1 IN THE CIRCUIT COURT OF THE STATE OF OREGON 2 FOR THE COUNTY OF WASHINGTON 3 4 STATE OF OREGON, ) ) 5 Plaintiff, ) ) 6 vs. ) No. C940322CR ) 7 RANDAL LEE SCHWARTZ, ) ) 8 Defendant. ) Volume 1 9 10 11 TRANSCRIPT OF PRETRIAL PROCEEDINGS 12 13 BE IT REMEMBERED THAT on the 13th 14 day of June 1995, the above-entitled matter came on 15 for Hearing before the HONORABLE ALAN C. BONEBRAKE, 16 a Circuit Court Judge. 17 18 APPEARANCES 19 Thomas J. Tintera Washington County Deputy District Attorney 20 Representing the State of Oregon 21 Mark Sussman Attorney at Law 22 Representing the Defendant 23 24 25 2 1 WITNESS INDEX 2 3 FOR THE DEFENDANT: Direct Cross ReD ReX 4 5 Paul Lazenby 61 70 71 6 Richard Cower 73 102 107 109 7 113 8 John Kent 116 9 James Lilley 123 164 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 3 1 MORNING SESSION 2 BEGINNING AT 10:30 A.M. 3 JUNE 13, 1995 4 5 MR. TINTERA: This is the time set 6 for the continuation in the omnibus hearing in 7 State of Oregon versus Randal Lee Schwartz. 8 940322CR. Defendant is present, not in custody at 9 this time and appearing with counsel, Mark Sussman. 10 THE COURT: I have met with counsel 11 earlier this morning in chambers and we have talked 12 briefly about how we might proceed most 13 economically in this matter with regard to trial 14 time. 15 I understand that, and we all agree, 16 that the first order of business might be to review 17 the motion to suppress that was directed to the 18 search warrant and affidavit that was filed to make 19 a preliminary determination on that. If I decided, 20 for instance, that the affidavit was insufficient 21 and entered an order suppressing the fruits of any 22 search and statements that were made as a result or 23 during that search, that, at least at this point in 24 time, would end the case. If I did not enter such 25 an order, then we would go on to hear the motion to 4 1 controvert. Then I would revisit the issue 2 regarding the motion to suppress after hearing the 3 motion to controvert. 4 During the last hour, I have 5 reviewed the affidavit that was presented to the 6 magistrate, Judge Freerkson, in support of the 7 warrant. I've reviewed the warrant and I have 8 reviewed the original motion to suppress filed by 9 Mr. Sussman, along with the supporting documents 10 and the supplementary memorandum that was filed 11 more recently. I didn't look at every document in 12 the file, Mr. Tintera, but I didn't see a written 13 response by the State. Do you have -- 14 MR. TINTERA: I don't think I 15 provided one, Judge. 16 THE COURT: I'm ready to hear 17 argument. Mr. Sussman. 18 MR. SUSSMAN: Your Honor, since you 19 read through the memorandum, I don't want to repeat 20 everything that's in there, but, in summary, the 21 essence of our position is -- 22 THE COURT: It's overbroad. 23 MR. SUSSMAN: Well, initially that 24 and, of course, that the search itself and the 25 seizure of Mr. Schwartz's computers and computer 5 1 equipment did not produce any evidence that we 2 expect the State to produce, which would be 3 incriminating, but during the course of the 4 execution of the search warrant, Mr. Schwartz was 5 interviewed by Washington County sheriff's 6 detectives and Intel officials acting in concert 7 with the law enforcement agency and what we 8 complain of are the statements obtained from 9 Mr. Schwartz which was obtained as a result of the 10 service of the search warrant. And if the search 11 warrant was improperly issued, as in the affidavit 12 it does not state they state probable cause, or if 13 the warrant was -- if the search was unlawful, then 14 the statements were obtained by exploitation of 15 that illegality and they may not be used. 16 THE COURT: It's an interesting way 17 to get there. I understand your argument. I've 18 been confronted with issues before about 19 admissibility of statements after a search was 20 executed as part of a search warrant, but typically 21 with those, it's after incriminating evidence was 22 found as well. 23 What I understand here is your 24 belief is that in the serving of the search 25 warrant, there was nothing incriminating found. 6 1 Nevertheless, they did interview your client and 2 statements were given by your client and what you 3 primarily seek to suppress here are statements made 4 on the ground on insufficient affidavit, it was 5 overbroad, et cetera. 6 I understand your argument. Doesn't 7 make any difference that there was no incriminating 8 evidence. 9 MR. SUSSMAN: That's correct. We 10 don't expect that the State will offer any evidence 11 from the search. 12 THE COURT: Unless they haven't told 13 you of everything. 14 MR. SUSSMAN: Well, I don't believe 15 Mr. Tintera would withhold anything. 16 THE COURT: I doubt that. 17 MR. SUSSMAN: At any rate, as you've 18 indicated, there are several separate grounds for 19 invalidating the search just on the face of the 20 warrant. 21 One of the grounds, the last ground 22 that I assert in the memorandum, which is something 23 that may require additional testimony, but the 24 essence of that argument is that ORS 133.575 does 25 not authorize -- law enforcement does not provide 7 1 law enforcement to employ civilians in the 2 execution of a search warrant unless there has been 3 prior authorization from a judge, and that 4 typically has to require a finding that this was 5 done for purposes of safety. That those 6 procedures, there was no such showing made that 7 that was not authorized by the Court and that 8 statutory violation invalidates the warrant and 9 invalidates the search. 10 THE COURT: Does it say that in the 11 statute or is that a conclusion that you reached? 12 I have not read that statute before today and I'm 13 aware that occasionally, the courts have said that 14 statutory violations do not necessarily give rise 15 to a suppression of evidence. 16 For instance, there used to be cases 17 on warrants not executed for service at any time of 18 day or night, that sort of thing. Nevertheless, it 19 was served at night or the time period, as I 20 recall. 21 There are other statutory provisions 22 regarding search warrants, and I recall that there 23 has been case law on some of those points. My 24 recollection is statutory violations do not always 25 give rise to the prophylactic rule requiring 8 1 suppression of evidence. 2 MR. SUSSMAN: To answer the first 3 part of the question, 133.575 Sub 1 reads that "A 4 search warrant may be executed only within the 5 period and at the time authorized by the warrant 6 and only by a police officer. A police officer 7 charged with its execution may be accompanied by 8 such other persons as may be reasonably necessary 9 for the successful execution of the warrant with 10 all practicable safety." 11 Then in Sub 3 -- I'm sorry. That's 12 the basis of the argument that we make, is that the 13 statute specifically allows certain limited 14 exceptions for the use for allowing other persons 15 as are reasonably necessary for purposes of safety 16 to accompany the officer in execution of the search 17 warrant, and I think the record in this case shows 18 that was not the case here. 19 THE COURT: The question I have, 20 though, assuming you're correct for the purposes of 21 argument on that, does the statute -- is there 22 required -- is their remedy here suppression of the 23 evidence? Is that by statute or case law 24 someplace? 25 MR. SUSSMAN: I believe this is 9 1 under State v. Davis at 295 Oregon at 237, that 2 this statute -- this is among the statutory 3 requirements which have constitutional significance 4 with respect to the codification of search and 5 seizure principles and the application of the 6 execution of searches that arose to sufficient 7 level to require suppression. 8 The second key -- The first argument 9 raised in the memorandum, the first key argument 10 here affecting the affidavit itself is that it's 11 our position that the affidavit does not state 12 sufficient facts to establish probable cause to 13 search Mr. Schwartz's residence, to search for 14 items of evidence at his residence. 15 Recognizing that the affidavit in 16 the search warrant should be read in a common sense 17 fashion and you may make reasonable -- the 18 magistrate may make reasonable inferences from the 19 facts set forth, I think the cases of State v. 20 Maxfield, which we brought to the Court's 21 attention, having recently been decided by the 22 Court of Appeals, and State v. Corpus Ruiz both 23 deal closely with analogous situations where you 24 had certain facts which may have permitted some 25 inferences that there was some kind of unlawful 10 1 activity going on, but the facts in the affidavits 2 did not -- were not sufficient to rise to the level 3 to make it probable, to make it more likely than 4 not that evidence of a crime was to be found in the 5 place to be searched. 6 Now, the affidavit in this case 7 largely recites activities of Mr. Schwartz taking 8 place within Intel that Intel has suggested were 9 against corporate policy and were a basis for 10 termination of his employment. 11 There are a couple key places where 12 the affidavit suggests that something more like a 13 crime is occurring, and I suggest that these 14 portions of the affidavit, where the inferences are 15 being made which are used to support the issuance 16 of the warrant, did not state sufficient facts and 17 were largely speculative. 18 THE COURT: If you don't mind that I 19 interrupt -- Mr. Tintera knows that I have a habit 20 of doing that -- but I find it's helpful for me to 21 sometimes try to state what I understand your 22 argument to be, then you can correct me if I'm 23 wrong. 24 You seem to have two points here. 25 One is the affidavit doesn't state facts sufficient 11 1 to show there was a crime being committed. 2 Secondly, if there was, there are 3 not sufficient facts to show probable cause to 4 believe that any evidence of that crime, if there 5 was one, would be in the claim. Is that a fair 6 summary? 7 MR. SUSSMAN: I think that's a fair 8 summary. There may be facts or suggestions that 9 may allow the inference that there was something 10 unlawful, but in certain key places in the 11 affidavit -- and I think that where the affidavit 12 is largely speculative are, if you look at, for 13 instance, Page 2 of the affidavit in the third 14 paragraph where the affidavit begins to recite 15 information to link or to suggest that Mr. Schwartz 16 may have been doing something which was suggested 17 to be criminal. 18 What you have is a statement that 19 "Mr. Morrissey told me that he expressed concern to 20 Mr. King the password information had been passed 21 to Mr. Schwartz' Apple portable computer." Yet the 22 affidavit states that this is really a bold 23 conclusion with no factual basis to say that there 24 was any documentation showing that file information 25 had -- that Mr. Schwartz had logged in in a certain 12 1 way or that they found anything on the programs 2 that were being run that would suggest that this is 3 where -- that made that particular connection. 4 The information that we have here is 5 that prior to that, Mr. Schwartz was running a 6 system on Intel computers within Intel using his 7 own password and using his own identification. The 8 factual basis for that concern or for drawing more 9 than some kind of inference is missing. This does 10 not state facts that show that it is probable that 11 Mr. Schwartz, in fact, transferred information to 12 this Apple portable computer. 13 THE COURT: You're looking at 14 Paragraph 2, Page 2? 15 MR. SUSSMAN: Paragraph 3, Page 2. 16 THE COURT: Give me a chance to read 17 that. 18 "Mr. Morrissey told me that 19 Mr. Schwartz has an Apple portable computer which 20 he attaches to the Intel computer network when 21 Mr. Schwartz is at his office on Intel property. 22 Then Mr. Morrissey told me that he expressed 23 concern to Mr. Kent that password information had 24 been transferred to Mr. Schwartz' Apple portable 25 computer." 13 1 MR. SUSSMAN: What we have here is 2 speculation, conjecture, but it lacks a factual 3 basis and there is nothing preceding it in the 4 affidavit which provides facts which would show 5 that Mr. Schwartz, in fact, transferred -- 6 THE COURT: You're saying the last 7 sentence there is speculation? 8 MR. SUSSMAN: That's right. 9 THE COURT: I think we might assume 10 that if Mr. Morrissey is testifying from knowledge 11 that he has -- 12 MR. SUSSMAN: Yes. 13 THE COURT: -- that he has such a 14 computer and uses it on Intel property. And the 15 second part, "Mr. Morrissey told me" -- he 16 expressed concern that password information had 17 been transferred, and I guess what you're saying 18 there is, they didn't state anything at all other 19 than the so-called concern to show that, in fact, 20 that occurred, that there is some indication in 21 their computer memory or whatever, some firsthand 22 observation by another person or anything like 23 that. Is that what you're saying? 24 MR. SUSSMAN: Yes. And that -- Then 25 when you look at the next paragraph regarding 14 1 Mr. Cower's statement to Detective Lilley, we have 2 a statement in -- well, basically the entire 3 paragraph, but the first sentence reads in part 4 where Mr. Cower told the affiant that based upon 5 his security experience in computer hacking, then 6 it goes on to say, "In order to avoid detection in 7 the workplace, Mr. Schwartz would transfer the 8 information to his Apple computer in order to work 9 on the information in the privacy of his own home 10 and information" -- 11 THE COURT: I wrote down here when I 12 read that "opinion". 13 MR. SUSSMAN: Exactly. It's 14 speculation, conjecture, opinion of this person, 15 and there is no factual basis stated for why that 16 opinion is fact, is factual, that there is a 17 factual basis for it. 18 Similarly with the next sentence, 19 says that, "Mr. Cower told me that this would be a 20 convenient way for Mr. Schwartz to move the 21 information to his office or home without being 22 detected by Intel's electronic safeguards." This 23 is based on Mr. Cower's experience. It is a 24 statement of opinion. It is perhaps speculation of 25 how something could be done if it was going to be 15 1 done, but there are no facts in this case to show 2 that this, in fact -- that there was -- that it was 3 probable that this is what was happening. 4 In a similar -- there is a third 5 spot where there is a similar emphasis on what 6 we'll call conjecture or speculation, and that is 7 at Page 4 of the affidavit where Detective Lilley 8 relies upon the statement of Detective Lazenby 9 based on -- where it says, Detective Lazenby told 10 him through his experience and training that he 11 knows persons who are involved in these activities 12 often will try to conceal the contents of the disks 13 and tapes. Mr. Schwartz used bi-labels or 14 mislabeled their contents and, therefore, they 15 asked for search and seizure of all, any and all 16 computer disks and tapes. 17 Once again, here we have -- we have 18 the issue of the affidavit not even stating the 19 facts of what these activities are that are being 20 referenced here, then referring to disks and tapes 21 Mr. Schwartz used where there is nothing in the 22 affidavit prior to that that shows Mr. Schwartz, in 23 fact, used disks or tapes which were then removed 24 from Intel and taken to his home. 25 And, in fact, that statement is 16 1 somewhat inconsistent with the statement on Page 1 2 of the affidavit in which Mr. Morrissey is quoted 3 in the next-to-last paragraph in the last sentence 4 of the third paragraph down. 5 THE COURT: Which page, Page 3? 6 MR. SUSSMAN: Well, I was referring 7 to -- working off Page 4, Detective Lazenby's 8 statement. 9 THE COURT: Okay. 10 MR. SUSSMAN: Referring you back to 11 Page 1. In the third Paragraph in the last 12 sentence where it begins that "Mr. Morrissey told 13 me that the reason he believed that Mr. Schwartz, 14 himself, was running the program was because 15 Mr. Schwartz is security conscious enough to use a 16 security password which would be difficult for 17 anybody else to obtain and utilize." 18 Seems that the statements about -- 19 in that sentence and in the previous sentence that 20 Mr. Schwartz was running the program under his own 21 identification and he was security conscious enough 22 that he would be able to make these tracks hard to 23 find, that seems inconsistent with the statements 24 that are -- the general statements that Detective 25 Lazenby is making, that you would expect to find 17 1 mislabeling or contents not labeled. 2 But the key to the challenge to 3 Detective Lazenby's information on Page 4 is that 4 there is an insufficient factual basis for the 5 conclusions stated by Detective Lazenby again to 6 show that it is probably, number one, that 7 Mr. Schwartz used disks and tapes. That there are 8 no facts to indicate what activities are that are 9 being referenced and that are then used to support 10 the request for -- which was ultimately granted -- 11 seizure of any and all disks and tapes. 12 THE COURT: Can't we infer that the 13 activities that are spoken of there are the 14 activities that are described previously in the 15 affidavit? 16 MR. SUSSMAN: Well, again, even if 17 we assume that he's referring to these activities, 18 meaning reading these files, the affidavit -- we 19 have nothing in the affidavit which would indicate 20 that -- what we have in the affidavit indicates 21 that this was done on Intel systems, and while it 22 is -- one may infer that these activities, because 23 they are unauthorized, are grounds for termination, 24 may be criminal, and then the person who has a 25 portable computer may have other accouterments to 18 1 it that could be taken out and might be found in 2 his home. 3 I think that is precisely the kind 4 of series of logical jumps that the Court and Court 5 of Appeals analyzed in State v. Corpus Ruiz saying 6 this was taking it too far, it wasn't in the 7 underlying facts of the case. 8 And in State v. Maxfield, the Court 9 said look at -- there are some things here that 10 perhaps make sense but doesn't necessarily 11 logically follow that you are going to find the 12 evidence of a crime or even -- of the crime 13 described in Maxfield in the marijuana growing in 14 the place that has to be searched. 15 In this case, we don't even 16 necessarily have a clear statement that, number 17 one, that there is a crime. And, number two, what 18 crime it is that you are looking for? And, number 19 three, that it would be -- that evidence of that 20 crime would be found in the place to be searched. 21 THE COURT: I've only read this 22 affidavit a couple times. Is there not somewhere 23 in this affidavit and statement that he typically, 24 your client, worked in his home as well as at 25 Intel's premises? Can you answer that for me? 19 1 Mr. Tintera. 2 MR. TINTERA: I can, Judge. Yes, 3 there is. It's on Page 2 from -- it's the 4 paragraph above the one that starts with 1 and 2 at 5 the bottom of the page and it's the last sentence. 6 THE COURT: "Further, Mr. Morrissey 7 told me that Mr. Schwartz told me that Mr. Schwartz 8 often works out of his office and at home." 9 I distinguish that from the 10 marijuana case, the photograhp case, because there 11 was no indications of what place, if any, that the 12 stuff might be growing. 13 On the other hand, here at least, 14 we -- from the affidavit, the magistrate could 15 understand that Mr. Schwartz typically operated his 16 computer in not less than two locations, one of 17 them being the Intel's premises and the other his 18 home. 19 MR. TINTERA: Three locations, Your 20 Honor, home or business. 21 THE COURT: Okay, his personal place 22 of business. So that's a bit different than having 23 pictures of growing marijuana with no indication 24 that it may be annexed to any particular location. 25 I'm not suggesting that you have good argument, you 20 1 have a lot of argument here, but every case has 2 different facts. 3 MR. SUSSMAN: I understand that. 4 But the thing is -- but the opening paragraph of 5 which indicates that the program that was running, 6 this crack program -- 7 THE COURT: When he saw it running 8 that day? 9 MR. SUSSMAN: Right, which raised 10 Mr. Morrissey's eyebrows and triggered this, was 11 running on an Intel computer at Intel. And it was 12 a long-running program within the Intel computers 13 there. And the thing is that what the affidavit 14 does not do, even though there is a statement that 15 Mr. Schwartz sometimes worked at home, Mr. Schwartz 16 has a portable computer, there is nothing in there, 17 other than speculation, that he could do these 18 things, that he could transfer, could copy these 19 things so that he could work on them at home that 20 indicates that there was a factual basis to show 21 that there had been that link to show that it was 22 probable that he was. 23 THE COURT: You see me getting that 24 glazed-over look sometimes. Doesn't mean I don't 25 understand your argument, but you say it's 21 1 speculation that the statement -- that the program 2 could be copied. Can I take this man's word for it 3 that he's a computer person, that the information 4 could be copied? It might be speculation, 5 arguably, that your client then took it home or 6 took it to some other location, but just seems to 7 me that the qualifications are sufficiently stated 8 there for me to believe when this person says that 9 this information could be copied onto a personal 10 computer that I could, as a magistrate, believe 11 that. Again, using a common sense approach to it, 12 understanding that the common sense approach 13 doesn't mean we dispense with facts for probable 14 cause, but we can draw reasonable inferences. 15 MR. SUSSMAN: The thing that 16 militates against that somewhat is that the first 17 paragraph on the top of Page 2 clearly states that 18 this activity was occurring and that Mr. Schwartz 19 had files and that Mr. Schwartz's files were -- 20 that were checked were within the Intel computer, 21 the system within Intel and that were clearly 22 identified by Mr. Schwartz, and that that action 23 inconsistent with -- doesn't support the factual 24 jumps that there were and doesn't say that there 25 were copies, any process made to copy them. 22 1 THE COURT: I agree that's an 2 argument that can be made. I don't disagree with 3 that. Does not necessarily support a conclusion 4 that he, in fact, did make copies. 5 MR. SUSSMAN: For instance, the kind 6 of factual basis that would support making that 7 inferential jump from the fact that there were 8 files on Mr. Schwartz -- clearly labeled files in 9 his own name within the Intel system, that they had 10 been somehow copied without authorization and taken 11 out, and what is missing, the jump that is made in 12 the affidavit is, you have that statement which 13 shows we have these things. We're concerned that 14 they shouldn't be here. 15 Number two, Mr. Morrissey's concern 16 that Mr. Schwartz could make copies of these, 17 because whether it be a portable computer or any 18 other computer could make copies of these things. 19 And then we have the opinions of Mr. Cower about 20 how that could be done, but what's missing is that 21 factual basis that you might see in other 22 affidavits that would say something like 23 "Mr. Schwartz is known to make copies of Intel 24 files." 25 THE COURT: That would support the 23 1 conclusion that, in fact, he did make copies. Two 2 points. He could make copies. He did make copies. 3 I don't have a problem with the first part. The 4 second part -- 5 MR. SUSSMAN: That's what is 6 missing, that factual link that allows us to go 7 from inference to probability, which is the essence 8 of the holdings in Corpus Ruiz and Maxfield, and 9 that the facts have to show that it is probable, 10 that it is more likely than not that there is 11 evidence of a crime to be found in the place to be 12 searched, and that's what's missing here. 13 Though it's discussed at some length 14 in the memo, I would really again bring your 15 attention back to one of the holdings in State v. 16 Carter Grant, the Supreme Court case cited in my 17 memorandum at Page 13 of that opinion where the 18 Court said there may be a number of inferences or 19 conclusions which may be drawn from this particular 20 evidence, but if it's just one of many 21 possibilities and doesn't rise to the level of 22 probability, it will not support the issuance of 23 the affidavit -- I mean, the affidavit will not 24 support the issuance of a warrant. And that's the 25 fundamental weakness and shortcoming of this 24 1 affidavit. 2 Bear with me for a second, Your 3 Honor, while I look for the affidavit I was looking 4 for. 5 THE COURT: Sure. 6 (Off the record.) 7 MR. SUSSMAN: In addition to what we 8 say that the facts are missing in the search 9 warrant, in the affidavit, there are some facts 10 which are stated in the affidavit which also seem 11 to contradict the conclusion that it is probable 12 that Mr. Schwartz -- or that evidence of some crime 13 would be found in Mr. Schwartz's home. 14 I made the point a number of times 15 that the affidavit states that he was running this 16 program under his own name and under his own 17 identification and these were in his own files, and 18 yet the affidavit goes on to suggest that the 19 reason you would find, if you were going to look 20 for these things in Mr. Schwartz's home, is that 21 somebody involved in these kinds of activities, the 22 computer hacking, which is something that is done 23 covertly or can be done outside of general 24 scrutiny, and that is what is consistent with the 25 earlier information in the affidavit, which is that 25 1 Mr. Schwartz -- this was being done out in the open 2 or, as I was trying to articulate the reference to 3 his being security conscious and being able to make 4 passwords or make things hard to get into, that he 5 had -- it indicates that he had the skills to cover 6 his tracks and the affidavit indicates that was not 7 done. 8 Actually, that actually undercuts 9 the inference that the rest of the affidavit was 10 trying to create, that he is accomplishing 11 surreptitiously or secreting information. 12 Now, the next thrust of the argument 13 in challenging the search in this case is that the 14 search warrant, itself, was drawn so broadly, is 15 overbroad and it was drawn so broadly that it is 16 defective in two ways: 17 Number one, it allows the search and 18 seizure of items which were not supported by facts 19 in the affidavit, justifying the seizure of those 20 items, and that's the State v. Ingram line of 21 authority. 22 And then the second defect in that 23 is that where it is, the warrant is drawn so 24 broadly that it allows the officer searching to do 25 so without the appropriate limitation under their 26 1 discretion of what to be looking for and seizing. 2 It also is overbroad, both of those. That is, 3 again, with reference to State v. Ingram. 4 I know you've read through the 5 memorandum. I went through that in great detail, 6 each of the sections of the warrant, and why I 7 submit that each of those sections were either not 8 supported by factual bases to show probable cause 9 to seize those items or how the search warrant 10 allowed for the search of items. For instance, the 11 search of any and all items of data or printouts or 12 files of any kind which goes too far because it 13 provides absolutely no limitation on the scope of 14 the search or the discretion of the officers doing 15 the search. 16 And, in fact, the way -- I cited, on 17 Pages 23, 24, 25 of my memorandum, State v. Jones, 18 supporting the proposition that what the warrant 19 did in that case is allow the search for items to 20 see if there was, in fact, evidence of crime rather 21 than -- which kind of puts the cart before the 22 horse, rather than saying -- then establishing that 23 there is the evidence of a crime which you may 24 search for and then seize. 25 As I mentioned in my memorandum, it 27 1 is probably dangerously close to, if not a prime 2 example of, something which has become a general 3 warrant. 4 I will not repeat, but I will 5 reiterate that the fact that Mr. Schwartz has on 6 his files materials at home, electronic mail, 7 material that he was writing as an author, 8 implicates his First Amendment under the United 9 States Constitution and rights under Article I, 10 Section 1 of the Oregon Constitution, which means 11 that the search should be drawn in more narrowly to 12 avoid infringing on those rights, and that was not 13 done in this case. 14 So for those reasons, we think the 15 affidavit in the search warrant, just on their 16 face, are defective and did not support the search 17 that occurred in this case. 18 THE COURT: Thank you. 19 Mr. Tintera. 20 MR. TINTERA: Thank you, Judge. 21 First point I'd like to address is 133.575, Judge, 22 and to read that in a common sense manner to make 23 sense of that particular statute, it says, "Police 24 officer charged with the execution may be 25 accompanied by such other persons as may be 28 1 reasonably necessary for the successful conclusion 2 of the warrant with all practical safety. 3 Practical safety is not final," it indicates, and I 4 would suggest that that is an ad hoc situation 5 where you deal with what you're searching for. 6 Now, if it's safety to the police 7 officers, obviously they're going to bring more 8 police officers, such as the SWAT team, but then 9 this wouldn't apply because it says police officers 10 are available. So what they're talking about is 11 bringing other people along for safety in regard to 12 the execution of the search warrant. Doesn't say 13 "safety of the persons." Says "safety." 14 What you have heard prior at our 15 other hearing was that the reason the Intel people 16 were brought was safety in extracting the computer 17 equipment so that the information would not be lost 18 or destroyed. That's exactly why the Intel people 19 were there. They were there as consultants to be 20 able to take the computer equipment safely from 21 Mr. Schwartz's home without destroying the 22 information or the subject of the search, and I 23 think that we are within the parameters of this 24 statute. 25 The statute is not limited to safety 29 1 of persons or safety of police officers. I think 2 it is reasonable to extend it to the safety of the 3 items that are being seized. In other words, that 4 it maintains its integrity. If there were other 5 people that would be necessary, for instance, if 6 they were seizing radioactive materials and it was 7 necessary to transport them in a particular way, 8 you might bring a civilian in to assist in 9 transporting. That might carry to other things of 10 safety of the people, but also to maintain the 11 integrity of the media being searched. And this 12 encompasses that and, therefore, the Intel people 13 were brought in to protect Mr. Schwartz's equipment 14 and the integrity of it, and assure its safety, but 15 also to maintain the medium so it could be removed 16 from its place and to an area where it could not be 17 corrupted. So I think we're within that particular 18 statute. 19 THE COURT: What about the 20 requirement that he mentioned that it's necessary 21 to submit that to the magistrate for authorization? 22 MR. TINTERA: I don't see that. 23 MR. SUSSMAN: Your Honor, to clarify 24 that, it's not in the statute. In my memorandum 25 and authority I cite for that was -- it refers to 30 1 the cases which allow, under special circumstances, 2 the Court to appoint somebody to supervise, a 3 private party to supervise or as a master in 4 certain circumstances. 5 THE COURT: All right. I understand 6 that now. 7 MR. TINTERA: Did you have any other 8 questions? 9 THE COURT: No. Let me make a note 10 on that, though. 11 MR. SUSSMAN: Your Honor, that 12 authority was cited at Page 32 of the memo. 13 THE COURT: Okay. 14 MR. TINTERA: In regard to the 15 search warrant itself, or the affidavit -- 16 THE COURT: Excuse me. Wait a 17 minute. I need to answer a phone call. 18 (Court in recess.) 19 THE COURT: Proceed, Mr. Tintera. 20 MR. TINTERA: In regard to the 21 affidavit, counsel's first point is that there is 22 no crime stated. I'd refer the Court specifically 23 to ORS 164.377 Sub 4, which says, "Any person who 24 knowingly without authorization uses access or 25 attempts to access any computer, computer system, 31 1 computer network or any computer software program, 2 documentation or data contained in such computer, 3 computer system or computer networks, commits 4 computer crime." That is established in the first 5 page of the affidavit. 6 THE COURT: Doesn't it have to be 7 for some purpose, though? 8 MR. TINTERA: No. 9 THE COURT: You were reading from -- 10 MR. TINTERA: 164.377. 11 THE COURT: I guess I skimmed over 12 it this morning. I did. I saw Subsection 2 where 13 it talks about, "Any person commits computer crime 14 who knowingly accesses, attempts to access or uses 15 or attempts to use any computer system, network or 16 part thereof for the purpose of devising." 17 MR. TINTERA: Those are the 18 felonies. 19 THE COURT: Okay. Then you're 20 saying Sub 4, that's misdemeanors? 21 MR. TINTERA: Yes. 22 THE COURT: That's simply to 23 accessing of it; is that right? 24 MR. TINTERA: Without authorization 25 or attempt to access. 32 1 THE COURT: Okay. 2 MR. TINTERA: So that is established 3 in the first page of the affidavit where it 4 indicates that this program had been run, that this 5 computer had been accessed and that Mr. Schwartz 6 was without authorization to do that. That 7 establishes computer crime. So the crime is stated 8 in the affidavit itself. 9 In regard to the probable cause, it 10 was helpful to me to read this affidavit, just read 11 it, which I did. Of course, I've read it more than 12 once, but just read it in an atmosphere of reading 13 along. And when I did that, we established that an 14 Intel employee is beyond his authorization going 15 into an area of SSD. It is a limited access area 16 because the products are considered 17 state-of-the-art computer systems, and it goes on. 18 We know that the area that he's 19 entering into is restricted technology area and 20 he's not authorized to go in there. We also know 21 what he's doing in there is deciphering, which is 22 essentially what a crack program is, passwords. We 23 also know that he uses on his -- when he works at 24 Intel, that he uses a laptop computer, which is a 25 portable computer, that that is how he does his 33 1 work at Intel. He plugs it into the Intel system. 2 We also know, through the security 3 expert for Intel, that this is a way to -- that 4 information can be transported on laptop computers 5 and that will evade Intel security measures. So we 6 pick that up from reading the affidavit. 7 We also know that Mr. Schwartz, in 8 the past, has felt it necessary to gain access to 9 the Intel system, breaching its security, what they 10 call the firewall. It's not referenced that in the 11 affidavit, but -- so I'll use the terms in the 12 affidavit, but that he has breached the security 13 systems of Intel by accessing Intel computers from 14 outside of Intel -- 15 THE COURT: This is in Paragraph 16 3 -- 17 MR. TINTERA: It's Page 3. 18 THE COURT: Page 3, the statement by 19 Dick Brandewie? 20 MR. TINTERA: Yes. So we know he's 21 done that in the past. And what we're seeing is a 22 person who is willing and able to breach Intel 23 security. 24 Then we get to the point of have we 25 established that it is more likely than not that 34 1 the evidence of computer crime would be discovered 2 in the areas authorized by the search? Well, we 3 know that he works at Intel. We know he works at 4 his home and his business and we know that he has a 5 vehicle. These were the areas that were authorized 6 to be searched. And that he hooks up his portable 7 computer to the Intel system and leaves with it, as 8 stated in the affidavit. 9 So is it more likely than not that a 10 person that is willing to compromise passwords into 11 a technologically restricted area is going to 12 transport that information away from Intel to use 13 at their own -- in the privacy of their own home 14 and office, as referenced in the affidavit? 15 The Court has referred -- I'm 16 looking at Page 2 now, as these just being just 17 opinions of Mr. Cower, and definitely counsel has 18 referred to that as speculation and conjecture. 19 THE COURT: Well, to be honest, I 20 didn't write down "just opinion," I wrote down 21 "opinion," recognizing that sometimes the Court 22 does -- may rely upon the opinion of people, if 23 they are qualified to express opinions, in finding 24 probable cause. 25 For instance, I even thought of a 35 1 situation we commonly confront in narcotics 2 seizures where we rely upon expertise of police 3 officers or their snitches from experience to be 4 able to identify controlled substances and that 5 sort of thing, so I know that is permissible. 6 MR. TINTERA: I think the magistrate 7 could rely on that in regard to the medium of 8 transportation of the information out of Intel for 9 use as Mr. Schwartz saw fit, for whatever reason 10 that he was gaining access to. But we know he used 11 this computer and it's reasonable to assume that 12 the information that he's using is on that laptop. 13 The police are not asking to search 14 everything. They're asking to search the areas 15 where they know he uses the computer system or 16 transports the computer system. And just seems to 17 me when you sit back and you read this from a 18 common sense, not hypertechnical, but from a common 19 sense standpoint, the information presented in here 20 just follows, it fits, that once a person is 21 willing to do this, that they are going to 22 transport, based on what Mr. Cower said, off 23 campus, to do whatever they're going to do with it, 24 whether it's to sell the information or whatever 25 they're going to do with it, but they're not going 36 1 to necessarily keep it in Intel. 2 Mr. Sussman says, well, gee, he used 3 his own name, did all this stuff. We don't 4 necessarily catch the smart ones. Just because -- 5 There are many forgery cases where an individual 6 signs his own name to the check where the check is 7 stolen. 8 THE COURT: That's happened? 9 MR. TINTERA: Somebody else's check, 10 not their own. But it doesn't detract from what's 11 in the affidavit just because he's caught at doing 12 what he's doing. That doesn't mean that this is 13 something that a magistrate could look at, and that 14 would be conjecture to come up with something that 15 says it's beyond his scope of authority. 16 I don't want to belabor the 17 particular point, but the most helpful thing to me 18 was to just sit back and read this, and when I did 19 that, I had an outline of what had happened here. 20 A contract employee is exceeding the scope of his 21 employment going into a highly sensitive area of 22 the supercomputer division of the Intel 23 Corporation, cracking the passwords of the people 24 who work there, which gives him access to their 25 files, and doing that through the medium of a 37 1 laptop computer that he can take off campus through 2 Intel security. And we know he works at his home 3 or business and he transports it in a vehicle and 4 that's what we asked to search. 5 THE COURT: Then you have the 6 opinion of Mr. Cower that in order to escape 7 detection -- he says here, "In order to avoid 8 detection in the workplace, Mr. Schwartz would 9 transfer the information to his Apple portable 10 computer in order to work with the information in 11 the privacy of his own home or office." 12 I take that as a statement by him 13 that a person wanting to do this, he said 14 Mr. Schwartz, but that a person wanting to do it in 15 order to escape detection would do that sort of 16 thing and then under the unique facts involved 17 here, it translates into his opinion as to what 18 Mr. Schwartz did. 19 MR. TINTERA: Yes. 20 THE COURT: That's what he's saying. 21 Is that your interpretation of that? 22 MR. TINTERA: Yes. 23 THE COURT: It would seem logical if 24 a person was trying to escape detection of what he 25 was doing, he would try to get the stuff out of 38 1 home office, so to speak, so he could work on it in 2 privacy. 3 MR. TINTERA: I think that's what 4 he's saying. 5 THE COURT: Then he's saying that's 6 what Mr. Schwartz was doing. 7 MR. TINTERA: Based on his 8 experience as a network security expert for Intel, 9 yes. 10 THE COURT: Then if he did that, 11 logically, where would he go, to his office or 12 home? 13 MR. TINTERA: Well, is it more 14 reasonable to -- 15 THE COURT: Well, he could do it on 16 a park bench if he had a portable computer, 17 couldn't he? Unless it's winter. 18 MR. TINTERA: Well, we know he works 19 on his computer at Intel. We know he works on the 20 computer at home, through the affidavit, and at his 21 business. So those are the three areas that were 22 asked to be searched, and the medium of transport. 23 THE COURT: Okay. 24 MR. TINTERA: In regard to the 25 seizure of the computer system, it indicates in the 39 1 affidavit that the -- I've -- regarding Detective 2 Lazenby, referencing Page 4, "necessary for an 3 expert to examine the computer evidence to prevent 4 destruction of that evidence and any other 5 information on the computer." 6 I believe that is computer evidence, 7 although not the strongest description of the 8 computer system, I believe it supports a seizure of 9 the computer system itself in the search warrant so 10 that it can be taken by an expert to be examined to 11 where the information will not be destroyed. It is 12 not, perhaps, as spelled out as we may like in 13 hindsight, but I believe that that does support the 14 seizure of the computer system. Certainly supports 15 the seizure of the laptop computer. 16 In regard to the free speech 17 argument, I'll just briefly touch on that. There 18 is no way that the officers are going to be able to 19 know that an area of speech or of a book or 20 anything is on a computer system. There is no way 21 that they can draft the affidavit in a good faith 22 way to anticipate that information unless or until 23 they actually find it there, Judge, so I'm not sure 24 that we're on the same page when it comes to the 25 free speech argument. 40 1 That's all I have, unless the Court 2 has some questions for me. 3 THE COURT: You've just been handed 4 a note. 5 MR. TINTERA: That's all I have, 6 Judge. 7 THE COURT: Did you address -- just 8 give me a minute here. 9 Mr. Sussman, anything further? 10 MR. SUSSMAN: To the extent that the 11 affidavit stated a crime, as Mr. Tintera pointed 12 out, the crime that the affidavit states is one 13 that was committed wholly within the premises of 14 Intel from the face of the affidavit, the 15 unauthorized access or attempt to do that, that the 16 statute referred to. The evidence of that is all 17 from the affidavit on the face of it, clearly 18 within the files and activity. 19 THE COURT: Where is all the 20 evidence of it? He saw the computer running at 21 Intel. That doesn't exclude the possibility that 22 other evidence might be found off premises. 23 MR. SUSSMAN: Because the affidavit 24 refers to the fact it was based on the inspection 25 of Mr. Schwartz's files that were within the 41 1 computer systems, where these programs were 2 running. The laptop only plugs into the system 3 where this access was taking place, and the first 4 paragraph states that. 5 What's happening here is an ongoing 6 program that is running at the time this 7 application for the search warrant was sought, and 8 the active file is showing that this program is 9 running, and what was in that program were within 10 the files under Mr. Schwartz's name, but that were 11 within the Intel computer system. 12 The evidence of that, if that was, 13 in fact, a crime, that was all evidence within the 14 Intel computer systems and the files that were 15 there. 16 THE COURT: Why wouldn't also 17 evidence be disclosed in his own laptop computer? 18 If it was at his place of residence, might be 19 evidence of a crime, afterwards, after the fact. 20 You're saying the exact moment the 21 crime was being committed and thereafter records 22 would be on the premises of Intel. Why wouldn't it 23 also be likely, more probably than not, that his 24 own laptop computer would contain evidence of what, 25 in fact, had occurred based upon what's in the 42 1 affidavit? And not only his own laptop computer, 2 but other computer records that he would have 3 available. 4 MR. SUSSMAN: Well, in part because 5 the program that was being run here was being run 6 on a separate computer, a computer that was within 7 the Intel system. And I don't believe -- 8 THE COURT: Does it say that? I 9 thought Mr. Tintera said it was his practice to 10 plug in his laptop computer when he was on the 11 Intel premises. 12 MR. TINTERA: It's on Page 2, 13 second -- third paragraph. 14 THE COURT: Says, "Mr. Morrissey 15 told me that Mr. Schwartz has an Apple portable 16 computer which he attaches to the Intel computer 17 network when Mr. Schwartz is at his office or -- 18 "at his office on Intel property." 19 MR. SUSSMAN: And Paragraph 1 20 indicates that the program was running on a Sun 21 computer -- I'm sorry, Page 1, second paragraph, 22 says that "Mr. Morrissey indicated that on October 23 28th, he noticed an unusual process running on Sun 24 computer which he was administering. It was the 25 crack program." He found the file in that 43 1 paragraph, saw this as a possible violation. 2 And then the next paragraph 3 indicates that he sees that it's Mr. Schwartz 4 because it's under Schwartz's identification and 5 finds files under Mr. Schwartz's name in that 6 system. So that was merely the point, that the 7 evidence of that offense, if there was an offense 8 there, it was all contained in there. 9 And then the next step, what we 10 have, the other common sense way of looking at this 11 also is that people at Intel see that this program 12 is running and there is some compromised passwords 13 on the system at SSD that they are worried about. 14 And then you have the next leap, 15 which is the speculation, well, we see by his own 16 files that it's out there in the open, that Randal 17 Schwartz is running this. Well, he could be taking 18 this out of Intel. He could possibly do that on 19 his computer, on his portable that we know that he 20 has. He might have something there that we're 21 worried that he might have. We're concerned about 22 that and we want to take a look and see if there is 23 anything there and that's, in effect, what the rest 24 of that affidavit for the search warrant 25 essentially states and what, in effect, was the 44 1 search authorized. 2 The facts that would make that -- 3 take it to that next level to beyond the 4 speculation, beyond the inference to the 5 probability, the facts stating probable cause, 6 aren't there. 7 THE COURT: I understand they have 8 to bridge that gap. Mr. Tintera, I know 9 technically -- 10 MR. TINTERA: I have a very brief -- 11 THE COURT: I'll let you both 12 complete everything that you have to say because 13 it's helpful to me. 14 MR. TINTERA: I only want to respond 15 to a couple things. 16 In regard to Mr. Sussman's -- I have 17 looked for the lowest common denominator in regard 18 to the crime stated, and there are others. Since 19 he's brought it up, I'll mention it. 20 Paragraph of -- Page 2, Paragraph 3, 21 where it talks about Mr. Schwartz's activity in 22 bypassing Intel's security systems, includes a 23 reference to 164.377 Sub 3, in which he alters -- 24 without authorization alters, damages or destroys 25 any computer, computer system, that is evidence of 45 1 altering the computer system without authorization 2 by breaching the Intel security so that he can 3 access their internal computers from the outside. 4 Further, it also references his 5 running the crack program on the SSD password files 6 is the theft of proprietary information. And I'm 7 referring to 164.377(2), sub lower case (c), 8 "Committing theft, including but not limited to 9 theft of proprietary information. Proprietary 10 information includes any scientific," and goes on, 11 "or business code that is known only to limited 12 individuals within an organization." That is also 13 established within the affidavit. 14 THE COURT: Mr. Sussman. 15 MR. SUSSMAN: I think we have beat 16 this horse to death. 17 THE COURT: I know. Again, I remind 18 you both that you are much more up to speed on the 19 facts involved here than I am, and it's 20 appropriate, I think, because it's your job to 21 supply the factual information and argument to me, 22 and hopefully my mind isn't cluttered by any 23 preconceived notion or other knowledge of how 24 computers work or any of that, and you have a clean 25 slate here because I have no knowledge of computers 46 1 and I rely only on what you tell me and what's in 2 your affidavit and arguments. 3 You've indicated that -- You've both 4 made fine arguments and it has been helpful and it 5 was helpful to me this morning to read the 6 affidavit again. And what I did was sort of, as 7 Mr. Tintera suggested he did, before I read the 8 memoranda that were filed, I read it, the affidavit 9 and the warrant, as though I was the Judge being 10 confronted with the task, it was being presented to 11 me. And my habit when I do that is not to write in 12 the margins, because I have the original, but thank 13 God for yellow sticky tabs, is to place yellow tabs 14 on the margins of the affidavit every time I see a 15 question. 16 And then if something comes to mind, 17 an issue that I see, something that isn't answered 18 on the basis of knowledge or reliability or 19 whatever, then as I read through the affidavit, 20 some of those questions are answered and I remove 21 the tabs. And when I get done, I have tabs left 22 and I review those to see if nevertheless the 23 material in the affidavit is sufficient to state 24 probable cause. And I did that and there were a 25 number of questions. 47 1 I wrote "opinion" in the margins. 2 Some places, I wrote "speculation," and after going 3 clear through, most of my questions were answered. 4 I then went back and reviewed it again, and at 5 first blush, knowing that I had not yet heard 6 argument, I was satisfied that the affidavit was 7 sufficient. 8 Then I heard argument -- Then I read 9 the memoranda, I saw the issues you raised, and 10 many of the ones were ones that I had seen after I 11 read the affidavit. 12 Now I've heard argument in addition. 13 Some of the points have been clarified, for 14 instance. I have not read the criminal statutes 15 carefully and didn't realize there was a 16 misdemeanor version of the crime and that simply 17 unauthorized entry into the computer system could 18 be a crime without a special purpose. Originally, 19 I felt there must be some special purpose proven, 20 and I thought the factual basis there might be 21 lacking. 22 But now I believe that, going 23 through that, I do find in this case, after having 24 reviewed the materials, heard argument, reviewed 25 the statutes cited, in fact, I think to take them 48 1 in order that Mr. Sussman has argued here, that 2 there was no statutory violation by reason of the 3 fact that police officers took Intel personnel to 4 the site of the search or searches in this case. 5 That it was authorized by statute. 6 Secondly, that in reviewing the 7 affidavit, I do find probable cause to exist and 8 the affidavit passes muster in that regard for 9 search of the premises, places listed in the search 10 warrant. 11 The remaining issue has to do with 12 the argument that it's overbroad, and every case is 13 different and every factual scenario unique, and I 14 don't know that I've ever read a case involving a 15 search of computer records. I am of the opinion, 16 though, given the facts that are involved in this 17 case and having considered the affidavit and then 18 the warrant that was authorized by the magistrate, 19 Judge Freerkson, that the warrant is not overbroad. 20 And so I think our next task is to 21 be involved in a motion to controvert and determine 22 whether or not there are facts in the affidavit 23 that must be excised and then reconsider the 24 affidavit to determine whether or not probable 25 cause exists, and we can get into that after the 49 1 noon hour. 2 Any questions? 3 MR. SUSSMAN: No, Your Honor. 4 MR. TINTERA: No, Judge. 5 THE COURT: Thank you. We'll 6 reconvene at 1:30. Thank you. 7 MR. TINTERA: Thank you, Judge. 8 (Luncheon recess.) 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 50 1 AFTERNOON SESSION 2 BEGINNING AT 1:30 P.M. 3 JUNE 13, 1995 4 5 THE COURT: Mr. Sussman. 6 MR. SUSSMAN: Your Honor, as I 7 understand, we're prepared to proceed now with 8 witnesses and testimony on the motion to 9 controvert. 10 THE COURT: All right. I am. 11 MR. SUSSMAN: The first witness to 12 accommodate some scheduling problems, we'll call 13 Rich Cower. 14 MR. TINTERA: Judge, before the 15 defense calls witnesses, I would like an 16 opportunity to -- as I read the statute, the 17 defense has to show by affidavit a substantial 18 basis for challenging the good faith, accuracy or 19 truthfulness of the affiant. 20 It's come to my attention on the 21 affidavit of counsel that there are some 22 inaccuracies that should be corrected, and I would 23 like to call a witness to correct those 24 inaccuracies in the form of not an affidavit but 25 actual sworn testimony in regard to the affidavits 51 1 that have been filed. 2 THE COURT: You wish to correct the 3 affidavit that was in support of the search 4 warrant? 5 MR. TINTERA: No. In support of -- 6 Counsel is required to file an affidavit in support 7 of the motion to controvert. 8 THE COURT: Right. 9 MR. TINTERA: And there are some 10 inaccuracies in counsel's affidavit, and I can 11 either call Mr. Sussman, but I think -- I thought 12 it would be more expedient -- Since he's the 13 affiant, I could call him, but I thought it would 14 be more expedient to call Mr. Cower to correct the 15 inaccuracies that I see in his affidavit. 16 I can do it either way, but I think 17 it's important because I think there is a threshold 18 determination that the Court must make, and that is 19 has the defense shown a substantial basis to 20 challenge the truthfulness, accuracy or good faith 21 of the affiant, Detective Lilley? I'm not 22 conceding that point. 23 THE COURT: I understand. In 24 particular, which affidavit filed by Mr. Sussman, 25 when and where and -- 52 1 MR. TINTERA: There are two 2 affidavits in support of the motion to controvert. 3 THE COURT: I do see one here. 4 MR. TINTERA: The first is dated 5 August 10, 1994. 6 THE COURT: I think that's the one 7 filed the 11th that I have before me. 8 MR. TINTERA: And the Second 9 Affidavit of Counsel Supporting Supplementary 10 Motion to Suppress Defendant's Motion to 11 Controvert, and that is dated June 5, 1995. Second 12 Affidavit of Counsel Supporting Supplementary 13 Motion to Suppress, and in parenthesis, Motion to 14 Controvert. 15 THE COURT: I do have that. Well, 16 in particular, tell me what it is you wish to do, 17 point out the so-called inaccuracies in the 18 affidavit of counsel? 19 MR. TINTERA: On Page 4 of the 20 affidavit of counsel, which is dated August 10, 21 starts on Line 4, but I think it's Paragraph 11 22 that "the affiant represented to the magistrate 23 that it was believed that the information relative 24 to the suspected offenses was obtained on floppy 25 disks." No report from any Intel employee mentions 53 1 floppy disks. Could have left the impression that 2 someone saw Mr. Schwartz in possession of floppy 3 disks or using floppy disks at Intel. 4 The reference to floppy disks was in 5 regard to the expert information that Detective 6 Lilley had received and how information can be 7 transported out of Intel. And I think Mr. Cower 8 can enlighten the Court, since he was the person 9 who said that in regard to that sworn statement by 10 counsel -- 11 THE COURT: Well, what he said is 12 not important. It's what was in the affidavit, 13 what was communicated to the magistrate that's 14 important. 15 MR. TINTERA: I understand, but my 16 final point, after I correct these inaccuracies, is 17 that there is no substantial basis to go any 18 further with the motion to controvert. 19 THE COURT: Show me in the 20 affidavit, then, where it appears that what 21 Mr. Sussman has in Paragraph 11 is not correct. In 22 other words, he's characterized in his affidavit, 23 Paragraph 11, you say he's characterized something 24 that was in the search warrant affidavit, or 25 mischaracterized something. 54 1 MR. TINTERA: Yes. All right, I'll 2 find it for you. 3 I'm sorry, it's Detective Lazenby. 4 It's Page 4, first paragraph, "Detective Lazenby of 5 the Washington County Sheriff's Office has told me 6 through his experience and training he knows of 7 persons who are involved in these activities often 8 will try to conceal the contents on disks and 9 tapes." 10 So disks and tapes reference on 11 floppy disks. I assume that's what he's 12 referencing. I think that's the only part that 13 deals with disks and tapes. And what he's trying 14 to get to is that this somehow misrepresents and 15 that there was no information. We didn't say 16 anything about there being -- that this was -- that 17 this information was put in the affidavit as -- 18 THE COURT: General information, 19 background information from Lazenby's experience 20 and training? 21 MR. TINTERA: Exactly. Thank you. 22 THE COURT: Not representing it as 23 being information solely received from Intel. 24 MR. TINTERA: Right. There is no 25 information that it came from Intel. 55 1 THE COURT: Did you interpret this 2 to mean, Mr. Sussman, that -- this paragraph on 3 Page 4 of the search warrant affidavit, that this 4 somehow was information that Lazenby had received 5 only from Intel? That's not what it says. 6 MR. SUSSMAN: No, Your Honor. I 7 think in presenting this to controvert, this as an 8 inaccuracy in the search warrant, as I indicated 9 and argued earlier, the search warrant stated no 10 facts to support -- the affidavit stated no facts 11 supporting there was floppy disks to request in the 12 bottom of Page 4 authorizing the seizure of floppy 13 disks. 14 Detective Lazenby refers to disks 15 and tapes. But what this would show is in asking 16 for the warrant, Detective Lilley was asking for 17 information, for a seizure of certain items which 18 we think -- which we intend to explore that would 19 indicate that nobody had told him, and he had no 20 knowledge that Mr. Schwartz was in possession or 21 use of floppy disks. That was the thrust of what I 22 was trying to get at in Paragraph 11. 23 THE COURT: So Lazenby, in the 24 search warrant affidavit, says he knows from his 25 experience that people that do this sort of thing 56 1 frequently conceal the data on disks and tapes. 2 And you want -- and he used that for the basis of 3 looking for disks and tapes that might be in the 4 defendant's possession. 5 You're saying that nobody from Intel 6 told him, gave him any information that would lead 7 him to believe that the defendant had anything on 8 disks or tapes, and so -- 9 MR. SUSSMAN: That's right. 10 THE COURT: -- so he had no basis 11 for believing that. 12 MR. SUSSMAN: That's right. 13 THE COURT: That there were any 14 disks or tapes in the defendant's possession. 15 MR. SUSSMAN: Yes, sir. 16 THE COURT: Except that he said his 17 experience. Does he have to rely only upon what 18 Intel would tell him? 19 MR. SUSSMAN: I don't think 20 Paragraph 11 says that Detective Lazenby says that 21 the information was contained on floppy disks. At 22 the bottom of Page 4 in the affidavit, the affiant 23 asks for seizure of these computer systems and all 24 floppy disks, inferring that this -- that there 25 was -- 57 1 THE COURT: I understand. 2 Mr. Tintera, what other points do you have? 3 MR. TINTERA: I'd like to expand on 4 what he said. Everyone is assuming, and counsel is 5 assuming, that we're talking about floppy disks. A 6 floppy disk is what you put in the computer to put 7 information on it. 8 THE COURT: I thought it was 9 something in a bad back. I've heard of a ruptured 10 disk. 11 MR. TINTERA: You can also have 12 ruptured disks, but they don't occur in computers. 13 I don't think so. Mr. Schwartz may have a -- 14 THE COURT: I told you I have a 15 clean slate as far as computers. 16 MR. TINTERA: Also, Detective 17 Lazenby did not restrict himself to floppy disks, 18 although people are assuming that there is also a 19 hard disk, which is something that remains inside 20 the computer that also contains information. So 21 you can have information on a hard disk of the 22 computer that can be copied onto a floppy disk that 23 can be removed. 24 What Detective Lazenby is talking 25 about, I think it's reasonable to assume, is both 58 1 forms of medium of containing computer information, 2 whether by using just the generic disk, it can be a 3 floppy or a hard disk. I think that's important to 4 note in regard to Paragraph 11 of counsel's 5 affidavit. 6 THE COURT: How many of these points 7 do you have? 8 MR. TINTERA: Well, that's 9 interesting, because I hadn't planned on presenting 10 this. I had planned on my witness answering that 11 question, so give me a minute. 12 THE COURT: I'm thinking about 13 procedure, how to do this. Having dealt with both 14 you and Mr. Sussman, my belief is neither of you is 15 going to do anything at all inappropriate or even 16 close to the line as far as presenting information 17 to me, and I'm going to go out on a limb and say 18 that if Mr. Sussman says in his affidavit that he 19 believes something to be true because of what he's 20 read, what I would like to do is let him present 21 his case and these points that you're bringing up 22 can well be made in your argument or rebuttal. 23 MR. TINTERA: But I think this is a 24 threshold question before we even get into the 25 motion to controvert. 59 1 THE COURT: I know you think that. 2 MR. TINTERA: You've understood 3 that. 4 THE COURT: I do. But procedure -- 5 I think the way to handle it, the way I'd like to 6 handle it is for him to go ahead and make his case. 7 And if you have an explanation or you think he's 8 misreading the affidavit or something -- well, I 9 understand the statute does require -- I've read 10 the statute on a number of cases. I know the 11 showing necessary. 12 I'd like to interpret the affidavit 13 followed by Mr. Sussman, at least initially, 14 subject to you being permitted to argue after 15 you've heard the evidence. And it may be that I'll 16 believe your argument and I'll say no, I'm not 17 going to consider that point or excise that point 18 or something, but I'd like to do this once, is what 19 I'm saying. 20 MR. TINTERA: I agree with Your 21 Honor, but the State v. Harp, 299 Oregon, 1995 case 22 indicates that they are referencing on Page 9, the 23 last full paragraph, they're talking about 24 Subsection 2, which we're talking about, allows the 25 defendant to contest the good faith, accuracy and 60 1 truthfulness of affiant. Then in quotes, "It has 2 only upon supplementary motion supported by 3 affidavits setting forth substantial basis for 4 questioning the good faith, accuracy and 5 truthfulness." 6 THE COURT: You and I have both been 7 parties to these sorts of proceedings where no 8 affidavit has been filed by the defendant or 9 affidavits that are so general that they tell us 10 nothing, to mixed affidavits, to rather lengthy 11 affidavit, as prepared here by Mr. Sussman. I 12 compare this to others that I have reviewed and, 13 frankly, again, procedurally, I'd like to go ahead 14 and let him make his presentation. 15 I agree there is a threshold issue, 16 but when he's done, you can load your rifle and 17 shoot at all the targets you wish to and I'll hear 18 your argument then. Otherwise, I'll hear your 19 argument now, and if I overrule you, he'll present 20 the evidence, then I'll hear your argument again. 21 It will be the same argument twice. 22 MR. TINTERA: Thank you. 23 THE COURT: Thank you. I appreciate 24 the fact that you've folded your tent and both 25 parties are willing to proceed procedurally the way 61 1 I've outlined. Let's proceed that way. 2 Mr. Sussman, call your first 3 witness. 4 MR. SUSSMAN: Detective Lazenby, 5 Your Honor. 6 7 PAUL LAZENBY 8 called as a witness on behalf of the Defendant, 9 having been first duly sworn under oath, was 10 examined and testified as follows: 11 12 THE CLERK: State your full name and 13 spell it for the record, please. 14 THE WITNESS: Paul Lazenby. 15 L-a-z-e-n-b-y. 16 17 DIRECT EXAMINATION 18 BY MR. SUSSMAN: 19 Q You are a detective with the Washington 20 County Sheriff's Office? 21 A Yes, I am. 22 Q How long have you been employed in that 23 capacity? 24 A I've been a police officer about 23 25 years. 62 1 Q And how long have you been a detective 2 with the Washington County Sheriff's Office? 3 A About 15 years. 4 Q To set the timeframe here, you were a 5 detective in the Sheriff's Office on or around 6 November 1st, 1993? 7 A Yes. 8 Q And were you asked to participate in the 9 preparation of a search warrant affidavit involving 10 Randal Schwartz and some computer equipment? 11 A I provided some information, yes. 12 Q Did you have a chance to read the 13 affidavit before it was presented to the 14 magistrate? 15 A I believe I read the next-to-the-final 16 draft or almost the final draft at Intel, yes. 17 Q Do you have copies of that with you? 18 A No. 19 Q When you reviewed the next-to-final 20 draft, did you make any changes in it? 21 A Not that I can remember. 22 Q Now, you've previously testified -- at 23 the beginning of this hearing many months ago -- 24 about your training and experience with computer 25 crime investigation. 63 1 A Uh-huh. 2 Q As I recall. And there is some reference 3 to your training and experience on Page 4 of the 4 affidavit. 5 Did you talk to Detective Lilley 6 about your -- about the nature of your training and 7 experience? 8 A Did I talk to him about it? 9 Q Yes. 10 A I can't remember discussing that 11 specifically with him. 12 Q Did you tell him specifically what you 13 had learned about computer crime investigations in 14 the two-week course that you took? 15 A I believe I did, yes. 16 Q Did you tell him that this was the first 17 computer crime case that you were involved in 18 investigating? 19 A The first one? 20 Q Yeah. 21 A No, I did not tell him that. 22 Q Now, on Page 4 of the affidavit, it 23 states that "Detective Lazenby of the Washington 24 County Sheriff's Office has told me that through 25 his experience and training, he knows that persons 64 1 who are involved in these activities often will try 2 to conceal the contents of disks and tapes 3 Mr. Schwartz used by mislabeling or not labeling 4 the contents," and then it continues. Did you have 5 any specific information -- 6 MR. TINTERA: Judge, I object to the 7 form of the question. It does continue, and I 8 think in fairness to the witness, he needs to 9 indicate the full sentence to put this in context. 10 THE COURT: Read the full sentence 11 to him. 12 BY MR. SUSSMAN: 13 Q The sentence concluded by saying, 14 "respectfully requested that the authorization for 15 seizure of any and all computer disks and tapes be 16 ordered to enable you to view the necessary storage 17 disks and tapes." 18 In your discussion with Detective 19 Lilley, when you talked with him about your 20 training and experience, at that point did you have 21 any information that Mr. Schwartz had used disks or 22 tapes? 23 A No. I was explaining to Detective Lilley 24 that based on the training that I had had, that 25 people when they do these crimes can put it on 65 1 disks, they can conceal it in the network 2 somewhere, they conceal it on a computer, put it in 3 different files. It's real easy to conceal this 4 information. 5 Q When you say "these crimes," what crimes 6 are you referring to? 7 A Computer-type crimes where somebody goes 8 into a computer and takes stuff that's not theirs. 9 Q In the course of that training, did you 10 get materials regarding -- that describe the nature 11 of people involved in computer crimes? 12 MR. TINTERA: Your Honor, I object. 13 The issue in a motion to controvert is information 14 that the affiant had, whether they left things out 15 or whether they did not have good faith or they 16 were not truthful in what they put in the 17 affidavit. 18 What Detective Lazenby may have 19 experienced in his training is not relevant to 20 that. The only thing we're looking at is what 21 Detective Lazenby may have told to Detective Lilley 22 and Detective Lilley, with bad faith or because he 23 wanted to conceal something or mislead the 24 magistrate, left it out of the affidavit. 25 THE COURT: Well, this witness is an 66 1 adverse witness to the defendant and this witness 2 has testified that he did give to Detective Lilley 3 information about what he had learned in his 4 courses, including the fact that defendants in 5 these types of cases transfer information to tapes 6 and disks. 7 I think it's fair to permit counsel 8 to cross-examine about that. He doesn't have to 9 take this witness's word for it, but -- that he 10 learned that information in those courses, but he 11 can cross-examine because if he can shed light on 12 this witness' credibility on that issue, also 13 places credibility on whether or not he told 14 Detective Lilley. 15 MR. TINTERA: I haven't seen any 16 showing by the defense that this is an adverse 17 witness. I don't think that should be a given in 18 this case. 19 The Sheriff's Department is 20 cooperative with all parties and I don't think, 21 just because of Detective Lazenby's occupation, 22 that we should assume he's adverse to the defense. 23 He may be adverse in that the goals of the defense 24 and the State are different, in that we're seeking 25 justice, but that would be the only thing that I 67 1 would concede in regard to adverse interests. 2 THE COURT: Well, I'm permitted and 3 have discretion to permit examination to proceed in 4 different manners and I will permit counsel to 5 proceed as on cross-examination of this witness for 6 the purpose of determining what information he may 7 have learned in his course work, and the question 8 that he asked, I think, is appropriate and I'll 9 overrule the objection. 10 MR. TINTERA: Thank you. 11 MR. SUSSMAN: Do you remember the 12 question? 13 THE WITNESS: No. Something about 14 did I get any materials. I got materials from 15 them, but it was more like articles like one might 16 get in this case and certain people who had been 17 involved in these types of crimes in the past. 18 BY MR. SUSSMAN: 19 Q Have you received any materials supplied 20 by the Department of Justice involving 21 investigating computer-related crimes? 22 A No. I don't remember that being any of 23 the material, off the top of my head. 24 Q Did you relate what you learned in any of 25 those articles about the profiles of people who 68 1 committed computer crimes to Detective Lilley? 2 A I didn't relate anything about a profile. 3 I don't remember seeing anything about a profile of 4 the types of persons. 5 Q In that training, you learned that it was 6 technically -- that technically, it was possible to 7 take a mirror image of the data stored on the hard 8 drive of a computer; is that right? 9 A Maybe I should go over the training. 10 Q The question is -- 11 A They talked about mirror imaging, yes. 12 Q And they are people trained to do 13 technical work in investigating computer crimes, 14 were capable of doing -- 15 A Mirror imaging. 16 Q -- mirror imaging? 17 A That's correct. 18 Q That's not what you were trained to do? 19 A That's correct. 20 Q Did you tell Detective Lilley that the 21 training or that people were trained -- let me 22 rephrase. 23 That it was possible to do mirror 24 imaging of the data stored on the hard drives of 25 computers? 69 1 A What I told Detective Lilley was that 2 that's why you have to seize the stuff, because you 3 have to take it back and have somebody do that. 4 You can't do it at the person's house or their 5 business because it's too involved, the process. 6 Q So you told him it was not -- 7 A You have to seize all this stuff. That's 8 why we were taught to seize it and tag it properly 9 and tag all the cables and things like that, so 10 that can be done by an expert, because we don't 11 have the experience to do that. You have to have 12 somebody specifically trained in that. 13 Q And at the time this was prepared, was 14 there anybody at the Washington County Sheriff's 15 Office who was trained to review the mirror imaging 16 of computers? 17 A Alan Watson of the Sheriff's Office had 18 gone through the classes but not completed the 19 final stages of the training. That's why we had to 20 go outside and have somebody come in. And you also 21 run into the problem with Apple computers, which 22 your client had, are even more difficult to do than 23 IBMs or clones and we had nobody trained in those. 24 Q Now, in that training course, was there a 25 follow-up program that was a follow-up to the 70 1 actual course work where you had to do some 2 self-testing by analyzing the computer disks? 3 A No. 4 MR. SUSSMAN: Thank you. Nothing 5 further of this witness. 6 THE COURT: Mr. Tintera. 7 8 CROSS-EXAMINATION 9 BY MR. TINTERA: 10 Q Counsel asked you if this was your first 11 computer crime case. Was this your first computer 12 crime case? 13 A This is the first case where the person 14 was actually charged with a computer crime. I'd 15 been on other cases where we seized computers and 16 done some tagging, and drug units had been involved 17 in this work for drug records, and me and Alan had 18 gone out and assisted in that. 19 Q To give the Court an idea of your 20 expertise in that area, how many cases, not where 21 they were charged with computer crimes but where 22 actual computer equipment was seized through a 23 search warrant, have you been involved in? 24 A I think about four or five with the 25 narcotics unit and one homicide case. 71 1 Q And what timeframe are we talking about? 2 A The last probably three years, four 3 years. 4 MR. TINTERA: Thank you. That's the 5 only question I have. 6 THE COURT: Mr. Sussman. 7 8 REDIRECT EXAMINATION 9 BY MR. SUSSMAN: 10 Q Of those cases that you just described 11 where the computers were seized, were you involved 12 in the examination of the data on the computer of 13 those? 14 A No. Like I said, I'm not trained in 15 that. They brought in experts to deal with that. 16 Mostly the people trained in that mostly are in the 17 federal agencies right now. I think Portland has 18 one or two people now trained in it and we're 19 trying to get Alan up to score and -- 20 Q So these limitations on your training and 21 experience were communicated to Detective Lilley? 22 A My limitation on what? 23 Q This scope, the extent of your training 24 and experience was communicated to Detective 25 Lilley? 72 1 A I don't know what you mean 2 "communicated." That wasn't -- 3 Q Did you tell him that's all you had done 4 before in terms of working on computer-related 5 cases? 6 A No. I didn't get into the numbers or 7 anything. 8 Q Did he ask you? 9 A No. 10 MR. SUSSMAN: Thank you. Nothing 11 further. 12 MR. TINTERA: No further questions. 13 THE COURT: Thank you. You may step 14 down. 15 MR. TINTERA: May this witness be 16 excused? 17 MR. SUSSMAN: I have no problem with 18 that. 19 THE COURT: You're free to go for 20 today. 21 Call your next witness. 22 MR. SUSSMAN: We'll call Rich Cower. 23 24 25 73 1 RICHARD COWER 2 called as a witness on behalf of the Defendant, 3 having been first duly sworn under oath, was 4 examined and testified as follows: 5 6 THE CLERK: State your full name and 7 spell it for the record, please. 8 THE WITNESS: Richard Cower. 9 C-o-w-e-r. 10 11 DIRECT EXAMINATION 12 BY MR. SUSSMAN: 13 Q In the fall, Mr. Cower, you informed me 14 that you recalled taking some handwritten notes 15 about your -- when you were involved in the 16 interview of Randal Schwartz. 17 A Yes, that evening at his house. 18 Q And you said that you turned those notes 19 over to somebody. 20 A Yes. 21 Q Do you remember who you turned them over 22 to? 23 A Probably the legal department. 24 Q At Intel? 25 A Yes. They were requested, as I recall, 74 1 in one of your -- I don't know the names for all 2 the papers that you generate, but they were 3 requested, a subpoena or affidavit, or whatever you 4 call it. I turned over copies, as I recall. They 5 are hard to read because my handwriting is very 6 poor. 7 MR. SUSSMAN: Your Honor, I would 8 just note -- before we deal with this motion to 9 controvert question -- those documents were not 10 included in the materials that were turned over, so 11 I would ask Mr. Woodard to take a look in the 12 documents that they have there to see if those 13 notes are in the files so that those can be turned 14 over. 15 MR. TINTERA: I'd like copies of 16 those, if they exist. 17 THE COURT: Do they exist, 18 Mr. Woodard? 19 MR. WOODARD: What notes? 20 THE COURT: Notes that -- 21 handwritten notes Mr. Cower may have made the night 22 the search warrant was executed regarding 23 statements that the defendant made to either he or 24 authorities, police officers. 25 MR. WOODARD: I will look through 75 1 things. I haven't seen handwritten notes other 2 than my own and Mr. Pierce's, but I will search 3 through the files. 4 THE COURT: Were they on small paper 5 or -- 6 THE WITNESS: They were on a 7 Franklin-size notebook, which is a smaller paper, 8 and then copied onto larger paper, eight and a half 9 by eleven. 10 THE COURT: But the notes would take 11 up a small portion of the page? 12 THE WITNESS: Yes. 13 MR. WOODARD: I haven't seen them, 14 but I will look for them. 15 MR. SUSSMAN: Thank you. 16 THE COURT: Thank you. 17 BY MR. SUSSMAN: 18 Q Mr. Cower, what's a network security 19 specialist? 20 A I deal with network security at Intel 21 specifically writing policy for security at Intel, 22 network security at Intel. 23 Q And this is for a corporate policy? 24 A Yes, it is. 25 Q And you are located in what office? 76 1 A Folsom, California. 2 Q Were you located in the Folsom, 3 California office in October, November of 1993? 4 A Oh, yes. 5 Q Was there any policy manual that you had 6 been involved in the network security that you 7 prepared prior to November 1993? 8 A I didn't -- there were three policy 9 manuals in effect then. 10 Q And had you shared those policy manuals 11 with Detective Lilley at the time this affidavit 12 was prepared? 13 A I don't recall. 14 Q Is there any special training required 15 for that position? 16 A No. I mean, you have to have some 17 experience with network and computer systems. 18 Other than that, no. 19 Q And as a network security specialist, 20 what does that job require you to be concerned 21 with? 22 A Network security. 23 Q And you have to be concerned about 24 security leaks, whether passwords are secure? 25 A Yes, that's right, part of the job. 77 1 Q You have to test to see whether the 2 passwords are secured against outside efforts to 3 break into them? 4 A You have to define what an outside effort 5 is. 6 Q Well, let me simplify that. You are 7 concerned with making sure that the passwords are 8 secure and can't be used by somebody who is not the 9 owner of the password? 10 A We instruct systems managers at Intel how 11 to assure that passwords are secure. 12 Q Systems managers? 13 A Systems managers, yes. Systems 14 administrators. 15 Q What is a systems administrator? 16 A Somebody that administers access of 17 Intel's information to other employees at Intel. 18 Q Mr. Schwartz had been a systems 19 administrator in his work at Intel, isn't that 20 true? 21 A During what period of time? 22 Q Prior to November 1st, 1993. 23 A How far prior? 24 Q At some time prior, during the course of 25 his employment. 78 1 A Yes. 2 Q And he was doing, in fact, systems 3 administrator work during the period of time that 4 he was working at a division called IWARP? 5 A Yeah, SSD. 6 Q IWARP is a subsection of SSD? 7 A Yeah. 8 Q And was he performing systems 9 administrator work under Bob Wilcox, the person he 10 was -- one of the people named that he was working 11 under at the time the search warrant affidavit was 12 written November 1st, 1993? 13 A I would say based on the invoices that 14 I've seen for his work, yes. 15 Q As a systems administrator who was 16 concerned with maintaining the security of a 17 computer system under his or her control or 18 responsibility, does that person have to be 19 concerned about, well, somebody from outside of 20 Intel getting access to secret information inside 21 of Intel? 22 A Yes, they should be. 23 Q Industrial espionage? 24 A Yes. Just as a normal part of security 25 activity on the system that they are administering, 79 1 yeah, I would say yeah. 2 Q So any good security -- I mean systems 3 administrator will have to take that kind of 4 concern into account in designing -- in doing their 5 job? 6 A They should. 7 Q Now, did you discuss Mr. Schwartz's 8 position and responsibilities at Intel with 9 Detective Lilley? 10 A Trying to remember. I don't know. It's 11 almost two years. I don't recall. I mean, 12 certainly his responsibilities were discussed at 13 Intel. Whether they were discussed with Detective 14 Lilley or not, I don't know. 15 Q You were -- According to the reports that 16 were provided, there was something called a bridge 17 meeting on October 29th, 1993, after Mr. -- after 18 the crack program was run -- found running on this 19 SSD machine. 20 A Yes. 21 Q Were you aware of that meeting? 22 A Oh, yes. 23 Q Did you participate in that meeting? 24 A Yes. 25 Q Was that a conference telephone call or 80 1 was that an actual meeting? 2 A It was both. There was a meeting room in 3 Folsom where a number of us that were in Folsom got 4 together, and then the normal Intel meeting 5 procedure is that the people that aren't local, 6 they dial into the meeting. 7 Q Did you take notes while you were at that 8 meeting? 9 A Very few. Very few notes. 10 Q Was there anybody else there taking 11 notes? 12 MR. TINTERA: Objection. What does 13 this have to do with the motion to controvert? 14 THE COURT: Mr. Sussman, this one is 15 less obvious. 16 MR. SUSSMAN: Well, it's actually 17 somewhat unrelated. I was hoping, since Mr. Cower 18 has to leave, to get the information about -- 19 information that hasn't been disclosed under the 20 subpoena to make sure it was, in fact, available. 21 THE COURT: Well, I'm sustaining the 22 objection to that. 23 BY MR. SUSSMAN: 24 Q At any rate, at this meeting on October 25 29th, this bridge meeting, this meeting was to 81 1 discuss this security incident about finding this 2 crack program running? 3 A Yes. There were actually two things 4 discussed. There was the Crack Program, discovery 5 of the Crack Program, then subsequent discovery of 6 the -- there was also the gate, what we call the 7 Gate Program, gate script. 8 Q What Gate Program was that? 9 A That was Randall's gate script, Brillig. 10 B-r-i-l-l-i-g. That's the system. Those were the 11 two things. 12 What we were really discussing in 13 that meeting was ways in which -- the steps we 14 would have to take. There was very little 15 discussion about what was going to happen with 16 Randal. It was a given that Randal's contract with 17 Intel was going to be terminated and what we were 18 discussing was means to prevent any further damage 19 or subsequent damage to Intel's computer systems or 20 networks. 21 Q At that point, had the records of the 22 files showing the computer runs on the Crack 23 Program been copied or maintained in some -- 24 A I don't know at that point if they had 25 been or not. I don't know. I don't want to say 82 1 yes or no. I wasn't here in Oregon where those 2 records were. 3 Q Now, what was your initial contact with 4 somebody from the Washington County Sheriff's 5 Office? 6 A I'm sure that would have been sometime 7 that Monday, the following Monday, November 1st, 8 maybe. That Monday. 9 Q How did that contact come about? 10 A We were here in Oregon. I came up to 11 Oregon Sunday night and we met in Rick Pierce's 12 office. 13 Q On the Sunday night? 14 A No, no. Monday. 15 Q You came up Sunday night and met on 16 Monday? 17 A Yes. I'm not sure what time the sheriffs 18 showed up, the detectives, whatever, the police. I 19 know we had a series of meetings that I had to 20 attend, both related to this and not related to 21 this incident that date, and sometime during the 22 course of that day, I met the detective. 23 Q In the meetings that you attended that 24 morning, was there discussions about reporting the 25 incident to -- referring it to the Washington 83 1 County Sheriff's Office for prosecution? 2 A There may have been, but I don't think I 3 participated in them. That wasn't my -- my 4 interests weren't there. 5 Q Your interests and duties were where, 6 then? 7 A In protecting Intel's information assets 8 from subsequent damage. That's really all I was 9 concerned with. 10 Q When you say "protecting from subsequent 11 damage," what damage had you discovered at that 12 point? 13 A We had discovered -- the only damage we 14 had discovered was the stolen password file from 15 the SSD domain that Randal was cracking and the 16 gate script running on Brillig. 17 Q The password file itself, isn't that in 18 the public domain readable by anybody? 19 A Absolutely not. 20 Q How about anybody on that system? 21 A Anybody at SSD, yes, but that doesn't 22 define the public domain. You used the -- for the 23 global system of public domain, that's not true. 24 Q How about anybody within Intel with 25 access to the system? 84 1 A Anybody with a valid account on the SSD 2 system has access to the file, yes. 3 Q And there is nothing about a password 4 file itself which, looking at it, compromises the 5 material or the information in the files behind 6 those passwords; is that correct? 7 A I would say yes. I would say even 8 looking at the password file filed by somebody not 9 associated with Intel wouldn't be a good idea, 10 because you get a good list of user names that's 11 associated with that system and you might be able, 12 through inference, to figure out what's going on 13 there. You could use that in a social engineering 14 sense to gather other information. 15 Q So the concern is somebody outside of 16 Intel might have seen those passwords? 17 A Well, we wouldn't want somebody outside 18 of Intel to see that information. 19 Q Right. And you have non-disclosure 20 agreements with your employees and contractors 21 about information obtained that they are required 22 to sign? 23 A I don't know. 24 Q Did you tell Detective Lilley that people 25 within Intel could access password files and read 85 1 passwords? 2 A If they have an account on that system. 3 Q And if somebody has an account on the 4 Brillig system, they could read the password file? 5 A On Brillig? 6 Q On Brillig. 7 A Yes. 8 Q Did you tell that to Detective Lilley? 9 A I don't recall. 10 Q Did you check to see whether Randal 11 Schwartz had an account on Brillig? 12 A I think he did. He did. Yeah, he did. 13 Q Did you tell that to Detective Lilley? 14 A I don't recall. I don't recall if I told 15 him or who told him. 16 Q Do you recall that he was told by 17 somebody? 18 A No, I don't. I'm sorry. 19 Q You don't recall one way or the other? 20 A No, I don't. It was a long time ago. 21 Q That's fine. 22 Now, when you spoke with Detective 23 Lilley, did you specifically tell him that Randal 24 Schwartz would transfer information -- that he 25 would have transferred information to his Apple 86 1 portable computer to avoid detection? 2 A That was a likely scenario. 3 Q What do you mean when you say "that was a 4 likely scenario"? 5 A Well, initially, I think it was Friday, 6 when we contacted CERT, there was also a 7 password-cracking program going on in O'Reilly -- 8 Randal had taken the password file from O'Reilly 9 and Associates and was cracking that as well, and 10 that looked like it involved interstate trafficking 11 and possibly something that Randal didn't know. 12 We contacted CERT, and we advised 13 CERT of that. And what we wanted CERT to do was 14 CERT to call O'Reilly and Associates to say this 15 activity was going on and to keep us out of it. 16 And CERT said, "You have to talk to the FBI." 17 We talked to the FBI. I think I 18 spoke with Jim Kalush, somebody in the FBI Computer 19 Crime Unit, and the advice from them was do not let 20 Randal out of the building with his laptop, because 21 if he has any confidential information, it would be 22 on the laptop. 23 You have to understand that in the 24 moment, we didn't know what Randal had done. We 25 knew two things he had done and, based on that, he 87 1 might have done other things. We didn't know what 2 was going on and we had to look around. 3 Q Did you tell that to Detective Lilley, 4 that you didn't really know what he had done, that 5 this -- that you knew that he had run the crack 6 program, you knew -- 7 A We knew exactly what he had done. What 8 we didn't know is what he hadn't done. And by the 9 laptop going in and out of Intel, it allows an easy 10 means of moving information in and out of Intel 11 every day because the laptop is not looked at. 12 Q You had -- by the time you met with 13 Detective Lilley on Monday, November 1st, you had a 14 complete picture of Randal Schwartz's files that 15 were preserved at least since October 28th? 16 A We had -- I would say we had a complete 17 picture, but the shear volume of Randal's files did 18 not allow us to look at that information with any 19 detail. There is a tremendous amount of 20 information in Randal's directory. Tremendous 21 amount. 22 Q And that was Intel-related information? 23 These were his files within Intel? 24 A Yes. These were his files at his work 25 station in Intel. 88 1 Q Now, did you see any indication or 2 anybody else that you were informed of, that 3 Randal, between October 28th and November 1st, had 4 logged into any of the accounts behind the 5 passwords? 6 A Between October 28th and November 1st? 7 Q That's right. 8 A No, I don't think so. I didn't. 9 Q Did you tell Detective Lilley of that 10 information? 11 A I don't know. 12 Q In discussing the scenarios about what 13 Randal might have done and might not have done, did 14 you tell him that you didn't find anything that 15 would indicate that he had logged into any of 16 the -- 17 A I'm sorry, I don't know. I don't recall. 18 Q Were there other scenarios that you 19 considered that Randal might have been secreting 20 information out of Intel? 21 A Based on what we had found, the cracking 22 of the SSD password file and the -- and that 23 cracking effort had produced the vice president of 24 Intel's password, combined with his user name, we 25 really didn't know what Randal was up to, and the 89 1 scenario was frightening based on the information 2 contained in Ed Masi's directory. 3 Q So that set off all kinds of alarms that 4 that password was the one that had -- 5 A There were others, but that's the one 6 that I remember. 7 Q Sounds like you then assumed the worst. 8 A I wouldn't say the worst, but we assumed 9 anything could be going on. We didn't know what 10 was going on. 11 Q Were you specifically asked what Randal 12 Schwartz would do if he wanted to transfer 13 information to avoid detection? 14 A No. 15 Q Did you volunteer that information to 16 Detective Lilley? 17 A I probably volunteered the information 18 that I had gotten from the FBI computer crime unit 19 to Detective Lilley. That's what I would guess. 20 Q By the way, you mentioned CERT. 21 A Yes. 22 Q What is that? 23 A That's the Computer Emergency Response 24 Team located at Carnegie Mellon University. 25 Q Now, would transferring information from 90 1 those files to a Power Book be the only step 2 required to avoid detection? 3 A No. 4 Q Would logging into the password file in 5 your own name be a typical way of avoiding 6 detection, using your own ID? 7 A No. 8 Q Would running the crack program using 9 your own identification be a typical way of 10 avoiding protection? 11 A No. We had a discussion about this. 12 Q Besides transferring information to a 13 Power Book, are there any other steps that you 14 would consider that could be taken to transfer 15 information that was in the file that you found at 16 Intel outside? 17 A Yeah. I'm sure you could use floppies. 18 You can take floppies out of Intel relatively 19 easily. You can take paper out, depending on the 20 color of the paper, relatively easily. You can 21 mail things out. There is any number of ways to 22 get information out of Intel. 23 Q Is Randal the only person who goes in and 24 out of Intel with a Power Book? 25 A There aren't a lot of Power Books. 91 1 Q How about laptop? 2 A Oh, no. Absolutely not. There is 3 hundreds