And

this is based on the date of the system I was extracting from,

so assuming the clock is set correctly, that is the information

you would pull from.

Q. Is that something you check when you're doing a forensic

image that you know is going to be used for evidence in a

criminal matter?

A. Yes. So we look at the date and timestamp -- or, sorry, we

look at the information in the system to see the BIOS

information of what time the computer thinks it is.

Q. So do you have any reason to believe that that date is

incorrect?

A. So I don't know where this one -- which server this came

from, if it was an Amsterdam, then it should have been set to

Amsterdam time. So if I imaged it in America, we're nine or

ten hours different, so the time I actually started it might be

different than this actual time, but it should be fairly close.

Q. Let's talk about Amsterdam for a second. You mention that

you had desired to leave the servers in Amsterdam running; is

that right?

A. Absolutely.

Q. And at what point did the servers in Amsterdam come down

from usability, that a potential advertiser could no longer go

onto the Amsterdam Web site and post and publish an

advertisement to Backpage.com?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 226 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

227

A. They were shut down before I was brought into the case, so

I don't know the exact date that happened.

Q. You were brought into the case April 2018?

A. Late April, early May, that time frame.

Q. Do you have a record somewhere what date you were brought

into this case?

A. I would have to check my travel logs and see when I flew to

Phoenix or check my e-mail and see when I was requested to go

to Phoenix.

Q. Okay. You prepared your testimony today with the

government, correct?

A. Yes.

Q. Okay. Now, when you were testifying, you said that what

you wanted to do in Amsterdam was take it off line and then

access it through encrypted channels, correct?

A. Yes.

Q. Your hope was to keep it on line and remotely access it,

correct?

A. Yes, it was.

Q. Why did you want to do this?

A. Because I had already been to Phoenix and saw all the

servers sitting there, and this time I realized it would be

much easier to be able to access the servers live and just look

at everything up and running. It would have been much easier

than dead box forensics.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 227 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

228

Q. Is there any reason that the Arizona Tucson servers could

not have been taken off line and accessed through encrypted

channels remotely?

A. Technologically, no, that's possible.

Q. Do you recall Agent Cullen's testimony earlier this morning

when he said that FTK Imagers would not work on FreeBSD

programs?

A. Yes. I think he made some reference to that.

Q. I'm sorry. Can you say that again?

A. Yes. I remember him talking about that.

Q. And, yet, FTK is the program you successfully used,

correct?

A. So if we're talking FTK Imager, the tool to image drives,

then the FTK Imager can see a physical drive and create an

exact copy of it, no matter what file system is on there. If

the drive is encrypted, it will copy an encrypted drive, if

it's FreeBSD, it will copy a FreeBSD drive.

Now, if you want to use FTK Imager to review the data

on that drive, when you look at it, it won't be able to see the

data that's inside that drive, because it's a Windows forensic

tool primarily, and it's just not the correct tool to view the

data.

Q. So what tool do you use to view the data?

A. Are we talking FreeBSD?

Q. You have imaged how many servers in this case?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 228 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

229

A. Several.

Q. How many hard drives?

A. Dozens.

Q. Dozens, hundreds?

A. Maybe. There is a lot of hard drives, yes.

Q. And what program do you use to view those?

A. So I use a Linux based tool that --

Q. What is the name of it? I'm sorry to cut you off, but I'm

just curious about the name of the program.

A. So the program I use is different than the software used to

read the data. So the software is an application that runs

inside the operating system, so the software has to be able to

talk to the file system. So, in this case, I used a Z pool

tool, or Z -- ZFS views, something to that nature, that would

then reconstruct the data to -- so I could view the Z pools, as

I said.

Q. When you forensically imaged the servers and the hard

drives in this case, did you take photographs of anything?

A. When I imaged them to take photographs?

Q. Yes.

A. There was probably some administrative photographs I took,

yes.

Q. And you produced those to the government?

A. The photographs I took I sent via e-mail, I believe, or I

can't remember I -- a request was asked to get images -- or the

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 229 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

230

pictures and I sent them out.

Q. Who made that request?

A. The defense -- the request came from defense and I created

that, so I responded with the images to the FBI office.

Q. And you -- and what were these images of?

A. They were images of the servers themselves.

Q. My question is when you went into the servers and you

imaged an individual hard drive, did you take a photograph of

the BIOS screen, for example?

A. I do not believe so.

Q. Do you usually take photographs of the BIOS screen?

A. Not usually, no.

Q. Is that -- have you ever been taught to take photographs of

the BIOS screen?

A. I know some examiners take photographs of the BIOS screen.

Q. But it's optional, in your view?

A. The information is captured in other places. Again, the

tools I use capture the date, timestamp, so I don't always take

pictures of the BIOS.

Q. And you've been a member of the FBI computer analysis and

response team for ten years?

A. Yes.

Q. You follow the agency policies and the rules of evidence?

A. Yes.

Q. You regularly collect digital evidence for forensic

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 230 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

231

examinations?

A. Yes.

Q. You regularly create forensic images of hard drives and

other digital storage devices?

A. That is correct.

Q. And you don't take BIOS screen photographs?

A. Not always.

Q. Sometimes?

A. Yes, sometimes.

Q. And what is it, in your view, that determines whether or

not a piece of evidence is significant enough to be associated

with a BIOS screen photograph as you're accessing it?

A. Um, if I was loading BIOS and there was something

significant, like the date was way off, then I would probably

note that.

Q. Could you explain the information that's captured in a BIOS

screen?

A. It depends on the BIOS. Depends on the server.

Q. Could you give some examples?

A. Inside the BIOS there is information about the hard drives,

the boot order, other information like that.

Q. Is there information about the configuration of the server?

A. Yes, configuration of the server and some aspects of the

server are in the BIOS.

Q. Is there information about how the server, for example, if

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 231 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

232

it's a RAID?

A. That's probably in the -- there is a separate RAID

configuration tool that sits on boot up. There is separate --

depends on if it's hard RAID or soft RAID. There is many

different levels. And if you're speaking BIOS in general, it

may contain RAID information, it may not. They may be stored

somewhere else.

Q. And, again, RAID information is when multiple servers are

-- information is spread across multiple servers; is that

correct?

A. Multiple drives.

Q. Multiple drives. Excuse me. Okay.

After you take a forensic image, I think you indicated

that you hash verify it?

A. Yes.

Q. Okay. And that process is significant to verify that it's

identical to the original data, correct?

A. That is correct.

Q. Exhibit 120 and Exhibit 104 are the spreadsheets you've

created of the data you say existed in the database, correct?

A. Yes.

Q. Are you able to hash verify that?

A. Yes. So when I extract the databases, I hash the file I've

extracted, but since I'm generating that information, there is

nothing to compare it back to.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 232 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

233

Q. Because you actually created these spreadsheets, right?

A. Yes, I did.

Q. They never existed on Backpage.com?

A. Correct.

Q. So the information that is on there is stuff you pulled out

and that you created?

A. Yes.

Q. And it can't -- I think you just said you can't hash that

massive document that's in front of you because there is

nothing to hash it against. It didn't -- you created it. It

didn't exist previously, correct?

A. That is correct.

Q. So we can't verify the accuracy of the information that's

in these tables?

A. The only piece we can accurately say and hash verify would

be the image files, because it stores the hash of the image

when it's uploaded, and then I can compare the images are the

exact same.

Q. I want to talk about your attempt to recreate the

functionality of the Backpage.com systems. Can you please

explain what it means to virtualize the Backpage environment?

A. Yes. So to virtualize the environment would be to take a

piece of software, in this case it would be a Linux based

software distribution that could read the file formats

associated that I had created.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 233 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

234

I will then take all those images and I would do a

process called mounting the image, which is to use a piece of

software to take the image file and present it to the operating

system so that I can see the file system data.

Q. Okay. Does virtualizing an environment sort of stimulate

the Web site operation in a controlled environment?

A. If you're talking virtualization of Backpage.com, if you

virtualized everything, then, yes, that's what it would mean.

Q. You attempted to do this?

A. I attempted to virtualize aspects of the Web site.

Q. And you were unsuccessful?

A. Because of the size, the number of drives and the system I

was using, I ran into issues where I believe I ran out of RAM.

I didn't have enough computer hardware capacity to keep all of

the pieces in a virtual state.

Q. And you were here for Mr. Gerken's testimony when he

indicated that he would be able to create a read only version

of the system; is that correct?

A. Yes, I heard that.

Q. Okay. You've been testifying for a while this afternoon,

correct?

A. Yes.

Q. At no point in time in any of your direct or

cross-examination thus far have I heard you describe

de-crypting any of the Backpage servers or drives. Did you

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 234 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

235

de-crypt any of the Backpage servers or drives?

A. Um, nothing -- the servers and drives were not encrypted

no.

Q. They were not encrypted?

A. Correct.

Q. Okay. And when you provided -- I just want to actually

clear up a couple of confusing terms that have gone on today.

We talked -- I want to talk about databases first.

Okay. You've described a marketplace database, right?

A. Yes.

Q. And that's what existed on Backpage.com that contained

various advertisements, right?

A. Yes. So when I refer to a marketplace, that would be a

specific database for a geographic region that had been

designated by Backpage to store ads for a certain region.

Q. Okay. And you've also talked about an image database which

contains all of the images that were on Backpage.com, right?

A. Yes.

Q. And you've also talked about this MySQL database?

A. Yes.

Q. But that is a -- that's different than the servers and the

information that existed on Backpage.com, correct?

A. MySQL is different than -- what was the question?

Q. You've talked about a MySQL database, right?

A. Yes.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 235 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

236

Q. Okay. And that's a database that you created?

A. Yes. It was on my laptop.

Q. You ran code?

A. Um, ran a code, so I installed the program, yes.

Q. And I watched you run codes to do queries, correct?

A. Yes, I ran queries.

Q. Okay. And that database, as you've been using the term, is

a very distinct and separate thing from the marketplace

database or the image database as they existed on Backpage.com,

correct?

A. So the database is the extracted version from the database.

It was not sitting in a dot SQL format. I extracted that so

that it could be used and reviewed and accessed.

Q. You created it?

A. Yes, I did.

Q. It didn't exist on Backpage.com?

A. The SQL file I created did not.

Q. Okay. Are we able to bring up the program again? Could

you bring that up for me, the program that you were searching

with the prosecutor?

A. Yes.

I have to reconnect.

Q. I'm sorry?

A. I have to reconnect. It's timed out.

I've got it.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 236 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

237

Q. Okay. So how do I, as an attorney defending my client

against a 100-count indictment, run a search for all ads

reported to NCMEC?

A. We first had to find out which table contained that ad, if

it contains it at all.

Q. Okay. And the tables contain all of the information that

accompanied an ad. That's been your testimony, correct?

A. Yes. So if we're talking the ad table, that will contain

all the tables associated with the ad data.

Q. So how do I run a search for all ads that were reported to

NCMEC?

A. Again, I would look through that and see is this data

stored anywhere. I don't know if Backpage retained that

information.

Q. Well, I'm showing you again what's been marked as Exhibit

K, which is already in the record, and I believe we marked it

today as Exhibit 121.

MS. BERNSTEIN: Can we switch to the Elmo real quick,

please?

COURTROOM DEPUTY: Yes.

BY MS. BERNSTEIN:

Q. Do you see this section that's called violations?

A. Yes, I do.

Q. And do you see where it says, violation flag?

A. Yep.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 237 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

238

Q. And you see where it says reported to NCMEC?

A. I do see that.

Q. So it appears that information was maintained?

A. So then I would go to the violation column of the table.

If you like me to go there, I can --

Q. Please.

A. -- look at that and see, again, what information is there.

MS. BERNSTEIN: Can we switch back to the witness's

computer so we can observe the search?

THE WITNESS: Here's violations, and then I would

search this column for that information.

BY MS. BERNSTEIN:

Q. And, I'm sorry, I wasn't table to view your screen while

you were creating that search. I mean, my concern is as an

attorney just being able to do this to defend my client.

Could you show me again how you created the search?

A. So I haven't done a search yet. This is just the ad table.

So if we look up here --

Can we get the circle power?

COURTROOM DEPUTY: You should have. It's on.

Try again.

THE WITNESS: No.

BY MS. BERNSTEIN:

Q. I don't have access to this database that we have up,

correct?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 238 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

239

A. The IED underscore Backpage database was provided in

discovery on, again, a standalone hard drive. All the SQL dump

files were provided.

Q. So if that were read, your testimony, is that would be an

interactive Web site exactly like we're looking at now in Mint?

A. So you would have to take the database and ingest it into a

SQL server and then access it from a tool like HeidiSQL like I

have here.

Q. And HeidiSQL was not a program that ever ran on

Backpage.com, as far as you know?

A. Correct.

Q. And Mint was not a program that ever ran on Backpage.com,

as far as you know?

A. Correct. That is software I am using to aid myself.

Q. So this is -- this is different than what was on the

Backpage.com Web site again?

A. Yes. So if I -- if I took, let's say Backpage had a Word

document and I copied the Word document off, I could look at it

in Microsoft Word, I could look at it in WordPad, I could look

at it in a Linux manner, so I could look at the program in, you

know, different programs, but, yes, just because my Microsoft

Word program wasn't on the server, it doesn't mean I can't look

at the data.

Q. Exhibit K, Exhibit 121 is what it looked like when

Backpage.com was live, correct?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 239 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

240

A. Which one is K? Is that this?

Q. It's the black and white five page object editor.

A. So -- no, not necessarily. So this information -- Backpage

doesn't have a bunch of ads sitting out there displaying with

full pictures. All the data is stored in a database, and then

if a specific ad is requested, then the servers go out, grab

the data, put it in ad format and then that's what is

displayed. But sitting there right now or in the servers when

they are running was a database full of columns and rows

containing information.

Q. So Exhibit K is what this information looked like when

Backpage.com was up and running and this data was pulled?

A. You could retrieve it in this format, but this is not how

it was saved at Backpage. It wasn't saved like this. You

could generate a report that made it look like this or generate

an ad, but the data at rest at Backpage was in the SQL database

format, all text as we saw before.

Q. And there was a button to generate this ad?

A. Yes. You could click and make the ad be generated, yes.

Q. And I can't do that anymore?

A. Correct, neither can I.

Q. Okay. So, I'm sorry, back to this Mint HeidiSQL program.

Can you please show me how to search for all ads that were

reported to NCMEC?

THE COURT: You're going to have to use words.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 240 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

241

THE WITNESS: Okay. Yes. So if you look at the --

this is the ad table for IED again, so Washington, D.C.,

database.

BY MS. BERNSTEIN:

Q. And do I have the ability to search across the Web site as

opposed to going into the 176 separate marketplaces?

A. On a standalone, no, you would have to search each market

individually or create a program that would do the search for

all of those.

Q. Okay. Please continue.

A. So I have selected the ad table, and looking at the data

from the ad, what you see on your screen. Then if you scroll

over to the violation column, which would have been in -- it's

one of the 91 columns as violation.

Now, if you're asking for the specific SQL query to

search for that, I haven't done that yet, so I don't know the

exact syntax, because it's not a number or something I could

search for standard. I would have to see what formatting it

is, but I could visually inspect and just search through here

and look and see is there a NCMEC flag in the violation.

Q. Well, if you could scroll up for a bit -- sorry, if we can

go up to the first -- the top of this chart.

A. Yep, we're there.

Q. So I see -- on the screen we're looking at right now there

is two violations listed, correct?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 241 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

242

A. Violation count and violation.

Q. No. I'm actually just looking in the violation column,

that column of the 91 column.

A. Oh, yes.

Q. And I see two responses. If that's a fair characterization

of that?

A. Yes.

Q. Okay. And the first one says proxy score, 1.80?

A. Yes.

Q. What violation is that?

A. I don't know. All I can say is that's what the cell says

is that number you have referenced.

Q. Okay. And then a little bit lower it says, hits, one,

hits, back -- filter object ID 2827914, backslash filter object

ID, action, flag as spam, action match, dot relaxation, dot --

oh.

A. Oh, sorry.

Let me bring that up. There you go.

Q. And do you know what that means?

A. No, I didn't program these servers. All I know is that's

the information contained in that column.

Q. So let's keep going, because I'm still trying to figure out

how to find an ad that was reported to NCMEC.

A. Assuming there is one for IED, we could scroll through and

look through all of them, if you would like.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 242 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

243

Q. Well, how about this? The ad that we've been looking at in

Exhibit K slash Defendant's Exhibit 121 for purposes of this

hearing, appears to have been posted in Tacoma. So we know for

a fact, right, that there is at least one ad that was posted in

the Tacoma marketplace that was reported to NCMEC. Please show

me how we find that ad in this system.

A. So I only brought a small subset. I only have the

Washington, D.C., database. I did not bring the entire

universe of Backpage databases with me for the download that I

prepared.

Q. Can you click back out, because I did think that I saw

additional databases when you logged in and described that

being Washington.

A. Right here.

Q. So what are these other -- what are these other

spreadsheets you've created?

A. The information here -- so information schema is just,

that's something in SQL. So these -- all this information is

in the SQL server I created, so some are there by default, like

my PHD admin, cyst, new schema is one I created, MySQL is one I

created. These are databases I created to populate the MySQL

server. So the marketplace that I have uploaded are HON

underscore Backpage and IED. HON, I believe, is Honduras.

Q. Why did you bring the Honduras marketplace?

A. It was just small and I just grabbed them at random.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 243 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

244

Q. How many marketplaces were there total, as far as you know?

A. There are over a hundred, hundred and plus.

Q. Does 176 sound correct?

A. I haven't counted them, but it's possible.

Q. Okay. So we're not able -- and stop me if I'm wrong. If

you have the ability to work with this data for a little bit

longer and show me if an ad was reported to NCMEC, that's what

I'm trying to understand, but it sounds to me like you can't do

that; is that correct?

A. Sitting here right now without looking and looking up

syntax to see how you search for fields with quotes and things

like that, since I have never done that search before, then I

can't do it here, no.

Q. And so if I, as an attorney defending my client against a

100-count indictment, want to find out whether or not an ad was

reported to NCMEC, I have to look up fields of syntax and run

code and create a Mint HeidiSQL database to do that?

A. You could do that if you like to or you could hire an

expert to do that.

Q. But I have no ability to look at a report with a check box

that tells me whether or not it was reported to NCMEC, right,

that's gone?

A. Correct.

Q. Okay. Let's try another piece of data I'm interested in.

If we can go back to the ELMO, I'm on Exhibit 121 on

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 244 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

245

the first page. And we can see that there are various

modifications that were made to an ad.

How many do you see listed there?

A. Ten.

Q. Okay. And it indicates the date that the modification was

made, correct?

A. Yes, it does.

Q. The time the modification was made?

A. Correct.

Q. And the user who made the modification, correct?

A. Yes.

Q. And so I'm looking at the third entry, where there was a

change on Monday, June 10th of 2013, at 8:05 a.m. by user BP

85.

A. Yes.

Q. Okay. So I want to know what ads BP 85 modified. Can you

show me how to figure that out?

A. Again, so that would be in the moderator log, or moderator

log file there is a column.

MS. BERNSTEIN: Can we please switch back to the

witness's computer?

THE WITNESS: Yes. So I would go to moderator log.

It's maybe over here.

BY MS. BERNSTEIN:

Q. I'm sorry, actually, can you --

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 245 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

246

A. There it is.

Q. I'm sorry?

A. Here's the moderation log, moderator, moderation log.

Q. Okay. So the very first entry you have here, just on the

top that I can see, says, edited B. If you drag that column

out, is it going to tell me more or does it just say edited B?

Edited B. Okay.

And then next it appears to be a blank field; is that

right?

A. For the moderation log?

Q. For the moderation log that correlates to edited by.

A. Yes.

Q. So it doesn't tell me what user edited an ad?

A. That field is empty.

Q. But we just looked at it where there is a lot of

information about this specific user. None of those were

blank, right?

Let's scroll down again.

A. Which user are we talking about when you say none of them

are blank? Back on the ad you had up here?

Q. Yeah.

A. I saw -- yeah, so I saw one where it was -- had the -- the

moderator, we're assuming a moderator user edit of that.

Q. I'm sorry. Let's put this back up on the screen because I

don't want there to be any confusion.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 246 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

247

There is ten modifications that are viewable from the

object editor, which was the administrative tool we had when

Backpage.com was live. Those ten modifications, every single

one of them has a user -- has the name of a user who made the

modification, correct?

A. Yes.

Q. Okay. Now, let's go back -- and please just leave the

screen that you had up, because I had a couple more questions

about that one.

When I look at this screen I see, edited by on the

very top of the screen, edited B, excuse me. I scroll down a

couple -- I skip of five -- four lines, and then I see edited

A, edited B, edited A. And every time the moderation action

indicates that it was edited, the moderation log is blank as to

the user that did that, correct?

A. It appears that on this example, yes.

Q. Okay.

THE COURT: Counsel, I'm going to stop you.

MS. BERNSTEIN: Okay.

THE COURT: You can step down. Or disconnect,

whatever.

THE WITNESS: Okay.

THE COURT: So, Traci, what were the times again?

COURTROOM DEPUTY: October 18, 9:00 to 12:00 or

October 23rd, 9:00 to 12:00.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 247 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

248

THE COURT: Okay. So we have two time periods

available -- I'm starting trial next week -- but on the 18th

from 9:00 to 12:00 or the 23rd from 9:00 to 12:00.

MR. RAPP: The United States prefers the 23rd.

MR. CAMBRIA: I can't be here the 23rd.

THE COURT: I'm sorry, I couldn't hear you.

MR. CAMBRIA: I said that I couldn't be here the 23rd,

Your Honor. I have a conflict. I have a trip. But I think if

it's just to complete this hearing, that Ms. Bernstein could

stand in for me. And my client's here and would not have an

objection to that.

THE COURT: Okay.

MR. FEDER: I can't do it on the 23rd. I can do it on

the 18th.

THE COURT: You cannot do it on the 23rd?

MR. FEDER: Right.

MS. BERNSTEIN: I'm in a deposition on the 18th and my

expert is also unavailable on the 18th, so that won't work for

us, unfortunately.

THE COURT: The 24th?

MS. BERNSTEIN: I'm sorry?

THE COURT: The 24th?

MS. PERLMETER: 24th, 9:00 to noon?

MR. FEDER: What time?

THE COURT: Nine to noon.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 248 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

249

MS. BERTRAND: Judge, I'm not available on the 24th

but I can ask counsel to step in. I'm not taking witnesses on

this.

MR. CAMBRIA: Same here.

THE COURT: Okay.

MS. BERNSTEIN: Myself, Mr. Lincenberg, and

Mr. Bienert, are in a hearing in the Southern District of

California on the 24th at 1:00 o'clock in the afternoon.

THE COURT: The 25th from 1:00 to 4:00.

MR. RAPP: We can do the 25th, Your Honor.

MS. BERNSTEIN: I think we're just conferring. I'm

personally available on the 25th, as is my expert.

THE COURT: Everybody thumbs up.

Okay. I'm not hearing anybody can't make it.

MR. CAMBRIA: I can't make it.

MS. BERTRAND: I can't either, but the same.

MR. CAMBRIA: Ms. Bernstein can stand in for me on

that date, Your Honor.

THE COURT: Okay. So let's continue this on

October 25th at 1:00 p.m. Okay.

MS. BERNSTEIN: Thank you, Your Honor.

MR. EISENBERG: Your Honor, may I address the Court?

THE COURT: Yes.

MR. EISENBERG: Your Honor, I want to address the

Court on a matter of a witness that was subpoenaed for

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 249 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

250

appearance today. I'll give the Court some background, and it

won't take me long, but I think this is of importance to the

system and to the defendants and the parties.

The person that was subpoenaed by the defendants

through an affidavit of indigency which Your Honor signed,

being a CJA attorney, that is a matter of requirement, the

subpoena was directed to Issa Martin in Grand Prairie, Texas.

The subpoena was served. And I have a return of service on the

subpoena by a marshal whose name I cannot read, but obviously

in that district that serves Texas. And it was served on

October the 1st, 2019. I have a copy of the subpoena and its

return of service if the Court would like to see it.

That witness was not here this morning, and as far as

I could tell, she is not here this afternoon. My investigator

received a telephone call from this witness on the 1st of

October, and it essentially goes like this: Ms. Martin

responded forcefully that she had received a subpoena in

reference to a trial. She stated she was not going to testify

in any trial on behalf of Andrew Padilla. I, meaning my

investigator who is in court today, corrected Ms. Martin and

told her that the 10-3, meaning October 3rd, proceeding was a

hearing not a trial. She responded that she didn't care. She

was not appearing. I, meaning the investigator, informed her

that the subpoena was an order from the court. Ms. Martin

again stated that she did not care, she would not be appearing.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 250 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

251

She further stated that she would not appear unless you

subpoena everyone from the company. And I assume that means

Backpage. That's my assumption.

She said she had heard that she was the only one being

subpoenaed. I, meaning the investigator, asked her who told

her that, and she responded, I'm not saying. The investigator

asked Ms. Martin if she had been in contact with the

government. She stated she left a message with Reginald Jones.

I asked for his number. Ms. Martin responded to the effect,

he's with the prosecution. You have his number.

Ms. Martin told the investigator she would call

Mr. Eisenberg, the attorney who had issued the subpoena as

well. And my name is on the subpoena down in the lower lefthand corner.

As described by the investigator, Ms. Martin's

telephone demeanor could be described as forceful, firm, and

agitated. A few minutes later -- I believe a few minutes later

I received a call as well. And in this discussion I was told

by Ms. Martin that she had just got a subpoena and she wasn't

going to appear at a hearing on Friday. I told her that the

hearing was on Thursday. She said she wasn't going to get on

an airplane and come to any hearing. She had personal things

to attend to. She also said she was not going to be a witness

for Mr. Padilla.

I stated the subpoena was a directive from the Court

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 251 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

252

to appear and her presence was required. Then she stated she

would contact an attorney. She said that she had called Reggie

Jones about the subpoena and that she had also called

Mr. Ferrer's attorney. I asked her if Mr. Ferrer's attorney

represented her, but she simply said she would contact an

attorney about the subpoena. I told her such contact was her

prerogative, but repeated that it was a direction from the

Court requiring her appearance. And I stated if she did

contact an attorney, to have him or her give me a call.

At some point in the call I also suggested to her that

she make herself available for a meeting when she came into

Phoenix, but she was quite clear there would be no meeting.

And I would describe her demeanor to me, essentially, as the

same it was to the investigator, very forceful, if not hostile.

In my point of it is this, Your Honor. We, as the

defense, don't know whether we're going to have Ms. Martin

appear again now that there is an -- there is a new time Your

Honor has set, but I think we'd all be concerned about the fact

that a witness has disregarded an order of this Court. And I

am not sure what it is that Your Honor wants to do about it,

but I want to present this to the Court at this time because

she is in contempt of court, in my belief. I haven't heard

from her and I did not think it appropriate for me to try to

call her back again, but she's not here today.

THE COURT: Okay. So what are you asking?

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 252 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

253

MR. EISENBERG: I will talk with my colleagues, Your

Honor, with respect to how we want to proceed about this, but I

will be back with another subpoena to Your Honor requesting her

appearance if we do want her to appear again at this -- at the

continuation of this hearing.

As far as requesting her to be held in contempt of

court, Your Honor, I don't think that's necessarily up to me.

It could be up to the Court. But, in any event, I am going to

consider it and I'll talk to my colleagues about that, how to

proceed.

THE COURT: So you knew on October 1st that she was

telling you she's not coming?

MR. EISENBERG: Yes.

THE COURT: So I guess if I know in advance, I can

handle it better than after the fact, because she may have had

-- part of the things you mentioned is personal things. She's

subpoenaed from out of state on October 1st to appear in

Arizona on October 3rd.

MR. EISENBERG: Right.

THE COURT: There may have been a legitimate reason

why she's not here.

MR. EISENBERG: With respect, Your Honor, she gave me

none, nor was there any further contact on the next day.

THE COURT: I understand, but my experience with

civilians who are unrepresented is that they may not trust the

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 253 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

254

lawyers that are calling them, whether it's from the government

or the defense, that sometimes if I am able to get them on the

phone ahead of time, I can calm them down and get them to

comply, which is a suggestion if you need to call her next

time.

MR. EISENBERG: You mean you, the Court?

THE COURT: Yes.

MR. EISENBERG: Oh.

THE COURT: I mean, in open court. I wouldn't do it

without somebody else on the phone.

MR. EISENBERG: Well, that's a little difficult, Your

Honor, at this point because she didn't appear, and I did not

think it was incumbent upon myself to give her a call again

because I think she was just done with the process. I can't

characterize what was going on in her mind, but I do think it's

an effrontery to the Court not to appear. It's not my order,

it's Your Honor's order, and that is in the format of the

subpoena directing her appearance. If she had a problem with

appearing, then perhaps she could have found a lawyer, could

have called me, and perhaps something else would have been

done, but none of that was done.

THE COURT: To put this in context, who is she?

MR. EISENBERG: Issa Martin was a Backpage employee

who was at one time a custodian of records for Backpage. And

when Backpage received subpoenas, my understanding is that she

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 254 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

255

appeared, perhaps at grand juries, perhaps at trials, and she

was the person who I envision as a custodian of records, in

other words, someone who can identify records.

THE COURT: So just for future reference, part of my

consideration in what to do in these situations, because it's

not like it hasn't happened before, is, obviously, the

importance of the witness, and I guess I don't understand that

at this point, but --

MR. EISENBERG: Well --

THE COURT: So I -- if you think she's a critical

witness and you want me to have an order to show cause hearing

for her, I will certainly do that. If you are planning to call

her next time and you have the same hesitation, I think there

is a way to handle it.

MR. EISENBERG: Your Honor, my only further request is

to determine whether, if there was a call made to the

government, because she told me and my investigator that she

was going to call Mr. Jones, I don't know if that call was made

and I have no idea what was said. I just would like to get

confirmation whether a call was received.

THE COURT: Mr. Jones.

MR. JONES: I haven't spoken with Ms. Martin, Your

Honor. She did send me an e-mail, but as far as telephone

contact, I have not had any telephonic contact with her, nor

e-mail contact with her. She did send the government an e-mail

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 255 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

256

alerting us of the subpoena by defense and she did send us a --

with an attachment, I think, of the subpoena, which was

yesterday. I was in flight on my way to Arizona when I

received that e-mail.

THE COURT: And did you respond to her?

MR. JONES: No. My only response to her is when we

received the subpoena asking her -- we asked her to send the

subpoena to us. She sent us the subpoena. We have had no

contact with her regarding whether or not she will attend or

not, none of that, Your Honor, any contact with her whatsoever.

THE COURT: And did she leave you a phone message?

MR. JONES: Not to my knowledge. I have not been in

the office this week, but I have not received a voice mail from

her.

THE COURT: Okay.

MR. JONES: I'll check when I get back next week, but

I have not received a voice mail from her today.

MR. FEDER: Judge, could I add something?

I did have contact with Ms. Martin last week with my

investigator. She indicated to me she was, I think her word

was, working for the government and being flown around the

country as a custodian of records on behalf of the government,

and mentioned Mr. Jones name as her contact. And it was a very

short conversation because she cut it short indicating that she

wasn't going to talk to the defense. So it would appear there

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 256 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

257

is -- there is, at least, more than the contact that the

defense has had with Ms. Martin with the government. And I

would just like a representation that nobody in the government

has had any contact with her, made no representations, et

cetera, to her, and would like to get, since they would appear

to have an ability to contact her, to find out why she didn't

appear.

THE COURT: Well, no. The question was whether they

had contact with her about her appearance at this hearing. I

wasn't asking about in general throughout the history of this

case whether they've had contact with her. My concern was

whether they somehow impeded or interfered with her desire to

appear today.

MR. FEDER: Well, we've heard from Mr. Jones.

MR. JONES: We did not, Your Honor.

MR. FEDER: My assumption is that means nobody in the

government agent or lawyer has had contact with Ms. Martin in

regard to her presence at this hearing?

THE COURT: As far as the lawyers that are here, is

that an accurate representation?

MR. JONES: Yes, Your Honor. We stated she did e-mail

us alerting us of the subpoena. She sent us the subpoena that

was sent her. We did not inform her whether or not to attend.

We have no contact in that regard, Your Honor.

MR. BIENERT: Again, I'm just hearing all this. First

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 257 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

258

of all, one other piece of evidence which is why this is sort

of a strange situation. Either the middle of the night last

night or the night before in reading some of the Jencks that we

got from the government, as of, I think, Monday, there is a

transcript from a case where one of the forensic technicians

from the FBI testified, one of the ones alluded to from the

stand, either it was this witness or his colleague. In the

transcript there was a reference to Ms. Martin's testimony, so

back -- it was a case where they are going after someone and

there was a piece of evidence that tied into whether that was

the person -- that defendant was somebody who advertised on

Backpage.

The bottom line is it appeared from that transcript

that Ms. Martin testified this calendar year as a government

witness in conjunction with the FBI witness as to something

related to Backpage. I may be wrong, but it seems like

Ms. Martin's relationship with the FBI, taking that coupled

with her statement to my co-counsel that she, quote, works with

the FBI, it seems like her relationship is more than just a

normal, I'll call it, third-party witness. And if that is

true, then when she says, I'm not testifying for you, defense,

and if I heard government counsel right, if she writes him and

says, they sent me this subpoena -- I think he said I wrote

back or said something like, I'm not going to tell you whether

to appear or not --

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 258 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

259

THE COURT: No, that's not what he said.

MR. JONES: No, that's not.

MR. BIENERT: That's -- I just want to make sure, you

know, this is the second witness in a day now, in two days,

that seems to be saying we're not testifying, when they're, at

least facially, with some likely interaction with the

government. I spent two hours with a witness yesterday who was

all ready to go, and while I was there her lawyer said, oh,

there is Mr. Rapp calling us. I said, yeah, because she's on

the witness list. And then last night we get an e-mail she's

not testifying, she's taking the Fifth.

And so I am concerned, not intently -- not

intentionally, perhaps, but I am concerned that there are

witnesses that when they either reach out to the government or

the government learns they may testify for us, something is

said or done that makes them think they shouldn't do that. And

that would be an interference with our ability, as defendants,

to put on our case.

And we relied on -- to be honest with you, Your Honor,

that's why I withdraw the subpoena to Mr. Ferrer, because I

thought, why get into a battle over his rights when we got two

other witnesses who I think can give me the same thing. So I

don't know what to do about it except it's very strange. And I

would certainly hope that there is -- I mean, I would like to

think that if the government hears from any witness that we

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 259 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

260

have subpoenaed through a court-issued subpoena, that whatever

they say otherwise, it would be, well, if you have a subpoena,

you should be there.

THE COURT: Okay. I understand your concern. I don't

have any information that the government interfered with the

witness. Other than to make a record of your concerns, is

there a purpose to this? Do you want me to ensure that the

witness is available next hearing?

MR. BIENERT: First of all, we appreciate that. And I

think it certainly makes sense what you're saying. The reason

I'm hesitating is in light of what you had said earlier today

and where we are, there was definitely a purpose where we feel

like we need a witness like this, because, for example,

Ms. Martin, I think, would be familiar with the old Backpage

when it was running, and seems to have some familiarity with

something to do with what they pull off of Backpage now.

At the same time, I'm taking to heart Your Honor's

statement earlier today in where we are. So I think that where

we best leave it is we caucus, and if we believe that we need

her here -- I don't want to bring her here and then at the end

of it you're like, well, gee, that really didn't add much more.

So I think we need to caucus, but we may be submitting

something, Your Honor, asking for you to issue an order to show

cause or the like if we need her. But, frankly, if it doesn't

add anything that we really need, then I'm not going to do that

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 260 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

261

just for the show.

THE COURT: Okay. Mr. Eisenberg.

MR. EISENBERG: Well, Your Honor, I would simply add I

think we're obligated to tell the Court if someone is abusing

the Court's authority, so I look at this in a little bit of a

broader picture.

THE COURT: I appreciate that. Thank you.

MR. EISENBERG: Thank you, Your Honor.

THE COURT: Was there something else?

MR. EISENBERG: Not from me, Your Honor.

THE COURT: It looked like Mr. Stone was going to

stand up.

MR. STONE: Just anticipating that we'd be in recess

soon.

THE COURT: Okay. We're in recess.

Oh, counsel, before the -- when are we coming back,

the 25th -- by 5:00 p.m. the next day can you please give my

courtroom deputy your exhibits and exhibit list so that she

does not have to do this piecemeal at the next hearing.

MS. BERNSTEIN: Yes, Your Honor.

MR. BIENERT: I have one -- I apologize, one thing, a

clarification. I don't know if Your Honor would have even

noticed, but as part of pleadings for this hearing, some of the

exhibits that we submitted or may be using were some of the

blurbs from the various Jencks materials that the government

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 261 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

262

gave us of Mr. Ferrer. And I just want to make sure, in an

abundance of caution, we filed them under seal. And that's

part of the document under seal. But I guess I wanted to

clarify Your Honor's earlier order, you issued a protective

order where only counsel can maintain it, and obviously we're

not letting anyone else have it and our clients have to look at

it in our office, I understand that, but to the degree that we

are submitting a pleading where there is some aspect of that

that is relevant to the pleading, not wholesale putting the

reports in, it seems extremely cumbersome for us to have to do

separate under seal filings simply because there is something

in the many, many, many pages of debris of Mr. Ferrer that is

relevant to a motion or hearing. And so I was seeking a

clarification of whether while the protective order is in

place, if we are, nonetheless, allowed, if it's part of a

pleading in front of Your Honor in court, can we submit it like

we normally do or do we have to go through an under seal

process simply because it involves one of his many statements?

MS. BERNSTEIN: And, Your Honor, to further clarify an

issue that created earlier this week, though it wasn't an issue

at this hearing, our response to the motion to quash was over

200 pages and so we were asked to provide, per your chamber

rules, a hard copy of it, and there was some confusion about

how that would interface with the directive that we also not

make copies of that information.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 262 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

263

THE COURT: Okay. Does the government want to be

heard?

MR. RAPP: Well, if they're filing -- so you can't

just circumvent the protective order by filing the reports on

the public docket, I don't know if that's what they're

referring to, but if they want to use the reports as some type

of a pleading, they have to file them under seal.

THE COURT: That's your request?

MR. RAPP: That's our request.

THE COURT: Okay.

MR. BIENERT: And maybe the best way I could ask Your

Honor to consider it, and a reasoned way, to be specific, what

we submitted them to you as part of was the issue -- our

opposition to the motion to quash filed by Mr. Ferrer and his

attorney. And so obviously it was extremely relevant to say,

look at all the things he's talking about that we think are

relevant to this hearing.

And I would encourage Your Honor, if it helps you make

the decision, to look at what those under seal blurbs and

statements are. They are just garden variety important factual

evidence about the case. It's like any other witness, it's

just not the kind of thing I've ever seen placed under seal.

He's not a witness that needs to be protected. He's out in the

open as to who he is. It's not stuff where we're talking about

a whole bunch of other people where they need to be protected.

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 263 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

264

And this is just simply another of the many slogs through mud

-- my term -- that I feel like this case is just to do the

normal things we do. And there is just no reason for us to

have to go through under seal filings because we referenced

something that Mr. Ferrer, their main witness, said in, like,

200 pages of interviews.

THE COURT: Okay. And I agree with you. I am

distressed by the number of documents filed under seal and

would like to minimize that. So I will go take a look at that

response and look at my order and see if that can be changed

somehow. Okay.

MR. BIENERT: Thank you, Your Honor.

(Proceedings concluded at 5:05 p.m.)

* * *

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 264 of 265
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

265

C E R T I F I C A T E

I, CHRISTINE M. COALY, do hereby certify that I am

duly appointed and qualified to act as Official Court Reporter

for the United States District Court for the District of

Arizona.

I FURTHER CERTIFY that the foregoing pages constitute

a full, true, and accurate transcript of all of that portion of

the proceedings contained herein, had in the above-entitled

cause on the date specified therein, and that said transcript

was prepared under my direction and control.

DATED at Phoenix, Arizona, this 5th day of October,

2019.

/s/ Christine M. Coaly_______

Christine M. Coaly, RMR, CRR

Case 2:18-cr-00422-DJH Document 789 Filed 10/05/19 Page 265 of 265