Thread by @innercitypress

OK - US v. Josh Schulte #Vault7 CIA leak trial Day 4, CIA supervisor Leonis still on stand, Schulte's cross examination soon. Inner City Press is covering the trial innercitypress.com/sdnylive98schu… & seeking to unseal documentcloud.org/documents/2205… & will live tweet, thread below

https://twitter.com/innercitypress/status/1537618480719138825

CIA' Leonis: Josh told me he was going to fight back. It caught me off guard. He was going to put up a fight about a management decision. That's not the way people talk in a professional environment.
AUSA: Did you ever retaliate against him?
Leonis: No.

AUSA: Mr. Schulte wrote he has incurred the wrath of his supervisor Karen. How was Karen?
CIA's Leonis: Karen cared so much about people. She'd walk the halls and ask you about your family... We asked Josh and Amol to go to the Employee Assistance Program

Leonis: This not the kind of thing you want to deal with, 3 weeks into a job [as supervisor]. I just wanted to help people build tools to collect intelligence for our country.
AUSA: Is there classified info in this email?
Leonis: The 3d graf talks about developers

Leonis: And it talks about a vulnerability in one of our network. And it talks about foreign office West. So it gave the location. And it had the name of an undercover officer. So in my read, it is not unclassified.

Judge Furman: Jurors, I approved the substitution of the phrase "Foreign Office West" for the actual location. Just so you understand.
Leonis: After Vault 7 was published, we became a crime scene. The investigators bought cameras into the SCIF, which was strange

AUSA: No further questions.
Judge Furman: Cross-examination.
Schulte: Good morning.
CIA's Leonis: Good morning.
Schulte: Didn't I have a great relationship with my management before you?
Leonis: I can't say.
Schulte: You didn't have my file?
Leonis: No.

Schulte: I was promoted every year until my last year, right?
Leonis: I don't know.
Schulte: You didn't have access to promotion records?
Leonis: I don't remember.
Schulte: But you began keeping a dossier (says the "R") on me, in a white binder, right?
Leonis: No.

Schulte: You never kept a white binder?
Leonis: Later we did.
Schulte: Before you became a manager at the CIA, where did you work before?
AUSA: Objection!
Judge Furman: Sustained.
Schulte: Had you ever managed people?
Leonis: No.

Schulte: Did you ever get training on conflict resolution?
CIA Leonis: I had experience in getting people to sit down and talk.
Schulte: Just hash things out.. When Jeremy Weber wrote to you, not copying me, did you know he had stopped talking with me?
Leonis: No.

Schulte: So this email that Mr. Weber sent --
Leonis: Mr. Weber should not have sent that email.
Schulte: So that's over-reaching. Let's go to 1062. Mr. Weber is escalating the issue directly to you, correct?
Leonis: I'm in his management chain.

Schulte: You never asked me my side of the story, right?
CIA's Leonis: I needed more information -
Schulte: I'm sorry, sir, just answer yes or no.
Leonis: No.
Schulte: You could have called a meeting between us and resolved it?
Leonis: I needed info first.

CIA's Leonis: My concern was who had admin privileges to the libraries.
Schulte: What does that entail?
Leonis: Control over the libraries. Being able to change or modify things.
Schulte: But you also said everyone has the ability to do that, to write code

Schulte: So on April 18 you begin to write the memo of warning, right?
CIA Leonis: No.
Schulte: You didn't?
Leonis: It was a memorandum.

Schulte: You wrote it without even speaking with me, right?
Leonis: We were going to talk with you about it.
Schulte: The question is, you had decided on April 18 you were going to issue me the memorandum?
Leonis: Yes. But then we were going to have a conversation.

Schulte: But H.R. wasn't even there, right?
CIA Leonis: I think they were there.
Schulte: But they didn't sign the memorandum as a witness. Aren't they supposed to sign the memo?
AUSA: Objection.
Judge Furman: Sustained.

Schulte: Did you know that the Atlassian tools were installed by Patrick?
AUSA: Objection!
Judge Furman: Sustained.

Schulte: This cut-off had only to do with Atlassian, and no other servers like IRC, right?
AUSA: Objection.
Judge Furman: Sustained. It speaks for itself, Mr. Schulte.

Schulte: Are you aware of Dave D. who worked in RDB?
CIA's Leonis: I don't know how to answer your question.
Schulte: Uh, with yes or no?
Leonis: I'm aware of a Dave.
Schulte: And he moved.
Leonis: Yes.

Judge Furman: OK, jurors, we'll take our break now. Do not discuss the case. And Mr. Leonis, you remain on cross examination, do not discuss it with the government.
Thread will continue.

Jury entering!
Judge Furman: You may proceed.
Schulte: Good afternoon. Before testifying, you met with AUSA Denton 15 times, correct?
CIA's Leonis: Less. Maybe 10.
Schulte: Some lasted several hours, right?
Leonis: Maybe two hours.

Schulte: Brutal Kangaroo is the project, right?
CIA's Leonis: It is the tool suite.
Schulte: Shattered Assurance is one of the tools, and uses Drifting Deadline, right?
Leonis: That's what it says here.
Judge Furman: I think we've covered this.

Schulte: Let's talk about Weekly Activity Reports. Did I submit mine to you?
Leonis: Yes.
Schulte: I'd like to read this --
Judge Furman: Don't. It's in evidence. Move on.
[With jury out of room, Judge Furman urged Schulte to finish his cross of Leonis today

Leonis: Shattered Assurance was inside Brutal Kangaroo. It was your job to --
Schulte: I object, Judge.
Judge Furman: Overruled.
Schulte: I move to introduce the stipulation 3008.
Judge Furman: You don't have to read the first paragraph.

Judge Furman: I'm giving you fifteen or twenty minutes more.
Schulte: Can we have a sidebar?
Judge Furman: No. Let's do it more quickly please.
Schulte: I want to talk about the 'fight back' statement. Is there not a formal way for CIA employees to fight back?

CIA Leonis: Fight back is not language we use. But there are mechanisms to address concerns.
Schulte: Did you know that through the CIA's formal process my performance report (PAR) was modified?
Leonis: No.

Schulte: How do you characterize my demeanor at the meeting?
Leonis: You were frustrated.
Schulte: When was the first time you talked to me about access to Brutal Kangaroo?
Leonis: We said, all projects.
Schulte: But project were transferred with me.

CIA Leonis: You were told which projects would could take with you.
Schulte: It never said Brutal Kangaroo.
Judge Furman: Mr. Schulte, you may not testify. Put on your mask and let me see counsel at sidebar.

[After long sidebar]
Schulte: OK I want to talk about security. Did you know that the CCI site was an SC Zero cite?
AUSA: Objection.
Judge Furman: Just yes or no.
CIA's Leonis: Yes.
Schulte: And what does that mean?
AUSA: Objection.
Judge Furman: Sustained.

Schulte: The CIA interviews and tests applicant there, right?
CIA's Leonis: I don't know.
AUSA: Your Honor we are getting into the issue that came up the other day.
Schulte: May stand-by counsel hand a copy --
AUSA: We object!
Judge Furman: At the sidebar again.

[Back up]
Schulte: I want to ask you about DEVLAN. Have you heard it described as the Wild, Wild West?
CIA's Leonis: No. Never heard that.
Schulte: Did you know that a developer put the Stash backup on a public page?
Leonis: No.

Schulte: Is it CIA policy to basically close up shop after a leak?
AUSA: Objection.
Judge Furman: Sustained. Let's wrap this up.
Schulte: Are you aware of the Wikileaks task force?
CIA's Leonis: Yes. But I was not party to it.

Schulte: No further questions.
Judge Furman: Any re-direct?
AUSA: No, Your Honor.
Judge Furman: Mr. Leonis you are free to go. Have a nice weekend. Next witness.
Patrick of Microsoft, an "incident response" specialist; previously with "an FFRDC called MITRE."

Patrick: I did work with the FBI's Cyber Action Team. We'd deploy to victim organizations. I personally deployed about five times.
AUSA: What is a virtual machines?
Patrick: Essentially a computer inside a computer.

AUSA: What is an insider threat investigation?
Patrick: Where we suspect someone inside the company did it.
AUSA: Have you been trained?
Patrick: Yes, in cyber security.
AUSA: Any awards?
Patrick: Yes. Internal awards. Also from the Polish military intelligence

AUSA: Did you investigate Wikileaks publications?
Patrick Leedom: Yes. Of Vault 7 and Vault 8.
AUSA: Where did the leak come from in Confluence?
Patrick: From back-up files. The March 3 back-up.

Judge Furman: It's 2:47 pm so we'll end for the week.
[With jury gone]
AUSA: Mr Schulte wants 18 witnesses. Some raise CIPA issues; some have not been subpoenaed.
Judge Furman: Then they're not subject to subpoena. Maybe we'll have a classified hearing next week

Schulte: They are not letting me use the laptop in the MDC.
Judge Furman: Did you ask them? I am surprised. As I said at the sidebar, I urge you to pare down your questions. Your cross examination of Mr. Leonis was not efficient. Sometimes less is more.

And with that, Judge Furman leaves the bench. Stories and tales coming on InnerCityPress.com and patreon.com/MatthewRussell…