If you are currently a juror for the Ross Ulbricht "Silk Road" trial you should close this page now, because this is precisely the kind of stuff the judge doesn't want you reading: armchair analysis of a witness on the stand. Specifically Ilhwan Yum, who
testified on Thursday which was day 9 of the trial. I was a little underwhelmed by the testimony, but I don't think it's Mr. Yum's fault since the rules of evidence would preclude some of the more entertaining findings. Also, the prosecution needs to tailor his testimony to a group of people who don't read /r/Bitcoin multiple times a day.
FBI Addresses
After some preliminaries where Mr Yum establishes a chain of custody for the two hard drives that were recovered and necessary legal positioning regarding MD5 and SHA1 checksums of the hard drive
he confirms what has been essentially public knowledge: the coins from Ross's Laptop were swept into
1FfmbH...paPH. What wasn't explicitly stated was that the coins from the Silk Road server were swept into
1F1tAa...4xqX. It was also
made clear that the addresses held coins from the two different servers. There was some brief mention the sum of the address was higher, but the defense addressed that later.
There was some operational information in the testimony about how they claimed the silk road coins. Apparently the sweep occured while the site was live and operational, and they even went through some steps to insure that the balances wouldn't be updated until all of the bitcoins were seized. And they even used the bitcoin services that were already on the server. This was important because the initial sweep off of the server took about four ours, according to the blockchain.
But what is interesting is that there appear to be two larger bumps within the next month:
Every circle on this chart represents a transaction into the 1F1tAa address. Most of the dots on the flat part probably represent "dusters" and "taggers" as I call them, but I don't know if the big jumps are coins recovered from other servers or coins that were improperly swept up. There's a lot of them so it's hard to tell.
Since this is a legal proceeding I think I should also be a bit more precise. The coins were not actually on the Iceland server, what was found was the private keys to bitcoin addresses,
lots of them. Over 2 million on the Iceland server and over 11 thousand on Ross's laptop. Clearly there weren't that many addresses holding a balance, so the sweeps only gathered those coins with balances. These addresses were entered in as CDs and are exhibits 650 and 651, which an individual well known in bitcoin circles
has said he will be obtaining.
Connecting the dots
This is the part of the testimony I found most astonishing. The analysis was
simply of one-to-one transactions. That's not the astonishing part, the rules of evidence basically would only allow transactions to be admitted to evidence where the party conducting the transaction is known and proven. In this case they only took effort to prove the transactions on behalf of keys held by the Iceland server to addresses whose private keys were on Ross's Laptop. One to one, not passing go or going through a tumbler or even through any kind of a relay. Direct from Iceland to Ross's laptop. That was the surprising part, not the astonishing part.
The astonishing part was how many bitcoins went into Ross's Laptop. There were
700,254 BTC worth of these one-to-one exchanges that occurred, and only 89,000 BTC received didn't come directly from silk road, 88.7% of the coins had a direct connection. Rather than detail every transaction in excruciating detail the defense showed only one:
b3561f...4984
I'm not sure why this transaction (the one in yelllow) was shown of all of the possible transactions to show. But judging on the way legal processes can go they were likely putting something into play that may need to be referenced later.
But wait... there's more!
You didn't think they would spend all that time and effort just to get a victimless crime prosecuted? Although they prosecution hasn't come out and made the final accusation in testimony (it's supposed to be coming Monday 2 Feb) they did have Mr. Yum enter in evidence relating to a transaction that wasn't one of the one-to-one transactions, but instead came from Ross's laptop. Mr Yum stuck to the boring details of the transaction itself
in his testimony.
He read in two transactions, and over the course of several pages makes it clear that the coins from the top three transactions were from private keys on Ross's laptop, the orange transaction came from Ross's laptop, and the coins in blue (later spent in the transactions in blue) received the coins he sent. Something more than $489,000 USD by Coinbase's estimates (where I get my transaction rate information). The next witness was getting to the good parts before the judge sent everyone home for the weekend.
Defense Cross Examination
The defense didn't spend nearly as much time cross examining the witness as the prosecution did directly examining him. And there was no redirect. But what he did do was place some seeds where a reasonable doubt could form. Like he worked with a partner, he wrote his analysis programs in
Python (actually it was Mr. Edmond who did the hands on typing, coders get left out of the spotlight
again), but they chose that because Pie Wallet (which was written in Python) was already on Ross's laptop. Those were all conversational.
The real doubt seeds come int he questions that are relating to the fact that the FBI is new to bitcoin seizures. They
initially didn't have a protocol in place to seize coins, which Mr. Yum helped establish. Wallets can
move from computer to computer, (but some other forensic data established their last access date). The government had access to the Iceland server
for months before the shutdown. And hey, maybe Silk Road was just
a hot-wallet service? Some of the more blockchain related questions (and the more sensible ones) were when the defense also
discussed the practice I call "dusting" and "tagging" with the witness, not grounds for reasonable doubt in my book.
He also tested Mr. Yum's knowledge of the large transactions on the blockchian. The defense
asked Mr. Yum about a large transaction on 22 Nov 2013 that summed 195,000 BTC. He then showed him some paperwork (but the transcript doesn't have references to the evidence numbers) and claims it has three outputs. I'de love to see what Mr. Yum was shown because I believe it was these two transactions (
1746d7...8ca9 and
1c1244...d204), but the lack of precision annoys me. It was described as
a transaction of 195,000 bitcoin that that was then quickly broken up into three smaller transactions [source]
There are two transactions close to that sum, both on the same date (22 Nov), and both are nearly 195 (194.993, with over half a BTC in the earlier one). Also both had two outputs. While there was three between them I think the defense was being sloppy in their questioning. Here's the graphs (minus the 47 inbound transactions for the first tx).
And what bothers me more is that the notion of on the spot "blockchain trivia" somehow makes an expert qualified or not. There are over 58 million transactions and you expect a witness in a trial to be able to answer about a random transaction without their proper tools and due diligence? If I had to guess I would have gone with a Bitstamp audit (and I would have
gotten lucky). Perhaps he felt he could ask because it was from a government exhibit, but I can't tell from the transcript.
Presumption of Innocence Still Stands
Don't forget, as of this post the trial isn't over, and Ross still has the presumption of innocence. While you may be reading the transcript and be ready to convict someone (Ross or the government) realize that the prosecution hasn't rested and the defense hasn't had a chance to present their case. If the case seems damning, that is only because the prosecution is competent in what they do, because if they didn't get to this point in pre-trial the judge would have kept it off her docket.
But the real question is how will the defense will address their side of the case. Spoliation of evidence? The keys were planted? Ross was a patsy for the real DPR (that's been teased in opening statements)? Ross never created those transactions he just held the keys as a backup for the real DPR? It was actually Mr. McMillan the school custodian who would have gotten away with it if it wasn't for those meddling teenagers and that talking dog? Who knows, it's their case to make.
So please, keep the pitchforks and torches down until the jury comes back with a decision. Then we can see which side will be mobbing and for what reason.
