1 IN THE CIRCUIT COURT OF THE STATE OF OREGON 2 FOR THE COUNTY OF WASHINGTON 3 4 STATE OF OREGON, ) ) 5 Plaintiff, ) ) 6 vs. ) No. C940322CR ) 7 RANDAL LEE SCHWARTZ, ) ) 8 Defendant. ) Volume 6 9 10 11 TRANSCRIPT OF PROCEEDINGS 12 13 BE IT REMEMBERED THAT on the 13th 14 day of July 1995, the above-entitled matter came on 15 for Hearing before the HONORABLE ALAN C. BONEBRAKE, 16 a Circuit Court Judge. 17 18 APPEARANCES 19 Thomas J. Tintera Washington County Deputy District Attorney 20 Representing the State of Oregon 21 Mark Sussman Attorney at Law 22 Representing the Defendant 23 24 25 2 1 WITNESS INDEX 2 3 FOR THE STATE: Direct Cross ReD ReX 4 5 6 James Lilley 37 53 84 89 7 Robert H. Wilcox, Jr. 91 8 Robert Wilcox 109 136 9 Brad Benson 139 143 148 10 Louis Poehlitz 151 160 11 Richard J. Greco 167 180 186 189 12 13 FOR THE DEFENDANT: 14 15 Exhibit No. 102 121 122 16 Exhibit No. 103 121 122 17 Exhibit No. 106 121 122 18 19 20 21 22 23 24 25 3 1 MORNING SESSION 2 BEGINNING AT 9:30 A.M. 3 JULY 13, 1995 4 5 (Whereupon, the following 6 proceedings were held in 7 open court, out of the 8 presence of the jury:) 9 THE COURT: Two issues this morning, 10 folks. Two issues: The videotape and the request 11 by the State to have one of the witnesses sit in. 12 Last night, I did my work partially 13 complete, apparently, because I checked Shepards 14 and immediately recalled the case that I had 15 recalled reading, State v. Cooper, 120 Or App 490. 16 Mr. Tintera pointed out to my staff this morning 17 that that case is also cited in 319 Oregon 162 and 18 the Supreme Court reached a different opinion, so I 19 have read that quickly. I also viewed the 20 videotape last night. 21 Anything additional? 22 MR. TINTERA: Yes, I have one 23 additional matter. 24 THE COURT: Which matter? 25 MR. TINTERA: Nothing additional to 4 1 say on those. I have something to say before we 2 bring the jury back in. 3 THE COURT: Let's talk about your 4 request to have the witness sit in, Rich Cower. 5 Have you had a chance to review the Supreme Court 6 version of State v. Cooper, Mr. Sussman? 7 MR. SUSSMAN: Your Honor, I just 8 glanced at it briefly this morning and I can't give 9 you a cogent analysis. 10 THE COURT: Would you want more time 11 to take a look at that? There is interesting 12 language. As the Supreme Court tends to do, they 13 tend to go on page after page. The part that 14 Mr. Tintera undoubtedly is going to want to hone in 15 on is on Page 170 where it says, "We presume that 16 the Oregon legislature enacting OEC 615 Sub 2 17 intended to adopt along with the rule the same 18 policy of providing parody between the parties that 19 the committee report indicates motivated Congress 20 in enacting Federal Rule 615(2). Accordingly, 21 under OEC 615(2), the State may designate a person 22 who will be a witness in the case as it's 'officer' 23 who is exempt from exclusion." 24 Then they say, "That decided, the 25 issue then is whether a city police officer may be 5 1 so designated by the State." That question 2 remains. But the first part is, apparently, the 3 thinking was that in the adoption of this rule 4 that, first of all, in a trial, a natural -- a 5 person who -- a party who is a natural person had a 6 right to be present. We all know that. Then they 7 also believe that the legislature wanted to treat 8 corporations the same for non-natural parties and 9 to permit a party to designate some witness to sit 10 in in those proceedings. Anyway -- 11 MR. SUSSMAN: Your Honor, my 12 recollection, as you talk about the case, I think 13 that that case dealt with -- specifically with a 14 police officer -- 15 THE COURT: You're right. 16 MR. SUSSMAN: -- sitting in to 17 assist during the course of the trial. And if my 18 memory serves correctly, it was a question of 19 whether or not in a State prosecution a city police 20 officer who was not an employee of the State could 21 sit in. 22 But I think, again if memory serves 23 correctly, the fact that there was a police officer 24 for a city, the Supreme Court said that it was 25 basically kind of a subdivision of the State and so 6 1 the officer did stand in place or did fit under 2 the -- I guess the broad definition of an agent of 3 the party, which was the State of Oregon, which is 4 somewhat different from the situation that 5 Mr. Tintera proposes where he seeks to designate 6 not an agent of the State such as Detective Lilley 7 or Detective Lazenby, but an agent of the 8 complaining party, Intel, to sit in during the 9 course of the trial. 10 Now, the victim, as I recall the 11 victims' rights legislation, allows the victim, or 12 if the victim is a non-person and a representative 13 of the person to attend, that they could, it can 14 be, but that -- I do not recall, do not believe 15 there was anything in the legislative history in 16 the statute that addressed the situation of 17 allowing where the victim is a non-person dealing 18 with a situation presented here where the party 19 wants to bring in a critical witness to represent 20 the corporation and allow -- designate that person 21 as the representative of the victim for purposes of 22 sitting in, of non-exclusion under the victims' 23 rights laws. 24 I think the victims' rights laws 25 would be perfectly well satisfied and it would 7 1 be -- I would have no quarrel with John Woodard, 2 who has been the agent and representative of Intel 3 throughout these proceedings sitting in throughout 4 the case. And, in fact, my understanding is that 5 he seems to have been and probably expects that he 6 will continue to do that. 7 I also would again be prepared to 8 concede that the State's expert from Intel, whom 9 I've been notified is Rich Cower, may sit in during 10 the testimony of our expert, but I think that it 11 goes beyond the scope of the holding in that case 12 for the statute to permit Rich Cower to sit at 13 counsel table through much of the State's case and 14 where the State particularly wants to have 15 Mr. Cower sitting there through cross-examination 16 before he's testified simply compounds the dilemma 17 and the potential due process problem that is 18 created by allowing witnesses to sit through 19 cross-examination and portions of the trial which 20 may directly be related to and very likely be 21 related to the testimony of that particular witness 22 as well. 23 So I think if -- I think that 24 Mr. Tintera's request goes too far, but for limited 25 purposes such as the testimony of our expert, I 8 1 believe it should be allowed for that purpose. 2 THE COURT: Mr. Tintera. 3 MR. TINTERA: Judge, having read the 4 case and I also have read the case of State v. 5 Alexander, 105 Or App 566 1991, case that dealt 6 with this particular Oregon Evidence Code 615. 7 The first point that I'd like to 8 make with Your Honor is that the application of 615 9 is discretionary with the Court. The Court may 10 exercise that statute. It's not a mandatory 11 statute. Or the Court may exercise its discretion 12 in allowing a witness to remain at the request of 13 one of the parties. 14 I would ask the Court to exercise 15 your discretion and allow Mr. Cower to sit through 16 the trial to assist me. It is important to the 17 prosecution of this case that I have his ability to 18 analyze what the defense is doing and in a 19 contemporaneous manner and not later or during the 20 breaks. 21 I would also agree with -- 22 THE COURT: Well, I'm going to hone 23 in on Subsection 3 then, Mr. Tintera, where it says 24 it's essential. Being important to assist you is 25 one thing. Being essential is -- I see it going a 9 1 bit further. 2 I want to know what you're telling 3 me. Do you think it's essential or is it just 4 important? This gets to the point, the questions 5 that I asked you yesterday in analyzing this, and 6 that is Mr. Cower, apparently, is a single person 7 who embodies both characteristics that you want and 8 that is, he has specific knowledge about this case 9 and also apparently very skilled in computer 10 matters. And the question I asked yesterday is 11 that if there is not another single person 12 available to assist you in those two areas, would 13 there not be two people possibly that would not be 14 witnesses, one who might be skilled in computer 15 matters that could assist you and another that 16 might be knowledgeable about the facts? And if 17 those people -- if such a person or persons would 18 be available, then it wouldn't be essential that 19 Mr. Cower be here. 20 MR. TINTERA: Well, those people are 21 not available. What I'm trying to figure out is, I 22 would attempt to try the case if Mr. Cower is not 23 permitted to be here, but without knowing what the 24 defense cross-examination is and without knowing 25 what the full parameters of the witnesses that 10 1 they're going to call, what those questions are, 2 it's difficult for me to say whether he is 3 essential without knowing those things. 4 THE COURT: I understand. Let me 5 think through this about what alternatives would be 6 available and whether or not they are practical and 7 whether or not if you took advantage of them it 8 would make a ruling meaningless. 9 If I exclude Mr. Cower, I expect if 10 you wish to and had the funds available to you, you 11 could order a daily transcript from my reporter and 12 then nothing in my ruling excluding witnesses would 13 prevent you from then talking to Mr. Cower about 14 the testimony of the witnesses from the transcript. 15 MR. TINTERA: I'm not so sure about 16 that. I thought the essence of the exclusion of 17 witnesses is not to discuss what occurs in the 18 courtroom. I think I would be prohibited from 19 going over transcript of testimony from the 20 courtroom with Mr. Cower. 21 THE COURT: Well, the transcript, 22 yes, but not areas involved in the transcript. In 23 other words, in discussing with your witnesses 24 their testimony preparatory to testifying, you 25 certainly could go through specific areas and ask 11 1 questions, and issues that came up during the trial 2 would be fair game for counsel to talk with 3 witnesses. Yes. Probably having him read the 4 transcript would be a violation. Something short 5 of that might be possible. 6 I'm not suggesting that that's a 7 good alternative. What I'm suggesting, I wonder 8 what the danger is of having Mr. Cower sit in here. 9 In other words, if you could do virtually the same 10 thing anyway. 11 So you're saying in your mind it's 12 essential that he be here? 13 MR. TINTERA: I'm trying to be as 14 forthright as I can, Judge. I can't guarantee that 15 he will have some essential knowledge to be able to 16 give me during the trial based on what the defense 17 is going to ask. I can guarantee that he has 18 essential -- he has the most knowledge and the most 19 computer skill of anyone who is available to me to 20 meet what the defense has planned through their 21 witnesses. 22 I can't say that he will be 23 absolutely essential as he sits here because 24 nothing may occur during the trial which makes him 25 essential. 12 1 THE COURT: That's fair. What 2 you're saving is it's hard to know for certain, to 3 be honest, until you hear what Mr. Sussman does and 4 what his witnesses say and -- 5 MR. TINTERA: Exactly. I can tell 6 you this from some of my witnesses, I'm learning 7 new things that I don't know the answer to all the 8 time, including this morning. I'm learning things 9 that I didn't know about the computer, that if just 10 talking with my own witnesses is producing that, 11 then I absolutely do need Mr. Cower right by my 12 side to ask him about that during trial. I can 13 tell you that because there are things that have 14 already happened this morning that I don't 15 understand, and it was on a fairly simple point, I 16 thought, until the witness started talking. 17 So just with my own witness, I can 18 tell you this, that I need his ability to translate 19 what they are saying to me in a language that I can 20 understand. So from that standpoint, he is 21 essential based upon what has already occurred this 22 morning. 23 THE COURT: In interpreting the 24 statute, the Court has to determine what meaning is 25 to be given to "essential." Is this like proof 13 1 beyond a reasonable doubt? Does "essential" mean 2 basically beyond all doubt or does it mean beyond a 3 reasonable doubt, so to speak? 4 In other words, I suspect that the 5 statute does not require a showing that the State 6 cannot proceed without having this witness 7 available, but that "essential" means here 8 something less than that. "Essential" meaning 9 essential to permitting the party to having an 10 opportunity fairly to understand the testimony of 11 witnesses, cross-examination, the significance of 12 technical matters, and to be able to ask questions 13 to present evidence and in order to have a fair 14 determination of the case by the jury. I have an 15 idea if I was to define "essential" here, that's 16 how I would do it. 17 Is it not possible to call Mr. Cower 18 earlier to change the order in which you have your 19 witnesses testify so that -- I know he still would 20 have an opportunity to be -- to testify on 21 rebuttal, but at least to get his initial testimony 22 on the record before he has an opportunity to hear 23 other witnesses testify, other state's witnesses, 24 obviously. The defense witnesses will be 25 afterwards. 14 1 MR. TINTERA: Well, I suppose it is 2 possible. In this type of case, Judge, I think it 3 is important that we maintain some sort of sequence 4 of events. I'm very much concerned about losing 5 the jury in the presentation. 6 Mr. Cower's testimony as the State's 7 expert is close to the most complex. I think John 8 Kent's testimony is fairly complex. He's scheduled 9 for tomorrow, but -- as is Mr. Cower, but I think 10 that this is -- I think in this case a foundation 11 of understanding has to be built slowly with the 12 jury or they will be overwhelmed, and I suppose 13 it's possible to start with the most complex 14 witness first, but I think that, from my standpoint 15 of showing to the jury what happened in a common 16 sense manner, that is not the way to do it. 17 And I'd also -- I have two other 18 points, not on this subsection, of essential 19 witness. 20 THE COURT: On this same area of 21 allowing Mr. Cower to sit in? 22 MR. TINTERA: Yes, I do. 23 THE COURT: Go ahead. 24 MR. TINTERA: If State v. Cooper has 25 broadened the definition of agent of the officer or 15 1 employee of a party, officer of a party, which is 2 not a natural person designated as its 3 representative by its attorney, if that case does, 4 in fact, broaden the language to include the 5 federal language of providing parody of the parties 6 so that a person will be a witness, can be an 7 officer and exempt from exclusion, if in fact 8 that's true, then it has also adopted what the 9 Federal Rule 615 Senate Judiciary Committee report 10 which is referenced beginning in State v. Cooper on 11 Page 16A. 12 And the rationale for allowing that 13 is perhaps very much evident in this case, and I'm 14 quoting on Page 169. "The investigative agent's 15 presence may be extremely important to government 16 counsel, essential, when the case is complex or 17 involves some specialized subject matter. The 18 agent, having lived with the case for a long time, 19 may be able to assist in meeting trial surprise 20 where the best prepared counsel would otherwise 21 have difficulty." 22 Further goes and says, "It would not 23 seem often that the government could meet the 24 burden of showing that the agent's presence is 25 essential." In essence, this was added to have the 16 1 person who was most familiar with the facts. They 2 don't limit it to a complex case or a case 3 involving specialized subject matter, but this is a 4 complex case and does involve specialized subject 5 matter. 6 THE COURT: Weren't they talking 7 there, though, talking about the investigative 8 agent about police officers, or does it indicate -- 9 MR. TINTERA: Just says 10 "investigative agent." "Agent" isn't capitalized, 11 but they were referring to the part where they were 12 talking about "officer" in quotes. 13 But if you read 170 along with that, 14 the -- and I -- along with the rule of the same 15 policy of providing parody between the parties, the 16 report case that motivated Congress in enacting the 17 statute in Subsection 2, the State may designate a 18 person who will be a witness in its case as its 19 officer who is exempt from exclusion. And I 20 would -- if, in fact, that expands the Subsection 2 21 of 615, I would designate Rich Cower as the officer 22 or case agent in this particular case. 23 So basically my argument is 24 threefold: One, I'm asking the Court to exercise 25 your discretion in allowing Mr. Cower to remain 17 1 present during the trial. I'm also indicating to 2 the Court that in order for me to translate the 3 language that the witnesses speak in, it is 4 essential that he act as a translator to me. And I 5 can't tell you what it is that the words that will 6 be spoken that will require translation. I can 7 tell you this, they have already occurred this 8 morning when I was talking to some of the witnesses 9 that I anticipate calling this morning, such 10 that -- and he was not present when it occurred, 11 such that I have a call in to him to try to find 12 out what this means. 13 So that's the handicap that I'm 14 presented with in this particular case and I think 15 that there is a legitimate remedy for that handicap 16 and that's allowing Mr. Cower to be present to 17 assist me in translating what the witnesses testify 18 to. They do not use the language that you and I 19 use. They use a technical language that requires 20 and is essential, in my opinion, to my fair 21 presentation and to allow parody in this particular 22 case that they be allowed to -- that he be allowed 23 to assist me. 24 And if, in fact, that's in State v. 25 Cooper, expands what agency of a party means to -- 18 1 THE COURT: There is no question it 2 does. Expands it to also include city police 3 officers. When I say "officer" there, that's used 4 differently than the statute does. Statute doesn't 5 refer to -- I think basically we're talking about 6 corporate officers. But State v. Cooper clearly 7 extends a city policeman to be included within 8 "officer," within the term there. 9 The question is whether or not they 10 really mean what they say in the language I read 11 from Page 170 that they didn't limit it to 12 policemen there. They just said "a designated 13 person," which literally would mean anyone, whether 14 a policeman or not. 15 MR. TINTERA: But if we look at the 16 legislative senate subcommittee that was dealing 17 with this, the Federal Rule of 615 and what their 18 comments were and what their intent was, I think it 19 is well within your discretion and I'd ask you to 20 exercise it to assure parody on a very complex case 21 because that's what they're talking about. 22 If they are talking about case 23 agents, I don't think we can limit it there. If, 24 in fact, their intent was to assist counsel to 25 allow in the particular case the assistance that is 19 1 required to effectively present the case before the 2 jury, and I think it is well within your discretion 3 to rule that in this particular case, that I'm 4 going to exercise my discretion to allow this 5 witness to remain in court because it is, whether 6 you say -- whether you determine it is important or 7 is essential to the State's presentation, wherever 8 we fall there, it is clearly a significant point 9 one way or the other to the presentation of the 10 case and that the Court can exercise discretion to 11 allow me to have him in the courtroom. 12 THE COURT: Mr. Sussman -- 13 MR. SUSSMAN: Your Honor -- 14 THE COURT: -- anything else? 15 MR. SUSSMAN: No, Your Honor. 16 Your Honor brought up the point, 17 which is a reasonable response to the request, that 18 you exercise your discretion to allow Mr. Cower sit 19 through, that calling Mr. Cower early in the case 20 might be an appropriate way of addressing that 21 particular issue. 22 THE COURT: Well, if I allowed him 23 to do that, there are other things that I would do 24 to try to protect the rights of everyone involved. 25 I think Mr. Tintera has made a case 20 1 out for having Mr. Cower sit here. I've read State 2 v. Cooper, both Court of Appeals and Supreme Court 3 version, and I don't know that on Page 170 they 4 mean what they say. I have taken language from 5 appellate decisions before to mean literally what 6 they say, then have my hand slapped and them say, 7 "Oh, no, we didn't mean that. That was dicta." 8 They say in there the State may 9 designate a person. Doesn't limit it to police 10 officers, does it? In this case, State v. Cooper, 11 it was a city policeman and they do analyze the 12 facts and say a city policeman really stands by 13 statute and same position as a state police officer 14 and previously said state police officer can be 15 designated as an officer. So even though they say 16 "person," they're dealing with police officers. 17 I'll start by saying if I take that 18 language literally to mean what they say there, 19 then the State can and may designate Mr. Cower as 20 their agent or officer to sit in on this trial to 21 assist in the prosecution of this case. And I'm 22 not restating everything that has been said here 23 about how essential that is and the complexity of 24 this case, because if the complexity of the case, 25 of the computer language and facts is not obvious 21 1 yet, it will be after the record is complete. 2 And so just based upon the statute 3 in State v. Cooper, I will permit the State to 4 designate Mr. Cower as its officer or agent and to 5 be exempt from the statute that provides for 6 excluding the witnesses upon the motion of a party. 7 Beyond that, though, as a back up, I 8 also believe that showing that a person -- having a 9 witness sit in and assist being essential to the 10 presentation of one's case should not be an 11 impossible burden. That essentially means 12 something less than certainty. 13 As Mr. Tintera has pointed out here, 14 he doesn't know for sure what the facts of the 15 defense will be, and it may be after the case is 16 all over, it will clearly show on the record that 17 it was essential beyond a reasonable doubt. Well, 18 it's a little late then, and so the Court has to 19 decide this based upon recitation made by counsel 20 and what I know of the case so far, and my belief 21 is, from what I've heard in pretrial motions, 22 et cetera, that Mr. Cower was involved in this case 23 pretty much from the beginning. He is the security 24 person from Intel and was involved and intimately 25 aware of all the facts in this case, and beyond 22 1 that, he's an extremely skilled computer person. 2 He's the one person that has been demonstrated to 3 me so far that embodies both of those skills and 4 could be of substantial assistance to an attorney 5 in both understanding the facts and the 6 professional jargon that might be used here by 7 computer people in their testimony. So I think I 8 need to exercise my discretion and permit him to 9 sit in. 10 Having said that, there are other 11 thoughts that enter my mind. One is, we ought 12 to -- I encourage Mr. Tintera to call Mr. Cower at 13 the earliest possible opportunity before he has an 14 opportunity to hear other witnesses testify. In 15 fact, if it isn't essential before the other 16 State's witnesses testify, maybe Mr. Cower ought to 17 sit outside until the first few witnesses testify. 18 I don't know that it would be necessary for him to 19 be here while other Intel employees or possibly a 20 police officer or two testify. 21 Secondly, I think -- I will digress 22 a bit. I think a parody is important. Obviously, @ 23 the defendant, I know, from everything I've heard, 24 is quite skilled in computer matters, to his 25 credit, intelligent young man and very skilled and 23 1 also, at least from the time the police were 2 involved here, is aware of many of the facts 3 involved in the case. And I think fairness, parody 4 really dictates that the State be given an 5 opportunity to have such a skilled person be 6 involved also. I'm not convinced that anybody can 7 fill that role except Mr. Cower, so I do exercise 8 that discretion in allowing Mr. Cower to be 9 available. 10 Does he need to hear the other 11 State's witnesses testify before he testifies? 12 MR. TINTERA: I would like him 13 present during Intel employees' testimony, yes. 14 That's the problem I ran into this morning. They 15 started talking about things that I just didn't 16 understand and I wasn't aware of. 17 THE COURT: The record will show 18 what we have done and I encourage you, for the 19 purposes of our record here, that might be reviewed 20 at some point, to call him at your earliest 21 possible opportunity. 22 I also keep in mind, something I've 23 observed over the last 25 or 30 years, when 24 witnesses are permitted to remain in court, there 25 certainly is a risk that they will -- we're always 24 1 concerned about people lying, making up testimony, 2 maybe something less than that, forgetting some 3 facts in order to make their testimony coincide 4 with the testimony of other witnesses that they 5 hear testify. That's the risk, certainly. 6 I'm also aware that Mr. Cower, also 7 not a police officer, is a professional security 8 person with Intel and in a fairly high position and 9 probably besides being subjected to penalty for 10 false swearing or perjury, subject to some form of 11 disciplinary action that anyone was aware he was 12 doing that sort of thing as part of his employment. 13 And, in addition, I'm also aware 14 that Mr. Tintera's request to have him sit in here 15 cuts both ways. I have an idea that Mr. Tintera 16 really wishes he didn't have to have him sit in 17 here because the fact that he will sit in here and 18 hear the testimony of other witnesses certainly may 19 result in some impeachment of his witnesses and 20 Mr. Sussman will have the opportunity, if he thinks 21 that Mr. Cower is testifying in a fashion that 22 makes his testimony dovetail with other witnesses, 23 to point out the fact that, either in 24 cross-examination or argument, that Mr. Cower sat 25 in here and heard every one of them testify. 25 1 And so the fact that Mr. Cower sits 2 in here does -- although he's here to assist 3 Mr. Tintera, the defense will have an opportunity 4 to impeach him by reason of that fact. 5 Having said everything, I will 6 permit him to sit in. 7 The second matter, the videotape, 8 briefly. Anything else on that? 9 MR. TINTERA: No, Your Honor. 10 THE COURT: Mr. Sussman, it's a 11 great videotape. I understand a lot more about 12 computers than I did before, but looks like a 13 perpetuation deposition that Mr. Tintera didn't 14 have a chance to sit in on. You're going to call 15 your witness anyway. Except for great graphics, 16 that's what it sounds like. 17 If I was involved in a medical 18 malpractice case or personal injury case and an 19 expert witness was not available to testify at the 20 time of trial, that's exactly what I'd see -- the 21 plaintiff or the party presenting the witness, 22 that's exactly what I would see in the form of a 23 videotape. And the request -- the request for 24 perpetuation deposition would be taken and that's 25 what it looks like to me, perpetuation deposition 26 1 without notice to the other side, without giving 2 him an opportunity to be present and ask questions 3 and cross-examine the witness, and then that's 4 what -- that's my observation. 5 MR. SUSSMAN: Your Honor, we see it 6 as an essential foundation for the overall 7 presentation of the witness' testimony, 8 particularly dealing with the more specific 9 case-related issues. 10 There is -- as a preliminary matter, 11 we would ask to be allowed to show that to the 12 jury. If the Court believes that it is too much in 13 the form of testimony to be allowed as an exhibit, 14 I believe that because the witness is still here 15 subject to cross-examination that any voice-over in 16 that that goes with the animation, with the 17 demonstration, which is necessary, is a necessary 18 foundation and sets the stage for the other 19 testimony and should be allowed. 20 Mr. Tintera has the advantage of 21 having the transcript on that and can review that, 22 been able to review that and deal with his experts 23 in terms of whether that's accurate and can 24 cross-examine on those things. If there are 25 certain remarks, introductory remarks about taking 27 1 this with you and looking at it again, that can be 2 very easily erased in terms of that voice-over 3 portion of the tape so there is no suggestion that 4 the jury -- if the jury will take that with them, 5 so that the videotape can be used as a 6 demonstrative aid to the overall testimony and 7 rather than have -- I think it would move that 8 testimony along. 9 It would ease the presentation to 10 use the videotape as the foundation rather than go 11 through this in terms of questioning so that it can 12 be -- effectively present the diagrams, the charts, 13 the graphics in there to explain to the jury what 14 we all are aware of and have discussed at great 15 length, very complicated and technical issues which 16 we have all struggled to grasp. 17 So I would suggest that even if the 18 Court were to find that this is in the form of -- 19 this is something that is too much in the form of 20 testimony to be allowed as an exhibit, that we be 21 allowed to present it as part of the witness' 22 presentation, and the witness will be here subject 23 to cross-examination on all aspects of the 24 presentation, including the voice-over narration 25 parts on the videotape, which is one thing that 28 1 Mr. Tintera has had now, once it was completed, 2 will have had more than a week to examine and 3 consult with his experts for its accuracy and to be @ 4 able to cross-examine on that. 5 THE COURT: Thank you. Mr. Tintera. 6 MR. TINTERA: I'm not going to 7 reiterate my arguments. But having it four days in 8 this type of case just doesn't cut it, in my mind. 9 And whether it's a week -- this case is a year and 10 a half old. To get that a week before trial is -- 11 especially with the other things that I've already 12 alerted to the Court, it's just not fair. 13 THE COURT: Has that tape been 14 marked as an exhibit? We need to have it marked. 15 THE CLERK: Defendant's Exhibit 101. 16 THE COURT: Talking about the 17 videotape that is now marked Exhibit 101. And this 18 is a pretrial motion regarding its admissibility on 19 the objection of the State primarily because it was 20 disclosed late on. And I previously said and it's 21 clear to me that this is not something that 22 Mr. Sussman had for months and just sat on and 23 slipped it in as discovery a minute before -- day 24 or two before trial, but something that they have 25 been working on and unfortunately wasn't completed 29 1 until just at the time of trial. 2 I don't think that it's appropriate 3 that the Court should take time now during the 4 trial to go through the videotape and redact out, 5 as objections may be made, certain portions of it 6 that may be objectionable, and there are portions 7 of it that are. It could qualify as -- a 8 substantial portion of it could qualify as 9 demonstrative evidence, but the advice here that it 10 has not been submitted so the State can review it, 11 analyze it and determine how to react to it in -- 12 whether producing another videotape or bringing in 13 some other witness, the diagram or whatever, to 14 rebut portions of it, it's just too far down the 15 road to do that. 16 I would encourage counsel in the 17 future in preparing such exhibits to have them done 18 well before trial so that any of these difficulties 19 can be ironed out so that the exhibit can be used. 20 I also keep in mind that the witness 21 that is to testify, the expert who is on the 22 videotape will be present and may testify. I know 23 that cuts both ways, because Mr. Sussman has said 24 that if Mr. Tintera wants to cross-examine him, he 25 will be here to do that. On the other hand, he can 30 1 say virtually everything, with some exception, that 2 he said on the videotape. The only thing we lose 3 are the graphics involved, which are good, but 4 having reviewed it, I think the concepts embodied 5 in his testimony is on the tape and certainly can 6 be communicated to the jury without the graphics, 7 at least without the graphics that are on the 8 videotape and the witness would have the 9 opportunity to use the blackboard or paper or 10 whatever to draw any diagrams and that sort of 11 thing. 12 I understand the defendant has 13 probably spent a substantial amount of money having 14 this thing produced. That's not a criteria for me 15 to use in deciding whether or not to permit it to 16 be admitted. On balance, I am considering this and 17 ruling that it may not be shown to the jury, so I'm 18 allowing the State's motion. 19 MR. SUSSMAN: Your Honor, would the 20 Court permit, as Mr. Tintera suggested, the showing 21 of the graphics portion of the videotape? Seems to 22 me -- 23 THE COURT: If we can work out the 24 mechanics so that can be done, the graphics of it 25 are good, obviously. I looked at them. I think 31 1 they are helpful. I'm wondering about mechanically 2 how we're going to do that, whether they be -- the 3 question I had with all the brilliant computer 4 people here, couldn't you reproduce most of those 5 graphics on a chart or diagram that he could use at 6 an easel instead of chopping the tape up and 7 turning it off and on, and et cetera, as we go 8 through this? 9 MR. SUSSMAN: If we can present -- 10 eliminate the voice-over, the -- what I'll call the 11 talking head portion and have a videotape of the 12 graphics and that we run the -- during appropriate 13 times in relation to questions -- 14 THE COURT: I'd be open to that 15 possibility, if we can do it mechanically so that 16 it's not difficult. In other words, when I've had 17 videotapes before, we have tried to start and stop 18 and that sort of thing and it runs into difficulty. 19 There are a dozen or so key graphic 20 presentations during the tape and I'm wondering if 21 it wouldn't be easier, now that I have ruled as I 22 have, to salvage those by somehow having a computer 23 printout and having them enlarged and using an 24 easel and having the witness step down and use 25 those during his presentation instead of trying to 32 1 show them on a monitor. 2 MR. SUSSMAN: I'm trying to 3 determine the scope of what we're limited to here. 4 THE COURT: Sure. I'll consider the 5 graphics portions of it -- you certainly could use 6 it -- if we can do it in an appropriate fashion. 7 I'd suggest you think in terms of having it printed 8 out. 9 Anything else? 10 MR. SUSSMAN: May I have a moment 11 with Mr. Tintera? 12 THE COURT: Sure. 13 (Discussion off the record 14 between counsel.) 15 MR. SUSSMAN: Your Honor, there is 16 the one other issue that Mr. Tintera and I have and 17 I've not had a chance to sit down with him to cover 18 yet. It's trying to work out the telephone 19 testimony of the out-of-state witness. 20 THE COURT: That will be during your 21 case? 22 MR. SUSSMAN: Yes. 23 THE COURT: See if you can resolve 24 that. 25 MR. TINTERA: My position has been, 33 1 if counsel would let me know what was going to be 2 asked of this witness, I could answer the question, 3 and I'm still waiting. 4 THE COURT: Well, keep working on 5 that. See if you can't resolve that. 6 MR. TINTERA: I do have one other 7 matter. During defendant's opening statements, to 8 put this in perspective, the Court had granted the 9 motion in limine to prohibit any reference to the 10 defendant's hacking or password-cracking activities 11 at Tektronix. The Court granted that motion in 12 limine. However, yesterday, in front of the jury, 13 the defendant's counsel indicated that he was an 14 employee at Tektronix and he did an exemplary job, 15 that he was very valuable to Tektronix. 16 Now, I believe the defense has now 17 opened the door to allow me to attack that 18 position. They shouldn't have brought up Tektronix 19 at all, and I didn't think they were in front of 20 the jury. Now that they have, I think that they've 21 opened the door and now I can walk through that 22 door. 23 THE COURT: Well, I'll think about 24 that one. I'll take that under advisement. I 25 don't have to rule on that yet. 34 1 MR. TINTERA: I'm not so sure. The 2 witness we were talking about, one was Jim Lilley, 3 and he is my first witness. 4 THE COURT: Does he have personal 5 knowledge? 6 MR. TINTERA: The defendant told 7 him. 8 THE COURT: Told him what? 9 MR. TINTERA: That he had been 10 cracking passwords while he was working at 11 Tektronix and that he had been suspended two weeks 12 for it. 13 THE COURT: Officer Lilley doesn't 14 plan on taking any vacation during the trial, does 15 he? 16 MR. TINTERA: He does, actually. 17 After his testimony this morning, he's going to 18 Bend. He will be back next week, however. 19 THE COURT: I'm not going to rule on 20 that just yet. I would caution counsel to, both of 21 you, be aware of what you're doing. You're both 22 experienced, obviously, but the open doors, 23 sometimes trucks get driven through them, so that 24 argument has a nice ring to it. 25 I haven't heard response from 35 1 Mr. Sussman yet. I suggest he will think -- I'm 2 sure he will have one. Evidence in opening 3 statements is usually brought out. I'd like to 4 wait to see what the evidence is brought by the 5 defense before I consider what sort of evidence on 6 that issue might be produced by the State, likely 7 on rebuttal. So I have some time to consider that 8 before I would do that. 9 Anything else? 10 MR. TINTERA: No, Your Honor. 11 (Whereupon, the following 12 proceedings were held in 13 open court, the jury being 14 present, at 10:20 a.m.:) 15 THE COURT: Sorry we had you in 16 there so long, ladies and gentlemen. Counsel 17 showed up, I asked them last night to show up at 18 9:15 because we had final matters to discuss and I 19 had to make decisions on matters that I thought 20 would take 15 minutes. Took an hour. I apologize. 21 We weren't reading the sports page or anything like 22 that while you were waiting. 23 I don't want you to guess what we 24 were doing, but as you might expect, from time to 25 time, I have to make decisions about evidence and 36 1 procedures and that sort of thing, and we 2 accumulated some that hadn't been decided yet and I 3 had to do that and needed to rely on argument and 4 consider the law and it took a while. I like to 5 keep that at a minimum during the trial and 6 sometimes it happens -- did this morning -- and 7 probably will happen again. We try to minimize it. 8 You've heard the opening statements 9 and now we're prepared to begin with the evidence. 10 So, Mr. Tintera, your first witness. 11 MR. TINTERA: That will be James 12 Lilley. 13 14 JAMES LILLEY 15 called as a witness on behalf of the Plaintiff, 16 having been first duly sworn under oath, was 17 examined and testified as follows: 18 19 THE CLERK: State your full name and 20 spell it for the record, please. 21 THE WITNESS: My name is Jim Lilley. 22 L-i-l-l-e-y. 23 24 25 37 1 DIRECT EXAMINATION 2 BY MR. TINTERA: 3 Q Mr. Lilley, you are employed with the 4 Sheriff's Department of Washington County? 5 A Yes, I am. 6 Q In what capacity? 7 A Senior Deputy working in investigations. 8 Q And how long have you been in law 9 enforcement? 10 A 17 years. 11 Q And in the course of your -- have you had 12 any training in regard to being a Senior Deputy or 13 investigator? 14 A Yes, I have. 15 Q During your 17 years, have you had 16 occasion to interview people who are suspected of 17 engaging in criminal conduct? 18 A Yes, I have. 19 Q And have you had any training or 20 experience in regard to how to accurately make 21 notes or memorialize those type of statements? 22 What do you do? 23 A Yes, I've had the training. Basically 24 what I do is conduct the interview, make notes of 25 the interview as I go along, and based on those 38 1 notes, generate a report that reflects the content 2 of the interview and then reduce that to writing so 3 that if it's down the road when I need to refer to 4 it, I'll have the information that I obtained at 5 that time. 6 Q If I can take you back to November 1st of 7 1993, did you have an occasion to be called to the 8 Intel Corporation here in Washington County? 9 A Yes, I did. 10 Q And where did you go? 11 A I went to the Intel facilities on Cornell 12 Road, Hawthorn Farms I believe is the name of that 13 particular complex, and met with Intel people 14 there. 15 Q In the course of your meetings, did you 16 eventually draft an affidavit for a judge's review 17 in regard to searching particular areas? 18 A Yes, I did. 19 Q And did one of those areas involve the 20 home of Randal Schwartz? 21 A Yes, it did. 22 Q And which judge authorized that search, 23 do you know? 24 A (Pause) I don't recall now. 25 Q When was the search warrant served on 39 1 Mr. Schwartz's residence? 2 A November 1st, 1993, at 6:35 p.m. 3 Q And where was the residence located? 4 A The residence was at 12290 Southwest 5 Butner Road, which is unincorporated Washington 6 County in the State of Oregon. 7 Q Who was present, not with the Police 8 Department but in the residence when you got there? 9 A Mr. Randal Schwartz and his brother. 10 Q Now, were they in custody, handcuffed? 11 A No. 12 Q But did you do anything to let them know 13 what their rights might have been? 14 A Yes, I did. 15 Q And what would that have been? 16 A I read the Miranda rights that I carry 17 and always read from a card. 18 Q Can you tell the jury what those rights 19 are? 20 A Yes, I can. I prefer to read them from 21 the card that I use. That's the only way that I 22 ever read them. 23 Q All right. 24 A "You have the right to remain silent. 25 Anything you say can and will be used against you 40 1 in a court of law. You have the right to talk to a 2 lawyer and have him or her present with you while 3 you are being questioned. If you cannot afford to 4 hire a lawyer, one will be appointed to represent 5 you before any questioning, if you wish." At which 6 point I ask each person who is present if they 7 understand those rights as I read them to them. 8 Q What about Randal Schwartz, what did he 9 say? 10 A He verbally indicated that he understood 11 the rights that I read to him. 12 Q And he was cooperative with the 13 investigation? 14 A Yes, he was, as a matter of fact. 15 Q Did you speak with him about the reason 16 you were there? 17 A Yes, I did. In fact, as is usually the 18 case when we serve the search warrant, the first 19 thing that people want to know is why are we there 20 and what are we doing? What's going on? And as is 21 usually the case, I took that opportunity to tell 22 Mr. Schwartz exactly why we were there. 23 Q What did you tell him? 24 A I told Mr. Schwartz that I had been out 25 at the Intel Corporation earlier in the day. That 41 1 I had talked with the Intel employees who had told 2 me that they, in essence, were accusing him of 3 breaking into computer systems, obtaining passwords 4 from those computer systems, and that this was 5 activity that he was not -- that they were alleging 6 that this was activity that he was not authorized 7 to do and was not allowed to do. 8 And I explained to Mr. Schwartz that 9 the reason that I was here was to, in effect, get 10 his side of the story, find out if what Intel was 11 telling me was the truth or not, or if there was a 12 different way to look at what Intel was telling me 13 from Mr. Schwartz's point of view. 14 Q And after you explained that to 15 Mr. Schwartz, then what happened? 16 A I explained to him what Intel was 17 alleging and that he accessed these two computer 18 systems without authorization where he was not 19 supposed to be doing it, that he was obtaining 20 password files that he was not entitled to, that he 21 was not supposed to do. And Mr. Schwartz's 22 response to that was that yes, in fact, he had done 23 the things that the Intel people were alleging that 24 he had done. 25 He went on to explain to me that the 42 1 reason that he had done that was in order to be 2 able to get access to his e-mail from within the 3 workplace instead of having to wait until he got 4 home to do it and that that was the reason why he 5 was accessing these systems and trying to get 6 passwords. 7 Q Now, was there any further questioning or 8 further explanation that Mr. Schwartz provided to 9 you about that? 10 A Yeah. We went back through that. When 11 he was telling me about accessing the e-mail or 12 trying to access the machines to get his e-mail 13 access, he told me that he knew what he was doing 14 was against Intel policy. And, in fact, I'll use 15 his exact words, "technically illegal." But he 16 again reiterated that his whole intent was just to 17 be able to access his computer mail from his 18 workstation rather than go back home. 19 Q Now, when you -- before he started 20 talking about his e-mail, did you go through the 21 sequence of information that you knew about his 22 activities on the computers Mink and Brillig with 23 him? 24 A I think when we started after this 25 initial conversation, that's when we started to get 43 1 into the specifics of it and that's when we 2 discussed the Mink system, and then we went on to 3 discuss Brillig and SSD. 4 Q Could you tell the jury about that, 5 please? 6 A We started back from scratch again and I 7 asked him about the password cracking program 8 called Crack and accessing Brillig at Intel's 9 Supercomputer Division. Mr. Schwartz admitted to 10 me that he had accessed the Brillig and for SSD and 11 told me the reason for doing that was to check the 12 security systems of those two systems to see 13 whether they were hardened enough to prevent other 14 people from doing what he was attempting to do, and 15 that was his purpose in doing that. 16 We started to get into more detail 17 on that. Mr. Schwartz told me that he had been 18 accessing Intel's Mink system by a method that he 19 referred to -- and I use his word -- back-dooring, 20 until about April of 1993. He stated again that 21 this was in order for him to be able to access 22 electronic mail at his workstation. But then he 23 also told me that while he was conducting this 24 back-dooring, he knew it was against Intel policy 25 and could possibly be considered a criminal act. 44 1 Mr. Schwartz admitted to me that he 2 had been contacted by Mark Morrissey and Dirk 3 Brandewie way back in April of 1993 about his 4 activities with the Mink system and accessing it, 5 and at which time they had told him that he had to 6 restore the system back; in other words, put the 7 gate or the blocks back onto the system because he 8 wasn't supposed to be doing that and didn't want 9 anybody else doing it, either, and that he, in 10 fact, did do that. 11 He then told me that he started 12 trying to use some other process to attempt to 13 crack passwords, found that they weren't very 14 efficient and, in fact, then went back and removed 15 the gates or again began to back-door the Mink 16 system. At which point, Mr. Schwartz told me that 17 about in July of 1993, he was again contacted by 18 Mr. Morrissey and Mr. Brandewie, who had conducted 19 follow-up checks on the Mink system, and they had 20 found that he had removed the gates again and was 21 doing what he had been told not to do in April and 22 that he was, again, in July was told to put those 23 gates back on and not to go back into that system. 24 We then went on to discuss about his 25 accessing to the Brillig system and the SSD system 45 1 and the use of the Intel Snoopy system, which I 2 needed him to explain to me. 3 Q Let me stop you for a minute. How 4 computer literate were you at this time? 5 A Not very. In fact, basically not. 6 Q Did you use -- Did you have to resort to 7 people to help you understand what it was that was 8 being explained to you? 9 A Yes, I did. In fact, I had two or three 10 Intel employees in the room with me throughout the 11 questioning process. They weren't always the same 12 three people or all three people, but there was 13 always somebody there from Intel who could help me 14 understand the answers I was getting from 15 Mr. Schwartz because -- I liken it to using an 16 interpreter for someone to doesn't speak English. 17 Q How do you know that what you got from 18 Mr. Schwartz was accurate? 19 A Because I made notes at the time of the 20 interview, notes of the terms that he used, and 21 made sure that I understood at least the outline of 22 what he was talking about so that I could reduce 23 that to writing and make it understandable not only 24 for myself, but anybody else who would be reading 25 my reports. 46 1 Q So from those notes, you generated a 2 report? 3 A That's right. 4 Q Is that what you have in front of you? 5 A That's what I'm referring to through 6 here, yes, is the report that I wrote. 7 Q So after the talk about his activities on 8 the Mink computer in July of 1993, you went to 9 talking about the Brillig computer in the SSD 10 division at Intel? 11 A That's correct. 12 Q What did he tell you about that? 13 A He then started to give me some more 14 information about what he was doing with the 15 Brillig and SSD computer systems and how he was 16 doing it and the reason he was doing it. 17 At this point, he told me he was 18 using the Intel Snoopy system to speed up the Crack 19 program because, apparently, if you don't have fast 20 enough equipment or fast enough system, it takes a 21 very, very long time to run that program to attempt 22 to crack passwords. 23 And it was at this point that 24 Mr. Schwartz acknowledged to me that, again, it was 25 not -- not only what he was doing was against Intel 47 1 policy, but that there -- but that he knew in his 2 own mind what he was doing was a criminal act. 3 That he could be held criminally liable for this 4 specific activity. But -- 5 Q And that was in reference to what? 6 A To running the Crack program to try to 7 access or obtain passwords from the Brillig system 8 and the SSD system. 9 Q And then what did you talk about? 10 A At this point, Mr. Schwartz again was 11 adamant with me that the reason that he was running 12 these programs and trying to crack the passwords 13 was to find out how security-hardened the two 14 systems were against exactly that kind of activity. 15 However, he also acknowledged that another reason 16 he was doing that was that he was working under 17 contract in the Brillig system and that his 18 contract was soon due to expire, at which point his 19 personal password for that system would be revoked 20 and he was trying to get alternative passwords to 21 the Brillig system so he would be able to continue 22 to access it even after he had finished working on 23 it and his contract to do that had expired. 24 Q Let's stop here. He said what about 25 alternative passwords? 48 1 A That the reason he was running the Crack 2 password program against Brillig specifically was 3 because his contract, the Brillig account contract 4 that he was working on was soon to expire and when 5 it did expire, he had to turn -- he had to 6 relinquish his password. He lost his personal 7 password. And so what he wanted to do was to make 8 sure that even after he had officially stopped 9 working on that system, he would still be able to 10 access it by using one of the passwords he was able 11 to obtain by running the Crack program against the 12 Brillig system. 13 Q Someone else's password? 14 A Somebody else's password. 15 Q You've mentioned the Mink computer, the 16 Brillig computer, the Supercomputer Division. Are 17 those portions or parts of Intel located in 18 Washington County, State of Oregon? 19 A Yes, they are. 20 Q What was your understanding when he was 21 talking about the Crack program, what is a Crack 22 program, do you know? 23 A I certainly didn't at that time. I 24 learned very quickly, both prior to contacting 25 Mr. Schwartz and then through talking with 49 1 Mr. Schwartz. In fact, Mr. Schwartz kind of helped 2 me further understand the Crack program and how it 3 was used and what it was used for. 4 Q So what does it do? 5 A It's a program -- as best that I can 6 understand and try to explain to anybody else, 7 basically is a program that deluges the system with 8 multiple variations of numbers and letters and 9 codes until one of those combinations comes up and 10 will access that system. 11 Q So it deciphers codes? 12 A Yeah. 13 Q Now, after you had this interview with 14 Mr. Schwartz, we talked about what you've told the 15 jury. While you were having the interview, were 16 you doing anything to keep track of what 17 Mr. Schwartz had told you? 18 A Yes, I was. I was making notes. I had a 19 yellow pad and I would make notes of specific 20 responses to questions or specific statements, 21 either as a result of -- in response to a question 22 or that were voluntarily made. 23 Q Well, in your report, for instance, you 24 have in quotes in regard to Mr. Schwartz's 25 statements "technically illegal." Why is that in 50 1 quotes? 2 A Because that was the exact words that 3 Mr. Schwartz used when we were talking about the 4 allegation that Intel was making about his activity 5 with the Brillig -- with Mink and Brillig and SSD. 6 Q And how long did you talk to 7 Mr. Schwartz? 8 A We were probably in interview for two 9 hours. 10 Q And after the interview was over, in 11 regard to your report, what did you do to generate 12 your report? 13 A Once we had finished serving the search 14 warrant, I had finished the interviews, we went 15 back to the Sheriff's Office to log the evidence. 16 And in this particular instance, I went back to my 17 desk and sat down with my tape recorder and I 18 dictated the results of my interview, the contents 19 of my interview onto tape so that -- while it was 20 fresh in my mind so that it could be typed up the 21 next day by the secretaries and then I could review 22 it and make any editing processes to it after the 23 fact. 24 But I -- because I was not computer 25 literate, because I did not -- that some of my 51 1 understanding of what was being told to me was very 2 temporary, I was understanding it at the time but 3 was not confident that I would necessarily fully 4 understand it the next morning, I wanted to get 5 everything down on tape while it was fresh in my 6 mind, while I could recollect it all accurately, 7 and so that's what I did. And once that was on 8 tape, that was it. We all went home for the day. 9 Q When you did the tape, did you rely on 10 your memory to make sure you were accurate in 11 creating the tape which later turned out to be your 12 report? 13 A No, I used my notes. And the reason I 14 used my notes is, when I dictate my reports, I 15 always -- my narrative always runs chronologically. 16 In other words, I did this, this is when I did this 17 thing, all the way down the line in chronological 18 order. 19 My notes, while cryptic, are also in 20 chronological order of the interview. In other 21 words, as statements are made and I make notes on 22 those statements, there is a chronological order to 23 them. And I used those notes to create this report 24 and to keep it in chronological order and to make 25 sure that I was not forgetting something that 52 1 needed to go into the report. 2 Q When you were talking about after he had 3 cracked the passwords for the Supercomputer 4 Division computers, did you ever talk to 5 Mr. Schwartz about whether he had used those 6 passwords? 7 A Yes, I did. 8 Q Could you tell the jury what he said 9 about that? 10 A Mr. Schwartz was adamant that at no time 11 did he ever access any of the files using any of 12 the cracked passwords that he obtained through the 13 Crack program. He was very adamant about that. 14 Q Did that discussion go any further as to 15 whether he had in the past accessed files? I'm 16 talking about the IWARP system. 17 A I don't recall him ever at any point 18 stating that he had ever used Crack passwords to 19 access any system that -- 20 Q What did he say about the IWARP system? 21 A He told me that he had previously worked 22 at an organization called IWARP, which he described 23 as being a subsidiary of Intel, and that he, in 24 fact, accessed files in that IWARP system through a 25 program called Root. And he did say at that time 53 1 he had taken the further step of actually viewing 2 information from files that he had accessed. 3 Q Did he indicate, in regard to that 4 particular activity, whether he knew that was 5 illegal or against Intel policy? 6 A He admitted to me that he knew that was 7 both against Intel policy and also was illegal. 8 MR. TINTERA: Those are the only 9 questions I have. 10 THE COURT: Mr. Sussman. 11 MR. SUSSMAN: Thank you, Your Honor. 12 13 CROSS-EXAMINATION 14 BY MR. SUSSMAN: 15 Q Detective Lilley, you testified that you 16 were -- when you began this investigation, this was 17 approximately two years ago now, so you had been 15 18 years a police officer, but your familiarity with 19 computers, computer crimes, material you're dealing 20 with in this case was almost nonexistent; is that 21 right? 22 A That's correct. 23 Q And, in fact, this is the first computer 24 crimes case that you had been involved in at the 25 time? 54 1 A That's correct. 2 Q When you were called to go to Intel to 3 meet with them on November 1st to take a report 4 about what happened, you really had no 5 understanding about the nature of the systems they 6 were talking about, correct? 7 A At the time that I arrived, that's 8 correct. 9 Q And you had trouble understanding what 10 you were being informed about, the nature, even the 11 activities that were going on? 12 A It certainly took me a while to be able 13 to grasp what it was that they were telling me, 14 specifically understanding terminology and making 15 distinctions between things like systems and 16 programs and things like that. 17 Q And you had to rely on the Intel people 18 to explain to you what had happened and what the 19 significance of that was; is that right? 20 A That's correct. 21 Q At the time that you arrived there and 22 began this investigation, in fact, you were told 23 that the Intel people had done an investigation and 24 were reporting to you that in their view, 25 Mr. Schwartz had committed illegal acts in 55 1 violation of Oregon statutes; is that right? 2 A I don't recall whether they were -- 3 whether Intel was specifying that they had -- that 4 he had violated specific Oregon statutes or whether 5 that was something that we looked at during the 6 process of taking the report. 7 Q Well, you prepared an Affidavit for 8 Search Warrant in which you had to swear to under 9 oath, correct? 10 A That's correct. 11 Q And the second paragraph of the 12 affidavit, you said that when you spoke with Mark 13 Morrissey, senior engineer at Intel, he advised you 14 that he had found evidence of violation of ORS 15 164.377, computer crimes, at Intel Corporation, 16 with the address. That's what you stated in your 17 sworn affidavit; is that correct? 18 A That's correct. 19 Q So was that not accurate then? 20 A No. What that is reflecting is that when 21 I was talking with Mr. Morrissey -- 22 Q The question is, was that accurate? Is 23 that exactly what Mr. Morrissey told you? 24 A I don't recall if that's exactly what he 25 told me or whether that was what the two of us 56 1 determined had taken place. 2 Q So that was your interpretation of what 3 he told you? 4 A In one sense, yes. 5 Q Now, you took pains to understand what 6 you were being told by the Intel people before you 7 prepared this affidavit; is that correct? 8 A That's correct. 9 Q And in the particular affidavit, you 10 indicated that in one place that Mr. Schwartz -- 11 let me withdraw that. We'll come back to that. 12 Now, let me back up. Would you 13 describe briefly for the jury what the 14 participation of the various Intel employees were 15 in the preparation of the search warrant affidavit? 16 Who did you meet with first? 17 A I don't now recall who I met first and in 18 what order I spoke with them, primarily because 19 most of them were already there as a group and I 20 was getting information from all these people. The 21 exact order of obtaining that information, I don't 22 recall, and my affidavit is not going to reflect 23 that. What my affidavit is going to reflect is the 24 substance of what I was told by the various named 25 individuals employed by Intel. 57 1 Q So you don't remember exactly what was 2 said in the preparation of that search warrant 3 affidavit? 4 A Not specific quotes. I couldn't make 5 specific quotes, no. 6 Q Did you check into Mr. Schwartz's 7 background before obtaining that search warrant 8 affidavit? 9 A Not an independent check. I made no 10 specific inquiry into Mr. Schwartz's background. 11 Q Did Mr. Morrissey, when you were 12 preparing that affidavit, did he tell you what 13 Mr. Schwartz's position was at Intel? 14 A Yes, he did. 15 Q And what did he tell you? 16 A I'm going to have to refer to the 17 affidavit now -- 18 Q Please do. 19 A -- to be specific. 20 Q Please do. 21 A You're referring to what went into the 22 affidavit, correct, or are you talking about my 23 report? 24 Q No. I asked you specifically if -- when 25 you prepared the affidavit, whether Mr. Morrissey 58 1 told you what Mr. Schwartz's position was at Intel. 2 A In rereading through the affidavit here, 3 I don't see where they told me specifically what 4 Mr. Schwartz's job was at Intel. What they told me 5 was what he was not entitled to. 6 Q They just told you that he worked there? 7 A That's correct. 8 Q Did Mr. Morrissey tell you specifically 9 what his own position was? 10 MR. TINTERA: Objection. I don't 11 see how this was raised by any of the questions 12 that I went into with this witness. 13 THE COURT: I think it's within the 14 realm of cross-examination and proper. Overruled. 15 MR. TINTERA: Thank you. 16 THE WITNESS: Mr. Morrissey told me 17 he was a senior engineer with Intel. 18 BY MR. SUSSMAN: 19 Q Who else was at that -- did you meet with 20 that morning? 21 A John Kent. 22 Q Did John Kent tell you what his position 23 was? 24 A Yes, he did, Systems Network 25 Administrator for SSD. 59 1 Q Who else did you meet with? 2 A Mr. Rich Cower. 3 Q Anybody else? 4 A There were other people there, but 5 they're not mentioned in the affidavit. 6 Q Did Mr. Morrissey tell you what a Systems 7 Administrator does? 8 A Just told me what part of his duties 9 were. Didn't give me a full job description of 10 exactly what it was that he did. 11 Q Did Mr. Kent tell you what a network 12 administrator was? 13 A No, I don't believe he did. 14 Q Were you told that -- Did anybody tell 15 you there that Mr. Schwartz had a contract at Intel 16 that allowed him to do work when he was not 17 actually at the Intel site? 18 A I don't recall at this time. 19 Q Okay. Detective Lilley, do you recall 20 testifying in this courtroom in hearings related to 21 this case about a month ago, on June 13th, 1995? 22 A Yes. 23 Q And at that time, do you recall being 24 asked the question, "Did any of the Intel personnel 25 inform you that Randal Schwartz worked on Intel 60 1 business from home?" And you answered, "I believe 2 that I recall that they did say that." 3 A At another point in time, they did, but 4 as far as what went into the affidavit at the time 5 I was doing the affidavit, that was not information 6 that was included in the affidavit. And I don't 7 recall whether I had that information at the time 8 that I was doing the affidavit as opposed to the 9 time later during the investigation. 10 Q That question followed the question when 11 I asked you during the investigation of the reports 12 from Intel and in preparing your search warrant, 13 whether you were asked -- told what Mr. Schwartz's 14 position was at Intel and then whether he was 15 authorized to do work from home. Do you recall 16 that now? 17 A Not without referring to the transcript, 18 no. 19 Q Do you recall saying that -- When you 20 were gathering up this information, this 21 information was new to you and you were trying to 22 assimilate a great deal of new information, 23 correct? 24 A Correct. 25 Q A lot of information you were not 61 1 familiar with? 2 A That's correct. 3 Q And, for example, that you were trying to 4 understand basically in broad strokes? 5 A That's correct. 6 Q And that is, in essence, again, because 7 of your understanding of computers and computer 8 systems and their operation was limited? 9 A Is what? 10 Q Is very limited. 11 A That's correct. 12 Q And you had trouble at times following 13 what you were told -- 14 A That's correct. 15 Q -- and the information that was given to 16 you? 17 A That's correct. 18 Q When you were interviewing Mr. Morrissey 19 in preparation for the interview, did he tell you 20 that Mr. Schwartz was security conscious? 21 A Yes, he did. I believe so, yes. 22 Q And did he tell you what that meant? 23 A My understanding at that time was that he 24 had experience in the field of security. That he 25 understood the need for security, why it was set 62 1 up. And I believe at that time he said that 2 they -- I just lost my train there. Give me the 3 question again. I'm sorry. 4 Q You were explaining -- telling me whether 5 Mr. Morrissey explained what that meant, what that 6 meant when he said that Mr. Schwartz was security 7 conscious. 8 A That he understood security, why it was 9 there, and that, in fact, he -- one of his areas of 10 expertise was in establishing security systems. 11 Q And he communicated to you that 12 Mr. Schwartz was very clever when it came to 13 computers? 14 A That's correct. 15 Q And that he was very sophisticated in 16 network security? 17 A Yes. 18 Q And that he had previously worked in that 19 area? 20 A Yes. 21 Q And other areas of Intel? 22 A I don't specifically remember whether it 23 was in other areas of Intel or not, to be honest 24 with you. 25 Q And he told you that in the context of 63 1 Mr. Schwartz that he was a contractor for them and 2 did very sophisticated work for Intel? 3 A That's correct. 4 Q And that, in essence, that Mr. Schwartz 5 was very savvy about computers and computer 6 security? 7 A Yes. 8 Q And did he tell you that Mr. Schwartz was 9 certainly sophisticated enough to know how to cover 10 his tracks if he were trying to break into a 11 system? 12 A I don't specifically recall that at that 13 point. 14 Q But you recall being told that? 15 A At some point in time, yes. But not 16 necessarily at that point in time. 17 Q Now, did Mr. Morrissey tell you that when 18 he discovered this Crack program running, which 19 they were reporting to you that Mr. Schwartz was 20 running that program under his own user identity; 21 is that correct? 22 A That's correct. 23 Q And it was on the machine that was 24 running the program that was clearly marked 25 "Crack"; is that correct? 64 1 A I believe so, yes. 2 Q And was running it against a file that 3 was clearly marked "password SSD"? 4 A Yes. 5 Q And completely out in the open? 6 A That's correct. 7 Q And at that time, did he tell you that 8 Mr. Schwartz, as of the date that you met with him, 9 had not removed a Crack program from his files? 10 A That's correct. 11 Q And he had not removed any of the 12 password files from his files? 13 A That he had not? 14 Q That he had not removed the password 15 files, themselves, that the Crack was running 16 against from his files? 17 A That's correct. 18 Q And he told you that those password files 19 had been copied from the password file that was in 20 SSD; is that correct? 21 A I believe so, yes. 22 Q And the original password file was still 23 at SSD? 24 A That's correct. 25 Q The password that Mr. Schwartz had used 65 1 to look at that password file was still at SSD? 2 A That's correct. 3 Q And Mr. Schwartz had merely copied them? 4 A That's correct. 5 Q At the time that you prepared the search 6 warrant affidavit and obtained the search warrant, 7 did the people at Intel tell you that they had made 8 any effort to determine whether or not Mr. Schwartz 9 had looked at the material in the files behind the 10 Crack passwords? 11 A My understanding was from them at that 12 time that they were -- they would not necessarily 13 know if he had or not. 14 Q In fact, they were worried that 15 Mr. Schwartz had cracked the passwords in order to 16 get into those files to take sensitive information; 17 is that right? 18 A They expressed their concern as the 19 potential for him to do that. 20 Q In fact, you had a discussion with 21 Mr. Cower in which he told you that Mr. Schwartz 22 had a portable laptop computer? 23 A That's correct. 24 Q And that based on his experience, he 25 would expect that Mr. Schwartz would copy material 66 1 from those files onto his computer and take them 2 home? 3 A The way it was explained, and as I 4 understood it at that time, was that Mr. Schwartz 5 had the opportunity and there was the potential to 6 do that. Whether or not he had done it is another 7 matter. 8 Q The reason for the search warrant was so 9 that you could go seize his computers and his 10 computer files to determine that, whether he had 11 done that? 12 A That's correct. 13 Q Because that's what they were concerned 14 was the problem? 15 A That's correct. 16 Q And that's what they were looking for? 17 A Yes. 18 Q And in fact, you put in your affidavit 19 that Mr. Cower told you that based on his 20 experience in computer security that in order to 21 avoid detection in the workplace, Mr. Schwartz 22 would transfer the information to his Apple 23 computer in order to work with the information in 24 the privacy of his own home or office? 25 A That's what the affidavit says, yes. 67 1 Q And that Mr. Cower told you that this 2 would be a convenient way for Mr. Schwartz to move 3 the information to his office or home without being 4 detected by Intel's electronic safeguards? 5 A Yes. 6 Q They told you that Mr. Schwartz often 7 works out of his home or office? 8 A That's correct. 9 Q And you put that in the affidavit, so 10 that the password file from SSD was still at Intel? 11 A As I understood it, yes. 12 Q The password was still at Intel? 13 A That's correct. 14 Q You didn't need a search warrant to look 15 for those? 16 A Not the originals, no. 17 Q You needed a search warrant to see if 18 there was any information from the files, from the 19 passwords that were cracked that had been taken? 20 A That's correct. 21 Q And that was the crime that you were 22 investigating -- 23 A That's correct. 24 Q -- when you went to Mr. Schwartz's home? 25 A That's correct. @ 68 1 Q And when you went there, it was about 2 6:30 in the evening? 3 A That's correct. 4 Q Did you know that Mr. Schwartz's 5 activities during the day at Intel had been 6 monitored? 7 A Yes, I did. 8 Q The people at Intel had made copies of 9 all of his files? 10 A I believe so, yes. 11 Q And that they had been able to monitor 12 actually what he was doing that day by logging in, 13 by what computers he logged in? 14 A That's correct. 15 Q And when he logged off? 16 A That's correct. 17 Q And at that time, by the time you were 18 preparing that search warrant, had anybody at Intel 19 told you that Mr. Schwartz had not logged back into 20 the computer where the Crack program was running 21 since the first day that the program had started 22 running? 23 A I believe so. 24 Q That program started running on October 25 21st; is that correct? 69 1 A I don't recall the exact date, but it was 2 prior to November 1st. 3 Q It had been running for quite sometime 4 prior to that? 5 A Yes. 6 Q And it had been running for quite 7 sometime before Mr. Morrissey checked the system 8 and found it running? 9 A That's correct. 10 Q And that during that entire time the 11 program was running out in the open on 12 Mr. Schwartz's -- under Mr. Schwartz's own 13 password, own identification? 14 A That's correct. 15 Q And Mr. Schwartz had not checked back in 16 since the very beginning? 17 A As I recall, no. 18 Q Did anybody give you any specific 19 information when you prepared that affidavit for 20 the search warrant to indicate that Mr. Schwartz 21 had, in fact, copied any sensitive information from 22 those files? 23 A No. 24 Q So that when that search warrant was 25 prepared, the two things that Intel people knew for 70 1 sure was that there had been some incident that 2 they didn't -- that they were concerned about in 3 the spring when Mr. Schwartz was running and 4 developing a gate program to get access to e-mail 5 from outside of Intel? 6 A I don't believe they stated that he was 7 using -- no, they did, for e-mail, that's correct. 8 Q And that he was running this Crack 9 program? 10 A That's correct. 11 Q And they were particularly concerned 12 because of some of the people -- some of the 13 passwords that were cracked; is that right? 14 A Yes. 15 Q One of the passwords belonged to a fellow 16 by the name of Ed Masi? 17 A Yes. 18 Q Vice president of SSD? 19 A Yes. 20 Q And the other was Justin Rattner? 21 A That's correct. 22 Q He was the scientist, chief architect for 23 SSD? 24 A Yes. 25 Q And so they were worried that 71 1 Mr. Schwartz was stealing secret information? 2 A That's correct. 3 Q And when that search warrant was executed 4 that night, the search warrant was executed so that 5 you could seize Mr. Schwartz's computer? 6 A Correct. 7 Q Actually, all of his computers? 8 A Correct. 9 Q All of his computer files? 10 A Correct. 11 Q All of the disks that the computer 12 information was stored on? 13 A Correct. 14 Q And what was the purpose for seizing all 15 that? 16 A To determine whether, in fact, he had 17 stolen or obtained information from those systems 18 that he wasn't entitled to. 19 Q And nobody told Mr. Schwartz that anybody 20 was coming? 21 A No. 22 Q Of course not. And your understanding 23 was when you went over there to execute the search 24 warrant that nobody had spoken to Mr. Schwartz from 25 Intel before this time? 72 1 A That was my understanding, yes. 2 Q Now, when you showed up to Mr. Schwartz's 3 house about 6:30 or so in the evening, how many 4 officers were there? 5 A Seven. 6 Q And you knocked at the door? 7 A Correct. 8 Q Mr. Schwartz answered the door? 9 A No. I believe his brother answered the 10 door. 11 Q Are you certain of that? 12 A Yes. 13 Q As certain as you are about -- 14 A No, I'm sorry. He answered the door. 15 Let me refer to my report. 16 I'm sorry, I don't recall 17 specifically. That's not in there. My 18 recollection is that it was Mr. Schwartz's brother 19 that answered the door and that Mr. Schwartz was 20 upstairs. 21 Q But you're not certain of that? 22 A Not absolutely positive. That's my 23 recollection, that it was his brother that answered 24 the door. 25 Q And in your report, you said it was 73 1 Mr. Schwartz's brother that answered the door; 2 isn't that correct? 3 A I think I just said that my report 4 doesn't reflect who answered the door. 5 Q Now, when Mr. Schwartz answered the door, 6 the seven deputies were at the door? 7 A I don't believe that all of us were 8 there. I think two or three of us initially and 9 the others joined us once we made contact. 10 Q As soon as you made contact, the others 11 followed you? 12 A Yes. 13 Q And you announced to him that you had a 14 search warrant? 15 A Yes. 16 Q And you read the search warrant? 17 A That's correct. 18 Q And told him you were there to search for 19 evidence of a crime? 20 A That's correct. 21 Q Some of the others went upstairs to see 22 if anybody else was in the house? 23 A Correct. 24 Q You brought Mr. Schwartz's brother 25 downstairs into the living room? 74 1 A That's correct. 2 Q Both were there? 3 A That's correct. 4 Q Then you advised both of them of the 5 Miranda rights that you described previously? 6 A Yes, I did. 7 Q Rights that you read to somebody who is 8 suspected of a crime before you interrogate them; 9 is that correct? 10 A Rights that are read to an individual who 11 is either in custody or, in their own mind, would 12 feel that they were in custody and were not free to 13 leave. Does not necessarily mean that they are in 14 custody. 15 Q No, but means you read it to them because 16 you are questioning somebody -- 17 A The rights are read to them after the 18 service -- I always read the contents of the search 19 warrant, immediately followed by reading of their 20 constitutional rights, because I'm serving a search 21 warrant, I'm seizing the house and the people in 22 the house are no longer free to leave, and under 23 case law, I'm required to read them their Miranda 24 rights. 25 Q So you do this as part of your 75 1 investigation when you believe that there is 2 criminal activity? 3 A When I'm serving a search warrant 4 specifically. 5 Q After you came in and advised 6 Mr. Schwartz of his rights and you told him you 7 wanted to speak with him -- 8 A Yes. 9 Q -- and he offered to speak with you in 10 the kitchen area right next to the living room; is 11 that correct? 12 A I don't specifically recall whether he 13 made that suggestion or not. 14 Q But you wanted to go to another place 15 that was more private? 16 A That's correct. 17 Q So you went into a back room? 18 A That's correct. 19 Q A back room in the house and that's where 20 the questioning of Mr. Schwartz took place for the 21 next two hours? 22 A Yes. 23 Q Now, that -- I noted when you started 24 talking about Mr. Schwartz's testimony it was about 25 25 after 10:00, and when you finished, it was 76 1 approximately 20 to 11:00. During that two hours 2 that you were in there with Mr. Schwartz, was the 3 questioning and the interaction with Mr. Schwartz 4 going on just about all of that time? 5 A Not nonstop. There were breaks in those 6 conversations as people came in and out of the 7 room. There were matters that I would have to 8 attend to that would cause me to leave the room to 9 check on something and one of the other officers 10 would come in. 11 Q But it went on for the better part of two 12 hours? 13 A That's correct. 14 Q And so your notes summarized the essence 15 of what was said? 16 A My report is a summary of the essence of 17 what was said. My notes were specifics that I 18 based the report on. 19 Q And the text of your report covers about 20 four and a half pages in describing the activities 21 going on; is that right? 22 A That's correct. 23 Q And would you look at Page 2 of that 24 report and tell me where in your report you 25 summarize or you say anything about what you told 77 1 Mr. Schwartz about the reasons you were there and 2 the nature of the investigation. 3 A It doesn't say that. 4 Q Also like you to take a quick look at 5 your report and tell me other -- where you -- 6 looking at your use of quotation marks, the only 7 place that you have any of the statements in quotes 8 referring to the discussion and the discussion of 9 the specifics under investigation, the activities 10 at Intel under investigation at that time, that 11 "technically illegal" statement that you referred 12 to is the only statement that is in quotes. 13 A No, there is also the statement 14 "back-dooring." 15 Q Okay. So those are the only two, other 16 than putting like "Crack" or "Root" or words like 17 that? 18 A Correct. Those are in quotation marks, 19 but those were to designate specific terms. There 20 are other quotations in there, but -- 21 Q That don't relate to the specifics of 22 running the Crack program or that particular 23 investigation? 24 A Yes. 25 Q We have had a couple hearings where we 78 1 have had a chance to talk about this and -- 2 A Yeah. 3 Q -- we have previously had some discussion 4 about this back in September, a hearing on 5 September 20 of last year, and I asked you some 6 questions about some specifics -- about some 7 specific conversations that you had with 8 Mr. Schwartz at that time and you said that your 9 report is a summary, the results of the interview 10 with Mr. Schwartz. Is that accurate when you said 11 that -- 12 A Yes. 13 Q -- at times it was specific and at times 14 on technical points or other matters it was not? 15 A That's correct. 16 Q The report is really a substantive 17 summary of the outcome of your interview? 18 A That's correct. 19 Q Now, it's been two years since that 20 interview. You can't recall everything that was 21 specifically said during that, can you? 22 A No. 23 Q Mr. Schwartz was pretty cooperative 24 during the course of that discussion? 25 A Yes, he was. 79 1 Q When you went over to Mr. Schwartz's 2 house -- At the Washington County Sheriff's 3 Department, you have access to some tape recorders? 4 A Yes. 5 Q Ever use tape recorders in conducting 6 interviews? 7 A On occasion, yes. 8 Q Do you have access to video cameras? 9 A Yes. 10 Q Sometimes you bring those along on 11 searches? 12 A I never used one, no. 13 Q But they are available? 14 A They are available for that purpose, yes. 15 Q And you can have video and audio? 16 A Correct. 17 Q Did you bring a tape recorder along with 18 you? 19 A If I had one, it wasn't for the purpose 20 of tape recording the conversation, no. 21 Q Did you bring a tape recorder with you? 22 A I don't recall whether I -- the reason I 23 say this, I normally carry a tape recorder in my 24 car should I need it to dictate a report or tape 25 record a conversation, yes, but I did not have one 80 1 in the house with me, no. 2 Q You had one available and didn't bring it 3 in the house? 4 A That's correct. I may have had one 5 available or could have had one available, but I 6 didn't bring it in. 7 Q And a video camera is available to the 8 Sheriff's Office to bring along to also record what 9 happened during the course of the search and the 10 discussions; is that correct? 11 A That would also have been available. 12 Q You didn't use a tape recorder and tape 13 record any conversations with Mr. Schwartz, did 14 you? 15 A No. 16 Q That would have been a much more accurate 17 way to record the precise conversation, wouldn't 18 it? 19 A That's the most accurate way to do it, 20 yes. 21 Q Particularly in an area where you are 22 discussing subject matter with which you are not 23 familiar? 24 A Correct. 25 Q A video camera could have accomplished 81 1 the same thing, couldn't it? 2 A Correct. 3 Q Didn't use that, either? 4 A No, I didn't. 5 Q Now, I note that -- I recall in your 6 testimony and your report you refer to Mr. Schwartz 7 saying that he ran -- you looked at some files at 8 IWARP when he ran a program called Root. You have 9 "Root" in quotes. Your recollection is you're 10 certain that Root -- he told you that Root was a 11 program that he used to run? 12 A "Root" was a word that he used as the 13 means for which he ran the Crack program. 14 Q So that when you say the Root was a 15 program, that maybe you misunderstood? 16 A That's quite possible, given my 17 experience at that point in time, yeah. 18 Q Or maybe you misspoke yourself? 19 A No. That was my understanding as to what 20 Mr. Schwartz had told me and as reflected in the 21 report. 22 Q And you also said that Mr. Schwartz told 23 you his contract to run Brillig was about to 24 expire. 25 A That's correct. 82 1 Q You're certain that's what he told you? 2 A Yes. 3 Q As certain as you are about the other 4 statements that he -- 5 MR. TINTERA: Objection. Not a 6 proper statement to comment about one statement in 7 regard to other statements. 8 THE COURT: Sustained. 9 BY MR. SUSSMAN: 10 Q You may have been wrong about that, about 11 your understanding of Mr. Schwartz's -- what 12 program, which computer, which area of Intel 13 Mr. Schwartz had a contract with at that time; is 14 that right? 15 A You mean about Brillig? 16 Q Yes. 17 A No. 18 Q Thank you. 19 MR. SUSSMAN: One moment, please. 20 (Discussion off the record 21 between counsel and 22 Mr. Olstad.) 23 MR. SUSSMAN: Excuse me. 24 BY MR. SUSSMAN: 25 Q Now, one other thing. In talking about 83 1 running this program called Root, did he explain to 2 you what Root was? 3 A I don't recall. All I recall and all 4 that is reflected in the report is that that was 5 the name of the program that he used to access 6 files at IWARP. 7 Q And that Root allowed him to get access 8 to these files? 9 A Again, the report -- he told me that Root 10 was the name of the program that he used to access 11 the files. 12 Q Now, in that paragraph where you describe 13 the discussion where Mr. Schwartz described getting 14 access to IWARP, the files in IWARP, do you 15 anywhere mention -- you have in quotes the words 16 that it was "technically illegal". 17 Let me rephrase. The words that he 18 said it was "technically illegal" do not appear in 19 that paragraph, do they? 20 A Not in that paragraph, no. 21 Q And you are -- are you certain -- In your 22 previous testimony in this report, you say that 23 Mr. Schwartz said that was against Intel policy and 24 illegal. 25 A What was specifically? 84 1 Q Looking at the files through Root. 2 A Through Root, that's correct. 3 Q And that was your understanding of his 4 statement at the time? 5 A Yes, it was. 6 Q Do you know now what "root" is? 7 A No, I don't. 8 Q Do you know now whether -- if it is a 9 program or not? 10 A No, I don't. 11 MR. SUSSMAN: I have nothing 12 further. 13 THE COURT: Mr. Tintera. 14 15 REDIRECT EXAMINATION 16 BY MR. TINTERA: 17 Q Mr. Lilley, counsel is asking you about 18 the part of your report where you talk about the 19 defendant's access to the IWARP system. 20 A That's correct. 21 Q And you were talking to Mr. Schwartz on 22 November 1st, 1993. He indicated that activity was 23 when? 24 A Three years prior to that. 25 Q So that would have been 1990? 85 1 A That's correct. 2 Q And you talked about him actually taking 3 a step, a further step. What was that about? 4 A A further step at IWARP? 5 Q Yes. 6 A Aside from -- he had taken the further 7 step of actually viewing the contents, yes. 8 Q Contents of other people's files? 9 A That's correct. 10 Q And then he made an admission about that 11 conduct. What did he say? 12 A He said in words to the effect, he 13 acknowledged that what he was doing was against 14 Intel policy and that it was illegal. 15 Q And that he had no right to do that? 16 A That's correct. 17 Q Now, you were asked about the 18 availability of the tape recorder or video camera. 19 Why didn't you use those? 20 A Those aren't -- I don't use them a lot in 21 my interviews. For one reason, I find that people 22 find them inhibiting. It's not as much of a free 23 flow of information, particularly on an initial 24 interview where, in all honesty, I don't know where 25 the interview is going to go. 86 1 Mainly an initial interview is to 2 get a feel for what's going on, what one person has 3 to say about an incident as opposed to what other 4 people have told me about an incident. Mainly a 5 fact-finding thing. I make notes so that I'm able 6 to write a report that is an overview of that 7 interview, specific where it needs to be specific. 8 But as far as tape recording, as a general rule, I 9 don't use a tape recorder or a video camera for 10 those kinds of interviews. I would use those 11 devices at a further point in the investigation, 12 possibly. 13 Q Now, the defense attorney has elicited 14 that the interview of Mr. Schwartz took two hours. 15 A Approximately. 16 Q Approximately two hours. Then he 17 mentioned that your testimony was only from 10:25 18 to 10:50 about those statements. Do you remember 19 that? 20 A Yes. 21 Q Are there areas of the statements of 22 Mr. Schwartz's that you have not told the jury 23 about? 24 A That's correct. 25 Q So there are other aspects of the 87 1 conversation that have not been testified to; is 2 that correct? 3 A That's correct. 4 Q You were also asked about did anybody 5 from Intel or yourself speak to the defendant 6 before the search warrant was executed and your 7 answer was no. 8 A That's correct. 9 Q And why was that? 10 A Because we didn't want him to know that 11 we knew about his activity and give him an 12 opportunity to cease it and get rid of any evidence 13 that might be incriminating. In other words, if he 14 knew we were coming, we would run the risk of 15 losing evidence. 16 Q Is it your understanding when the 17 Supercomputer Division password file was copied, 18 could you tell how many times it had been copied? 19 A I don't recall now whether I do or not. 20 I mean, the password file had been copied and how 21 many times and on what occasions, I don't recall 22 now, no. 23 Q So you had no way of knowing whether it 24 was on a laptop computer or on a little computer 25 disk, did you? 88 1 A That's correct. 2 Q But your best guess was, "Let's look at 3 this and let's look at this house and see what's 4 there"? 5 A That's correct. 6 Q You were asked about what Mr. Kent or 7 Mr. Morrissey may have told you about what 8 Mr. Schwartz's duties were at Intel or 9 responsibilities. Did they tell you anything about 10 whether the information they gave you about him 11 setting up the Gate programs on Brillig and Mink or 12 him copying the Supercomputer Division password 13 files were authorized or not? 14 A Yes. 15 Q And what was that? 16 A That he was not authorized to do that. 17 Q So you did know that? 18 A Yes. 19 MR. TINTERA: Thank you. I don't 20 have any other questions. 21 22 23 24 25 89 1 RECROSS-EXAMINATION 2 BY MR. SUSSMAN: 3 Q Detective Lilley, when you talked 4 about -- going back to the question about 5 Mr. Schwartz's activity while working at IWARP, 6 during that conversation, did Mr. Schwartz tell you 7 specifically what his job was when he was -- 8 A I don't recall him doing that. 9 Q You don't recall what that was? 10 A No, I don't. 11 Q Do you recall him -- do you have any 12 recollection of the discussion about what those 13 duties and his position at IWARP involved? 14 A No, I don't. 15 Q You indicated that you tend not to use 16 tape recorders because it can be intimidating when 17 you have interviews. In this case, it was true 18 that Mr. Schwartz, according to your testimony, was 19 very cooperative? 20 A That's correct. 21 Q It was a free-flowing conversation, you 22 were saying? 23 A That's correct. 24 Q You were saying he was not reluctant to 25 respond to questions? 90 1 A That's correct. 2 Q No reason to think that he wouldn't agree 3 to tape record a conversation then, was there? 4 A Probably not. 5 MR. SUSSMAN: Nothing further. 6 THE COURT: Mr. Tintera. 7 MR. TINTERA: No further questions. 8 THE COURT: Thank you. You may step 9 down. 10 Let's take a ten-minute break. 11 Since we got started late, we'll probably go into 12 the noon hour, so about ten minutes. 13 (Recess.) 14 THE COURT: Call your next witness, 15 Mr. Tintera. 16 MR. TINTERA: Bob Wilcox. 17 18 ROBERT H. WILCOX, JR. 19 called as a witness on behalf of the State, having 20 been first duly sworn under oath, was examined and 21 testified as follows: 22 23 THE CLERK: State your full name and 24 spell it for the record, please. 25 THE WITNESS: Robert H. Wilcox, Jr. 91 1 W-i-l-c-o-x. 2 3 DIRECT EXAMINATION 4 BY MR. TINTERA: 5 Q Mr. Wilcox, have you ever been an 6 employee of the Intel Corporation? 7 A Yes. 8 Q And when was that? 9 A I was an employee in 1993. I left in 10 January of 1995, this year. 11 Q And what are you doing now? 12 A I'm setting up a consulting business. 13 Q And in what area of consulting is this 14 that you will be in? 15 A Computer network planning. 16 Q And could you tell the jury while you 17 were working with Intel, what were your duties or 18 what were your responsibilities? We're looking at 19 really the period of 1993. 20 A I was the computer networking manager for 21 the Hawthorn Farms building complex at Intel. 22 Q Translate that, please. 23 A I was responsible for the operation of 24 the computer networks for that building and their 25 connections to other Intel buildings. 92 1 Q So when you talk about computer networks, 2 are you saying how the various computers at Intel 3 talk to each other or the users talk through the 4 computers with each other? 5 A That's correct. All the equipment and 6 software that allows the computers to talk to each 7 other is the computer network in this case. 8 Q And how many computers are you talking 9 about are connected to that network? 10 A In our building complex, there are 11 approximately 3,000 computers and approximately 12 1500 people. 13 Q So at Hawthorn Farms there are 3,000 14 computers? 15 A Approximately. 16 Q And as a network administrator, you make 17 sure that the roads between the computers are free 18 of debris? 19 A It was more a case of expanding the roads 20 as the traffic became heavier and heavier and to 21 try to group people who are doing similar work 22 together so that their traffic would be local to 23 their neighborhood, in effect. And, finally, to 24 measure the traffic and see where we need to 25 improve things. 93 1 Q So if the traffic is heavier between 2 computer A and B, you might make computer B be able 3 to handle more traffic, is that it? 4 A Right. Or put them on the same road, put 5 them on the same part of the network. 6 Q And in the course of those particular 7 duties, did you ever have an occasion to work with 8 Randal Schwartz? 9 A Yes. 10 Q And do you remember when that started, 11 when that -- 12 A I don't have an independent recollection 13 of the date that I hired him. 14 Q Well, if I could show you what has been 15 marked State's Exhibit 14. Could you look at 16 State's Exhibit 14, which is four documents stapled 17 together. 18 A Yes. 19 Q What are those? 20 A These are the documents -- the Intel 21 documents that I used to hire Randal at the time, 22 and I'm not sure, there are several dates on here, 23 but apparently 2-20-92 is the start date. 24 Q And did you have a name for the group 25 that you were operating on the network as the 94 1 networking manager or not? 2 A I think just the Hawthorn Farms network 3 group. I don't recall it had a specific name. 4 Q And so in February of 1992, you hired 5 Mr. Schwartz into that group? 6 A Correct. 7 Q Is this a large group of people or small 8 group? 9 A No, it was quite small. I think at that 10 time there were probably around four of us, or 11 maybe three at that time. 12 Q Was Mr. Schwartz hired with any 13 particular purpose? 14 A Yes. Yes. 15 Q And what purpose was that? 16 A To monitor the computer networks. We 17 needed to have several UNIX workstations. 18 Q Wait a minute. What does that mean. 19 What's a UNIX workstation? 20 A It's a specific type of computer and it 21 requires an expert in order to administer it or 22 operate it, and I was not an expert in that area. 23 Q Is UNIX a particular computer language? 24 A UNIX is the so-called operating software 25 for the computer. Another example of operating 95 1 software for a computer would be DOS or Windows. 2 So if you have the computer, you need to have the 3 operating system to do anything, and then you would 4 add the programs that you want to do the real work 5 with. 6 Q So what operating system are you familiar 7 with? 8 A I'm more familiar with the DOS, Windows 9 and VMS operating systems. 10 Q And so to do your job, you needed 11 somebody that was familiar with a UNIX operating 12 system? 13 A Yes. 14 Q If I've got this right, is this like 15 having different car engines? You have maybe a 16 Chevy and a Mazda engine and they are kind of 17 different, so you need different technicians to 18 work on the different engines; is that right? 19 A Absolutely. I wouldn't be qualified to 20 administer a UNIX system. 21 Q But Mr. Schwartz was? 22 A Yes. 23 Q Why didn't you just have one operating 24 system? It's not really relevant to this case, but 25 why didn't you just have one? 96 1 A Well, different operating systems have 2 different strengths and weaknesses. And the second 3 reason is that sometimes this software that you 4 want to run to do the work will only run on one 5 operating system and not on just any of them. 6 Q So Mr. Schwartz is your UNIX operating 7 systems person? 8 A Correct. 9 Q What was he supposed to be doing to 10 assist you in the computer network managing? 11 A Well, there were three responsibilities 12 that Randal Schwartz had: The first was to 13 administer the UNIX computer systems, and that 14 means to install the software, make it work, back 15 up the computer systems so that if the system 16 malfunctioned, we'd be able to go to a tape backup 17 and bring everything back to start it again. And 18 to put these computer systems on the Intel network 19 so that they operated harmoniously with the rest of 20 the Intel computers. 21 Second area was to get network 22 monitoring software working on the computers so 23 that we could measure the network traffic that we 24 had. And the software involved there is Spectrum, 25 which is a brand name for a particular piece of 97 1 software, and Sun Net Manager, which is another 2 brand name for another piece of network. 3 Q I didn't hear that, Spectrum and what? 4 A Sun Net Manager. 5 Q So that system is like one of those black 6 cords across the highway to count the cars going 7 by, is that -- 8 A It's a system which communicates with the 9 network equipment and gathers the statistics of how 10 much traffic has been going by. 11 Q So it's a black cord across the highway 12 with the box connected to the control center? 13 A The control center would be the UNIX 14 workstation, and the network itself had its own 15 built-in intelligence for counting each car going 16 by. 17 Q What's the third area that Mr. Schwartz 18 is supposed to do? 19 A The third area was to automate the 20 administration of the network. 21 Q What does that mean? 22 A Well, it's a broad task. One of the 23 parts of that was to bring up the DNS system, and 24 you'll hear more about that later, for Hawthorn 25 Farms and to make that work with the rest of the 98 1 DNS systems within Intel. And there were a few 2 other areas. 3 Q A DNS system, you're talking about a 4 Domain Name Server; is that correct? 5 A Correct. 6 Q Now, when computers talk to each other -- 7 I know people at Intel give computers names. 8 A Correct. 9 Q Like people names? 10 A Yeah. 11 Q Tell me a couple. 12 A Well, some of the names I use were the 13 names of artists, so I used Kandinsky, which is a 14 famous artist, or Manray. 15 Q But when computer Kandinsky talks to 16 computer Manray, do they use those names? 17 A Yes, they do. 18 Q And are those names attached to numbers? 19 A Yes. 20 Q What are those numbers called? 21 A The numbers are the addresses of the 22 computer or the full name would be the IP address, 23 and they are exactly like phone numbers. 24 Q So each computer has its own like 25 address, an IP address? 99 1 A Yes, that's correct. 2 Q So computer Kandinsky has one and 3 computer Manray has its own address? 4 A That's correct. 5 Q On the network? 6 A Yes. 7 Q And what does the Domain Name Server do? 8 A Well, in the simplest case, when the 9 Kandinsky computer wants to talk to the Manray 10 computer, the Kandinsky computer asks the DNS 11 system, the DNS server, "What's the telephone 12 number? What's the IP address of Manray?" And the 13 Domain Name Service returns the number, the IP 14 address of Manray back to Kandinsky and Kandinsky 15 uses the number to communicate with Manray. 16 Q So the Domain Name Server is an 17 operator -- 18 A Yes. 19 Q -- that the computer calls to get the 20 number for where to complete its call; is that 21 fair? 22 A Correct. 23 Q So what was Mr. Schwartz supposed to be 24 doing with this DNS, Domain Name Server? 25 A The operation of DNS could consume weeks 100 1 of discussion, and I am not really even an expert, 2 myself, in this area, but all of the computers in 3 the Hawthorn Farms building complex had numbers and 4 each of these numbers was registered in the Domain 5 Name Service, along with the name of the computer. 6 So anybody in our building complex, 7 if they wanted to talk with one computer to 8 another, they would call the Domain Name System and 9 get the numerical address, the IP address, the 10 number from the Domain Name System from the user 11 that they wanted to talk to. 12 As well, if a computer outside our 13 building complex wanted to talk with a computer, it 14 would go to that same system. Or if we wanted to 15 talk to -- from our building to another, a call 16 would be made to our local Domain Name Service and 17 then from there, that request would be relayed to 18 other domain name services outside our building 19 within Intel, or even outside Intel if you wanted 20 to communicate with the system outside of Intel. 21 Q Kind of like if you wanted to go to the 22 overseas operator? 23 A That's exactly it. 24 Q So those were the three areas of 25 responsibility for Mr. Schwartz? 101 1 A In the area of this -- this third area of 2 automation, there was also a program to look for 3 addresses that had been given out or numbers that 4 had been given out that were no longer in use, so 5 we could reuse the number, and I believe that this 6 was the main project at the end of the time period 7 when Randal worked for me at that time. 8 Q So we're talking the end of the time 9 period being the fall of 1993? 10 A Correct. And I believe that we would 11 call that project the IP address administration 12 automation. 13 Q The IP address automation? 14 A Correct. 15 Q So that sounds like the phone company 16 going around to find out who is not -- who has been 17 disconnected from a number so they can give the 18 number to a new subscriber. 19 A That's exactly it. 20 Q What was the relationship to Mr. Schwartz 21 and yourself as far as were you equal co-workers 22 or -- 23 A Randal worked for me. 24 Q So he was -- he first responded to you, 25 as you were his supervisor? 102 1 A Correct. 2 Q State's Exhibit 14 references part of his 3 duties on the last page as a Systems Administrator. 4 What does that mean, the third page of that 5 document, "UNIX Systems Administrator"? 6 A This was the first area I spoke of, which 7 is to install new software on these UNIX computers 8 to make sure that they operate properly, to be sure 9 that if one failed, another could take over the 10 job. That's the area of computer backups of 11 putting data onto tape. It's a fairly broad 12 classification, so -- but within the people who do 13 that kind of job, it's fairly well-known what's 14 involved. 15 Q Of the three specific areas that 16 Mr. Schwartz was hired for that you spoke to the 17 jury about, which one of those areas, if any, 18 involved security? 19 A Well, each of those areas involved 20 security in the sense that as you were doing that 21 job, you would have to take into account security 22 considerations. 23 Q Because Intel wants its internal network 24 secure from -- 25 MR. SUSSMAN: Objection to leading 103 1 on this one. 2 THE COURT: Sustained. 3 BY MR. TINTERA: 4 Q Why is that? 5 A Like many businesses now, Intel uses its 6 computer networks to actually do the work, so if 7 the network were to stop working because of a 8 security incident, then the company would, in 9 effect, stop working. 10 And the second reason is that as all 11 these people are working there every day doing 12 their job, they're storing their work on computers 13 and so that information is considered to be an 14 Intel secret. And if a competitor were to obtain 15 that information, they would know what Intel was 16 doing or they might be able to recreate a product 17 that Intel had been developing without actually 18 doing the work. 19 Q And when you talk about a security 20 incident, what did you have in mind? 21 A Well, security incident could be somebody 22 who was not authorized to access information 23 accessing it, or somebody causing other people not 24 to be able to access their work or their computers. 25 Q Did the computer network that you were 104 1 administering involve the Supercomputer Division at 2 Cornell Oaks? 3 A No. I was only responsible for the 4 computer networks in the Hawthorn Farms complex and 5 the connections between Hawthorn Farms and any 6 other Intel building. 7 Q Cornell Oaks is away from Hawthorn Farms? 8 A Correct. 9 Q Did any of the areas that Mr. Schwartz 10 was hired to work on involve any responsibilities 11 in the Supercomputer Division? 12 A No. 13 Q Did any of the three responsibilities or 14 areas that Mr. Schwartz was working under you for 15 involve him setting up -- do you know what a Gate 16 program is? 17 A No. 18 Q Did any of those -- Do you know if any of 19 his work involved setting up a gate in your system? 20 A No. I can't think of a case where that 21 would be. 22 Q And what about operating a Crack program, 23 is that something that you would do? 24 A No, not for computers outside my 25