1 IN THE CIRCUIT COURT OF THE STATE OF OREGON 2 FOR THE COUNTY OF WASHINGTON 3 4 STATE OF OREGON, ) ) 5 Plaintiff, ) ) 6 vs. ) No. C940322CR ) 7 RANDAL LEE SCHWARTZ, ) ) 8 Defendant. ) Volume 1 9 10 11 TRANSCRIPT OF PRETRIAL PROCEEDINGS 12 13 BE IT REMEMBERED THAT on the 13th 14 day of June 1995, the above-entitled matter came on 15 for Hearing before the HONORABLE ALAN C. BONEBRAKE, 16 a Circuit Court Judge. 17 18 APPEARANCES 19 Thomas J. Tintera Washington County Deputy District Attorney 20 Representing the State of Oregon 21 Mark Sussman Attorney at Law 22 Representing the Defendant 23 24 25 2 1 WITNESS INDEX 2 3 FOR THE DEFENDANT: Direct Cross ReD ReX 4 5 Paul Lazenby 61 70 71 6 Richard Cower 73 102 107 109 7 113 8 John Kent 116 9 James Lilley 123 164 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 3 1 MORNING SESSION 2 BEGINNING AT 10:30 A.M. 3 JUNE 13, 1995 4 5 MR. TINTERA: This is the time set 6 for the continuation in the omnibus hearing in 7 State of Oregon versus Randal Lee Schwartz. 8 940322CR. Defendant is present, not in custody at 9 this time and appearing with counsel, Mark Sussman. 10 THE COURT: I have met with counsel 11 earlier this morning in chambers and we have talked 12 briefly about how we might proceed most 13 economically in this matter with regard to trial 14 time. 15 I understand that, and we all agree, 16 that the first order of business might be to review 17 the motion to suppress that was directed to the 18 search warrant and affidavit that was filed to make 19 a preliminary determination on that. If I decided, 20 for instance, that the affidavit was insufficient 21 and entered an order suppressing the fruits of any 22 search and statements that were made as a result or 23 during that search, that, at least at this point in 24 time, would end the case. If I did not enter such 25 an order, then we would go on to hear the motion to 4 1 controvert. Then I would revisit the issue 2 regarding the motion to suppress after hearing the 3 motion to controvert. 4 During the last hour, I have 5 reviewed the affidavit that was presented to the 6 magistrate, Judge Freerkson, in support of the 7 warrant. I've reviewed the warrant and I have 8 reviewed the original motion to suppress filed by 9 Mr. Sussman, along with the supporting documents 10 and the supplementary memorandum that was filed 11 more recently. I didn't look at every document in 12 the file, Mr. Tintera, but I didn't see a written 13 response by the State. Do you have -- 14 MR. TINTERA: I don't think I 15 provided one, Judge. 16 THE COURT: I'm ready to hear 17 argument. Mr. Sussman. 18 MR. SUSSMAN: Your Honor, since you 19 read through the memorandum, I don't want to repeat 20 everything that's in there, but, in summary, the 21 essence of our position is -- 22 THE COURT: It's overbroad. 23 MR. SUSSMAN: Well, initially that 24 and, of course, that the search itself and the 25 seizure of Mr. Schwartz's computers and computer 5 1 equipment did not produce any evidence that we 2 expect the State to produce, which would be 3 incriminating, but during the course of the 4 execution of the search warrant, Mr. Schwartz was 5 interviewed by Washington County sheriff's 6 detectives and Intel officials acting in concert 7 with the law enforcement agency and what we 8 complain of are the statements obtained from 9 Mr. Schwartz which was obtained as a result of the 10 service of the search warrant. And if the search 11 warrant was improperly issued, as in the affidavit 12 it does not state they state probable cause, or if 13 the warrant was -- if the search was unlawful, then 14 the statements were obtained by exploitation of 15 that illegality and they may not be used. 16 THE COURT: It's an interesting way 17 to get there. I understand your argument. I've 18 been confronted with issues before about 19 admissibility of statements after a search was 20 executed as part of a search warrant, but typically 21 with those, it's after incriminating evidence was 22 found as well. 23 What I understand here is your 24 belief is that in the serving of the search 25 warrant, there was nothing incriminating found. 6 1 Nevertheless, they did interview your client and 2 statements were given by your client and what you 3 primarily seek to suppress here are statements made 4 on the ground on insufficient affidavit, it was 5 overbroad, et cetera. 6 I understand your argument. Doesn't 7 make any difference that there was no incriminating 8 evidence. 9 MR. SUSSMAN: That's correct. We 10 don't expect that the State will offer any evidence 11 from the search. 12 THE COURT: Unless they haven't told 13 you of everything. 14 MR. SUSSMAN: Well, I don't believe 15 Mr. Tintera would withhold anything. 16 THE COURT: I doubt that. 17 MR. SUSSMAN: At any rate, as you've 18 indicated, there are several separate grounds for 19 invalidating the search just on the face of the 20 warrant. 21 One of the grounds, the last ground 22 that I assert in the memorandum, which is something 23 that may require additional testimony, but the 24 essence of that argument is that ORS 133.575 does 25 not authorize -- law enforcement does not provide 7 1 law enforcement to employ civilians in the 2 execution of a search warrant unless there has been 3 prior authorization from a judge, and that 4 typically has to require a finding that this was 5 done for purposes of safety. That those 6 procedures, there was no such showing made that 7 that was not authorized by the Court and that 8 statutory violation invalidates the warrant and 9 invalidates the search. 10 THE COURT: Does it say that in the 11 statute or is that a conclusion that you reached? 12 I have not read that statute before today and I'm 13 aware that occasionally, the courts have said that 14 statutory violations do not necessarily give rise 15 to a suppression of evidence. 16 For instance, there used to be cases 17 on warrants not executed for service at any time of 18 day or night, that sort of thing. Nevertheless, it 19 was served at night or the time period, as I 20 recall. 21 There are other statutory provisions 22 regarding search warrants, and I recall that there 23 has been case law on some of those points. My 24 recollection is statutory violations do not always 25 give rise to the prophylactic rule requiring 8 1 suppression of evidence. 2 MR. SUSSMAN: To answer the first 3 part of the question, 133.575 Sub 1 reads that "A 4 search warrant may be executed only within the 5 period and at the time authorized by the warrant 6 and only by a police officer. A police officer 7 charged with its execution may be accompanied by 8 such other persons as may be reasonably necessary 9 for the successful execution of the warrant with 10 all practicable safety." 11 Then in Sub 3 -- I'm sorry. That's 12 the basis of the argument that we make, is that the 13 statute specifically allows certain limited 14 exceptions for the use for allowing other persons 15 as are reasonably necessary for purposes of safety 16 to accompany the officer in execution of the search 17 warrant, and I think the record in this case shows 18 that was not the case here. 19 THE COURT: The question I have, 20 though, assuming you're correct for the purposes of 21 argument on that, does the statute -- is there 22 required -- is their remedy here suppression of the 23 evidence? Is that by statute or case law 24 someplace? 25 MR. SUSSMAN: I believe this is 9 1 under State v. Davis at 295 Oregon at 237, that 2 this statute -- this is among the statutory 3 requirements which have constitutional significance 4 with respect to the codification of search and 5 seizure principles and the application of the 6 execution of searches that arose to sufficient 7 level to require suppression. 8 The second key -- The first argument 9 raised in the memorandum, the first key argument 10 here affecting the affidavit itself is that it's 11 our position that the affidavit does not state 12 sufficient facts to establish probable cause to 13 search Mr. Schwartz's residence, to search for 14 items of evidence at his residence. 15 Recognizing that the affidavit in 16 the search warrant should be read in a common sense 17 fashion and you may make reasonable -- the 18 magistrate may make reasonable inferences from the 19 facts set forth, I think the cases of State v. 20 Maxfield, which we brought to the Court's 21 attention, having recently been decided by the 22 Court of Appeals, and State v. Corpus Ruiz both 23 deal closely with analogous situations where you 24 had certain facts which may have permitted some 25 inferences that there was some kind of unlawful 10 1 activity going on, but the facts in the affidavits 2 did not -- were not sufficient to rise to the level 3 to make it probable, to make it more likely than 4 not that evidence of a crime was to be found in the 5 place to be searched. 6 Now, the affidavit in this case 7 largely recites activities of Mr. Schwartz taking 8 place within Intel that Intel has suggested were 9 against corporate policy and were a basis for 10 termination of his employment. 11 There are a couple key places where 12 the affidavit suggests that something more like a 13 crime is occurring, and I suggest that these 14 portions of the affidavit, where the inferences are 15 being made which are used to support the issuance 16 of the warrant, did not state sufficient facts and 17 were largely speculative. 18 THE COURT: If you don't mind that I 19 interrupt -- Mr. Tintera knows that I have a habit 20 of doing that -- but I find it's helpful for me to 21 sometimes try to state what I understand your 22 argument to be, then you can correct me if I'm 23 wrong. 24 You seem to have two points here. 25 One is the affidavit doesn't state facts sufficient 11 1 to show there was a crime being committed. 2 Secondly, if there was, there are 3 not sufficient facts to show probable cause to 4 believe that any evidence of that crime, if there 5 was one, would be in the claim. Is that a fair 6 summary? 7 MR. SUSSMAN: I think that's a fair 8 summary. There may be facts or suggestions that 9 may allow the inference that there was something 10 unlawful, but in certain key places in the 11 affidavit -- and I think that where the affidavit 12 is largely speculative are, if you look at, for 13 instance, Page 2 of the affidavit in the third 14 paragraph where the affidavit begins to recite 15 information to link or to suggest that Mr. Schwartz 16 may have been doing something which was suggested 17 to be criminal. 18 What you have is a statement that 19 "Mr. Morrissey told me that he expressed concern to 20 Mr. King the password information had been passed 21 to Mr. Schwartz' Apple portable computer." Yet the 22 affidavit states that this is really a bold 23 conclusion with no factual basis to say that there 24 was any documentation showing that file information 25 had -- that Mr. Schwartz had logged in in a certain 12 1 way or that they found anything on the programs 2 that were being run that would suggest that this is 3 where -- that made that particular connection. 4 The information that we have here is 5 that prior to that, Mr. Schwartz was running a 6 system on Intel computers within Intel using his 7 own password and using his own identification. The 8 factual basis for that concern or for drawing more 9 than some kind of inference is missing. This does 10 not state facts that show that it is probable that 11 Mr. Schwartz, in fact, transferred information to 12 this Apple portable computer. 13 THE COURT: You're looking at 14 Paragraph 2, Page 2? 15 MR. SUSSMAN: Paragraph 3, Page 2. 16 THE COURT: Give me a chance to read 17 that. 18 "Mr. Morrissey told me that 19 Mr. Schwartz has an Apple portable computer which 20 he attaches to the Intel computer network when 21 Mr. Schwartz is at his office on Intel property. 22 Then Mr. Morrissey told me that he expressed 23 concern to Mr. Kent that password information had 24 been transferred to Mr. Schwartz' Apple portable 25 computer." 13 1 MR. SUSSMAN: What we have here is 2 speculation, conjecture, but it lacks a factual 3 basis and there is nothing preceding it in the 4 affidavit which provides facts which would show 5 that Mr. Schwartz, in fact, transferred -- 6 THE COURT: You're saying the last 7 sentence there is speculation? 8 MR. SUSSMAN: That's right. 9 THE COURT: I think we might assume 10 that if Mr. Morrissey is testifying from knowledge 11 that he has -- 12 MR. SUSSMAN: Yes. 13 THE COURT: -- that he has such a 14 computer and uses it on Intel property. And the 15 second part, "Mr. Morrissey told me" -- he 16 expressed concern that password information had 17 been transferred, and I guess what you're saying 18 there is, they didn't state anything at all other 19 than the so-called concern to show that, in fact, 20 that occurred, that there is some indication in 21 their computer memory or whatever, some firsthand 22 observation by another person or anything like 23 that. Is that what you're saying? 24 MR. SUSSMAN: Yes. And that -- Then 25 when you look at the next paragraph regarding 14 1 Mr. Cower's statement to Detective Lilley, we have 2 a statement in -- well, basically the entire 3 paragraph, but the first sentence reads in part 4 where Mr. Cower told the affiant that based upon 5 his security experience in computer hacking, then 6 it goes on to say, "In order to avoid detection in 7 the workplace, Mr. Schwartz would transfer the 8 information to his Apple computer in order to work 9 on the information in the privacy of his own home 10 and information" -- 11 THE COURT: I wrote down here when I 12 read that "opinion". 13 MR. SUSSMAN: Exactly. It's 14 speculation, conjecture, opinion of this person, 15 and there is no factual basis stated for why that 16 opinion is fact, is factual, that there is a 17 factual basis for it. 18 Similarly with the next sentence, 19 says that, "Mr. Cower told me that this would be a 20 convenient way for Mr. Schwartz to move the 21 information to his office or home without being 22 detected by Intel's electronic safeguards." This 23 is based on Mr. Cower's experience. It is a 24 statement of opinion. It is perhaps speculation of 25 how something could be done if it was going to be 15 1 done, but there are no facts in this case to show 2 that this, in fact -- that there was -- that it was 3 probable that this is what was happening. 4 In a similar -- there is a third 5 spot where there is a similar emphasis on what 6 we'll call conjecture or speculation, and that is 7 at Page 4 of the affidavit where Detective Lilley 8 relies upon the statement of Detective Lazenby 9 based on -- where it says, Detective Lazenby told 10 him through his experience and training that he 11 knows persons who are involved in these activities 12 often will try to conceal the contents of the disks 13 and tapes. Mr. Schwartz used bi-labels or 14 mislabeled their contents and, therefore, they 15 asked for search and seizure of all, any and all 16 computer disks and tapes. 17 Once again, here we have -- we have 18 the issue of the affidavit not even stating the 19 facts of what these activities are that are being 20 referenced here, then referring to disks and tapes 21 Mr. Schwartz used where there is nothing in the 22 affidavit prior to that that shows Mr. Schwartz, in 23 fact, used disks or tapes which were then removed 24 from Intel and taken to his home. 25 And, in fact, that statement is 16 1 somewhat inconsistent with the statement on Page 1 2 of the affidavit in which Mr. Morrissey is quoted 3 in the next-to-last paragraph in the last sentence 4 of the third paragraph down. 5 THE COURT: Which page, Page 3? 6 MR. SUSSMAN: Well, I was referring 7 to -- working off Page 4, Detective Lazenby's 8 statement. 9 THE COURT: Okay. 10 MR. SUSSMAN: Referring you back to 11 Page 1. In the third Paragraph in the last 12 sentence where it begins that "Mr. Morrissey told 13 me that the reason he believed that Mr. Schwartz, 14 himself, was running the program was because 15 Mr. Schwartz is security conscious enough to use a 16 security password which would be difficult for 17 anybody else to obtain and utilize." 18 Seems that the statements about -- 19 in that sentence and in the previous sentence that 20 Mr. Schwartz was running the program under his own 21 identification and he was security conscious enough 22 that he would be able to make these tracks hard to 23 find, that seems inconsistent with the statements 24 that are -- the general statements that Detective 25 Lazenby is making, that you would expect to find 17 1 mislabeling or contents not labeled. 2 But the key to the challenge to 3 Detective Lazenby's information on Page 4 is that 4 there is an insufficient factual basis for the 5 conclusions stated by Detective Lazenby again to 6 show that it is probably, number one, that 7 Mr. Schwartz used disks and tapes. That there are 8 no facts to indicate what activities are that are 9 being referenced and that are then used to support 10 the request for -- which was ultimately granted -- 11 seizure of any and all disks and tapes. 12 THE COURT: Can't we infer that the 13 activities that are spoken of there are the 14 activities that are described previously in the 15 affidavit? 16 MR. SUSSMAN: Well, again, even if 17 we assume that he's referring to these activities, 18 meaning reading these files, the affidavit -- we 19 have nothing in the affidavit which would indicate 20 that -- what we have in the affidavit indicates 21 that this was done on Intel systems, and while it 22 is -- one may infer that these activities, because 23 they are unauthorized, are grounds for termination, 24 may be criminal, and then the person who has a 25 portable computer may have other accouterments to 18 1 it that could be taken out and might be found in 2 his home. 3 I think that is precisely the kind 4 of series of logical jumps that the Court and Court 5 of Appeals analyzed in State v. Corpus Ruiz saying 6 this was taking it too far, it wasn't in the 7 underlying facts of the case. 8 And in State v. Maxfield, the Court 9 said look at -- there are some things here that 10 perhaps make sense but doesn't necessarily 11 logically follow that you are going to find the 12 evidence of a crime or even -- of the crime 13 described in Maxfield in the marijuana growing in 14 the place that has to be searched. 15 In this case, we don't even 16 necessarily have a clear statement that, number 17 one, that there is a crime. And, number two, what 18 crime it is that you are looking for? And, number 19 three, that it would be -- that evidence of that 20 crime would be found in the place to be searched. 21 THE COURT: I've only read this 22 affidavit a couple times. Is there not somewhere 23 in this affidavit and statement that he typically, 24 your client, worked in his home as well as at 25 Intel's premises? Can you answer that for me? 19 1 Mr. Tintera. 2 MR. TINTERA: I can, Judge. Yes, 3 there is. It's on Page 2 from -- it's the 4 paragraph above the one that starts with 1 and 2 at 5 the bottom of the page and it's the last sentence. 6 THE COURT: "Further, Mr. Morrissey 7 told me that Mr. Schwartz told me that Mr. Schwartz 8 often works out of his office and at home." 9 I distinguish that from the 10 marijuana case, the photograhp case, because there 11 was no indications of what place, if any, that the 12 stuff might be growing. 13 On the other hand, here at least, 14 we -- from the affidavit, the magistrate could 15 understand that Mr. Schwartz typically operated his 16 computer in not less than two locations, one of 17 them being the Intel's premises and the other his 18 home. 19 MR. TINTERA: Three locations, Your 20 Honor, home or business. 21 THE COURT: Okay, his personal place 22 of business. So that's a bit different than having 23 pictures of growing marijuana with no indication 24 that it may be annexed to any particular location. 25 I'm not suggesting that you have good argument, you 20 1 have a lot of argument here, but every case has 2 different facts. 3 MR. SUSSMAN: I understand that. 4 But the thing is -- but the opening paragraph of 5 which indicates that the program that was running, 6 this crack program -- 7 THE COURT: When he saw it running 8 that day? 9 MR. SUSSMAN: Right, which raised 10 Mr. Morrissey's eyebrows and triggered this, was 11 running on an Intel computer at Intel. And it was 12 a long-running program within the Intel computers 13 there. And the thing is that what the affidavit 14 does not do, even though there is a statement that 15 Mr. Schwartz sometimes worked at home, Mr. Schwartz 16 has a portable computer, there is nothing in there, 17 other than speculation, that he could do these 18 things, that he could transfer, could copy these 19 things so that he could work on them at home that 20 indicates that there was a factual basis to show 21 that there had been that link to show that it was 22 probable that he was. 23 THE COURT: You see me getting that 24 glazed-over look sometimes. Doesn't mean I don't 25 understand your argument, but you say it's 21 1 speculation that the statement -- that the program 2 could be copied. Can I take this man's word for it 3 that he's a computer person, that the information 4 could be copied? It might be speculation, 5 arguably, that your client then took it home or 6 took it to some other location, but just seems to 7 me that the qualifications are sufficiently stated 8 there for me to believe when this person says that 9 this information could be copied onto a personal 10 computer that I could, as a magistrate, believe 11 that. Again, using a common sense approach to it, 12 understanding that the common sense approach 13 doesn't mean we dispense with facts for probable 14 cause, but we can draw reasonable inferences. 15 MR. SUSSMAN: The thing that 16 militates against that somewhat is that the first 17 paragraph on the top of Page 2 clearly states that 18 this activity was occurring and that Mr. Schwartz 19 had files and that Mr. Schwartz's files were -- 20 that were checked were within the Intel computer, 21 the system within Intel and that were clearly 22 identified by Mr. Schwartz, and that that action 23 inconsistent with -- doesn't support the factual 24 jumps that there were and doesn't say that there 25 were copies, any process made to copy them. 22 1 THE COURT: I agree that's an 2 argument that can be made. I don't disagree with 3 that. Does not necessarily support a conclusion 4 that he, in fact, did make copies. 5 MR. SUSSMAN: For instance, the kind 6 of factual basis that would support making that 7 inferential jump from the fact that there were 8 files on Mr. Schwartz -- clearly labeled files in 9 his own name within the Intel system, that they had 10 been somehow copied without authorization and taken 11 out, and what is missing, the jump that is made in 12 the affidavit is, you have that statement which 13 shows we have these things. We're concerned that 14 they shouldn't be here. 15 Number two, Mr. Morrissey's concern 16 that Mr. Schwartz could make copies of these, 17 because whether it be a portable computer or any 18 other computer could make copies of these things. 19 And then we have the opinions of Mr. Cower about 20 how that could be done, but what's missing is that 21 factual basis that you might see in other 22 affidavits that would say something like 23 "Mr. Schwartz is known to make copies of Intel 24 files." 25 THE COURT: That would support the 23 1 conclusion that, in fact, he did make copies. Two 2 points. He could make copies. He did make copies. 3 I don't have a problem with the first part. The 4 second part -- 5 MR. SUSSMAN: That's what is 6 missing, that factual link that allows us to go 7 from inference to probability, which is the essence 8 of the holdings in Corpus Ruiz and Maxfield, and 9 that the facts have to show that it is probable, 10 that it is more likely than not that there is 11 evidence of a crime to be found in the place to be 12 searched, and that's what's missing here. 13 Though it's discussed at some length 14 in the memo, I would really again bring your 15 attention back to one of the holdings in State v. 16 Carter Grant, the Supreme Court case cited in my 17 memorandum at Page 13 of that opinion where the 18 Court said there may be a number of inferences or 19 conclusions which may be drawn from this particular 20 evidence, but if it's just one of many 21 possibilities and doesn't rise to the level of 22 probability, it will not support the issuance of 23 the affidavit -- I mean, the affidavit will not 24 support the issuance of a warrant. And that's the 25 fundamental weakness and shortcoming of this 24 1 affidavit. 2 Bear with me for a second, Your 3 Honor, while I look for the affidavit I was looking 4 for. 5 THE COURT: Sure. 6 (Off the record.) 7 MR. SUSSMAN: In addition to what we 8 say that the facts are missing in the search 9 warrant, in the affidavit, there are some facts 10 which are stated in the affidavit which also seem 11 to contradict the conclusion that it is probable 12 that Mr. Schwartz -- or that evidence of some crime 13 would be found in Mr. Schwartz's home. 14 I made the point a number of times 15 that the affidavit states that he was running this 16 program under his own name and under his own 17 identification and these were in his own files, and 18 yet the affidavit goes on to suggest that the 19 reason you would find, if you were going to look 20 for these things in Mr. Schwartz's home, is that 21 somebody involved in these kinds of activities, the 22 computer hacking, which is something that is done 23 covertly or can be done outside of general 24 scrutiny, and that is what is consistent with the 25 earlier information in the affidavit, which is that 25 1 Mr. Schwartz -- this was being done out in the open 2 or, as I was trying to articulate the reference to 3 his being security conscious and being able to make 4 passwords or make things hard to get into, that he 5 had -- it indicates that he had the skills to cover 6 his tracks and the affidavit indicates that was not 7 done. 8 Actually, that actually undercuts 9 the inference that the rest of the affidavit was 10 trying to create, that he is accomplishing 11 surreptitiously or secreting information. 12 Now, the next thrust of the argument 13 in challenging the search in this case is that the 14 search warrant, itself, was drawn so broadly, is 15 overbroad and it was drawn so broadly that it is 16 defective in two ways: 17 Number one, it allows the search and 18 seizure of items which were not supported by facts 19 in the affidavit, justifying the seizure of those 20 items, and that's the State v. Ingram line of 21 authority. 22 And then the second defect in that 23 is that where it is, the warrant is drawn so 24 broadly that it allows the officer searching to do 25 so without the appropriate limitation under their 26 1 discretion of what to be looking for and seizing. 2 It also is overbroad, both of those. That is, 3 again, with reference to State v. Ingram. 4 I know you've read through the 5 memorandum. I went through that in great detail, 6 each of the sections of the warrant, and why I 7 submit that each of those sections were either not 8 supported by factual bases to show probable cause 9 to seize those items or how the search warrant 10 allowed for the search of items. For instance, the 11 search of any and all items of data or printouts or 12 files of any kind which goes too far because it 13 provides absolutely no limitation on the scope of 14 the search or the discretion of the officers doing 15 the search. 16 And, in fact, the way -- I cited, on 17 Pages 23, 24, 25 of my memorandum, State v. Jones, 18 supporting the proposition that what the warrant 19 did in that case is allow the search for items to 20 see if there was, in fact, evidence of crime rather 21 than -- which kind of puts the cart before the 22 horse, rather than saying -- then establishing that 23 there is the evidence of a crime which you may 24 search for and then seize. 25 As I mentioned in my memorandum, it 27 1 is probably dangerously close to, if not a prime 2 example of, something which has become a general 3 warrant. 4 I will not repeat, but I will 5 reiterate that the fact that Mr. Schwartz has on 6 his files materials at home, electronic mail, 7 material that he was writing as an author, 8 implicates his First Amendment under the United 9 States Constitution and rights under Article I, 10 Section 1 of the Oregon Constitution, which means 11 that the search should be drawn in more narrowly to 12 avoid infringing on those rights, and that was not 13 done in this case. 14 So for those reasons, we think the 15 affidavit in the search warrant, just on their 16 face, are defective and did not support the search 17 that occurred in this case. 18 THE COURT: Thank you. 19 Mr. Tintera. 20 MR. TINTERA: Thank you, Judge. 21 First point I'd like to address is 133.575, Judge, 22 and to read that in a common sense manner to make 23 sense of that particular statute, it says, "Police 24 officer charged with the execution may be 25 accompanied by such other persons as may be 28 1 reasonably necessary for the successful conclusion 2 of the warrant with all practical safety. 3 Practical safety is not final," it indicates, and I 4 would suggest that that is an ad hoc situation 5 where you deal with what you're searching for. 6 Now, if it's safety to the police 7 officers, obviously they're going to bring more 8 police officers, such as the SWAT team, but then 9 this wouldn't apply because it says police officers 10 are available. So what they're talking about is 11 bringing other people along for safety in regard to 12 the execution of the search warrant. Doesn't say 13 "safety of the persons." Says "safety." 14 What you have heard prior at our 15 other hearing was that the reason the Intel people 16 were brought was safety in extracting the computer 17 equipment so that the information would not be lost 18 or destroyed. That's exactly why the Intel people 19 were there. They were there as consultants to be 20 able to take the computer equipment safely from 21 Mr. Schwartz's home without destroying the 22 information or the subject of the search, and I 23 think that we are within the parameters of this 24 statute. 25 The statute is not limited to safety 29 1 of persons or safety of police officers. I think 2 it is reasonable to extend it to the safety of the 3 items that are being seized. In other words, that 4 it maintains its integrity. If there were other 5 people that would be necessary, for instance, if 6 they were seizing radioactive materials and it was 7 necessary to transport them in a particular way, 8 you might bring a civilian in to assist in 9 transporting. That might carry to other things of 10 safety of the people, but also to maintain the 11 integrity of the media being searched. And this 12 encompasses that and, therefore, the Intel people 13 were brought in to protect Mr. Schwartz's equipment 14 and the integrity of it, and assure its safety, but 15 also to maintain the medium so it could be removed 16 from its place and to an area where it could not be 17 corrupted. So I think we're within that particular 18 statute. 19 THE COURT: What about the 20 requirement that he mentioned that it's necessary 21 to submit that to the magistrate for authorization? 22 MR. TINTERA: I don't see that. 23 MR. SUSSMAN: Your Honor, to clarify 24 that, it's not in the statute. In my memorandum 25 and authority I cite for that was -- it refers to 30 1 the cases which allow, under special circumstances, 2 the Court to appoint somebody to supervise, a 3 private party to supervise or as a master in 4 certain circumstances. 5 THE COURT: All right. I understand 6 that now. 7 MR. TINTERA: Did you have any other 8 questions? 9 THE COURT: No. Let me make a note 10 on that, though. 11 MR. SUSSMAN: Your Honor, that 12 authority was cited at Page 32 of the memo. 13 THE COURT: Okay. 14 MR. TINTERA: In regard to the 15 search warrant itself, or the affidavit -- 16 THE COURT: Excuse me. Wait a 17 minute. I need to answer a phone call. 18 (Court in recess.) 19 THE COURT: Proceed, Mr. Tintera. 20 MR. TINTERA: In regard to the 21 affidavit, counsel's first point is that there is 22 no crime stated. I'd refer the Court specifically 23 to ORS 164.377 Sub 4, which says, "Any person who 24 knowingly without authorization uses access or 25 attempts to access any computer, computer system, 31 1 computer network or any computer software program, 2 documentation or data contained in such computer, 3 computer system or computer networks, commits 4 computer crime." That is established in the first 5 page of the affidavit. 6 THE COURT: Doesn't it have to be 7 for some purpose, though? 8 MR. TINTERA: No. 9 THE COURT: You were reading from -- 10 MR. TINTERA: 164.377. 11 THE COURT: I guess I skimmed over 12 it this morning. I did. I saw Subsection 2 where 13 it talks about, "Any person commits computer crime 14 who knowingly accesses, attempts to access or uses 15 or attempts to use any computer system, network or 16 part thereof for the purpose of devising." 17 MR. TINTERA: Those are the 18 felonies. 19 THE COURT: Okay. Then you're 20 saying Sub 4, that's misdemeanors? 21 MR. TINTERA: Yes. 22 THE COURT: That's simply to 23 accessing of it; is that right? 24 MR. TINTERA: Without authorization 25 or attempt to access. 32 1 THE COURT: Okay. 2 MR. TINTERA: So that is established 3 in the first page of the affidavit where it 4 indicates that this program had been run, that this 5 computer had been accessed and that Mr. Schwartz 6 was without authorization to do that. That 7 establishes computer crime. So the crime is stated 8 in the affidavit itself. 9 In regard to the probable cause, it 10 was helpful to me to read this affidavit, just read 11 it, which I did. Of course, I've read it more than 12 once, but just read it in an atmosphere of reading 13 along. And when I did that, we established that an 14 Intel employee is beyond his authorization going 15 into an area of SSD. It is a limited access area 16 because the products are considered 17 state-of-the-art computer systems, and it goes on. 18 We know that the area that he's 19 entering into is restricted technology area and 20 he's not authorized to go in there. We also know 21 what he's doing in there is deciphering, which is 22 essentially what a crack program is, passwords. We 23 also know that he uses on his -- when he works at 24 Intel, that he uses a laptop computer, which is a 25 portable computer, that that is how he does his 33 1 work at Intel. He plugs it into the Intel system. 2 We also know, through the security 3 expert for Intel, that this is a way to -- that 4 information can be transported on laptop computers 5 and that will evade Intel security measures. So we 6 pick that up from reading the affidavit. 7 We also know that Mr. Schwartz, in 8 the past, has felt it necessary to gain access to 9 the Intel system, breaching its security, what they 10 call the firewall. It's not referenced that in the 11 affidavit, but -- so I'll use the terms in the 12 affidavit, but that he has breached the security 13 systems of Intel by accessing Intel computers from 14 outside of Intel -- 15 THE COURT: This is in Paragraph 16 3 -- 17 MR. TINTERA: It's Page 3. 18 THE COURT: Page 3, the statement by 19 Dick Brandewie? 20 MR. TINTERA: Yes. So we know he's 21 done that in the past. And what we're seeing is a 22 person who is willing and able to breach Intel 23 security. 24 Then we get to the point of have we 25 established that it is more likely than not that 34 1 the evidence of computer crime would be discovered 2 in the areas authorized by the search? Well, we 3 know that he works at Intel. We know he works at 4 his home and his business and we know that he has a 5 vehicle. These were the areas that were authorized 6 to be searched. And that he hooks up his portable 7 computer to the Intel system and leaves with it, as 8 stated in the affidavit. 9 So is it more likely than not that a 10 person that is willing to compromise passwords into 11 a technologically restricted area is going to 12 transport that information away from Intel to use 13 at their own -- in the privacy of their own home 14 and office, as referenced in the affidavit? 15 The Court has referred -- I'm 16 looking at Page 2 now, as these just being just 17 opinions of Mr. Cower, and definitely counsel has 18 referred to that as speculation and conjecture. 19 THE COURT: Well, to be honest, I 20 didn't write down "just opinion," I wrote down 21 "opinion," recognizing that sometimes the Court 22 does -- may rely upon the opinion of people, if 23 they are qualified to express opinions, in finding 24 probable cause. 25 For instance, I even thought of a 35 1 situation we commonly confront in narcotics 2 seizures where we rely upon expertise of police 3 officers or their snitches from experience to be 4 able to identify controlled substances and that 5 sort of thing, so I know that is permissible. 6 MR. TINTERA: I think the magistrate 7 could rely on that in regard to the medium of 8 transportation of the information out of Intel for 9 use as Mr. Schwartz saw fit, for whatever reason 10 that he was gaining access to. But we know he used 11 this computer and it's reasonable to assume that 12 the information that he's using is on that laptop. 13 The police are not asking to search 14 everything. They're asking to search the areas 15 where they know he uses the computer system or 16 transports the computer system. And just seems to 17 me when you sit back and you read this from a 18 common sense, not hypertechnical, but from a common 19 sense standpoint, the information presented in here 20 just follows, it fits, that once a person is 21 willing to do this, that they are going to 22 transport, based on what Mr. Cower said, off 23 campus, to do whatever they're going to do with it, 24 whether it's to sell the information or whatever 25 they're going to do with it, but they're not going 36 1 to necessarily keep it in Intel. 2 Mr. Sussman says, well, gee, he used 3 his own name, did all this stuff. We don't 4 necessarily catch the smart ones. Just because -- 5 There are many forgery cases where an individual 6 signs his own name to the check where the check is 7 stolen. 8 THE COURT: That's happened? 9 MR. TINTERA: Somebody else's check, 10 not their own. But it doesn't detract from what's 11 in the affidavit just because he's caught at doing 12 what he's doing. That doesn't mean that this is 13 something that a magistrate could look at, and that 14 would be conjecture to come up with something that 15 says it's beyond his scope of authority. 16 I don't want to belabor the 17 particular point, but the most helpful thing to me 18 was to just sit back and read this, and when I did 19 that, I had an outline of what had happened here. 20 A contract employee is exceeding the scope of his 21 employment going into a highly sensitive area of 22 the supercomputer division of the Intel 23 Corporation, cracking the passwords of the people 24 who work there, which gives him access to their 25 files, and doing that through the medium of a 37 1 laptop computer that he can take off campus through 2 Intel security. And we know he works at his home 3 or business and he transports it in a vehicle and 4 that's what we asked to search. 5 THE COURT: Then you have the 6 opinion of Mr. Cower that in order to escape 7 detection -- he says here, "In order to avoid 8 detection in the workplace, Mr. Schwartz would 9 transfer the information to his Apple portable 10 computer in order to work with the information in 11 the privacy of his own home or office." 12 I take that as a statement by him 13 that a person wanting to do this, he said 14 Mr. Schwartz, but that a person wanting to do it in 15 order to escape detection would do that sort of 16 thing and then under the unique facts involved 17 here, it translates into his opinion as to what 18 Mr. Schwartz did. 19 MR. TINTERA: Yes. 20 THE COURT: That's what he's saying. 21 Is that your interpretation of that? 22 MR. TINTERA: Yes. 23 THE COURT: It would seem logical if 24 a person was trying to escape detection of what he 25 was doing, he would try to get the stuff out of 38 1 home office, so to speak, so he could work on it in 2 privacy. 3 MR. TINTERA: I think that's what 4 he's saying. 5 THE COURT: Then he's saying that's 6 what Mr. Schwartz was doing. 7 MR. TINTERA: Based on his 8 experience as a network security expert for Intel, 9 yes. 10 THE COURT: Then if he did that, 11 logically, where would he go, to his office or 12 home? 13 MR. TINTERA: Well, is it more 14 reasonable to -- 15 THE COURT: Well, he could do it on 16 a park bench if he had a portable computer, 17 couldn't he? Unless it's winter. 18 MR. TINTERA: Well, we know he works 19 on his computer at Intel. We know he works on the 20 computer at home, through the affidavit, and at his 21 business. So those are the three areas that were 22 asked to be searched, and the medium of transport. 23 THE COURT: Okay. 24 MR. TINTERA: In regard to the 25 seizure of the computer system, it indicates in the 39 1 affidavit that the -- I've -- regarding Detective 2 Lazenby, referencing Page 4, "necessary for an 3 expert to examine the computer evidence to prevent 4 destruction of that evidence and any other 5 information on the computer." 6 I believe that is computer evidence, 7 although not the strongest description of the 8 computer system, I believe it supports a seizure of 9 the computer system itself in the search warrant so 10 that it can be taken by an expert to be examined to 11 where the information will not be destroyed. It is 12 not, perhaps, as spelled out as we may like in 13 hindsight, but I believe that that does support the 14 seizure of the computer system. Certainly supports 15 the seizure of the laptop computer. 16 In regard to the free speech 17 argument, I'll just briefly touch on that. There 18 is no way that the officers are going to be able to 19 know that an area of speech or of a book or 20 anything is on a computer system. There is no way 21 that they can draft the affidavit in a good faith 22 way to anticipate that information unless or until 23 they actually find it there, Judge, so I'm not sure 24 that we're on the same page when it comes to the 25 free speech argument. 40 1 That's all I have, unless the Court 2 has some questions for me. 3 THE COURT: You've just been handed 4 a note. 5 MR. TINTERA: That's all I have, 6 Judge. 7 THE COURT: Did you address -- just 8 give me a minute here. 9 Mr. Sussman, anything further? 10 MR. SUSSMAN: To the extent that the 11 affidavit stated a crime, as Mr. Tintera pointed 12 out, the crime that the affidavit states is one 13 that was committed wholly within the premises of 14 Intel from the face of the affidavit, the 15 unauthorized access or attempt to do that, that the 16 statute referred to. The evidence of that is all 17 from the affidavit on the face of it, clearly 18 within the files and activity. 19 THE COURT: Where is all the 20 evidence of it? He saw the computer running at 21 Intel. That doesn't exclude the possibility that 22 other evidence might be found off premises. 23 MR. SUSSMAN: Because the affidavit 24 refers to the fact it was based on the inspection 25 of Mr. Schwartz's files that were within the 41 1 computer systems, where these programs were 2 running. The laptop only plugs into the system 3 where this access was taking place, and the first 4 paragraph states that. 5 What's happening here is an ongoing 6 program that is running at the time this 7 application for the search warrant was sought, and 8 the active file is showing that this program is 9 running, and what was in that program were within 10 the files under Mr. Schwartz's name, but that were 11 within the Intel computer system. 12 The evidence of that, if that was, 13 in fact, a crime, that was all evidence within the 14 Intel computer systems and the files that were 15 there. 16 THE COURT: Why wouldn't also 17 evidence be disclosed in his own laptop computer? 18 If it was at his place of residence, might be 19 evidence of a crime, afterwards, after the fact. 20 You're saying the exact moment the 21 crime was being committed and thereafter records 22 would be on the premises of Intel. Why wouldn't it 23 also be likely, more probably than not, that his 24 own laptop computer would contain evidence of what, 25 in fact, had occurred based upon what's in the 42 1 affidavit? And not only his own laptop computer, 2 but other computer records that he would have 3 available. 4 MR. SUSSMAN: Well, in part because 5 the program that was being run here was being run 6 on a separate computer, a computer that was within 7 the Intel system. And I don't believe -- 8 THE COURT: Does it say that? I 9 thought Mr. Tintera said it was his practice to 10 plug in his laptop computer when he was on the 11 Intel premises. 12 MR. TINTERA: It's on Page 2, 13 second -- third paragraph. 14 THE COURT: Says, "Mr. Morrissey 15 told me that Mr. Schwartz has an Apple portable 16 computer which he attaches to the Intel computer 17 network when Mr. Schwartz is at his office or -- 18 "at his office on Intel property." 19 MR. SUSSMAN: And Paragraph 1 20 indicates that the program was running on a Sun 21 computer -- I'm sorry, Page 1, second paragraph, 22 says that "Mr. Morrissey indicated that on October 23 28th, he noticed an unusual process running on Sun 24 computer which he was administering. It was the 25 crack program." He found the file in that 43 1 paragraph, saw this as a possible violation. 2 And then the next paragraph 3 indicates that he sees that it's Mr. Schwartz 4 because it's under Schwartz's identification and 5 finds files under Mr. Schwartz's name in that 6 system. So that was merely the point, that the 7 evidence of that offense, if there was an offense 8 there, it was all contained in there. 9 And then the next step, what we 10 have, the other common sense way of looking at this 11 also is that people at Intel see that this program 12 is running and there is some compromised passwords 13 on the system at SSD that they are worried about. 14 And then you have the next leap, 15 which is the speculation, well, we see by his own 16 files that it's out there in the open, that Randal 17 Schwartz is running this. Well, he could be taking 18 this out of Intel. He could possibly do that on 19 his computer, on his portable that we know that he 20 has. He might have something there that we're 21 worried that he might have. We're concerned about 22 that and we want to take a look and see if there is 23 anything there and that's, in effect, what the rest 24 of that affidavit for the search warrant 25 essentially states and what, in effect, was the 44 1 search authorized. 2 The facts that would make that -- 3 take it to that next level to beyond the 4 speculation, beyond the inference to the 5 probability, the facts stating probable cause, 6 aren't there. 7 THE COURT: I understand they have 8 to bridge that gap. Mr. Tintera, I know 9 technically -- 10 MR. TINTERA: I have a very brief -- 11 THE COURT: I'll let you both 12 complete everything that you have to say because 13 it's helpful to me. 14 MR. TINTERA: I only want to respond 15 to a couple things. 16 In regard to Mr. Sussman's -- I have 17 looked for the lowest common denominator in regard 18 to the crime stated, and there are others. Since 19 he's brought it up, I'll mention it. 20 Paragraph of -- Page 2, Paragraph 3, 21 where it talks about Mr. Schwartz's activity in 22 bypassing Intel's security systems, includes a 23 reference to 164.377 Sub 3, in which he alters -- 24 without authorization alters, damages or destroys 25 any computer, computer system, that is evidence of 45 1 altering the computer system without authorization 2 by breaching the Intel security so that he can 3 access their internal computers from the outside. 4 Further, it also references his 5 running the crack program on the SSD password files 6 is the theft of proprietary information. And I'm 7 referring to 164.377(2), sub lower case (c), 8 "Committing theft, including but not limited to 9 theft of proprietary information. Proprietary 10 information includes any scientific," and goes on, 11 "or business code that is known only to limited 12 individuals within an organization." That is also 13 established within the affidavit. 14 THE COURT: Mr. Sussman. 15 MR. SUSSMAN: I think we have beat 16 this horse to death. 17 THE COURT: I know. Again, I remind 18 you both that you are much more up to speed on the 19 facts involved here than I am, and it's 20 appropriate, I think, because it's your job to 21 supply the factual information and argument to me, 22 and hopefully my mind isn't cluttered by any 23 preconceived notion or other knowledge of how 24 computers work or any of that, and you have a clean 25 slate here because I have no knowledge of computers 46 1 and I rely only on what you tell me and what's in 2 your affidavit and arguments. 3 You've indicated that -- You've both 4 made fine arguments and it has been helpful and it 5 was helpful to me this morning to read the 6 affidavit again. And what I did was sort of, as 7 Mr. Tintera suggested he did, before I read the 8 memoranda that were filed, I read it, the affidavit 9 and the warrant, as though I was the Judge being 10 confronted with the task, it was being presented to 11 me. And my habit when I do that is not to write in 12 the margins, because I have the original, but thank 13 God for yellow sticky tabs, is to place yellow tabs 14 on the margins of the affidavit every time I see a 15 question. 16 And then if something comes to mind, 17 an issue that I see, something that isn't answered 18 on the basis of knowledge or reliability or 19 whatever, then as I read through the affidavit, 20 some of those questions are answered and I remove 21 the tabs. And when I get done, I have tabs left 22 and I review those to see if nevertheless the 23 material in the affidavit is sufficient to state 24 probable cause. And I did that and there were a 25 number of questions. 47 1 I wrote "opinion" in the margins. 2 Some places, I wrote "speculation," and after going 3 clear through, most of my questions were answered. 4 I then went back and reviewed it again, and at 5 first blush, knowing that I had not yet heard 6 argument, I was satisfied that the affidavit was 7 sufficient. 8 Then I heard argument -- Then I read 9 the memoranda, I saw the issues you raised, and 10 many of the ones were ones that I had seen after I 11 read the affidavit. 12 Now I've heard argument in addition. 13 Some of the points have been clarified, for 14 instance. I have not read the criminal statutes 15 carefully and didn't realize there was a 16 misdemeanor version of the crime and that simply 17 unauthorized entry into the computer system could 18 be a crime without a special purpose. Originally, 19 I felt there must be some special purpose proven, 20 and I thought the factual basis there might be 21 lacking. 22 But now I believe that, going 23 through that, I do find in this case, after having 24 reviewed the materials, heard argument, reviewed 25 the statutes cited, in fact, I think to take them 48 1 in order that Mr. Sussman has argued here, that 2 there was no statutory violation by reason of the 3 fact that police officers took Intel personnel to 4 the site of the search or searches in this case. 5 That it was authorized by statute. 6 Secondly, that in reviewing the 7 affidavit, I do find probable cause to exist and 8 the affidavit passes muster in that regard for 9 search of the premises, places listed in the search 10 warrant. 11 The remaining issue has to do with 12 the argument that it's overbroad, and every case is 13 different and every factual scenario unique, and I 14 don't know that I've ever read a case involving a 15 search of computer records. I am of the opinion, 16 though, given the facts that are involved in this 17 case and having considered the affidavit and then 18 the warrant that was authorized by the magistrate, 19 Judge Freerkson, that the warrant is not overbroad. 20 And so I think our next task is to 21 be involved in a motion to controvert and determine 22 whether or not there are facts in the affidavit 23 that must be excised and then reconsider the 24 affidavit to determine whether or not probable 25 cause exists, and we can get into that after the 49 1 noon hour. 2 Any questions? 3 MR. SUSSMAN: No, Your Honor. 4 MR. TINTERA: No, Judge. 5 THE COURT: Thank you. We'll 6 reconvene at 1:30. Thank you. 7 MR. TINTERA: Thank you, Judge. 8 (Luncheon recess.) 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 50 1 AFTERNOON SESSION 2 BEGINNING AT 1:30 P.M. 3 JUNE 13, 1995 4 5 THE COURT: Mr. Sussman. 6 MR. SUSSMAN: Your Honor, as I 7 understand, we're prepared to proceed now with 8 witnesses and testimony on the motion to 9 controvert. 10 THE COURT: All right. I am. 11 MR. SUSSMAN: The first witness to 12 accommodate some scheduling problems, we'll call 13 Rich Cower. 14 MR. TINTERA: Judge, before the 15 defense calls witnesses, I would like an 16 opportunity to -- as I read the statute, the 17 defense has to show by affidavit a substantial 18 basis for challenging the good faith, accuracy or 19 truthfulness of the affiant. 20 It's come to my attention on the 21 affidavit of counsel that there are some 22 inaccuracies that should be corrected, and I would 23 like to call a witness to correct those 24 inaccuracies in the form of not an affidavit but 25 actual sworn testimony in regard to the affidavits 51 1 that have been filed. 2 THE COURT: You wish to correct the 3 affidavit that was in support of the search 4 warrant? 5 MR. TINTERA: No. In support of -- 6 Counsel is required to file an affidavit in support 7 of the motion to controvert. 8 THE COURT: Right. 9 MR. TINTERA: And there are some 10 inaccuracies in counsel's affidavit, and I can 11 either call Mr. Sussman, but I think -- I thought 12 it would be more expedient -- Since he's the 13 affiant, I could call him, but I thought it would 14 be more expedient to call Mr. Cower to correct the 15 inaccuracies that I see in his affidavit. 16 I can do it either way, but I think 17 it's important because I think there is a threshold 18 determination that the Court must make, and that is 19 has the defense shown a substantial basis to 20 challenge the truthfulness, accuracy or good faith 21 of the affiant, Detective Lilley? I'm not 22 conceding that point. 23 THE COURT: I understand. In 24 particular, which affidavit filed by Mr. Sussman, 25 when and where and -- 52 1 MR. TINTERA: There are two 2 affidavits in support of the motion to controvert. 3 THE COURT: I do see one here. 4 MR. TINTERA: The first is dated 5 August 10, 1994. 6 THE COURT: I think that's the one 7 filed the 11th that I have before me. 8 MR. TINTERA: And the Second 9 Affidavit of Counsel Supporting Supplementary 10 Motion to Suppress Defendant's Motion to 11 Controvert, and that is dated June 5, 1995. Second 12 Affidavit of Counsel Supporting Supplementary 13 Motion to Suppress, and in parenthesis, Motion to 14 Controvert. 15 THE COURT: I do have that. Well, 16 in particular, tell me what it is you wish to do, 17 point out the so-called inaccuracies in the 18 affidavit of counsel? 19 MR. TINTERA: On Page 4 of the 20 affidavit of counsel, which is dated August 10, 21 starts on Line 4, but I think it's Paragraph 11 22 that "the affiant represented to the magistrate 23 that it was believed that the information relative 24 to the suspected offenses was obtained on floppy 25 disks." No report from any Intel employee mentions 53 1 floppy disks. Could have left the impression that 2 someone saw Mr. Schwartz in possession of floppy 3 disks or using floppy disks at Intel. 4 The reference to floppy disks was in 5 regard to the expert information that Detective 6 Lilley had received and how information can be 7 transported out of Intel. And I think Mr. Cower 8 can enlighten the Court, since he was the person 9 who said that in regard to that sworn statement by 10 counsel -- 11 THE COURT: Well, what he said is 12 not important. It's what was in the affidavit, 13 what was communicated to the magistrate that's 14 important. 15 MR. TINTERA: I understand, but my 16 final point, after I correct these inaccuracies, is 17 that there is no substantial basis to go any 18 further with the motion to controvert. 19 THE COURT: Show me in the 20 affidavit, then, where it appears that what 21 Mr. Sussman has in Paragraph 11 is not correct. In 22 other words, he's characterized in his affidavit, 23 Paragraph 11, you say he's characterized something 24 that was in the search warrant affidavit, or 25 mischaracterized something. 54 1 MR. TINTERA: Yes. All right, I'll 2 find it for you. 3 I'm sorry, it's Detective Lazenby. 4 It's Page 4, first paragraph, "Detective Lazenby of 5 the Washington County Sheriff's Office has told me 6 through his experience and training he knows of 7 persons who are involved in these activities often 8 will try to conceal the contents on disks and 9 tapes." 10 So disks and tapes reference on 11 floppy disks. I assume that's what he's 12 referencing. I think that's the only part that 13 deals with disks and tapes. And what he's trying 14 to get to is that this somehow misrepresents and 15 that there was no information. We didn't say 16 anything about there being -- that this was -- that 17 this information was put in the affidavit as -- 18 THE COURT: General information, 19 background information from Lazenby's experience 20 and training? 21 MR. TINTERA: Exactly. Thank you. 22 THE COURT: Not representing it as 23 being information solely received from Intel. 24 MR. TINTERA: Right. There is no 25 information that it came from Intel. 55 1 THE COURT: Did you interpret this 2 to mean, Mr. Sussman, that -- this paragraph on 3 Page 4 of the search warrant affidavit, that this 4 somehow was information that Lazenby had received 5 only from Intel? That's not what it says. 6 MR. SUSSMAN: No, Your Honor. I 7 think in presenting this to controvert, this as an 8 inaccuracy in the search warrant, as I indicated 9 and argued earlier, the search warrant stated no 10 facts to support -- the affidavit stated no facts 11 supporting there was floppy disks to request in the 12 bottom of Page 4 authorizing the seizure of floppy 13 disks. 14 Detective Lazenby refers to disks 15 and tapes. But what this would show is in asking 16 for the warrant, Detective Lilley was asking for 17 information, for a seizure of certain items which 18 we think -- which we intend to explore that would 19 indicate that nobody had told him, and he had no 20 knowledge that Mr. Schwartz was in possession or 21 use of floppy disks. That was the thrust of what I 22 was trying to get at in Paragraph 11. 23 THE COURT: So Lazenby, in the 24 search warrant affidavit, says he knows from his 25 experience that people that do this sort of thing 56 1 frequently conceal the data on disks and tapes. 2 And you want -- and he used that for the basis of 3 looking for disks and tapes that might be in the 4 defendant's possession. 5 You're saying that nobody from Intel 6 told him, gave him any information that would lead 7 him to believe that the defendant had anything on 8 disks or tapes, and so -- 9 MR. SUSSMAN: That's right. 10 THE COURT: -- so he had no basis 11 for believing that. 12 MR. SUSSMAN: That's right. 13 THE COURT: That there were any 14 disks or tapes in the defendant's possession. 15 MR. SUSSMAN: Yes, sir. 16 THE COURT: Except that he said his 17 experience. Does he have to rely only upon what 18 Intel would tell him? 19 MR. SUSSMAN: I don't think 20 Paragraph 11 says that Detective Lazenby says that 21 the information was contained on floppy disks. At 22 the bottom of Page 4 in the affidavit, the affiant 23 asks for seizure of these computer systems and all 24 floppy disks, inferring that this -- that there 25 was -- 57 1 THE COURT: I understand. 2 Mr. Tintera, what other points do you have? 3 MR. TINTERA: I'd like to expand on 4 what he said. Everyone is assuming, and counsel is 5 assuming, that we're talking about floppy disks. A 6 floppy disk is what you put in the computer to put 7 information on it. 8 THE COURT: I thought it was 9 something in a bad back. I've heard of a ruptured 10 disk. 11 MR. TINTERA: You can also have 12 ruptured disks, but they don't occur in computers. 13 I don't think so. Mr. Schwartz may have a -- 14 THE COURT: I told you I have a 15 clean slate as far as computers. 16 MR. TINTERA: Also, Detective 17 Lazenby did not restrict himself to floppy disks, 18 although people are assuming that there is also a 19 hard disk, which is something that remains inside 20 the computer that also contains information. So 21 you can have information on a hard disk of the 22 computer that can be copied onto a floppy disk that 23 can be removed. 24 What Detective Lazenby is talking 25 about, I think it's reasonable to assume, is both 58 1 forms of medium of containing computer information, 2 whether by using just the generic disk, it can be a 3 floppy or a hard disk. I think that's important to 4 note in regard to Paragraph 11 of counsel's 5 affidavit. 6 THE COURT: How many of these points 7 do you have? 8 MR. TINTERA: Well, that's 9 interesting, because I hadn't planned on presenting 10 this. I had planned on my witness answering that 11 question, so give me a minute. 12 THE COURT: I'm thinking about 13 procedure, how to do this. Having dealt with both 14 you and Mr. Sussman, my belief is neither of you is 15 going to do anything at all inappropriate or even 16 close to the line as far as presenting information 17 to me, and I'm going to go out on a limb and say 18 that if Mr. Sussman says in his affidavit that he 19 believes something to be true because of what he's 20 read, what I would like to do is let him present 21 his case and these points that you're bringing up 22 can well be made in your argument or rebuttal. 23 MR. TINTERA: But I think this is a 24 threshold question before we even get into the 25 motion to controvert. 59 1 THE COURT: I know you think that. 2 MR. TINTERA: You've understood 3 that. 4 THE COURT: I do. But procedure -- 5 I think the way to handle it, the way I'd like to 6 handle it is for him to go ahead and make his case. 7 And if you have an explanation or you think he's 8 misreading the affidavit or something -- well, I 9 understand the statute does require -- I've read 10 the statute on a number of cases. I know the 11 showing necessary. 12 I'd like to interpret the affidavit 13 followed by Mr. Sussman, at least initially, 14 subject to you being permitted to argue after 15 you've heard the evidence. And it may be that I'll 16 believe your argument and I'll say no, I'm not 17 going to consider that point or excise that point 18 or something, but I'd like to do this once, is what 19 I'm saying. 20 MR. TINTERA: I agree with Your 21 Honor, but the State v. Harp, 299 Oregon, 1995 case 22 indicates that they are referencing on Page 9, the 23 last full paragraph, they're talking about 24 Subsection 2, which we're talking about, allows the 25 defendant to contest the good faith, accuracy and 60 1 truthfulness of affiant. Then in quotes, "It has 2 only upon supplementary motion supported by 3 affidavits setting forth substantial basis for 4 questioning the good faith, accuracy and 5 truthfulness." 6 THE COURT: You and I have both been 7 parties to these sorts of proceedings where no 8 affidavit has been filed by the defendant or 9 affidavits that are so general that they tell us 10 nothing, to mixed affidavits, to rather lengthy 11 affidavit, as prepared here by Mr. Sussman. I 12 compare this to others that I have reviewed and, 13 frankly, again, procedurally, I'd like to go ahead 14 and let him make his presentation. 15 I agree there is a threshold issue, 16 but when he's done, you can load your rifle and 17 shoot at all the targets you wish to and I'll hear 18 your argument then. Otherwise, I'll hear your 19 argument now, and if I overrule you, he'll present 20 the evidence, then I'll hear your argument again. 21 It will be the same argument twice. 22 MR. TINTERA: Thank you. 23 THE COURT: Thank you. I appreciate 24 the fact that you've folded your tent and both 25 parties are willing to proceed procedurally the way 61 1 I've outlined. Let's proceed that way. 2 Mr. Sussman, call your first 3 witness. 4 MR. SUSSMAN: Detective Lazenby, 5 Your Honor. 6 7 PAUL LAZENBY 8 called as a witness on behalf of the Defendant, 9 having been first duly sworn under oath, was 10 examined and testified as follows: 11 12 THE CLERK: State your full name and 13 spell it for the record, please. 14 THE WITNESS: Paul Lazenby. 15 L-a-z-e-n-b-y. 16 17 DIRECT EXAMINATION 18 BY MR. SUSSMAN: 19 Q You are a detective with the Washington 20 County Sheriff's Office? 21 A Yes, I am. 22 Q How long have you been employed in that 23 capacity? 24 A I've been a police officer about 23 25 years. 62 1 Q And how long have you been a detective 2 with the Washington County Sheriff's Office? 3 A About 15 years. 4 Q To set the timeframe here, you were a 5 detective in the Sheriff's Office on or around 6 November 1st, 1993? 7 A Yes. 8 Q And were you asked to participate in the 9 preparation of a search warrant affidavit involving 10 Randal Schwartz and some computer equipment? 11 A I provided some information, yes. 12 Q Did you have a chance to read the 13 affidavit before it was presented to the 14 magistrate? 15 A I believe I read the next-to-the-final 16 draft or almost the final draft at Intel, yes. 17 Q Do you have copies of that with you? 18 A No. 19 Q When you reviewed the next-to-final 20 draft, did you make any changes in it? 21 A Not that I can remember. 22 Q Now, you've previously testified -- at 23 the beginning of this hearing many months ago -- 24 about your training and experience with computer 25 crime investigation. 63 1 A Uh-huh. 2 Q As I recall. And there is some reference 3 to your training and experience on Page 4 of the 4 affidavit. 5 Did you talk to Detective Lilley 6 about your -- about the nature of your training and 7 experience? 8 A Did I talk to him about it? 9 Q Yes. 10 A I can't remember discussing that 11 specifically with him. 12 Q Did you tell him specifically what you 13 had learned about computer crime investigations in 14 the two-week course that you took? 15 A I believe I did, yes. 16 Q Did you tell him that this was the first 17 computer crime case that you were involved in 18 investigating? 19 A The first one? 20 Q Yeah. 21 A No, I did not tell him that. 22 Q Now, on Page 4 of the affidavit, it 23 states that "Detective Lazenby of the Washington 24 County Sheriff's Office has told me that through 25 his experience and training, he knows that persons 64 1 who are involved in these activities often will try 2 to conceal the contents of disks and tapes 3 Mr. Schwartz used by mislabeling or not labeling 4 the contents," and then it continues. Did you have 5 any specific information -- 6 MR. TINTERA: Judge, I object to the 7 form of the question. It does continue, and I 8 think in fairness to the witness, he needs to 9 indicate the full sentence to put this in context. 10 THE COURT: Read the full sentence 11 to him. 12 BY MR. SUSSMAN: 13 Q The sentence concluded by saying, 14 "respectfully requested that the authorization for 15 seizure of any and all computer disks and tapes be 16 ordered to enable you to view the necessary storage 17 disks and tapes." 18 In your discussion with Detective 19 Lilley, when you talked with him about your 20 training and experience, at that point did you have 21 any information that Mr. Schwartz had used disks or 22 tapes? 23 A No. I was explaining to Detective Lilley 24 that based on the training that I had had, that 25 people when they do these crimes can put it on 65 1 disks, they can conceal it in the network 2 somewhere, they conceal it on a computer, put it in 3 different files. It's real easy to conceal this 4 information. 5 Q When you say "these crimes," what crimes 6 are you referring to? 7 A Computer-type crimes where somebody goes 8 into a computer and takes stuff that's not theirs. 9 Q In the course of that training, did you 10 get materials regarding -- that describe the nature 11 of people involved in computer crimes? 12 MR. TINTERA: Your Honor, I object. 13 The issue in a motion to controvert is information 14 that the affiant had, whether they left things out 15 or whether they did not have good faith or they 16 were not truthful in what they put in the 17 affidavit. 18 What Detective Lazenby may have 19 experienced in his training is not relevant to 20 that. The only thing we're looking at is what 21 Detective Lazenby may have told to Detective Lilley 22 and Detective Lilley, with bad faith or because he 23 wanted to conceal something or mislead the 24 magistrate, left it out of the affidavit. 25 THE COURT: Well, this witness is an 66 1 adverse witness to the defendant and this witness 2 has testified that he did give to Detective Lilley 3 information about what he had learned in his 4 courses, including the fact that defendants in 5 these types of cases transfer information to tapes 6 and disks. 7 I think it's fair to permit counsel 8 to cross-examine about that. He doesn't have to 9 take this witness's word for it, but -- that he 10 learned that information in those courses, but he 11 can cross-examine because if he can shed light on 12 this witness' credibility on that issue, also 13 places credibility on whether or not he told 14 Detective Lilley. 15 MR. TINTERA: I haven't seen any 16 showing by the defense that this is an adverse 17 witness. I don't think that should be a given in 18 this case. 19 The Sheriff's Department is 20 cooperative with all parties and I don't think, 21 just because of Detective Lazenby's occupation, 22 that we should assume he's adverse to the defense. 23 He may be adverse in that the goals of the defense 24 and the State are different, in that we're seeking 25 justice, but that would be the only thing that I 67 1 would concede in regard to adverse interests. 2 THE COURT: Well, I'm permitted and 3 have discretion to permit examination to proceed in 4 different manners and I will permit counsel to 5 proceed as on cross-examination of this witness for 6 the purpose of determining what information he may 7 have learned in his course work, and the question 8 that he asked, I think, is appropriate and I'll 9 overrule the objection. 10 MR. TINTERA: Thank you. 11 MR. SUSSMAN: Do you remember the 12 question? 13 THE WITNESS: No. Something about 14 did I get any materials. I got materials from 15 them, but it was more like articles like one might 16 get in this case and certain people who had been 17 involved in these types of crimes in the past. 18 BY MR. SUSSMAN: 19 Q Have you received any materials supplied 20 by the Department of Justice involving 21 investigating computer-related crimes? 22 A No. I don't remember that being any of 23 the material, off the top of my head. 24 Q Did you relate what you learned in any of 25 those articles about the profiles of people who 68 1 committed computer crimes to Detective Lilley? 2 A I didn't relate anything about a profile. 3 I don't remember seeing anything about a profile of 4 the types of persons. 5 Q In that training, you learned that it was 6 technically -- that technically, it was possible to 7 take a mirror image of the data stored on the hard 8 drive of a computer; is that right? 9 A Maybe I should go over the training. 10 Q The question is -- 11 A They talked about mirror imaging, yes. 12 Q And they are people trained to do 13 technical work in investigating computer crimes, 14 were capable of doing -- 15 A Mirror imaging. 16 Q -- mirror imaging? 17 A That's correct. 18 Q That's not what you were trained to do? 19 A That's correct. 20 Q Did you tell Detective Lilley that the 21 training or that people were trained -- let me 22 rephrase. 23 That it was possible to do mirror 24 imaging of the data stored on the hard drives of 25 computers? 69 1 A What I told Detective Lilley was that 2 that's why you have to seize the stuff, because you 3 have to take it back and have somebody do that. 4 You can't do it at the person's house or their 5 business because it's too involved, the process. 6 Q So you told him it was not -- 7 A You have to seize all this stuff. That's 8 why we were taught to seize it and tag it properly 9 and tag all the cables and things like that, so 10 that can be done by an expert, because we don't 11 have the experience to do that. You have to have 12 somebody specifically trained in that. 13 Q And at the time this was prepared, was 14 there anybody at the Washington County Sheriff's 15 Office who was trained to review the mirror imaging 16 of computers? 17 A Alan Watson of the Sheriff's Office had 18 gone through the classes but not completed the 19 final stages of the training. That's why we had to 20 go outside and have somebody come in. And you also 21 run into the problem with Apple computers, which 22 your client had, are even more difficult to do than 23 IBMs or clones and we had nobody trained in those. 24 Q Now, in that training course, was there a 25 follow-up program that was a follow-up to the 70 1 actual course work where you had to do some 2 self-testing by analyzing the computer disks? 3 A No. 4 MR. SUSSMAN: Thank you. Nothing 5 further of this witness. 6 THE COURT: Mr. Tintera. 7 8 CROSS-EXAMINATION 9 BY MR. TINTERA: 10 Q Counsel asked you if this was your first 11 computer crime case. Was this your first computer 12 crime case? 13 A This is the first case where the person 14 was actually charged with a computer crime. I'd 15 been on other cases where we seized computers and 16 done some tagging, and drug units had been involved 17 in this work for drug records, and me and Alan had 18 gone out and assisted in that. 19 Q To give the Court an idea of your 20 expertise in that area, how many cases, not where 21 they were charged with computer crimes but where 22 actual computer equipment was seized through a 23 search warrant, have you been involved in? 24 A I think about four or five with the 25 narcotics unit and one homicide case. 71 1 Q And what timeframe are we talking about? 2 A The last probably three years, four 3 years. 4 MR. TINTERA: Thank you. That's the 5 only question I have. 6 THE COURT: Mr. Sussman. 7 8 REDIRECT EXAMINATION 9 BY MR. SUSSMAN: 10 Q Of those cases that you just described 11 where the computers were seized, were you involved 12 in the examination of the data on the computer of 13 those? 14 A No. Like I said, I'm not trained in 15 that. They brought in experts to deal with that. 16 Mostly the people trained in that mostly are in the 17 federal agencies right now. I think Portland has 18 one or two people now trained in it and we're 19 trying to get Alan up to score and -- 20 Q So these limitations on your training and 21 experience were communicated to Detective Lilley? 22 A My limitation on what? 23 Q This scope, the extent of your training 24 and experience was communicated to Detective 25 Lilley? 72 1 A I don't know what you mean 2 "communicated." That wasn't -- 3 Q Did you tell him that's all you had done 4 before in terms of working on computer-related 5 cases? 6 A No. I didn't get into the numbers or 7 anything. 8 Q Did he ask you? 9 A No. 10 MR. SUSSMAN: Thank you. Nothing 11 further. 12 MR. TINTERA: No further questions. 13 THE COURT: Thank you. You may step 14 down. 15 MR. TINTERA: May this witness be 16 excused? 17 MR. SUSSMAN: I have no problem with 18 that. 19 THE COURT: You're free to go for 20 today. 21 Call your next witness. 22 MR. SUSSMAN: We'll call Rich Cower. 23 24 25 73 1 RICHARD COWER 2 called as a witness on behalf of the Defendant, 3 having been first duly sworn under oath, was 4 examined and testified as follows: 5 6 THE CLERK: State your full name and 7 spell it for the record, please. 8 THE WITNESS: Richard Cower. 9 C-o-w-e-r. 10 11 DIRECT EXAMINATION 12 BY MR. SUSSMAN: 13 Q In the fall, Mr. Cower, you informed me 14 that you recalled taking some handwritten notes 15 about your -- when you were involved in the 16 interview of Randal Schwartz. 17 A Yes, that evening at his house. 18 Q And you said that you turned those notes 19 over to somebody. 20 A Yes. 21 Q Do you remember who you turned them over 22 to? 23 A Probably the legal department. 24 Q At Intel? 25 A Yes. They were requested, as I recall, 74 1 in one of your -- I don't know the names for all 2 the papers that you generate, but they were 3 requested, a subpoena or affidavit, or whatever you 4 call it. I turned over copies, as I recall. They 5 are hard to read because my handwriting is very 6 poor. 7 MR. SUSSMAN: Your Honor, I would 8 just note -- before we deal with this motion to 9 controvert question -- those documents were not 10 included in the materials that were turned over, so 11 I would ask Mr. Woodard to take a look in the 12 documents that they have there to see if those 13 notes are in the files so that those can be turned 14 over. 15 MR. TINTERA: I'd like copies of 16 those, if they exist. 17 THE COURT: Do they exist, 18 Mr. Woodard? 19 MR. WOODARD: What notes? 20 THE COURT: Notes that -- 21 handwritten notes Mr. Cower may have made the night 22 the search warrant was executed regarding 23 statements that the defendant made to either he or 24 authorities, police officers. 25 MR. WOODARD: I will look through 75 1 things. I haven't seen handwritten notes other 2 than my own and Mr. Pierce's, but I will search 3 through the files. 4 THE COURT: Were they on small paper 5 or -- 6 THE WITNESS: They were on a 7 Franklin-size notebook, which is a smaller paper, 8 and then copied onto larger paper, eight and a half 9 by eleven. 10 THE COURT: But the notes would take 11 up a small portion of the page? 12 THE WITNESS: Yes. 13 MR. WOODARD: I haven't seen them, 14 but I will look for them. 15 MR. SUSSMAN: Thank you. 16 THE COURT: Thank you. 17 BY MR. SUSSMAN: 18 Q Mr. Cower, what's a network security 19 specialist? 20 A I deal with network security at Intel 21 specifically writing policy for security at Intel, 22 network security at Intel. 23 Q And this is for a corporate policy? 24 A Yes, it is. 25 Q And you are located in what office? 76 1 A Folsom, California. 2 Q Were you located in the Folsom, 3 California office in October, November of 1993? 4 A Oh, yes. 5 Q Was there any policy manual that you had 6 been involved in the network security that you 7 prepared prior to November 1993? 8 A I didn't -- there were three policy 9 manuals in effect then. 10 Q And had you shared those policy manuals 11 with Detective Lilley at the time this affidavit 12 was prepared? 13 A I don't recall. 14 Q Is there any special training required 15 for that position? 16 A No. I mean, you have to have some 17 experience with network and computer systems. 18 Other than that, no. 19 Q And as a network security specialist, 20 what does that job require you to be concerned 21 with? 22 A Network security. 23 Q And you have to be concerned about 24 security leaks, whether passwords are secure? 25 A Yes, that's right, part of the job. 77 1 Q You have to test to see whether the 2 passwords are secured against outside efforts to 3 break into them? 4 A You have to define what an outside effort 5 is. 6 Q Well, let me simplify that. You are 7 concerned with making sure that the passwords are 8 secure and can't be used by somebody who is not the 9 owner of the password? 10 A We instruct systems managers at Intel how 11 to assure that passwords are secure. 12 Q Systems managers? 13 A Systems managers, yes. Systems 14 administrators. 15 Q What is a systems administrator? 16 A Somebody that administers access of 17 Intel's information to other employees at Intel. 18 Q Mr. Schwartz had been a systems 19 administrator in his work at Intel, isn't that 20 true? 21 A During what period of time? 22 Q Prior to November 1st, 1993. 23 A How far prior? 24 Q At some time prior, during the course of 25 his employment. 78 1 A Yes. 2 Q And he was doing, in fact, systems 3 administrator work during the period of time that 4 he was working at a division called IWARP? 5 A Yeah, SSD. 6 Q IWARP is a subsection of SSD? 7 A Yeah. 8 Q And was he performing systems 9 administrator work under Bob Wilcox, the person he 10 was -- one of the people named that he was working 11 under at the time the search warrant affidavit was 12 written November 1st, 1993? 13 A I would say based on the invoices that 14 I've seen for his work, yes. 15 Q As a systems administrator who was 16 concerned with maintaining the security of a 17 computer system under his or her control or 18 responsibility, does that person have to be 19 concerned about, well, somebody from outside of 20 Intel getting access to secret information inside 21 of Intel? 22 A Yes, they should be. 23 Q Industrial espionage? 24 A Yes. Just as a normal part of security 25 activity on the system that they are administering, 79 1 yeah, I would say yeah. 2 Q So any good security -- I mean systems 3 administrator will have to take that kind of 4 concern into account in designing -- in doing their 5 job? 6 A They should. 7 Q Now, did you discuss Mr. Schwartz's 8 position and responsibilities at Intel with 9 Detective Lilley? 10 A Trying to remember. I don't know. It's 11 almost two years. I don't recall. I mean, 12 certainly his responsibilities were discussed at 13 Intel. Whether they were discussed with Detective 14 Lilley or not, I don't know. 15 Q You were -- According to the reports that 16 were provided, there was something called a bridge 17 meeting on October 29th, 1993, after Mr. -- after 18 the crack program was run -- found running on this 19 SSD machine. 20 A Yes. 21 Q Were you aware of that meeting? 22 A Oh, yes. 23 Q Did you participate in that meeting? 24 A Yes. 25 Q Was that a conference telephone call or 80 1 was that an actual meeting? 2 A It was both. There was a meeting room in 3 Folsom where a number of us that were in Folsom got 4 together, and then the normal Intel meeting 5 procedure is that the people that aren't local, 6 they dial into the meeting. 7 Q Did you take notes while you were at that 8 meeting? 9 A Very few. Very few notes. 10 Q Was there anybody else there taking 11 notes? 12 MR. TINTERA: Objection. What does 13 this have to do with the motion to controvert? 14 THE COURT: Mr. Sussman, this one is 15 less obvious. 16 MR. SUSSMAN: Well, it's actually 17 somewhat unrelated. I was hoping, since Mr. Cower 18 has to leave, to get the information about -- 19 information that hasn't been disclosed under the 20 subpoena to make sure it was, in fact, available. 21 THE COURT: Well, I'm sustaining the 22 objection to that. 23 BY MR. SUSSMAN: 24 Q At any rate, at this meeting on October 25 29th, this bridge meeting, this meeting was to 81 1 discuss this security incident about finding this 2 crack program running? 3 A Yes. There were actually two things 4 discussed. There was the Crack Program, discovery 5 of the Crack Program, then subsequent discovery of 6 the -- there was also the gate, what we call the 7 Gate Program, gate script. 8 Q What Gate Program was that? 9 A That was Randall's gate script, Brillig. 10 B-r-i-l-l-i-g. That's the system. Those were the 11 two things. 12 What we were really discussing in 13 that meeting was ways in which -- the steps we 14 would have to take. There was very little 15 discussion about what was going to happen with 16 Randal. It was a given that Randal's contract with 17 Intel was going to be terminated and what we were 18 discussing was means to prevent any further damage 19 or subsequent damage to Intel's computer systems or 20 networks. 21 Q At that point, had the records of the 22 files showing the computer runs on the Crack 23 Program been copied or maintained in some -- 24 A I don't know at that point if they had 25 been or not. I don't know. I don't want to say 82 1 yes or no. I wasn't here in Oregon where those 2 records were. 3 Q Now, what was your initial contact with 4 somebody from the Washington County Sheriff's 5 Office? 6 A I'm sure that would have been sometime 7 that Monday, the following Monday, November 1st, 8 maybe. That Monday. 9 Q How did that contact come about? 10 A We were here in Oregon. I came up to 11 Oregon Sunday night and we met in Rick Pierce's 12 office. 13 Q On the Sunday night? 14 A No, no. Monday. 15 Q You came up Sunday night and met on 16 Monday? 17 A Yes. I'm not sure what time the sheriffs 18 showed up, the detectives, whatever, the police. I 19 know we had a series of meetings that I had to 20 attend, both related to this and not related to 21 this incident that date, and sometime during the 22 course of that day, I met the detective. 23 Q In the meetings that you attended that 24 morning, was there discussions about reporting the 25 incident to -- referring it to the Washington 83 1 County Sheriff's Office for prosecution? 2 A There may have been, but I don't think I 3 participated in them. That wasn't my -- my 4 interests weren't there. 5 Q Your interests and duties were where, 6 then? 7 A In protecting Intel's information assets 8 from subsequent damage. That's really all I was 9 concerned with. 10 Q When you say "protecting from subsequent 11 damage," what damage had you discovered at that 12 point? 13 A We had discovered -- the only damage we 14 had discovered was the stolen password file from 15 the SSD domain that Randal was cracking and the 16 gate script running on Brillig. 17 Q The password file itself, isn't that in 18 the public domain readable by anybody? 19 A Absolutely not. 20 Q How about anybody on that system? 21 A Anybody at SSD, yes, but that doesn't 22 define the public domain. You used the -- for the 23 global system of public domain, that's not true. 24 Q How about anybody within Intel with 25 access to the system? 84 1 A Anybody with a valid account on the SSD 2 system has access to the file, yes. 3 Q And there is nothing about a password 4 file itself which, looking at it, compromises the 5 material or the information in the files behind 6 those passwords; is that correct? 7 A I would say yes. I would say even 8 looking at the password file filed by somebody not 9 associated with Intel wouldn't be a good idea, 10 because you get a good list of user names that's 11 associated with that system and you might be able, 12 through inference, to figure out what's going on 13 there. You could use that in a social engineering 14 sense to gather other information. 15 Q So the concern is somebody outside of 16 Intel might have seen those passwords? 17 A Well, we wouldn't want somebody outside 18 of Intel to see that information. 19 Q Right. And you have non-disclosure 20 agreements with your employees and contractors 21 about information obtained that they are required 22 to sign? 23 A I don't know. 24 Q Did you tell Detective Lilley that people 25 within Intel could access password files and read 85 1 passwords? 2 A If they have an account on that system. 3 Q And if somebody has an account on the 4 Brillig system, they could read the password file? 5 A On Brillig? 6 Q On Brillig. 7 A Yes. 8 Q Did you tell that to Detective Lilley? 9 A I don't recall. 10 Q Did you check to see whether Randal 11 Schwartz had an account on Brillig? 12 A I think he did. He did. Yeah, he did. 13 Q Did you tell that to Detective Lilley? 14 A I don't recall. I don't recall if I told 15 him or who told him. 16 Q Do you recall that he was told by 17 somebody? 18 A No, I don't. I'm sorry. 19 Q You don't recall one way or the other? 20 A No, I don't. It was a long time ago. 21 Q That's fine. 22 Now, when you spoke with Detective 23 Lilley, did you specifically tell him that Randal 24 Schwartz would transfer information -- that he 25 would have transferred information to his Apple 86 1 portable computer to avoid detection? 2 A That was a likely scenario. 3 Q What do you mean when you say "that was a 4 likely scenario"? 5 A Well, initially, I think it was Friday, 6 when we contacted CERT, there was also a 7 password-cracking program going on in O'Reilly -- 8 Randal had taken the password file from O'Reilly 9 and Associates and was cracking that as well, and 10 that looked like it involved interstate trafficking 11 and possibly something that Randal didn't know. 12 We contacted CERT, and we advised 13 CERT of that. And what we wanted CERT to do was 14 CERT to call O'Reilly and Associates to say this 15 activity was going on and to keep us out of it. 16 And CERT said, "You have to talk to the FBI." 17 We talked to the FBI. I think I 18 spoke with Jim Kalush, somebody in the FBI Computer 19 Crime Unit, and the advice from them was do not let 20 Randal out of the building with his laptop, because 21 if he has any confidential information, it would be 22 on the laptop. 23 You have to understand that in the 24 moment, we didn't know what Randal had done. We 25 knew two things he had done and, based on that, he 87 1 might have done other things. We didn't know what 2 was going on and we had to look around. 3 Q Did you tell that to Detective Lilley, 4 that you didn't really know what he had done, that 5 this -- that you knew that he had run the crack 6 program, you knew -- 7 A We knew exactly what he had done. What 8 we didn't know is what he hadn't done. And by the 9 laptop going in and out of Intel, it allows an easy 10 means of moving information in and out of Intel 11 every day because the laptop is not looked at. 12 Q You had -- by the time you met with 13 Detective Lilley on Monday, November 1st, you had a 14 complete picture of Randal Schwartz's files that 15 were preserved at least since October 28th? 16 A We had -- I would say we had a complete 17 picture, but the shear volume of Randal's files did 18 not allow us to look at that information with any 19 detail. There is a tremendous amount of 20 information in Randal's directory. Tremendous 21 amount. 22 Q And that was Intel-related information? 23 These were his files within Intel? 24 A Yes. These were his files at his work 25 station in Intel. 88 1 Q Now, did you see any indication or 2 anybody else that you were informed of, that 3 Randal, between October 28th and November 1st, had 4 logged into any of the accounts behind the 5 passwords? 6 A Between October 28th and November 1st? 7 Q That's right. 8 A No, I don't think so. I didn't. 9 Q Did you tell Detective Lilley of that 10 information? 11 A I don't know. 12 Q In discussing the scenarios about what 13 Randal might have done and might not have done, did 14 you tell him that you didn't find anything that 15 would indicate that he had logged into any of 16 the -- 17 A I'm sorry, I don't know. I don't recall. 18 Q Were there other scenarios that you 19 considered that Randal might have been secreting 20 information out of Intel? 21 A Based on what we had found, the cracking 22 of the SSD password file and the -- and that 23 cracking effort had produced the vice president of 24 Intel's password, combined with his user name, we 25 really didn't know what Randal was up to, and the 89 1 scenario was frightening based on the information 2 contained in Ed Masi's directory. 3 Q So that set off all kinds of alarms that 4 that password was the one that had -- 5 A There were others, but that's the one 6 that I remember. 7 Q Sounds like you then assumed the worst. 8 A I wouldn't say the worst, but we assumed 9 anything could be going on. We didn't know what 10 was going on. 11 Q Were you specifically asked what Randal 12 Schwartz would do if he wanted to transfer 13 information to avoid detection? 14 A No. 15 Q Did you volunteer that information to 16 Detective Lilley? 17 A I probably volunteered the information 18 that I had gotten from the FBI computer crime unit 19 to Detective Lilley. That's what I would guess. 20 Q By the way, you mentioned CERT. 21 A Yes. 22 Q What is that? 23 A That's the Computer Emergency Response 24 Team located at Carnegie Mellon University. 25 Q Now, would transferring information from 90 1 those files to a Power Book be the only step 2 required to avoid detection? 3 A No. 4 Q Would logging into the password file in 5 your own name be a typical way of avoiding 6 detection, using your own ID? 7 A No. 8 Q Would running the crack program using 9 your own identification be a typical way of 10 avoiding protection? 11 A No. We had a discussion about this. 12 Q Besides transferring information to a 13 Power Book, are there any other steps that you 14 would consider that could be taken to transfer 15 information that was in the file that you found at 16 Intel outside? 17 A Yeah. I'm sure you could use floppies. 18 You can take floppies out of Intel relatively 19 easily. You can take paper out, depending on the 20 color of the paper, relatively easily. You can 21 mail things out. There is any number of ways to 22 get information out of Intel. 23 Q Is Randal the only person who goes in and 24 out of Intel with a Power Book? 25 A There aren't a lot of Power Books. 91 1 Q How about laptop? 2 A Oh, no. Absolutely not. There is 3 hundreds of laptops. Thousands. I have one with 4 me. 5 Q Did you tell Detective Lilley that that 6 was common for people to carry laptops in and out 7 of Intel? 8 A I don't think we did. I don't recall 9 telling him that. 10 Q Did that subject come up? 11 A No. 12 Q Does it require prior authorization for 13 somebody to bring a laptop in and out of Intel? 14 A Uhm, I don't know. It requires -- 15 Actually, to get the laptop out, it must require 16 some prior authorization, because I know I have a 17 card with me that allows me to get my laptop out of 18 the building. Whether Randal had a card, I don't 19 know. I don't know how he got his laptop in and 20 out. 21 Q So the security policy on bringing 22 laptops in and out of Intel is not something you 23 are responsible for? 24 A No. 25 Q And just so I'm understanding your answer 92 1 clearly, your -- you think there is policy. I 2 mean, you think prior authorization to bring 3 laptops in and out is required? 4 A I believe in Randal's case, he would have 5 had to fill out a form and requested -- I'm hoping 6 he would have filled out a form requesting 7 permission to bring in the laptop, in and out. 8 Q You think that's the likely company 9 policy? 10 A Yeah, I would assume that. 11 Q Did anybody -- Before Detective Lilley 12 was contacted, did anybody check to see if Intel 13 had such an authorization? 14 A I don't know. 15 Q When you spoke with Detective Lilley, did 16 you have any specific information to indicate that 17 Randal Schwartz had transferred information from 18 those files that were clearly contained within the 19 Intel, in the Snoopy system there? 20 A The only specific information we had was 21 from Mark Morrissey, who told us Randal would come 22 in every day to plug in the laptop in the back of 23 the SPARC system, S-P-A-R-C, and unplug it when he 24 left, which provided an easy vehicle, if that's 25 what he was doing. 93 1 Q Outside of that, was there any other 2 specific information that Randal Schwartz had 3 copied any of the records that were associated with 4 those password files? 5 A I don't understand the question. 6 Q Outside of what you described about the 7 laptop being hooked up, did you have any other 8 specific information that Randal Schwartz had 9 transferred any records of Intel to that Apple 10 Power Book? 11 A No. 12 Q To look at any of the information or to 13 copy -- or to copy any of the information in those 14 files behind any of the passwords that were 15 cracked, somebody would have to log into that 16 password, is that correct, using that password? 17 A Yeah. I'd say yes. 18 Q Did -- In reviewing the files frozen from 19 Mr. Schwartz prior to November 1st, in reviewing 20 Mr. Schwartz's files -- rephrase the question. 21 Before you met with Detective 22 Lilley, did you review any of the system logs which 23 would show the use of any of those passwords that 24 were cracked? 25 A No. 94 1 Q Did anybody else check the system logs to 2 see if anybody had logged in on those passwords? 3 A I'm sure they did. 4 Q You were not personally aware of that? 5 A I can't remember. I would say no. It's 6 hard to remember. It's a long time ago. These are 7 the passwords on SSD? 8 Q Yes, the ones you were concerned about 9 being the subject of the crack program. 10 A That night when Detective Lilley and I 11 were talking to Randal, I think he admitted to 12 using one of them. 13 Q I was asking you about at the time that 14 you spoke to Detective Lilley in preparation of the 15 search warrant. 16 A Right. 17 Q Before you spoke to Randal Schwartz? 18 A No. 19 THE COURT: Just so that I 20 understand, because you're dealing with a blank 21 slate here as far as computers, to get access to 22 information behind the password, a person has to 23 log onto the computer; in other words, give some 24 identifier identifying who he is? 25 THE WITNESS: Usually. 95 1 THE COURT: Is that what "logging 2 on" means? 3 THE WITNESS: That's what it means. 4 There are other ways to do it, but in a very 5 general sense, yes, you do have to log on. 6 THE COURT: And identify yourself 7 and then use the proper passwords to get access? 8 THE WITNESS: Yes. There is really, 9 a pair of things. You type a user name, which 10 would be your name, or J. Bonebrake for Judge 11 Bonebrake. 12 THE COURT: Does the computer check 13 to see if Judge Bonebrake is the proper person 14 using that password? 15 THE WITNESS: The computer has no 16 inherent knowledge of that. It's assumed if you 17 know your password. Your password is really the 18 key to that account. The password is the key to 19 the door. 20 THE COURT: What would prevent a 21 person from using a false name when you log on? 22 THE WITNESS: Well, the user name is 23 matched up with the password. There is a file of 24 these things and the user name, your name would 25 have associated with it a password and the two go 96 1 together. 2 THE COURT: But if I want to get 3 access to information in a computer where you had 4 to have a password, and if I cracked the code and I 5 got the password and I know who the password 6 belonged to, instead of using J. Bonebrake, I used 7 A. Smith and that A. Smith password, I can get the 8 information? 9 THE WITNESS: Yes. 10 THE COURT: But then the log 11 wouldn't disclose that J. Bonebrake got it, it 12 would show that A. Smith got it? 13 THE WITNESS: Right. Only thing we 14 would know is, we would see a log-in from A. Smith. 15 THE COURT: When, in fact, it came 16 from J. Bonebrake? 17 THE WITNESS: Yes. 18 THE COURT: So the log wouldn't 19 necessarily disclose, if you checked it after the 20 fact, who actually had gained access. 21 THE WITNESS: That's right. The log 22 has no information about that at all. 23 THE COURT: Like it was a legitimate 24 access? 25 THE WITNESS: Yes. That's why the 97 1 passwords are so critical on these systems. 2 THE COURT: I understand that. 3 That's an area that Mr. Sussman was getting into. 4 If you, in fact, did check the log for the time 5 period between October 28th and November 1st, it 6 might look like the person who was actually 7 authorized to get into the information had been the 8 one that could have done it, even though it might 9 have been somebody else. 10 THE WITNESS: Yes. 11 THE COURT: You have to go back to 12 that person and say, "Did you do it?" 13 THE WITNESS: Exactly right. 14 THE COURT: Or check their computer 15 terminal or -- 16 THE WITNESS: That's right. 17 THE COURT: I'm learning something, 18 but I'll forget it by the time I get another one of 19 these. 20 BY MR. SUSSMAN: 21 Q Now, at the time you spoke to Detective 22 Lilley on that Monday morning, November 1st, did 23 you know that John Kent had checked Randal 24 Schwartz's files to determine whether he had logged 25 onto Brillig since October 28th, 1993? 98 1 A Probably. I probably knew that. I 2 probably knew that. 3 Q And you knew that he had not? 4 A Sure. 5 Q And Brillig was the machine which 6 provided the access to the crack program in SSD? 7 A No. I think you're getting two things 8 put together that don't necessarily go together. 9 There was a crack process, the SSD 10 password file was being cracked on Snoopy, I think, 11 he or Candensky, one of those machines in Mark 12 Morrissey's group. 13 THE COURT: You have a machine named 14 Snoopy? 15 THE WITNESS: Oh, yes. Why not? 16 But the Gate Program was running on a machine named 17 Brillig. Randal had, apparently, cracked Brillig 18 earlier and used an account on Brillig to ask -- 19 Randal no longer had an account on SSD which would 20 enable him to get a password file. He cracked the 21 password on Brillig, which he used that account to 22 SSD and, I believe, take the password file. 23 BY MR. SUSSMAN: 24 Q So the password file that was cracked -- 25 A Well, it was cracking. 99 1 Q -- was cracked, was then accessible to 2 Randal Schwartz through Brillig? 3 A By using an account -- I believe by using 4 an account that he had cracked on Brillig, because 5 he had no access to the SSD password file directly. 6 Q So as of between October 28th and 7 November 1st, there was no record that Randal 8 Schwartz had logged back onto Brillig? 9 A I believe so, yes. 10 Q You agree with that? That's correct? 11 A I believe that's correct. Yeah, sure. 12 Say yes. 13 Q Did you know that John Kent checked 14 Randal Schwartz's files to see whether he had any 15 stolen files from SSD? 16 A Which files are you referring to? Which 17 system? There is a number of systems involved here 18 and you have to be more specific, because there 19 clearly were stolen files on Snoopy. There was a 20 SSD password file which Randal was not authorized 21 to have. On Brillig, I believe that statement is 22 correct, that there were no stolen files on 23 Brillig. 24 Q And there were no files, none of the 25 files from the SSD password that were the 100 1 substantive files from behind those passwords -- 2 A Oh, right. Sure. I don't think those 3 were. That's my belief. 4 Q Now, did you tell -- when you met with 5 Detective Lilley, did you tell him that there were 6 no illegal files or stolen files found on Brillig? 7 A I don't recall telling him that, no. 8 Q Now, to make sure I understand, are you 9 saying you do not remember one way or the other? 10 A That's what I'm saying. 11 Q Were you aware of any prior occasions 12 during Randal Schwartz's employment, his contract 13 employment at Intel, that he ran crack programs? 14 A No. 15 Q Is it unusual for a systems administrator 16 to run crack? 17 A Oh, no. It's encouraged. It's one of 18 the tools that we distribute. 19 Q Did you explain that to Detective Lilley, 20 that crack was a tool commonly used by systems 21 administrators? 22 A I'm sorry, I don't recall again. 23 THE COURT: Why do you do that, to 24 determine the security level? 25 THE WITNESS: Yeah. We like to keep 101 1 good passwords. A crackable password is considered 2 a bad password, so we make an attempt to -- 3 THE COURT: So you encourage them to 4 run crack programs, but if they are successful, 5 then you expect them to report that to you? 6 THE WITNESS: I'm not sure they 7 report it back to us. Their job would be, if you 8 had an account, to run the crack program on your 9 password file and report it to you as a customer on 10 that machine. 11 THE COURT: And eliminate -- 12 THE WITNESS: And eliminate a bad 13 password. 14 THE COURT: To maintain a level of 15 security, then? 16 THE WITNESS: Yeah. It's a tool. 17 BY MR. SUSSMAN: 18 Q When Randal Schwartz was at IWARP, you 19 were in your present position? 20 A Yes. 21 Q And so was it ever reported to you that 22 he was running crack while he was at IWARP? 23 A No. Not to me. Again, it's not 24 structured that I know everyone at Intel that is 25 running crack all the time. You have to understand 102 @ 1 that the systems administrators are responsible for 2 systems within their domain, the systems that they 3 directly administer and they are expected to do 4 their job. 5 MR. SUSSMAN: The rest of my 6 questions are things that we covered in your last 7 experience. Thank you. 8 THE COURT: Mr. Tintera. 9 10 CROSS-EXAMINATION 11 BY MR. TINTERA: 12 Q When you referred to the systems 13 administered domain, what are you talking about? 14 A The systems at Intel are divided into 15 domains. The systems administrator at Intel isn't 16 responsible for systems Intel-wide, if you will, or 17 even Oregon campus-wide. Systems administrator at 18 Intel, I guess an example would be Mark Morrissey, 19 he was responsible for maybe 10 or 20 systems. 20 Some finite number of systems that you are directly 21 responsible for administering and managing and not 22 outside, you're not really supposed to go outside 23 of that domain. 24 Q What campus did Mark Morrissey work at? 25 A Hawthorn Farms. 103 1 Q In the timeframe we're talking about, end 2 of October, beginning of November, where did 3 Mr. Schwartz work? 4 A Hawthorn Farms. 5 Q Would the systems administrator at 6 Hawthorn Farms be responsible for computers at 7 Cornell Oaks Campus? 8 A Not usually, no. 9 Q Where is the SSD domain of Intel? 10 A Cornell Oaks. 11 Q And what type of systems administrative 12 duties or powers did Randal Schwartz have at the 13 Cornell Oaks SSD Campus? 14 A In the timeframe we're talking about? 15 Q Yes. 16 A None that I'm aware of. 17 Q Let's talk a little bit about transfer of 18 files or of information from a computer to -- 19 whether it's a laptop or floppy disk or any 20 transfer. 21 What type of -- if I go into 22 someplace where I am not permitted and I leave my 23 hand print on a mirror, somebody can come in and 24 take my fingerprints and determine it was me there. 25 What type of fingerprint does a computer have when 104 1 someone goes in and copies a file? What does it 2 leave? 3 A Nothing. At least in the systems, the 4 unique systems we're dealing with here, very 5 little, if anything. 6 Q So what information did you have whether 7 Mr. Schwartz had copied any information onto his 8 laptop that was existing on the Snoopy system? 9 A We had none. The only way to determine 10 that is to look at the laptop. 11 Q So there is no fingerprint left in Snoopy 12 saying somebody copied this one, two or three 13 times? 14 A No. There is nothing in Snoopy that 15 would point to that direction at all. 16 THE COURT: You can determine if a 17 person has accessed it, but you can't tell if they 18 copied it? 19 THE WITNESS: Right. We can't tell 20 even what files they've gone after. There isn't 21 a -- 22 THE COURT: Once they logged on and 23 accessed it, you don't know what they may have 24 looked at or copied? 25 THE WITNESS: Yeah. 105 1 THE COURT: Earlier, you said 2 "nothing," then you said "very little." 3 THE WITNESS: It depends on the 4 system. This is UNIX and there is very little 5 logging. There is a log generated when you access 6 the computer system when you use your name and 7 password. File logging is almost nonexistent for 8 most of Intel. 9 BY MR. TINTERA: 10 Q Could you explain to me what the Gate 11 script that you referenced on the Brillig computer 12 is? 13 A It was generally as -- I would look at it 14 as a script to modify the operation of that 15 computer system. It allowed access to Intel's 16 resources from the Internet, I believe is what it 17 did, what it looked like it did. 18 Q Was there any log-in procedure that you 19 would need to go through that gate? 20 A You would have to know where it was 21 running to get into it. 22 Q Assume you knew where it was running. 23 A You just point to it and go. 24 Q So was there any log-in that you would 25 leave that Intel could see that somebody entered 106 1 that gate through Brillig? 2 A The only log Randal had set up in looked 3 like debugging, he had run it in debugging, and it 4 was doing some logging. 5 Q Would you know if you went in through the 6 gate or not? 7 A Yes. I think so. I'm trying to remember 8 the Gate script. Been a while since I looked at 9 it. He knows more about it than I do. 10 Q Counsel asked you if Mr. Schwartz had 11 logged on to the Snoopy system on or after October 12 28th, which would -- 1993, which would have been a 13 Friday. Do you know how long the crack program had 14 been running on the Snoopy system? 15 A No, I don't. I know it was running for 16 quite some time. 17 Q So was it running before October 28th? 18 A Oh, yes. 19 Q Do you know if information had been taken 20 by Mr. Schwartz prior to October 28th? 21 A No, we don't know. 22 Q But you do know that when he came into 23 work, he plugged in his laptop at his computer 24 station at Intel; is that right? 25 A Yes. I never saw that happen, but I was 107 1 told that's what he did. 2 MR. TINTERA: Thank you. I don't 3 have any more questions. 4 5 REDIRECT EXAMINATION 6 BY MR. SUSSMAN: 7 Q The Gate program that you were talking 8 about, does that change the fundamental operation 9 of the system? 10 MR. TINTERA: Objection. What does 11 that have to do with the motion to controvert? 12 THE COURT: Well, I'm not sure, but 13 there is a lot I'm not sure of, so I'll let him go 14 ahead. Go ahead. 15 THE WITNESS: I'm going to pass on 16 that one. 17 THE COURT: You don't know; is that 18 what you're saying? 19 THE WITNESS: I don't know. I'm not 20 sure what he means by "fundamental operation of the 21 system." 22 BY MR. SUSSMAN: 23 Q Well, you said that in describing -- 24 A It changes the operation of the system. 25 Whether that's fundamental or not is a semantic 108 1 question that I have no idea of. You got me. 2 Q Well, does that change the system any 3 more than, say, a keystroke listing the files in a 4 system? 5 A Yes. In my opinion, it does. 6 Q How? 7 A I would imagine you could talk to four or 8 five system programmers and get four or five 9 different opinions on that, but in my opinion, yes. 10 Q And would you explain how, in your 11 opinion, does it then make that change? 12 A A simple listing of files. To use your 13 example, a simple listing of files is a simple 14 listing of files. That does not allow someone to 15 pass through a computer system into another 16 computer system, which is what the Gate system 17 does. 18 Q Aren't you describing a different way of 19 using the system, the basic system? 20 A It's a different way of using it, yes. 21 Q Were you aware whether Mr. Schwartz -- 22 the logs of Snoopy had been preserved, the backup 23 tapes of the log that were on Snoopy had been 24 preserved going back to the time that the crack 25 program started running around October -- 109 1 A I'm not aware of that. I don't know. I 2 don't have responsibility for where those -- for 3 backing systems up, and certainly not at Hawthorn 4 Farms. 5 Q So Mr. Morrissey may have preserved those 6 tapes as well? 7 A It's possible. 8 Q You don't know? 9 A I don't know. 10 MR. SUSSMAN: Thank you. I have 11 nothing further. 12 13 RECROSS-EXAMINATION 14 BY MR. TINTERA: 15 Q Let's go back to the gate. I think I 16 assumed that the Judge knows more about Intel 17 security than he may know. 18 Now, you said that the Gate program 19 allowed someone to come in from the Internet, which 20 is what? A computer system where people 21 communicate; is that fair? 22 A Yes, I would say that's a fair statement. 23 Q Does the Internet exist outside of the 24 Intel corporate structure? 25 A Oh, yes. 110 1 Q And what type of safeguards does Intel 2 take to keep people that are using the Internet as 3 an information source from accessing your 4 computers? 5 A We have what are called firewalls at the 6 access points where we have Internet drops. 7 THE COURT: What was the term? 8 THE WITNESS: Firewall. 9 THE COURT: That's different than a 10 gate? 11 THE WITNESS: Oh, yes, very 12 different, like I guess a firewall in a building, I 13 think. 14 THE COURT: You indicated something 15 that you believe to be very secure and doesn't 16 allow access through. I assume that's what you 17 mean. 18 THE WITNESS: Yeah, very secure. 19 THE COURT: Sounds more secure than 20 a gate. 21 THE WITNESS: It is. Usually. 22 BY MR. TINTERA: 23 Q Are there procedures where some Intel 24 employees are permitted to access through the 25 firewall into actual Intel computers? 111 1 A Coming in through the firewall? Right 2 now, that's turned off. 3 Q What about back in 1993? 4 A In 1993, there were -- I'm not positive. 5 I believe there were people accessing Intel through 6 the firewalls. 7 Q And is that through the computer called 8 Ruby? 9 A Oh, no. Ruby was at O'Reilly and 10 Associates. We have field engineers that are in 11 the field with SSD that -- 12 Q What was the name of the computer that 13 allowed the access? You're right, it wasn't Ruby. 14 A C-h-a-r-o-n. That's one of the 15 firewalls. 16 Q Are there any type of safeguards that you 17 use in regard to that type of access or that you 18 were using back in 1993? 19 A I'm sure there were. I would say yes, 20 there were safeguards in place. 21 Q Was one of those where the -- if you were 22 outside on the system and you tried to access your 23 firewall and go through this computer, it actually 24 calls you back to confirm that you're calling from 25 the computer you say you are. Are you familiar 112 1 with that? 2 A I don't recall what was in place at that 3 time. I know it's changed a lot since then. And 4 what we try to do is really -- is limit access from 5 the Internet to Intel machines. That's the goal. 6 The goal is to either do it securely, in which we 7 haven't found a way to do it securely, or limit it, 8 severely limit it. 9 Q Had there been, to your knowledge, back 10 when this information you were receiving in the end 11 of October, November, had there been any problems 12 that you were aware of with Mr. Schwartz in regard 13 to this Gate program prior to this sequence? 14 A There was one instance, March, it was in 15 that year, spring of that year, March or April, 16 something like that, when I think I got -- I 17 believe I got a call from Dirk Brandewie about the 18 Gate program running on one of his systems. 19 Q Do you know if that referenced Randal 20 Schwartz at all? 21 A Oh, yeah, it was Randal's program. 22 Q It was Randal's program? 23 A Yes. 24 Q What was your response then? 25 A "Get rid of the program." 113 1 Q Why? 2 A Because I think it exposed Intel -- The 3 exposure to Intel at that time, the way he had the 4 code running, the exposure to Intel was significant 5 enough to get rid of it. 6 Q Exposure? What are you talking about? 7 A That program the way it was running at 8 that moment, the first time we found it, it was 9 pretty wide open to anybody on the Internet. If 10 they had found it, they could have accessed Intel 11 computer systems. 12 Q If I was on the Internet with my computer 13 and I found that gate, I could just go through? 14 A Yeah. Didn't have any safeguards on it. 15 Q What was -- In 1993 in October, were the 16 safeguards such that in your opinion Intel was 17 secure from Internet access on his Gate program? 18 A I don't know without looking, without 19 seeing the code again, and I haven't looked at it 20 in quite a while. 21 MR. TINTERA: Thank you. That's all 22 I have. 23 @ 24 25 114 1 REDIRECT EXAMINATION 2 BY MR. SUSSMAN: 3 Q About this incident that you just 4 described, the Gate program that Randal had written 5 at that time -- 6 A Which time? 7 Q In the spring, the first one, the one 8 that you had received the call back from Dirk 9 Brandewie, did it have a gate and password as its 10 means of security? 11 A I don't think the initial program did. 12 Randal was asked to put hooks into the code to 13 block it, which he did. And then sometime later, 14 the hooks were found out of the code again and he 15 was asked to get rid of it. I wasn't aware of when 16 it happened again. That's what Dirk told me. 17 Q And was your understanding that he was 18 doing this to get access to his e-mail address at a 19 site, at a computer outside of Intel? 20 A I didn't know why he was doing it. I was 21 never told, not until the evening when Detective 22 Lilley and I interviewed Randal. 23 Q And that's when Randal told you that he 24 was doing that to get access to his e-mail address 25 which was at Ruby ORA.com? 115 1 A Well, I think he was getting access to 2 Intel e-mail. 3 Q That's right, through the gate? 4 A Yeah. 5 Q And in the spring of 1993, when this 6 security incident, quote/unquote, occurred, when 7 you were informed about this Gate program running, 8 Mr. Schwartz wasn't terminated at that point? 9 A No. 10 Q He was simply asked to rewrite or take 11 off that particular Gate program? 12 A Yes, to change the code. Not by me. I 13 don't think I was involved in that. I was informed 14 of it. 15 MR. SUSSMAN: I have nothing 16 further. 17 MR. TINTERA: No further questions. 18 MR. SUSSMAN: We have no problem 19 with the witness being excused so he can make his 20 flight. 21 THE COURT: Thank you for being 22 here. 23 (Short recess.) 24 25 THE COURT: Call your next witness. 116 1 MR. SUSSMAN: Your Honor, we'd like 2 to call John Kent. 3 4 JOHN KENT 5 called as a witness on behalf of the Defendant, 6 having been first duly sworn under oath, was 7 examined and testified as follows: 8 9 THE CLERK: State your full name and 10 spell it for the record, please. 11 THE WITNESS: My name is John Kent. 12 K-e-n-t. J-o-h-n. 13 14 DIRECT EXAMINATION 15 BY MR. SUSSMAN: 16 Q Mr. Kent, how are you employed? 17 A I'm a full-time employee at Intel. 18 Q In what capacity? 19 A Work as a systems network administrator 20 for the Intel IT group. 21 Q Where is that located? 22 A Located here in Oregon. I work at all 23 the campuses. 24 Q Were you employed in that position in 25 October and November of 1993? 117 1 A Yes, I was. I was specifically assigned 2 to the Intel Supercomputer Division at that time. 3 Q That would be -- Would that be the SSD? 4 A Yeah, Intel SSD. 5 Q Do you recall in November, the end of 6 October, November of 1993, doing some investigation 7 of files belonging to Randal Schwartz that were on 8 a Brillig machine computer? 9 A Yes, I do. 10 Q How did you come to get involved in that? 11 A I was contacted by another systems 12 administrator who, I believe, was located in 13 Hawthorn Farms or Jones Farm. He contacted me that 14 he saw via the account Merlin, the user Merlin 15 coming in through one of our systems and going over 16 to the systems at his location, so he was logging 17 in via our site. 18 Q What? 19 A He was logging in via a machine that was 20 located at our site. 21 Q Sorry, I didn't hear that. Was that 22 administrator Mark Morrissey? 23 A Yes. 24 MR. TINTERA: I object to any 25 inquiry in regard to this witness. There is no 118 1 reference of any direct contact of statements by 2 John Kent to Detective Lilley in the affidavit. 3 Detective Lilley does not say "John Kent." And 4 they cannot attack -- 5 THE COURT: I understand. Let me 6 hear from Mr. Sussman. 7 MR. SUSSMAN: You were anticipating 8 my next series of questions. 9 BY MR. SUSSMAN: 10 Q As a result of that investigation into 11 the files, did you participate in any of the -- in 12 a meeting with other Intel officials and Detective 13 Lilley on Monday morning, November 1st? 14 A I don't recall whether I was at that 15 meeting. I do know that I had one or two, both 16 telephone and personal, meetings with Intel people. 17 I don't recall if I was at a meeting, though, with 18 this person. 19 THE COURT: Did you have telephone 20 contact with any police officers? 21 THE WITNESS: No. 22 THE COURT: Did you have personal 23 contact with them, in particular Detective Lilley, 24 that you could recall? 25 THE WITNESS: I do recall having one 119 1 or two meetings, but I believe that was the grand 2 jury. We had a grand jury thing where I had to 3 come in. 4 THE COURT: The end of October, 5 first of November, just prior to a search warrant 6 being executed, do you recall anything about that? 7 THE WITNESS: No, I don't recall 8 being in the same room with a detective. I can't 9 recall that, no. 10 THE COURT: And not talking with 11 them personally? 12 THE WITNESS: I recall the people 13 from Intel, but I don't recall -- I can't recall at 14 this time. 15 THE COURT: Unless you have 16 something that refreshes his memory, Mr. Sussman, 17 or challenge his recollection with something that 18 affects his credibility, doesn't appear that he had 19 any contact with the police. 20 BY MR. SUSSMAN: 21 Q Did you have some conversations with Mark 22 Morrissey regarding the results of your 23 investigation -- 24 A Yes, I did. 25 Q -- involving Mr. Schwartz's files? And 120 1 were you present when Mr. Morrissey related that 2 information to Detective Lilley of the Washington 3 County Sheriff's Office? 4 A No, I don't believe I was there then. 5 Q And did you have -- did you personally 6 have any contact with Detective Lilley prior to 7 the -- well, in preparation of the affidavit for a 8 search warrant? 9 A No. I talked with Intel employees. 10 Q You prepared a memorandum, e-mail 11 memorandum that you sent to a person named David 12 Small regarding your findings about your 13 investigation of Mr. Schwartz's files? 14 A That's correct. I copied a couple people 15 on that. 16 Q Did you share that with Mark Morrissey? 17 A Yeah, I did share some of the information 18 with Mark Morrissey. Part of it may have been done 19 via telephone because he and I were in touch via 20 voice line while we were investigating both ends of 21 the connection, so -- 22 Q So the results of your -- the findings of 23 your investigation were communicated to Mark 24 Morrissey? 25 A Yeah, pretty much so. Other than that 121 1 written statement that you have there. 2 Q And the written statement you're 3 referring to is one that I showed you before you 4 were called to testify? 5 A Exactly. 6 Q Which was communication dated Thursday, 7 October 28, 1993, and Friday, October 29th, 1993? 8 A That's correct. 9 Q Which consisted of two pages of text plus 10 printouts of log runs? 11 A Yes. 12 Q To make sure we're clear, the information 13 in that two-page report was communicated to Mark 14 Morrissey? 15 MR. TINTERA: Judge, I'm objecting. 16 THE COURT: How is that relevant, 17 Mr. Sussman? 18 MR. SUSSMAN: Your Honor, it will 19 become relevant as to whether or not 20 Mr. Morrissey -- we have to ask him whether he 21 relayed the information to Detective Lilley or 22 certain of this information was presented to 23 Detective Lilley as to the absence of stolen or 24 legal files in part of the examination. 25 THE COURT: I can understand how you 122 1 may inquire of Mr. Morrissey about Detective 2 Lilley, but as to what this person told Detective 3 Lilley, I don't see how it's relevant. 4 MR. SUSSMAN: I was trying to 5 determine while he was here if he fully related to 6 Mr. Morrissey. 7 THE COURT: How does that help me 8 with any issue that I need to decide in this case? 9 MR. SUSSMAN: When we question 10 Mr. Morrissey about what he communicated to 11 Detective Lilley, it will provide further 12 background as far as evaluating what information 13 was presented to Detective Lilley. 14 THE COURT: Do you have any other 15 questions? 16 MR. SUSSMAN: No, nothing else for 17 this witness. 18 THE COURT: Mr. Tintera. 19 MR. TINTERA: I have no questions. 20 THE COURT: Thank you. You may step 21 down. 22 MR. TINTERA: May this witness go 23 about his business? 24 MR. SUSSMAN: I have no objection. 25 THE COURT: You're free to go for 123 1 the day. Thank you. 2 Call your next witness. 3 MR. SUSSMAN: Detective Lilley. 4 5 JAMES LILLEY 6 called as a witness on behalf of the Defendant, 7 having been first duly sworn under oath, was 8 examined and testified as follows: 9 10 THE CLERK: State your full name and 11 spell it for the record, please. 12 THE WITNESS: James G.W. Lilley. 13 L-i-l-l-e-y. 14 15 DIRECT EXAMINATION 16 BY MR. SUSSMAN: 17 Q How are you employed? 18 A Detective with the Washington County 19 Sheriff's Office. 20 Q And how long have you been employed as a 21 detective? 22 A 17 years this month. 23 Q As a detective? 24 A No. As a detective, two years. 25 Q And were you a detective in October and 124 1 November of 1993? 2 A Yes, I was. 3 Q And in that capacity, were you contacted 4 by some people at the Intel Corporation regarding 5 activities of Randal Schwartz? 6 A Yes, I was. 7 Q What was your first contact with the 8 folks at Intel? 9 A November 1st, the time being 11:40 a.m. 10 Q Is that when you actually met with the 11 people at Intel? 12 A Seems to me that I actually met with the 13 people at Intel a little later than that. I think 14 the 11:40 is when I was first -- I first got 15 involved in the investigation and was approached 16 about conducting it. 17 Q And what was the nature of that first 18 contact with the people at Intel? 19 A In broad strokes or specifically? 20 Q Specifically. 21 A They informed me that through an 22 investigation of their own -- 23 Q Who is "they"? 24 A That would be primarily Richard Cower, 25 Clyde Stites. Richard Pierce was involved, John 125 1 Kent was involved and Mark Morrissey was involved. 2 The main spokesman, for want of a better word, 3 would probably be Mr. Cower. 4 Q And these were the people who were 5 present at the meeting you had with the Intel 6 personnel? 7 A As I recall. I'm not sure how involved 8 Mr. Stites was, though as memory serves me, I 9 believe all those people were present when we made 10 contact with them. 11 Q And at that meeting, you were told that 12 Mr. Schwartz had, in the words of -- well, was 13 illegally bypassing access gates and utilizing a 14 crack program? 15 A That was the substance of what they were 16 saying, was yes, he had accessed into areas of 17 different computer systems that they believed -- 18 they were telling me -- he had no right to do. 19 Q Now, in the affidavit, you state that 20 Mark Morrissey had advised you that he had found 21 evidence of violations of ORS 164.377 (computer 22 crime) at Intel Corporation. Were those his words? 23 A I don't recall. I want to say no, they 24 weren't. I believe that that was something that 25 was put in after. When I was given the facts of 126 @ 1 the case as it was being told to me and I looked it 2 up in the ORS, that would have been the ORS that I 3 was basing the investigation on. I don't recall 4 whether Mr. Morrissey quoted that ORS section or 5 not. I have no recollection whether he did or not. 6 Q Well, what specific facts were you told 7 that was the basis of that statement? 8 MR. TINTERA: Judge, I object. The 9 affidavit stands on its own right now. There has 10 been no substantial basis produced for this inquiry 11 at all, for going in and line-by-line over the 12 affidavit with this witness who wrote the 13 affidavit. 14 The affidavit is a sworn statement 15 that's before the Court. There is no procedure at 16 all that the defendant has gotten to a level where 17 he can bring in the affiant and say, "How did you 18 know all this?" 19 THE COURT: Well, I want to ask 20 Mr. Sussman, in either of the affidavits that have 21 been filed, or any of them, is there any -- is this 22 a particular area that you're getting into now an 23 area that you have alleged that Detective Lilley 24 either did not provide to the magistrate 25 information that he had that you think he should 127 1 have or it's in any way inaccurate or untruthful or 2 incomplete, and if it is, what particular area? 3 MR. SUSSMAN: Well, it's our 4 position that certain of the information that was 5 provided, for whatever reason, was being 6 inaccurate. 7 In this particular case, what we 8 have here is a representation of a statement in the 9 affidavit which is as to what Mr. Morrissey said, 10 which was, as we're saying now, not exactly what 11 Mr. Morrissey said, and -- 12 THE COURT: Did you -- Is that in 13 your affidavit someplace? You have to set it up in 14 your affidavit, the statute requires that, and once 15 you've done that, then if a substantial basis 16 arises, the Court permits you to inquire of 17 witnesses into that. Then if you convince me that 18 there was some inaccuracies or untruthfulness or 19 the good faith of the affiant has been successfully 20 challenged, then we either add into the affidavit 21 or excise from it the material and then reassess 22 it. 23 MR. SUSSMAN: Your Honor, as I 24 recall, as I'm looking back through my materials 25 now, that was referred to, I believe, not in the 128 1 affidavit but in a footnote referencing -- one of 2 my pleadings referencing that conclusion and 3 referring to the motion to controvert. It would 4 appear, as I skim through the affidavits, that I 5 didn't specifically address that. 6 THE COURT: I think Mr. Tintera is 7 correct in that the law does require specific 8 assertion in the affidavit. It's a pleading 9 requirement, so to speak, for a motion to 10 controvert and if it's not there, we don't get into 11 it. 12 MR. SUSSMAN: That's correct. I was 13 mixing it up where I had made the reference. 14 THE COURT: Thank you. 15 BY MR. SUSSMAN: 16 Q In preparing the search warrant 17 affidavit, did you base that on the conversations 18 you had with the people at this meeting? 19 A That's correct. 20 Q And did you do any independent 21 investigation into Mr. Schwartz's background or 22 activities at Intel beyond what was reported to you 23 at that meeting? 24 A No. 25 Q Did Mr. Morrissey tell you what 129 1 Mr. Schwartz's duties were at Intel during that 2 meeting? 3 A Again, I have to ask specifically or in 4 general terms? 5 Q Specifically, did he tell you what his 6 job, what his position was at Intel? 7 A He told me what his position was at 8 Intel. 9 Q What was that? 10 A I have to get the actual title. I have 11 to look through to find out what that was, either 12 through my report or through the affidavit. 13 Q Go ahead. 14 A If you happen to know where it is and can 15 direct me to it. 16 Q I don't recall seeing it, that's why I'm 17 asking if you were informed of that. 18 A Can I take a moment to look through this? 19 Q Please. 20 A Beyond the fact that Mr. Schwartz worked 21 for Intel, I don't recall any further specific 22 descriptions as to what his job was. As is 23 obviously reflected in the affidavit, what I was 24 informed of were certain actions that Mr. Schwartz 25 engaged in that were not authorized under the terms 130 1 of his employment with Intel. 2 Q Did you ask what his employment terms 3 were with Intel? 4 A I don't recall. I'm trying desperately 5 to remember exactly, but to be honest with you, I 6 don't recall, and I'll qualify that by saying in 7 part, I probably would not have understood what 8 they were telling me, had they told me, had I asked 9 the question and had they told me. 10 In preparing this affidavit, I was 11 trying to assimilate -- absorb and assimilate an 12 awful lot of information that was not information 13 that I'm used to dealing with. And so my -- the 14 focus of my questions and the focus of my attention 15 as I'm trying to understand in broad strokes what 16 was the problem and then applying that, applying my 17 investigation to that. 18 Q So as I understand it, would it be fair 19 to say that when you went into this investigation 20 there with the people at Intel, your understanding 21 of computers, computer systems and operations of 22 sophisticated systems like at Intel was very 23 limited? 24 A Very limited, yes. 25 Q And you had to rely on information 131 1 provided to you by the Intel personnel? 2 A That's correct. 3 Q And your ability to process that 4 information would be -- based upon your prior 5 experience was limited? 6 A Based on my prior experience would be 7 limited, but not necessarily -- the information 8 that I was getting from them, I had to take -- I 9 did take great pains to make sure that I was 10 understanding what I was being told, if you can 11 appreciate the distinction there. 12 Q Certainly. This was a new area to you 13 dealing with -- would that be fair to say? 14 A Certainly, yes. 15 Q And dealing with descriptions of systems 16 and activities that you were unfamiliar with? 17 A That's correct. 18 Q Would it be fair to say at times you had 19 trouble following what you were being told? 20 A Certainly. 21 Q We have all been having that problem 22 today. 23 But unlike, say, a drug case where 24 presumably you've had a great deal of experience, 25 you didn't have the wealth of training and 132 1 experience in the area of computers and computer 2 crimes to ask critical questions of the Intel staff 3 the way you would in, say, a drug case? 4 A Correct. 5 Q Did anybody at that meeting tell you that 6 Mr. Schwartz was employed at Intel as an 7 independent contractor? 8 A Yes. 9 Q And did they tell you that he had duties 10 of -- called a systems administrator? 11 A Possibly. I don't specifically recall. 12 Q Did anybody tell you what the duties of a 13 systems administrator include? 14 A Again, if they did, I don't recall. 15 Q Did you make notes of those discussions 16 before you prepared this affidavit? 17 A I prepared the affidavit as I was being 18 provided the information. 19 Q So had you been told what the duties of a 20 systems administrator were, you would have put it 21 in the affidavit? 22 A If I felt it had bearing on the 23 information that I was putting into the affidavit 24 as it applied to the crime that I was alleging. 25 Q Did you ask anybody what the duties of a 133 1 systems administrator was? 2 A My recollection of the investigation, my 3 recollection of the preparation of the affidavit 4 was to establish what, if any, crime had been 5 committed, what the elements of that crime would be 6 and how Mr. Schwartz's activities applied to that. 7 In the instance -- the way the 8 affidavit was prepared and the way that I conducted 9 that investigation was from the point of view of 10 what was Mr. Schwartz not permitted to do as 11 opposed to everything and anything that he may have 12 been permitted to do. 13 Q So you prepared this affidavit then from 14 the point of view that Mr. Schwartz had been 15 reported to have committed a crime and you were 16 preparing the affidavit to present information to 17 show that he had committed a crime; is that 18 correct? 19 A Correct. 20 Q And in order to justify the issuance of a 21 search warrant? 22 A Correct. 23 Q So when you were there, it was not purely 24 an investigative meeting to determine -- 25 A Initially it was to determine whether a 134 1 crime had been committed, and if so, what the crime 2 was, then establishing what the elements of that 3 crime were and how the facts of the case that I was 4 being told about met those elements. 5 Q And in determining that, you had to rely 6 on how this was described to you by the Intel 7 personnel? 8 A Correct. 9 Q So were you told what information Randal 10 Schwartz was authorized to have access to at Intel? 11 A I didn't hear the beginning of the 12 question. 13 Q Were you told by the Intel personnel you 14 met with what information Randal Schwartz was 15 authorized to have access to? 16 A To some degree, yes, but not 17 specifically. 18 Q Were you specifically told that Randal 19 Schwartz worked on Intel matters while away on 20 business trips? 21 A I don't recall. 22 MR. TINTERA: I'll object to that. 23 That's not raised in the affidavit. 24 MR. SUSSMAN: How about how -- 25 MR. TINTERA: Wait a minute. 135 1 MR. SUSSMAN: I'll withdraw that. 2 THE COURT: You want to withdraw 3 that? 4 MR. SUSSMAN: Sure. 5 THE COURT: Ask a question. 6 BY MR. SUSSMAN: 7 Q Did any of the Intel personnel inform you 8 that Randal Schwartz worked on Intel business from 9 home? 10 A I believe I recall that they did say 11 that. 12 Q Did any of the Intel personnel tell you 13 that Randal Schwartz used his Gate program, the 14 gate program as described to you to read his 15 e-mail? 16 A At Intel, on Intel property? 17 Q Yes. 18 A They told me -- At that point in time? 19 Bear with me. I'm trying to distinguish 20 information that I received after service of the 21 warrant as opposed to before service of the 22 warrant, and sometimes that's a little -- that gets 23 a little hazy. 24 Q Let's put that question away for a 25 second. I'll revisit it later on. I'll rephrase 136 1 it in a way that may make it more clear. I'll move 2 on now. 3 Specifically in the affidavit on 4 Page 1, referring now to about the fourth 5 paragraph, Mr. Morrissey told you that Randal 6 Schwartz was security conscious. 7 A In Paragraph 4? 8 Q I'm sorry, it's the third paragraph. 9 It's the last sentence of the third paragraph. 10 A Yes. 11 Q Did Mr. Morrissey tell you what that 12 meant? 13 A I don't recall. 14 Q What did you take that to mean? 15 A I took that to mean that given the 16 sophistication of the activity being engaged in, 17 that this was something that not just anybody could 18 be doing, but that somebody with Mr. Schwartz's 19 capabilities and abilities would be able to do. 20 Q So it was communicated then that 21 Mr. Schwartz was very clever? 22 A Certainly. 23 Q Very sophisticated in network security? 24 A That's correct. 25 Q That he had worked in that area? 137 1 A Again, at what point in time I was given 2 that information -- I'll have to back off a little. 3 The context of what they were 4 telling me was that Mr. Randal [sic] was a 5 contractor for them and was extremely sophisticated 6 in the work that he did, he did very high level 7 work. For want of a better word, he was very savvy 8 in computers and computer security. 9 Q Did somebody specifically tell you that 10 he would know how to cover his tracks because of 11 his sophistication and his savvy? 12 A That did come up at a point in the 13 investigation. I cannot tell you whether that was 14 during the preparation of the affidavit or after 15 that. 16 Q They did tell you that Mr. Schwartz, 17 though, was using his own identity to get access -- 18 A Yes. 19 Q -- to Brillig, the machine that would 20 allow him access to SSD? 21 A Yes. 22 Q And that Mr. Schwartz was using his own 23 ID, his own password -- 24 A Correct. 25 Q -- to run the crack program? 138 1 A That's correct. 2 Q Were you told by Mr. Morrissey that -- 3 bear with me a second. 4 When you met with Mr. Morrissey on 5 the 1st, did he tell you that Randal Schwartz had 6 not removed the crack program password files or 7 list of crack passwords from Mr. Morrissey's 8 system? 9 A I can only repeat to you the wording in 10 the affidavit. 11 Q Had he told you that, would you have put 12 it in the affidavit? 13 A Certainly. 14 Q Did he tell you that he had copies of the 15 directories of Mr. Schwartz, directories up to the 16 time that the affidavit was prepared? 17 A That Mr. Morrissey had copies of -- 18 Q Of Mr. Schwartz's directories. 19 A You're going to have to explain 20 directories to me so that I understand. 21 Q Well, directories containing the files on 22 Mr. -- under Mr. Schwartz's -- his files on the 23 Intel computers. 24 A I don't know whether he had all the 25 files. The information that I was provided with 139 1 was the information that they had obtained under 2 the log-on name or the password that Mr. Schwartz 3 was using to run the crack program. And they had a 4 list -- they were telling me that this had been a 5 program that had been running for several days, 6 that it was run under the name of Merlin, which was 7 Mr. Schwartz's password or name, I guess. 8 Again, I learned a lot about 9 computers since then, but I'm not anywhere near it 10 yet, but I'm doing the best that I can. 11 When you start using specific 12 computer terms like "directories," I hesitate 13 because I'm not sure that I have a full 14 understanding of -- technical understanding of what 15 those words are as opposed to their everyday use. 16 So I have trouble answering that question for you. 17 I'm sorry. 18 Q Would it be fair to say at the time that 19 you first met with them and were preparing the 20 affidavit, your understanding of these terms was 21 perhaps even less clear? 22 A I was learning it as I went along. 23 Q Now, did Mr. Morrissey tell you that he 24 had asked John Kent to look at all of the files 25 under Mr. Schwartz's name that were on this machine 140 1 Brillig, that was the connection to SSD? 2 A If you could try the question one more 3 time. 4 Q Sure. Did Mr. Morrissey -- let me back 5 up. 6 You have said that Mr. Kent was at 7 the meeting. 8 A That's correct. 9 Q Did Mr. Kent tell you that he had made a 10 backup computer copy of all of Mr. -- the contents 11 of Mr. Schwartz's directories and that would be all 12 of the files and the material that he had on this 13 Brillig machine? 14 A Again, the hesitation is trying to 15 remember at what point I was told that. I knew at 16 one point -- at a point in time that that had been 17 done. Whether he told me that during the course of 18 putting together of the affidavit, I can't give you 19 an answer on that. 20 My answer to you on that would be if 21 it was not germane to what I was trying to allege 22 in the affidavit as far as the elements of the 23 crime, the nature of evidence to be searched for or 24 seized, it may not have gone into the affidavit. I 25 may have obtained the information at that time but 141 1 not included it in the affidavit at that time 2 because, as I understood it, it was not -- didn't 3 have anything to do with the elements of the crime 4 that Mr. Schwartz was being accused of committing. 5 Q Were you told then that -- by 6 Mr. Morrissey or Mr. Kent, who were at this 7 meeting -- that they had checked Mr. Schwartz's 8 files on this Brillig machine and found no stolen 9 or illegal files? 10 A I believe so. 11 Q But you left that out of the affidavit? 12 A If I could look at that section of the 13 affidavit. Because I remember reading the 14 affidavit and it was a matter of wording in there 15 that -- 16 Q Certainly. Take a look and show me. 17 A I think I understand the section that 18 you're talking about, if I could find it and reread 19 it and maybe give you a better answer on that. I 20 thought it was in the affidavit. 21 I must be thinking of another report 22 rather than what was in the affidavit. 23 Q No, it's not in the affidavit. 24 A Okay. The question again now. 25 Q That information is not in the affidavit, 142 1 is it? 2 A That he had run a check of the thing and 3 found nothing was missing? 4 Q No stolen or illegal files. 5 A No, it's not in the affidavit. 6 Q And during that examination of 7 Mr. Schwartz's files by Mr. Kent, were you told 8 that they checked his other systems directories and 9 files in Brillig and they found nothing out of 10 order or unusual with the contents? 11 A Again, that's information that came to 12 light during the course of the investigation. At 13 what point in the investigation, that's hard for me 14 to pinpoint now, as to whether it was during the 15 preparation of the affidavit or after that. That's 16 the best answer I can give you. 17 Q Did anybody tell you whether or not 18 Mr. Schwartz was authorized to carry a laptop in 19 and out of Intel? 20 A I was told that he did. I don't recall 21 whether I was specifically told that he was allowed 22 to do that or not allowed to do that. 23 Q You were told that he, in fact, did that? 24 A Yes. 25 Q The question is, were you told whether or 143 1 not he had formal authorization to do that? 2 A I don't recall being told that. 3 Q Did you ask? 4 A I don't recall asking that. 5 Q Did anybody tell you how long or over 6 what period of time it had been that Mr. Schwartz 7 was bringing a laptop computer in and out of Intel? 8 A No. 9 Q Did you ask? 10 A No. 11 Q You were told that Mr. Schwartz was 12 running the crack program under his own name? 13 A Correct. 14 Q You were told that the password SSD file 15 was found under Mr. Schwartz's own name? 16 A That a password for SSD? 17 Q Right. 18 A Yeah. 19 Q And this program had been running for a 20 long time, it was a long-running program? 21 A That's correct. 22 Q Running on Mr. Schwartz's own name and 23 ID? 24 A Yes. 25 Q It appeared there was no attempt to 144 1 disguise Mr. Schwartz's identity in running that 2 program. 3 A No. 4 Q Did you draw any inference then from the 5 fact that was done out in the open? 6 A Yes. 7 MR. TINTERA: Objection. What 8 inference he draws, what difference does that make 9 in regard to his good faith, accuracy or anything 10 raised in counsel's affidavit? 11 THE COURT: I think inference that 12 he might have drawn, reasonable inference that he 13 might have drawn that might be inconsistent with 14 what he was saying in the affidavit. Argument 15 could be made that there were inferences that were 16 inconsistent with other materials that he had in 17 the affidavit that good faith, accuracy or 18 truthfulness could be challenged on that basis. If 19 it isn't in the affidavit, that's another point. 20 Is that an issue that you raised in 21 the affidavit, either affidavit that you filed 22 here? 23 MR. SUSSMAN: The fact that these 24 were run out in the open? 25 THE COURT: Yes. 145 1 MR. SUSSMAN: Yes. 2 THE COURT: I thought I had read 3 that somewhere in the materials. Overruled. 4 MR. SUSSMAN: Understandable. There 5 has been so much material. 6 THE COURT: Both of you know this, I 7 kind of deal with generalities. Every time one of 8 these is raised, I'm not going to take a 10-minute 9 recess to read through the materials. I think the 10 issue had been raised, I recall the discussion, so 11 you go ahead. 12 MR. SUSSMAN: There is a example on 13 Page -- 14 THE COURT: The question again. 15 THE WITNESS: The question again. 16 BY MR. SUSSMAN: 17 Q What inference did you draw from the fact 18 that that was all done out in the open? 19 A I don't recall drawing any inference from 20 it, other than the fact that it was done out in the 21 open. 22 Q Doesn't seem very smart to do that out in 23 the open if you are trying to steal secret files, 24 does it? 25 A I've seen a lot of criminals do a lot of 146 1 stupid things. That is not -- that does not 2 preclude them from doing it. 3 Q Sure, but doesn't seem like a very clever 4 thing to do, does it? 5 A It's not a smart thing to do. 6 THE COURT: It's like burglarizing 7 your house and leaving your business card on the 8 drainboard. 9 THE WITNESS: Your wallet on the -- 10 BY MR. SUSSMAN: 11 Q Were you told by any of the Intel folks 12 that the password SSD file was a file available to 13 anybody with access to that system? 14 A Try that one again. I'm sorry. 15 Q Were you told that the password SSD file, 16 one of the files that we're talking about, that 17 they were telling you that Mr. Schwartz stole it? 18 A Okay. 19 Q Were you told that the password SSD file 20 itself was available to be examined, to be publicly 21 examined by anybody with access to that system? 22 A I don't recall. 23 Q Were you told that if somebody had access 24 to Brillig, that they could then read the password 25 SSD file? 147 1 A I don't recall that, being told that, 2 either. My understanding was -- my understanding 3 of the case was that an attempt had been made to 4 obtain passwords to files and systems by someone 5 who was not entitled to those passwords. 6 Q And that's the way it was explained to 7 you? 8 A That's the way it was explained to me. 9 Q Referring to Page 2 of your affidavit at 10 the very first line, Mr. Morrissey told you that he 11 checked files owned by Randal Schwartz using 12 Mr. Morrissey's computer system and discovered that 13 many passwords for SSD employees had been 14 compromised. 15 What did Mr. -- Did Mr. Morrissey 16 tell you what he meant by the fact that those files 17 were owned by Randal Schwartz? 18 A I don't recall. 19 Q Did you ask him what that meant? 20 A I don't recall. 21 Q Was there any discussion how he checked 22 the files owned by Mr. Schwartz? 23 A I'm sorry. You have to try that one 24 again. 25 Q Was there any discussion about how 148 1 Mr. Morrissey checked the files owned by 2 Mr. Schwartz? 3 A If there was, I don't recall. 4 Q When he told you that the passwords had 5 been compromised, did you ask him what that meant? 6 A I believe that I did. I don't have 7 specific recollection of asking. I believe that he 8 did in order to be sure that I -- that the 9 information that I was putting in the affidavit was 10 as accurate as I could possibly ascertain it to be. 11 My intent in that wording was that 12 these were passwords that were supposed to be 13 secure and available only to the person issued 14 those passwords or creating those passwords, and 15 that now somebody else, Mr. Schwartz, had access 16 and the use of those passwords where he was not 17 supposed to. 18 Q Did anybody tell you whether they found 19 any, from checking Mr. Schwartz's files or checking 20 those particular -- let me start over. 21 Were you told by people, by anyone 22 at Intel, whether or not anybody had tried to gain 23 access to the files of the compromised passwords 24 other than the owner of the passwords? 25 A My understanding was that Mr. Schwartz 149 1 had obtained those passwords. That it was not 2 known if he had utilized those passwords to gain 3 access to those systems or those files. 4 Q Did anybody tell you whether they had 5 checked? 6 A I don't recall whether I asked that 7 question or not, or whether I received an answer to 8 that or not. 9 Q At the bottom of Page -- On Page 2, you 10 indicate that -- the second paragraph describing 11 sensitive information -- would be in the files 12 under certain compromised passwords for Ed Masi and 13 Justin Rattner, the two people named. Were you 14 told whether there were any specific files under 15 their passwords where sensitive information was 16 likely contained? 17 A No. 18 Q Were you told whether any information -- 19 any of the information in any of those files was 20 found on any of Mr. Schwartz's files? 21 A No. 22 Q Did you ask whether or not anything from 23 those files was found in any of Mr. Schwartz's 24 files? 25 A Again, that is a question that I would 150 1 imagine that I would have asked. I don't recall 2 whether that question was asked at that point in 3 time or not. 4 Q You have previously testified that you 5 were told that -- by Mr. Kent or Mr. Morrissey -- 6 Mr. Schwartz's files on Brillig were examined and 7 no stolen or illegal files were found. 8 A Correct. 9 Q And when you were told this other 10 information about the files under the passwords of 11 Mr. Masi and Mr. Rattner, did you ask any questions 12 to clarify whether or not -- did you determine 13 whether or not you were talking about -- whether 14 there was any indication that any of those files 15 might have shown up somewhere else on 16 Mr. Schwartz's files? 17 A The files belonging to Mr. Rattner or 18 Masi? 19 Q Yeah. 20 A And you're asking if any of those showed 21 up on any of the other files of Mr. Schwartz? 22 Q I'm asking if you inquired as to whether 23 or not any of these files showed up? These would 24 be the stolen or illegal files. 25 A I don't recall asking the question. 151 1 Q On that same page, Page 2, in the third 2 paragraph, Mr. Morrissey told you -- he expressed 3 concern to Mr. Kent that password information had 4 been transferred to Mr. Schwartz's Apple computer. 5 Did Mr. Morrissey express that concern to you? 6 A Yes. 7 Q And when he expressed that concern to 8 you, were you told by Mr. Morrissey or anyone at 9 Intel that they had seen Randal Schwartz with 10 floppy disks in his possession? 11 A I don't recall one way or the other. 12 Q That he was in possession of any other 13 disks or tapes? 14 A Again, I don't know one way or the other 15 specifically. 16 Q Did he tell you, when he expressed this 17 concern, what information he was concerned with 18 that Mr. Schwartz had transferred? 19 A If you could rephrase that. 20 Q When he expressed concern that 21 Mr. Schwartz transferred information to his Apple 22 computer, did he tell you what information he was 23 concerned had been transferred? 24 A The concern was more for the potential 25 rather than any actual transfer of information. 152 1 Q So they had no specific information that 2 he had actually transferred anything? 3 A No. 4 Q Did they give you any information to 5 indicate that they had some -- any indication that 6 Mr. Schwartz had transferred anything to his 7 computer? 8 A No. 9 Q Did they say anything to you about 10 whether or not there would be any kind of trail on 11 the logs, on these computer program runs or 12 something like that that would show whether or not 13 Mr. Schwartz had logged into certain computers to 14 transfer information? 15 A You'll have to give me a minute. I'm 16 starting to overload on this. Try the question 17 again. 18 Q Were you told -- still talking about this 19 concern about transferring information -- were you 20 told whether or not there would be any kind of 21 trail, computer print, anything that could print 22 out how a program was run, showing something had 23 been logged, a computer had log into another 24 computer, another program, something that would 25 show a trail, some kind of trail that would 153 1 indicate that Mr. Schwartz had transferred anything 2 to his -- 3 A I don't recall any discussion about that. 4 Q Did you inquire? 5 A I don't believe so. 6 Q Regarding your conversation with 7 Mr. Cower on Page 2 of the affidavit, that appears 8 in the fourth paragraph. It says there that -- 9 Mr. Cower is talking about, based on his 10 experience, that in order to avoid detection in the 11 workplace, Mr. Schwartz would transfer the 12 information to his Apple portable computer in order 13 to work only with the information in the privacy of 14 his own home. Who brought up the subject of 15 avoiding detection in the workplace? 16 A I believe Intel people. 17 Q Did Mr. Cower express to you any activity 18 or facts that he was aware of that indicated that 19 Mr. Schwartz was running these programs in a way to 20 avoid detection in the workplace? 21 A No. 22 Q Mr. Cower listed a number of possible 23 places that data might be stored which he then 24 listed in the affidavit; is that correct? 25 A True. 154 1 Q And that list included keyboards, 2 monitors -- you're nodding -- motherboards, CPUs, 3 floppy disk drives. That's all correct so far? 4 A Yes. 5 Q Cables, expansion cards, plotters, 6 printers, phone modems, computerized image scanners 7 and automatic dialers. 8 A What page are we on now? 9 Q I'm asking -- 10 A You're talking under the section 11 "authorized to seize"? 12 Q Yes. Are those things that Cower had 13 mentioned to you? 14 A I relied on two people to provide me with 15 information as to what items would be reasonable to 16 search and seize for and, in part, that was 17 Detective Lazenby who had considerably more 18 knowledge in computer affairs, particularly as they 19 applied towards things of evidentiary value. 20 THE COURT: You said two sources. 21 That's one. 22 THE WITNESS: The other source was 23 the Intel people. 24 BY MR. SUSSMAN: 25 Q The list that shows up at the bottom of 155 1 Page 2 and goes to the top of Page 3, that is the 2 list of information which Cower gave you? 3 A Yes. 4 Q And then the remaining requests where you 5 seek authorization procedure came from your 6 discussion with Detective Lazenby? 7 A Correct. 8 Q Did anyone, during the course of this 9 discussion, tell you that they had seen 10 Mr. Schwartz with cables? 11 A No. 12 Q Expansion cards? 13 A No. 14 Q Plotters? 15 A No. 16 Q Printers? 17 A No. 18 Q Phone modems? 19 A No. 20 THE COURT: I can't hear you. I'm 21 sorry. No all the way? 22 THE WITNESS: Yes. 23 BY MR. SUSSMAN: 24 Q Computer mice? 25 A No. 156 1 Q Image scanners? 2 A No. 3 Q Automatic dialers? 4 A No. 5 Q Did anyone give you information that 6 Mr. Schwartz had been known to use a blue box? 7 A No. 8 Q Or a black box? 9 A No. 10 Q Now, on Page 3 of that affidavit, you 11 relate Mr. Morrissey's account of his discussion 12 with Dirk Brandewie about a prior incident. 13 A The first paragraph after the -- 14 Q The first full paragraph, that's correct. 15 A Okay. 16 Q And the affidavit reads that 17 Mr. Brandewie had found evidence that Mr. Schwartz 18 had bypassed the Intel security systems which 19 prevented people from accessing Intel information 20 from the outside. Were you told that Mr. Schwartz 21 had written this gate program so he could read his 22 e-mail? 23 A No. 24 Q Nobody at Intel? None of the Intel 25 people told you that? 157 1 A No. 2 Q So when Mr. Morrissey related this 3 conversation where Mr. Schwartz said he did it to 4 gain access to Intel systems from the outside, were 5 you told what the purpose was he was trying to do 6 by gaining access from the outside? 7 A No. I was told just the fact that he had 8 made the attempt or that he had succeeded in doing 9 that. 10 Q Was there any discussion about using the 11 Internet to provide people at Intel to read e-mail 12 or anything like that? 13 A Not that I can recall. 14 Q You would have put that in the affidavit 15 if you had been told? 16 A Again, I have to reiterate. In preparing 17 the affidavit, I addressed myself to what, if any, 18 crime had been committed and what the elements of 19 that crime were and set forth in the affidavit 20 those elements as best I could from the information 21 provided to me. 22 Q In that same paragraph, you indicate that 23 Mr. Morrissey told you that Ruby.ORA.com is a 24 program belonging to O'Reilly Associates. 25 A That's the wording used by Mr. Morrissey 158 1 that I used in the affidavit. 2 Q And you were told it was a program, not a 3 computer? 4 A I can only -- At this point in time when 5 you get down to technical computer terms, I was 6 very careful to use the words that were used by my 7 sources of information at Intel because that was my 8 only basis of knowledge, is the information 9 provided by them. 10 Q And, again, because we're dealing 11 specifically with this particular item, Ruby.ORA. 12 com, did you ask what that program or computer was, 13 what the connection was for? 14 A No. 15 Q Prior to the time that you interviewed 16 Mr. Schwartz, did anybody tell you that that was 17 his address for getting his e-mail? 18 A I don't believe so. 19 Q Now, in that paragraph, Mr. Morrissey 20 told you he didn't know how or where Mr. Schwartz 21 was accessing that Ruby program from. Did you ask 22 him? 23 A I don't recall if that was volunteered or 24 in response to a question, no. 25 Q Did he indicate that that was something 159 1 that could be determined by looking at the way the 2 program was written? 3 A Not that I recall. 4 Q On Page 4, you relate your conversation 5 with Detective Lazenby and you relate that he 6 provided you information through his training and 7 experience, in the first paragraph there. What did 8 Detective Lazenby tell you about his experience and 9 training regarding computers and computer hacking 10 crimes? 11 A Part of his experience and training is 12 experience and training that I personally know he 13 has through working with him, part of which was 14 because he told me he has had experience and 15 training in these matters, and that was what he was 16 basing his information on. 17 Q Did he explain to you what that training 18 consisted of? 19 A I don't recall him getting into 20 specifics, no. 21 Q Did you ask him what that training 22 consisted of? 23 A The specific areas of training and 24 experience, no. 25 Q Now, you've written search warrant 160 1 affidavits in drug cases? 2 A Certainly. 3 Q In search warrant affidavits where you 4 have a police informant with training and 5 experience that includes going to schools by the 6 FBI or the DEA, do you list that kind of experience 7 in your training? 8 A For informants? 9 Q No, for other police officers who are 10 providing information. 11 A I always set out my experience and 12 training in the affidavit. 13 Q Does your experience and training consist 14 of courses that you've attended like that? 15 A Certainly. 16 Q And you put that in the affidavit? 17 A I don't list every specific course that 18 I've been to. 19 Q But you do list significant courses that 20 you've been to? 21 MR. TINTERA: I object. None of the 22 affidavits filed by counsel raise anything about 23 any expert qualifications to give information in 24 the search warrant affidavit. 25 THE COURT: Mr. Sussman. 161 1 MR. SUSSMAN: I would need a moment 2 to refer to the affidavit. 3 THE COURT: Go ahead. 4 MR. SUSSMAN: Your Honor, 5 Mr. Tintera is correct. It's not in the affidavit. 6 It was a matter that I have raised elsewhere in the 7 pleadings and I had, in my mind, thought that I was 8 raising it with respect to the motion and it was 9 relating to the motion to controvert. I would 10 suggest that -- 11 THE COURT: You don't need to give 12 any additional explanation. You're going to be a 13 while longer with this witness? 14 MR. SUSSMAN: I'm just about done 15 with Detective Lilley. 16 THE COURT: How long are you going 17 to be? 18 MR. TINTERA: Very brief, Your 19 Honor. Not more than ten questions. And that's 20 generous. I think I would ask five, but I 21 thought -- 22 THE COURT: Well, I'll hold you to 23 that. 24 MR. TINTERA: Did you want to stop? 25 THE COURT: I thought if we were 162 1 going to have him back here tomorrow, he's 2 obviously about overloaded, and if I was a pinball 3 machine, I'd have "tilted" written all over my 4 face. 5 MR. TINTERA: My objection kind of 6 refreshed me, Judge. 7 THE COURT: I thought so. You 8 always get refreshed towards the end of the day. 9 Well, you still have my attention, 10 but I thought if we were going to go over, this 11 would be a good place to break. 12 Realistically, do you think you we 13 will be done with this witness by -- 14 MR. SUSSMAN: Realistically, I have 15 about four more questions on my list. 16 THE COURT: Go ahead. Let's see how 17 we do. I know he'd like to come back tomorrow. 18 MR. SUSSMAN: I'm not sure where we 19 were with the objection. 20 THE COURT: I think you conceded 21 that that had not been raised in the affidavit that 22 you filed specifically, and I'm sustaining the 23 objection. 24 BY MR. SUSSMAN: 25 Q In that paragraph where you're referring 163 1 to Detective Lazenby told you through his 2 experience and training, where he states that 3 persons involved in these activities often will try 4 to conceal the contents of the disks. Do you have 5 that in front of you? 6 A Yes. 7 Q What did you understand from Detective 8 Lazenby to mean by "these activities"? 9 A Criminal activities. 10 Q Now, had Detective Lazenby spoken to any 11 of the Intel people? 12 A He arrived during the course of the 13 investigation, during the course of the preparation 14 of the affidavit. At what point, I don't recall, 15 but he was there towards -- at least somewhere in 16 the middle and through to the end, from that point 17 on. He was tied up on something else and was 18 delayed in attending. 19 Q When he gave you this information and 20 referred to these activities, referring to criminal 21 activities, was this based on information that he 22 had heard from the Intel people, or was he talking 23 in general terms to you about investigation of 24 computer crimes? 25 A He was talking about his -- information 164 1 that he had obtained through experience and 2 training generally. 3 Q And so in -- would it be fair to say then 4 in using the word "these activities" trying to 5 convey the sense that he was referring to criminal 6 activities? 7 A In activities of this nature, yes. 8 Q Well, "this nature" isn't particularly 9 described. What were you trying to convey to the 10 Judge when you used "these activities"? 11 A Just that -- activities such as were 12 being allegedly being conducted by Mr. Schwartz. 13 Q Which you were alleging to be criminal 14 activities? 15 A Correct. 16 MR. SUSSMAN: I have nothing further 17 at this point. 18 THE COURT: Thank you. 19 Mr. Tintera. 20 21 22 23 24 25 165 1 CROSS-EXAMINATION 2 BY MR. TINTERA: 3 Q Detective Lilley, when you write an 4 affidavit like this, or when you wrote this 5 particular affidavit, what type of information were 6 you trying to provide to the magistrate? 7 A The allegation of a crime, the nature of 8 that crime, the venue of the crime, items of 9 potential evidentiary nature that would further 10 corroborate the elements that I was alleging. 11 Q I understand from your testimony that you 12 received an awful lot of information that day, and 13 I don't mean to insult your professionalism, but is 14 there anything that you left out of that affidavit 15 that you felt was important to the elements that 16 you have just testified to? 17 A Not that I can recall. 18 Q Was there anything that you may have 19 hedged a little bit on or been inaccurate in 20 putting in that affidavit that you swore to so that 21 the magistrate would be more likely to sign it? 22 A Certainly not. 23 MR. TINTERA: Those are the only 24 questions I have. 25 THE COURT: Mr. Sussman. 166 1 MR. SUSSMAN: Nothing further. 2 THE COURT: Thank you. You may step 3 down. 4 Do you have additional witnesses? 5 You indicate that you might want -- you may want to 6 do that telephone conference, but is that witness 7 on this issue? 8 MR. SUSSMAN: Yes, but so that we 9 didn't have to interrupt the witness and we could 10 complete Detective Lilley today, I figured we can 11 do that tomorrow. 12 THE COURT: That's fine. 13 MR. SUSSMAN: The other witness -- I 14 do have one more witness, Mark Morrissey, who we 15 would have available tomorrow morning. 16 THE COURT: Let's recess until 17 tomorrow morning. 18 THE WITNESS: Am I excussed or still 19 under subpoena? 20 THE COURT: Well, you're not on 21 vacation or anything? You're not going back to 22 Australia or New Zealand? 23 THE WITNESS: No. I'm not working 24 at the Sheriff's Office any longer. I'm working 25 offside, so I'd like to know whether I need to come 167 1 back tomorrow morning or not. 2 THE COURT: You don't have to come 3 back, but may be that you would be needed back. 4 THE WITNESS: I could certainly be 5 reached. 6 THE COURT: Let's recess until 7 tomorrow morning then. 8 You indicated that we would -- 9 timewise for the witness in Singapore works out 10 about 3:00 o'clock. 11 MR. SUSSMAN: 3:00 o'clock, 4:00 12 o'clock is fine. 4:30 is fine. 13 What I'm thinking, to make the most 14 efficient use of your time, that the only other -- 15 I have one more witness, which is Mark Morrissey, 16 who will take a while, but would not fill up the 17 morning and then go into the middle of the 18 afternoon. If you would prefer, it might be more 19 efficient to start in the afternoon, then take 20 everybody in the afternoon and we would be 21 finished. 22 MR. TINTERA: Well, I do have an 23 off-campus appointment tomorrow afternoon, but I 24 can cancel. 25 MR. SUSSMAN: If that's the case, we 168 1 can go ahead and do this in the morning. Then if 2 we do need to call Mr. Johnson-Laird, perhaps we 3 can accommodate both and then just come back and 4 take that later in the day. 5 MR. TINTERA: The problem I have, 6 Judge, is with Johnson-Laird, although I'm not 7 objecting to the form that his testimony is, what 8 relevance does he have to the motion to controvert? 9 He provided no information to anyone in regard to 10 the information in the affidavit. He was not 11 consulted. I don't think counsel is going to 12 disagree with me on this, but he will not be able 13 to produce evidence that he consulted with any of 14 the people that we have talked about either at 15 Intel or with the Sheriff's Department about this 16 case prior to the issuance of the affidavit. So in 17 a motion to controvert, what possible relevance can 18 he have to the accuracy, good faith or truthfulness 19 of Detective Lilley if he has not consulted with 20 anyone which Mr. Lilley got the information from? 21 THE COURT: Obviously it's not my 22 point to answer that question and -- 23 MR. TINTERA: I'm objecting to 24 taking his testimony at this time. I was going to 25 wait until he is called as a witness. I think we 169 1 can perhaps wait until after we hear from 2 Mr. Morrissey and may well be that the need becomes 3 moot at that point. 4 THE COURT: That could be. 5 MR. TINTERA: Did you want me to 6 cancel my appointment or not? 7 THE COURT: On the degree of 8 importance to you, is it something that's 9 relatively important to you? 10 MR. TINTERA: It's actually my 11 yearly checkup with my allergies. 12 MR. SUSSMAN: How long do you think 13 it will be? 14 MR. TINTERA: It's at 3:00 o'clock. 15 THE COURT: That means you'll get to 16 see him at 4:30. Have I just slandered a 17 physician? 18 MR. TINTERA: If we are hearing from 19 this guy from Hong Kong, I don't care if we call 20 him in the middle of his night. 21 MR. SUSSMAN: Basically the 22 testimony on that end would be fairly brief, the 23 number of questions that would be relevant, so 24 that -- 25 THE COURT: Your appointment is at 170 1 3:00, though? 2 MR. TINTERA: Yes. 3 MR. SUSSMAN: -- that we could call 4 him as late as 4:30. 5 THE COURT: Is your allergist here 6 in Hillsboro? 7 MR. TINTERA: He's at St. Vincent's 8 and I did not intend to come back. And you're 9 right, they do keep you waiting. 10 THE COURT: Are we here on Thursday? 11 MR. TINTERA: I'm committed in the 12 grand jury on homicide cases on Thursday, but I'm 13 available Friday. 14 THE COURT: Let's do it about 4:00 15 on Thursday. 16 MR. SUSSMAN: That would allow 17 Mr. Johnson-Laird to get the documents that have 18 been -- 19 MR. TINTERA: Then let's do it 20 tomorrow. 21 MR. SUSSMAN: To address the 22 subpoena issue, if that's still -- 23 THE COURT: We will take that 24 testimony, assuming we take it, at 4:00 o'clock on 25 Thursday. Tomorrow is Wednesday. Tomorrow we'll 171 1 start at 9:30. Thank you. 2 MR. TINTERA: Thank you, Judge. 3 (Evening recess.) 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25