Thread by @innercitypress

OK - it's US v Josh Schulte trial, Day 5. He's charged for Wikileaks' #Vault7, & he's representing himself. Inner City Press is covering @SDNYLIVE innercitypress.com/literary1vault… and beyond innercitypress.com/literary1vault… & will live tweet, thread below

https://twitter.com/innercitypress/status/1538184953577492485

Judge Furman: Jurors, welcome back. Government, you may proceed.
Assistant US Attorney: Good morning. Remind us, what did Mr Schulte do?
Microsoft's Patrick Leedom: He reverted to an earlier date. Then I investigated the network. The FBI was making forensic images

AUSA: How did you come to focus on Mr. Schulte?
Leedom: It all starting point back to him. When we reviewed his machines and his logs, we found some very suspicious things.
AUSA: Let's put up the chart and compare what #Wikileaks published to Mr. Schulte's logs

AUSA: What's the difference between a desktop and a server?
Microsoft's Leedom: A server is in a rack. It is basically like a beefy desktop.
AUSA: What type operating system ran on DevLAN?
Leedom: Window, Mac OS and Linux.

AUSA: We offer this chart of DevLAN into evidence.
Judge Furman: Any objection?
Schulte: No objection.

AUSA: At the risk as asking the obvious, what is "Date Created"?
[Jurors look bored - which happened during the first trial, too. This could take a while - but Schulte's own cross-examination of Microsoft's Leedom should be something]. Thread continues...

AUSA: Did you review what Wikileaks published?
Leedom: I did, the actual web pages.
AUSA: Where did the March 7 leak come from?
Leedom: The March 3 Confluence back-up.
AUSA: How do you know?
Leedom: The command was missing an argument.

AUSA: Let's look at what was posted on #Wikileaks. What is this?
Leedom: A page from the #Vault7 release.
AUSA: Did it appear as it would have on Confluence on DevLAN?
Leedom: Yes.

Leedom: #Wikileaks has its own font and color, but that's superficial. The information is the same. I didn't go though the page relationship or navigation directory.
AUSA: What conclusions did you draw?
Leedom: It made it easier to figure out how they stole it.

Leedom: We know this "165" is Schulte's workstation. Here, he requests administrative access to OLB Libraries, as SchulJo
AUSA: Does some person have to take an action to generate the event?
Leedom: Since he had the permissions, it was automatic.

Judge Furman: Mr Denton, would this be a natural place to stop?
AUSA Denton: Yes, your Honor.
Judge Furman: OK, jurors, we'll take our break. Enjoy it.
[Jury leaves]
AUSA Denton: We may finish direct today. We are 2 days behind.
[Oh, that pesky cross-examination]

Schulte: I want to note depending on how the government, once they get a chance to look at the letter I sent them, there may be a need to introduce the classified exhibit on cross.
Judge Furman: That's not happening this afternoon.
[Thread will continue]

[They're back]
AUSA: Did this session by Mr. Schulte eventually end?
Leedom: Yes, he logged out at 1:47.
AUSA: Do you see where he said "all private keys have been destroyed"?
Leedom: Yes. But he was still using them.

AUSA: Any activity with regard to the March 3 back up?
Leedom: Yes, they were accessed on April 20. Then he as administrator deleted log files- not normal.
Judge Furman: Could you just explain the basis for that testimony?
Leedom: Only delete when out of space.

Leedom: Having worked on cases where people nefariously hack in --
Schulte: Objection!
Judge Furman: Overruled.

AUSA: Did the defendant revert to that snapshot right away?
Leedom: He had to create a new one first. But eventually yes. A client on his work station was used to make this, at 5:29 pm on April 20.

Leedom: It's my opinion that these files were copied by the defendant.
AUSA: How do you know this?
Leedom: Wikileaks published these exact files.
Schulte: Objection!
Judge Furman: Overruled.

Leedom: It seems Mr. Schulte was using a scorched earth approach, just deleting all the log files and not just the juicy ones.
AUSA: What do you conclude?
Leedom: That the log deletions were successful.

AUSA: No further questions.
Judge Furman: Cross examination.
Schulte: Hello. Slide 89 - these are your forensic findings, correct?
Leedom: Yes.
Schulte: You state in bullet 1, "Schulte used" - but in bullet 2 you just say they were accessed, right?
Leedom: Yes.

Schulte: These were based on logs you retrieved from my CIA work station, right?
Leedom: Yes.
Schulte: But my work station would have not been impacted from the reversion, right?
Leedom: I don't understand.

Schulte: You met with the prosecutors to prepare, right?
Leedom: Yes.
Schulte: It was flattering to be picked to work on the case?
Leedom: It was.
Schulte: Raise your profile in the MITRE Corporation?
Leedom: In some ways.
Schulte: Now you're at Microsoft.
A: Yes

Schulte: DOJ is paying for your hotel?
Leedom: Yes.
Schulte: You had lunch with the prosecutors?
Leedom (laughs) Yes I did.
Schulte: You prepared your slides with Mr. Denton?
Leedom: Yes I did.

Schulte: You had complete access to the DevLAN machines, right?
Leedom: Yes.
Schulte: But you didn't recognize many of the CIA tools, right?
Leedom: Right.
Schulte: So someone else would have been more qualified --
AUSA: Objection!
Judge Furman: Sustained.

Schulte: Do you recall that the government said it must have happened on March 7?
Leedom: I'm a little blurry on that.
Schulte: Where did the FBI get that date?
Leedom: I don't remember.
Schulte: Were you involved in that analysis?
Leedom: I was in transition.

Schulte: Did you review the security of DevLAN?
Leedom: Yes.
Schulte: How was its security?
Leedom: Below average.
Schulte: Did you research the permission to access Stash?
Leedom: I didn't really work on that specifically.

Schulte: Did you know that Stuxnet was all over DevLAN?
AUSA: Objection! Can we have a sidebar?
Judge Furman: The objection is sustained.

Schulte: Would they know if someone just downloaded information onto a thumb drive?
Leedom: I don't know. I can't speak to that.
Judge Furman: This is where we'll call it for the day - until Friday. Don't discuss the case.

[Jury leaves]
Judge Furman: Mr Leedom, sorry you'll be here longer. But you're being compensated. You are excused.
[Leedom leaves]
Judge Furman: Mr Schulte came close to saying he wasn't given any forensic images. Is a curative instruction needed?
AUSA: If/when.

AUSA: There is a problem with Mr. Schulte saying, "Were you aware" - it's like he's testifying.
Judge Furman: Ask more neutrally. Given the pace, I think we'll run to or past July 10. Adjourned.
Stories soon on InnerCityPress.com & patreon.com/MatthewRussell…