1 IN THE CIRCUIT COURT OF THE STATE OF OREGON 2 FOR THE COUNTY OF WASHINGTON 3 4 STATE OF OREGON, ) ) 5 Plaintiff, ) ) 6 vs. ) No. C940322CR ) 7 RANDAL LEE SCHWARTZ, ) ) 8 Defendant. ) Volume 6 9 10 11 TRANSCRIPT OF PROCEEDINGS 12 13 BE IT REMEMBERED THAT on the 13th 14 day of July 1995, the above-entitled matter came on 15 for Hearing before the HONORABLE ALAN C. BONEBRAKE, 16 a Circuit Court Judge. 17 18 APPEARANCES 19 Thomas J. Tintera Washington County Deputy District Attorney 20 Representing the State of Oregon 21 Mark Sussman Attorney at Law 22 Representing the Defendant 23 24 25 2 1 WITNESS INDEX 2 3 FOR THE STATE: Direct Cross ReD ReX 4 5 6 James Lilley 37 53 84 89 7 Robert H. Wilcox, Jr. 91 8 Robert Wilcox 109 136 9 Brad Benson 139 143 148 10 Louis Poehlitz 151 160 11 Richard J. Greco 167 180 186 189 12 13 FOR THE DEFENDANT: 14 15 Exhibit No. 102 121 122 16 Exhibit No. 103 121 122 17 Exhibit No. 106 121 122 18 19 20 21 22 23 24 25 3 1 MORNING SESSION 2 BEGINNING AT 9:30 A.M. 3 JULY 13, 1995 4 5 (Whereupon, the following 6 proceedings were held in 7 open court, out of the 8 presence of the jury:) 9 THE COURT: Two issues this morning, 10 folks. Two issues: The videotape and the request 11 by the State to have one of the witnesses sit in. 12 Last night, I did my work partially 13 complete, apparently, because I checked Shepards 14 and immediately recalled the case that I had 15 recalled reading, State v. Cooper, 120 Or App 490. 16 Mr. Tintera pointed out to my staff this morning 17 that that case is also cited in 319 Oregon 162 and 18 the Supreme Court reached a different opinion, so I 19 have read that quickly. I also viewed the 20 videotape last night. 21 Anything additional? 22 MR. TINTERA: Yes, I have one 23 additional matter. 24 THE COURT: Which matter? 25 MR. TINTERA: Nothing additional to 4 1 say on those. I have something to say before we 2 bring the jury back in. 3 THE COURT: Let's talk about your 4 request to have the witness sit in, Rich Cower. 5 Have you had a chance to review the Supreme Court 6 version of State v. Cooper, Mr. Sussman? 7 MR. SUSSMAN: Your Honor, I just 8 glanced at it briefly this morning and I can't give 9 you a cogent analysis. 10 THE COURT: Would you want more time 11 to take a look at that? There is interesting 12 language. As the Supreme Court tends to do, they 13 tend to go on page after page. The part that 14 Mr. Tintera undoubtedly is going to want to hone in 15 on is on Page 170 where it says, "We presume that 16 the Oregon legislature enacting OEC 615 Sub 2 17 intended to adopt along with the rule the same 18 policy of providing parody between the parties that 19 the committee report indicates motivated Congress 20 in enacting Federal Rule 615(2). Accordingly, 21 under OEC 615(2), the State may designate a person 22 who will be a witness in the case as it's 'officer' 23 who is exempt from exclusion." 24 Then they say, "That decided, the 25 issue then is whether a city police officer may be 5 1 so designated by the State." That question 2 remains. But the first part is, apparently, the 3 thinking was that in the adoption of this rule 4 that, first of all, in a trial, a natural -- a 5 person who -- a party who is a natural person had a 6 right to be present. We all know that. Then they 7 also believe that the legislature wanted to treat 8 corporations the same for non-natural parties and 9 to permit a party to designate some witness to sit 10 in in those proceedings. Anyway -- 11 MR. SUSSMAN: Your Honor, my 12 recollection, as you talk about the case, I think 13 that that case dealt with -- specifically with a 14 police officer -- 15 THE COURT: You're right. 16 MR. SUSSMAN: -- sitting in to 17 assist during the course of the trial. And if my 18 memory serves correctly, it was a question of 19 whether or not in a State prosecution a city police 20 officer who was not an employee of the State could 21 sit in. 22 But I think, again if memory serves 23 correctly, the fact that there was a police officer 24 for a city, the Supreme Court said that it was 25 basically kind of a subdivision of the State and so 6 1 the officer did stand in place or did fit under 2 the -- I guess the broad definition of an agent of 3 the party, which was the State of Oregon, which is 4 somewhat different from the situation that 5 Mr. Tintera proposes where he seeks to designate 6 not an agent of the State such as Detective Lilley 7 or Detective Lazenby, but an agent of the 8 complaining party, Intel, to sit in during the 9 course of the trial. 10 Now, the victim, as I recall the 11 victims' rights legislation, allows the victim, or 12 if the victim is a non-person and a representative 13 of the person to attend, that they could, it can 14 be, but that -- I do not recall, do not believe 15 there was anything in the legislative history in 16 the statute that addressed the situation of 17 allowing where the victim is a non-person dealing 18 with a situation presented here where the party 19 wants to bring in a critical witness to represent 20 the corporation and allow -- designate that person 21 as the representative of the victim for purposes of 22 sitting in, of non-exclusion under the victims' 23 rights laws. 24 I think the victims' rights laws 25 would be perfectly well satisfied and it would 7 1 be -- I would have no quarrel with John Woodard, 2 who has been the agent and representative of Intel 3 throughout these proceedings sitting in throughout 4 the case. And, in fact, my understanding is that 5 he seems to have been and probably expects that he 6 will continue to do that. 7 I also would again be prepared to 8 concede that the State's expert from Intel, whom 9 I've been notified is Rich Cower, may sit in during 10 the testimony of our expert, but I think that it 11 goes beyond the scope of the holding in that case 12 for the statute to permit Rich Cower to sit at 13 counsel table through much of the State's case and 14 where the State particularly wants to have 15 Mr. Cower sitting there through cross-examination 16 before he's testified simply compounds the dilemma 17 and the potential due process problem that is 18 created by allowing witnesses to sit through 19 cross-examination and portions of the trial which 20 may directly be related to and very likely be 21 related to the testimony of that particular witness 22 as well. 23 So I think if -- I think that 24 Mr. Tintera's request goes too far, but for limited 25 purposes such as the testimony of our expert, I 8 1 believe it should be allowed for that purpose. 2 THE COURT: Mr. Tintera. 3 MR. TINTERA: Judge, having read the 4 case and I also have read the case of State v. 5 Alexander, 105 Or App 566 1991, case that dealt 6 with this particular Oregon Evidence Code 615. 7 The first point that I'd like to 8 make with Your Honor is that the application of 615 9 is discretionary with the Court. The Court may 10 exercise that statute. It's not a mandatory 11 statute. Or the Court may exercise its discretion 12 in allowing a witness to remain at the request of 13 one of the parties. 14 I would ask the Court to exercise 15 your discretion and allow Mr. Cower to sit through 16 the trial to assist me. It is important to the 17 prosecution of this case that I have his ability to 18 analyze what the defense is doing and in a 19 contemporaneous manner and not later or during the 20 breaks. 21 I would also agree with -- 22 THE COURT: Well, I'm going to hone 23 in on Subsection 3 then, Mr. Tintera, where it says 24 it's essential. Being important to assist you is 25 one thing. Being essential is -- I see it going a 9 1 bit further. 2 I want to know what you're telling 3 me. Do you think it's essential or is it just 4 important? This gets to the point, the questions 5 that I asked you yesterday in analyzing this, and 6 that is Mr. Cower, apparently, is a single person 7 who embodies both characteristics that you want and 8 that is, he has specific knowledge about this case 9 and also apparently very skilled in computer 10 matters. And the question I asked yesterday is 11 that if there is not another single person 12 available to assist you in those two areas, would 13 there not be two people possibly that would not be 14 witnesses, one who might be skilled in computer 15 matters that could assist you and another that 16 might be knowledgeable about the facts? And if 17 those people -- if such a person or persons would 18 be available, then it wouldn't be essential that 19 Mr. Cower be here. 20 MR. TINTERA: Well, those people are 21 not available. What I'm trying to figure out is, I 22 would attempt to try the case if Mr. Cower is not 23 permitted to be here, but without knowing what the 24 defense cross-examination is and without knowing 25 what the full parameters of the witnesses that 10 1 they're going to call, what those questions are, 2 it's difficult for me to say whether he is 3 essential without knowing those things. 4 THE COURT: I understand. Let me 5 think through this about what alternatives would be 6 available and whether or not they are practical and 7 whether or not if you took advantage of them it 8 would make a ruling meaningless. 9 If I exclude Mr. Cower, I expect if 10 you wish to and had the funds available to you, you 11 could order a daily transcript from my reporter and 12 then nothing in my ruling excluding witnesses would 13 prevent you from then talking to Mr. Cower about 14 the testimony of the witnesses from the transcript. 15 MR. TINTERA: I'm not so sure about 16 that. I thought the essence of the exclusion of 17 witnesses is not to discuss what occurs in the 18 courtroom. I think I would be prohibited from 19 going over transcript of testimony from the 20 courtroom with Mr. Cower. 21 THE COURT: Well, the transcript, 22 yes, but not areas involved in the transcript. In 23 other words, in discussing with your witnesses 24 their testimony preparatory to testifying, you 25 certainly could go through specific areas and ask 11 1 questions, and issues that came up during the trial 2 would be fair game for counsel to talk with 3 witnesses. Yes. Probably having him read the 4 transcript would be a violation. Something short 5 of that might be possible. 6 I'm not suggesting that that's a 7 good alternative. What I'm suggesting, I wonder 8 what the danger is of having Mr. Cower sit in here. 9 In other words, if you could do virtually the same 10 thing anyway. 11 So you're saying in your mind it's 12 essential that he be here? 13 MR. TINTERA: I'm trying to be as 14 forthright as I can, Judge. I can't guarantee that 15 he will have some essential knowledge to be able to 16 give me during the trial based on what the defense 17 is going to ask. I can guarantee that he has 18 essential -- he has the most knowledge and the most 19 computer skill of anyone who is available to me to 20 meet what the defense has planned through their 21 witnesses. 22 I can't say that he will be 23 absolutely essential as he sits here because 24 nothing may occur during the trial which makes him 25 essential. 12 1 THE COURT: That's fair. What 2 you're saving is it's hard to know for certain, to 3 be honest, until you hear what Mr. Sussman does and 4 what his witnesses say and -- 5 MR. TINTERA: Exactly. I can tell 6 you this from some of my witnesses, I'm learning 7 new things that I don't know the answer to all the 8 time, including this morning. I'm learning things 9 that I didn't know about the computer, that if just 10 talking with my own witnesses is producing that, 11 then I absolutely do need Mr. Cower right by my 12 side to ask him about that during trial. I can 13 tell you that because there are things that have 14 already happened this morning that I don't 15 understand, and it was on a fairly simple point, I 16 thought, until the witness started talking. 17 So just with my own witness, I can 18 tell you this, that I need his ability to translate 19 what they are saying to me in a language that I can 20 understand. So from that standpoint, he is 21 essential based upon what has already occurred this 22 morning. 23 THE COURT: In interpreting the 24 statute, the Court has to determine what meaning is 25 to be given to "essential." Is this like proof 13 1 beyond a reasonable doubt? Does "essential" mean 2 basically beyond all doubt or does it mean beyond a 3 reasonable doubt, so to speak? 4 In other words, I suspect that the 5 statute does not require a showing that the State 6 cannot proceed without having this witness 7 available, but that "essential" means here 8 something less than that. "Essential" meaning 9 essential to permitting the party to having an 10 opportunity fairly to understand the testimony of 11 witnesses, cross-examination, the significance of 12 technical matters, and to be able to ask questions 13 to present evidence and in order to have a fair 14 determination of the case by the jury. I have an 15 idea if I was to define "essential" here, that's 16 how I would do it. 17 Is it not possible to call Mr. Cower 18 earlier to change the order in which you have your 19 witnesses testify so that -- I know he still would 20 have an opportunity to be -- to testify on 21 rebuttal, but at least to get his initial testimony 22 on the record before he has an opportunity to hear 23 other witnesses testify, other state's witnesses, 24 obviously. The defense witnesses will be 25 afterwards. 14 1 MR. TINTERA: Well, I suppose it is 2 possible. In this type of case, Judge, I think it 3 is important that we maintain some sort of sequence 4 of events. I'm very much concerned about losing 5 the jury in the presentation. 6 Mr. Cower's testimony as the State's 7 expert is close to the most complex. I think John 8 Kent's testimony is fairly complex. He's scheduled 9 for tomorrow, but -- as is Mr. Cower, but I think 10 that this is -- I think in this case a foundation 11 of understanding has to be built slowly with the 12 jury or they will be overwhelmed, and I suppose 13 it's possible to start with the most complex 14 witness first, but I think that, from my standpoint 15 of showing to the jury what happened in a common 16 sense manner, that is not the way to do it. 17 And I'd also -- I have two other 18 points, not on this subsection, of essential 19 witness. 20 THE COURT: On this same area of 21 allowing Mr. Cower to sit in? 22 MR. TINTERA: Yes, I do. 23 THE COURT: Go ahead. 24 MR. TINTERA: If State v. Cooper has 25 broadened the definition of agent of the officer or 15 1 employee of a party, officer of a party, which is 2 not a natural person designated as its 3 representative by its attorney, if that case does, 4 in fact, broaden the language to include the 5 federal language of providing parody of the parties 6 so that a person will be a witness, can be an 7 officer and exempt from exclusion, if in fact 8 that's true, then it has also adopted what the 9 Federal Rule 615 Senate Judiciary Committee report 10 which is referenced beginning in State v. Cooper on 11 Page 16A. 12 And the rationale for allowing that 13 is perhaps very much evident in this case, and I'm 14 quoting on Page 169. "The investigative agent's 15 presence may be extremely important to government 16 counsel, essential, when the case is complex or 17 involves some specialized subject matter. The 18 agent, having lived with the case for a long time, 19 may be able to assist in meeting trial surprise 20 where the best prepared counsel would otherwise 21 have difficulty." 22 Further goes and says, "It would not 23 seem often that the government could meet the 24 burden of showing that the agent's presence is 25 essential." In essence, this was added to have the 16 1 person who was most familiar with the facts. They 2 don't limit it to a complex case or a case 3 involving specialized subject matter, but this is a 4 complex case and does involve specialized subject 5 matter. 6 THE COURT: Weren't they talking 7 there, though, talking about the investigative 8 agent about police officers, or does it indicate -- 9 MR. TINTERA: Just says 10 "investigative agent." "Agent" isn't capitalized, 11 but they were referring to the part where they were 12 talking about "officer" in quotes. 13 But if you read 170 along with that, 14 the -- and I -- along with the rule of the same 15 policy of providing parody between the parties, the 16 report case that motivated Congress in enacting the 17 statute in Subsection 2, the State may designate a 18 person who will be a witness in its case as its 19 officer who is exempt from exclusion. And I 20 would -- if, in fact, that expands the Subsection 2 21 of 615, I would designate Rich Cower as the officer 22 or case agent in this particular case. 23 So basically my argument is 24 threefold: One, I'm asking the Court to exercise 25 your discretion in allowing Mr. Cower to remain 17 1 present during the trial. I'm also indicating to 2 the Court that in order for me to translate the 3 language that the witnesses speak in, it is 4 essential that he act as a translator to me. And I 5 can't tell you what it is that the words that will 6 be spoken that will require translation. I can 7 tell you this, they have already occurred this 8 morning when I was talking to some of the witnesses 9 that I anticipate calling this morning, such 10 that -- and he was not present when it occurred, 11 such that I have a call in to him to try to find 12 out what this means. 13 So that's the handicap that I'm 14 presented with in this particular case and I think 15 that there is a legitimate remedy for that handicap 16 and that's allowing Mr. Cower to be present to 17 assist me in translating what the witnesses testify 18 to. They do not use the language that you and I 19 use. They use a technical language that requires 20 and is essential, in my opinion, to my fair 21 presentation and to allow parody in this particular 22 case that they be allowed to -- that he be allowed 23 to assist me. 24 And if, in fact, that's in State v. 25 Cooper, expands what agency of a party means to -- 18 1 THE COURT: There is no question it 2 does. Expands it to also include city police 3 officers. When I say "officer" there, that's used 4 differently than the statute does. Statute doesn't 5 refer to -- I think basically we're talking about 6 corporate officers. But State v. Cooper clearly 7 extends a city policeman to be included within 8 "officer," within the term there. 9 The question is whether or not they 10 really mean what they say in the language I read 11 from Page 170 that they didn't limit it to 12 policemen there. They just said "a designated 13 person," which literally would mean anyone, whether 14 a policeman or not. 15 MR. TINTERA: But if we look at the 16 legislative senate subcommittee that was dealing 17 with this, the Federal Rule of 615 and what their 18 comments were and what their intent was, I think it 19 is well within your discretion and I'd ask you to 20 exercise it to assure parody on a very complex case 21 because that's what they're talking about. 22 If they are talking about case 23 agents, I don't think we can limit it there. If, 24 in fact, their intent was to assist counsel to 25 allow in the particular case the assistance that is 19 1 required to effectively present the case before the 2 jury, and I think it is well within your discretion 3 to rule that in this particular case, that I'm 4 going to exercise my discretion to allow this 5 witness to remain in court because it is, whether 6 you say -- whether you determine it is important or 7 is essential to the State's presentation, wherever 8 we fall there, it is clearly a significant point 9 one way or the other to the presentation of the 10 case and that the Court can exercise discretion to 11 allow me to have him in the courtroom. 12 THE COURT: Mr. Sussman -- 13 MR. SUSSMAN: Your Honor -- 14 THE COURT: -- anything else? 15 MR. SUSSMAN: No, Your Honor. 16 Your Honor brought up the point, 17 which is a reasonable response to the request, that 18 you exercise your discretion to allow Mr. Cower sit 19 through, that calling Mr. Cower early in the case 20 might be an appropriate way of addressing that 21 particular issue. 22 THE COURT: Well, if I allowed him 23 to do that, there are other things that I would do 24 to try to protect the rights of everyone involved. 25 I think Mr. Tintera has made a case 20 1 out for having Mr. Cower sit here. I've read State 2 v. Cooper, both Court of Appeals and Supreme Court 3 version, and I don't know that on Page 170 they 4 mean what they say. I have taken language from 5 appellate decisions before to mean literally what 6 they say, then have my hand slapped and them say, 7 "Oh, no, we didn't mean that. That was dicta." 8 They say in there the State may 9 designate a person. Doesn't limit it to police 10 officers, does it? In this case, State v. Cooper, 11 it was a city policeman and they do analyze the 12 facts and say a city policeman really stands by 13 statute and same position as a state police officer 14 and previously said state police officer can be 15 designated as an officer. So even though they say 16 "person," they're dealing with police officers. 17 I'll start by saying if I take that 18 language literally to mean what they say there, 19 then the State can and may designate Mr. Cower as 20 their agent or officer to sit in on this trial to 21 assist in the prosecution of this case. And I'm 22 not restating everything that has been said here 23 about how essential that is and the complexity of 24 this case, because if the complexity of the case, 25 of the computer language and facts is not obvious 21 1 yet, it will be after the record is complete. 2 And so just based upon the statute 3 in State v. Cooper, I will permit the State to 4 designate Mr. Cower as its officer or agent and to 5 be exempt from the statute that provides for 6 excluding the witnesses upon the motion of a party. 7 Beyond that, though, as a back up, I 8 also believe that showing that a person -- having a 9 witness sit in and assist being essential to the 10 presentation of one's case should not be an 11 impossible burden. That essentially means 12 something less than certainty. 13 As Mr. Tintera has pointed out here, 14 he doesn't know for sure what the facts of the 15 defense will be, and it may be after the case is 16 all over, it will clearly show on the record that 17 it was essential beyond a reasonable doubt. Well, 18 it's a little late then, and so the Court has to 19 decide this based upon recitation made by counsel 20 and what I know of the case so far, and my belief 21 is, from what I've heard in pretrial motions, 22 et cetera, that Mr. Cower was involved in this case 23 pretty much from the beginning. He is the security 24 person from Intel and was involved and intimately 25 aware of all the facts in this case, and beyond 22 1 that, he's an extremely skilled computer person. 2 He's the one person that has been demonstrated to 3 me so far that embodies both of those skills and 4 could be of substantial assistance to an attorney 5 in both understanding the facts and the 6 professional jargon that might be used here by 7 computer people in their testimony. So I think I 8 need to exercise my discretion and permit him to 9 sit in. 10 Having said that, there are other 11 thoughts that enter my mind. One is, we ought 12 to -- I encourage Mr. Tintera to call Mr. Cower at 13 the earliest possible opportunity before he has an 14 opportunity to hear other witnesses testify. In 15 fact, if it isn't essential before the other 16 State's witnesses testify, maybe Mr. Cower ought to 17 sit outside until the first few witnesses testify. 18 I don't know that it would be necessary for him to 19 be here while other Intel employees or possibly a 20 police officer or two testify. 21 Secondly, I think -- I will digress 22 a bit. I think a parody is important. Obviously, @ 23 the defendant, I know, from everything I've heard, 24 is quite skilled in computer matters, to his 25 credit, intelligent young man and very skilled and 23 1 also, at least from the time the police were 2 involved here, is aware of many of the facts 3 involved in the case. And I think fairness, parody 4 really dictates that the State be given an 5 opportunity to have such a skilled person be 6 involved also. I'm not convinced that anybody can 7 fill that role except Mr. Cower, so I do exercise 8 that discretion in allowing Mr. Cower to be 9 available. 10 Does he need to hear the other 11 State's witnesses testify before he testifies? 12 MR. TINTERA: I would like him 13 present during Intel employees' testimony, yes. 14 That's the problem I ran into this morning. They 15 started talking about things that I just didn't 16 understand and I wasn't aware of. 17 THE COURT: The record will show 18 what we have done and I encourage you, for the 19 purposes of our record here, that might be reviewed 20 at some point, to call him at your earliest 21 possible opportunity. 22 I also keep in mind, something I've 23 observed over the last 25 or 30 years, when 24 witnesses are permitted to remain in court, there 25 certainly is a risk that they will -- we're always 24 1 concerned about people lying, making up testimony, 2 maybe something less than that, forgetting some 3 facts in order to make their testimony coincide 4 with the testimony of other witnesses that they 5 hear testify. That's the risk, certainly. 6 I'm also aware that Mr. Cower, also 7 not a police officer, is a professional security 8 person with Intel and in a fairly high position and 9 probably besides being subjected to penalty for 10 false swearing or perjury, subject to some form of 11 disciplinary action that anyone was aware he was 12 doing that sort of thing as part of his employment. 13 And, in addition, I'm also aware 14 that Mr. Tintera's request to have him sit in here 15 cuts both ways. I have an idea that Mr. Tintera 16 really wishes he didn't have to have him sit in 17 here because the fact that he will sit in here and 18 hear the testimony of other witnesses certainly may 19 result in some impeachment of his witnesses and 20 Mr. Sussman will have the opportunity, if he thinks 21 that Mr. Cower is testifying in a fashion that 22 makes his testimony dovetail with other witnesses, 23 to point out the fact that, either in 24 cross-examination or argument, that Mr. Cower sat 25 in here and heard every one of them testify. 25 1 And so the fact that Mr. Cower sits 2 in here does -- although he's here to assist 3 Mr. Tintera, the defense will have an opportunity 4 to impeach him by reason of that fact. 5 Having said everything, I will 6 permit him to sit in. 7 The second matter, the videotape, 8 briefly. Anything else on that? 9 MR. TINTERA: No, Your Honor. 10 THE COURT: Mr. Sussman, it's a 11 great videotape. I understand a lot more about 12 computers than I did before, but looks like a 13 perpetuation deposition that Mr. Tintera didn't 14 have a chance to sit in on. You're going to call 15 your witness anyway. Except for great graphics, 16 that's what it sounds like. 17 If I was involved in a medical 18 malpractice case or personal injury case and an 19 expert witness was not available to testify at the 20 time of trial, that's exactly what I'd see -- the 21 plaintiff or the party presenting the witness, 22 that's exactly what I would see in the form of a 23 videotape. And the request -- the request for 24 perpetuation deposition would be taken and that's 25 what it looks like to me, perpetuation deposition 26 1 without notice to the other side, without giving 2 him an opportunity to be present and ask questions 3 and cross-examine the witness, and then that's 4 what -- that's my observation. 5 MR. SUSSMAN: Your Honor, we see it 6 as an essential foundation for the overall 7 presentation of the witness' testimony, 8 particularly dealing with the more specific 9 case-related issues. 10 There is -- as a preliminary matter, 11 we would ask to be allowed to show that to the 12 jury. If the Court believes that it is too much in 13 the form of testimony to be allowed as an exhibit, 14 I believe that because the witness is still here 15 subject to cross-examination that any voice-over in 16 that that goes with the animation, with the 17 demonstration, which is necessary, is a necessary 18 foundation and sets the stage for the other 19 testimony and should be allowed. 20 Mr. Tintera has the advantage of 21 having the transcript on that and can review that, 22 been able to review that and deal with his experts 23 in terms of whether that's accurate and can 24 cross-examine on those things. If there are 25 certain remarks, introductory remarks about taking 27 1 this with you and looking at it again, that can be 2 very easily erased in terms of that voice-over 3 portion of the tape so there is no suggestion that 4 the jury -- if the jury will take that with them, 5 so that the videotape can be used as a 6 demonstrative aid to the overall testimony and 7 rather than have -- I think it would move that 8 testimony along. 9 It would ease the presentation to 10 use the videotape as the foundation rather than go 11 through this in terms of questioning so that it can 12 be -- effectively present the diagrams, the charts, 13 the graphics in there to explain to the jury what 14 we all are aware of and have discussed at great 15 length, very complicated and technical issues which 16 we have all struggled to grasp. 17 So I would suggest that even if the 18 Court were to find that this is in the form of -- 19 this is something that is too much in the form of 20 testimony to be allowed as an exhibit, that we be 21 allowed to present it as part of the witness' 22 presentation, and the witness will be here subject 23 to cross-examination on all aspects of the 24 presentation, including the voice-over narration 25 parts on the videotape, which is one thing that 28 1 Mr. Tintera has had now, once it was completed, 2 will have had more than a week to examine and 3 consult with his experts for its accuracy and to be @ 4 able to cross-examine on that. 5 THE COURT: Thank you. Mr. Tintera. 6 MR. TINTERA: I'm not going to 7 reiterate my arguments. But having it four days in 8 this type of case just doesn't cut it, in my mind. 9 And whether it's a week -- this case is a year and 10 a half old. To get that a week before trial is -- 11 especially with the other things that I've already 12 alerted to the Court, it's just not fair. 13 THE COURT: Has that tape been 14 marked as an exhibit? We need to have it marked. 15 THE CLERK: Defendant's Exhibit 101. 16 THE COURT: Talking about the 17 videotape that is now marked Exhibit 101. And this 18 is a pretrial motion regarding its admissibility on 19 the objection of the State primarily because it was 20 disclosed late on. And I previously said and it's 21 clear to me that this is not something that 22 Mr. Sussman had for months and just sat on and 23 slipped it in as discovery a minute before -- day 24 or two before trial, but something that they have 25 been working on and unfortunately wasn't completed 29 1 until just at the time of trial. 2 I don't think that it's appropriate 3 that the Court should take time now during the 4 trial to go through the videotape and redact out, 5 as objections may be made, certain portions of it 6 that may be objectionable, and there are portions 7 of it that are. It could qualify as -- a 8 substantial portion of it could qualify as 9 demonstrative evidence, but the advice here that it 10 has not been submitted so the State can review it, 11 analyze it and determine how to react to it in -- 12 whether producing another videotape or bringing in 13 some other witness, the diagram or whatever, to 14 rebut portions of it, it's just too far down the 15 road to do that. 16 I would encourage counsel in the 17 future in preparing such exhibits to have them done 18 well before trial so that any of these difficulties 19 can be ironed out so that the exhibit can be used. 20 I also keep in mind that the witness 21 that is to testify, the expert who is on the 22 videotape will be present and may testify. I know 23 that cuts both ways, because Mr. Sussman has said 24 that if Mr. Tintera wants to cross-examine him, he 25 will be here to do that. On the other hand, he can 30 1 say virtually everything, with some exception, that 2 he said on the videotape. The only thing we lose 3 are the graphics involved, which are good, but 4 having reviewed it, I think the concepts embodied 5 in his testimony is on the tape and certainly can 6 be communicated to the jury without the graphics, 7 at least without the graphics that are on the 8 videotape and the witness would have the 9 opportunity to use the blackboard or paper or 10 whatever to draw any diagrams and that sort of 11 thing. 12 I understand the defendant has 13 probably spent a substantial amount of money having 14 this thing produced. That's not a criteria for me 15 to use in deciding whether or not to permit it to 16 be admitted. On balance, I am considering this and 17 ruling that it may not be shown to the jury, so I'm 18 allowing the State's motion. 19 MR. SUSSMAN: Your Honor, would the 20 Court permit, as Mr. Tintera suggested, the showing 21 of the graphics portion of the videotape? Seems to 22 me -- 23 THE COURT: If we can work out the 24 mechanics so that can be done, the graphics of it 25 are good, obviously. I looked at them. I think 31 1 they are helpful. I'm wondering about mechanically 2 how we're going to do that, whether they be -- the 3 question I had with all the brilliant computer 4 people here, couldn't you reproduce most of those 5 graphics on a chart or diagram that he could use at 6 an easel instead of chopping the tape up and 7 turning it off and on, and et cetera, as we go 8 through this? 9 MR. SUSSMAN: If we can present -- 10 eliminate the voice-over, the -- what I'll call the 11 talking head portion and have a videotape of the 12 graphics and that we run the -- during appropriate 13 times in relation to questions -- 14 THE COURT: I'd be open to that 15 possibility, if we can do it mechanically so that 16 it's not difficult. In other words, when I've had 17 videotapes before, we have tried to start and stop 18 and that sort of thing and it runs into difficulty. 19 There are a dozen or so key graphic 20 presentations during the tape and I'm wondering if 21 it wouldn't be easier, now that I have ruled as I 22 have, to salvage those by somehow having a computer 23 printout and having them enlarged and using an 24 easel and having the witness step down and use 25 those during his presentation instead of trying to 32 1 show them on a monitor. 2 MR. SUSSMAN: I'm trying to 3 determine the scope of what we're limited to here. 4 THE COURT: Sure. I'll consider the 5 graphics portions of it -- you certainly could use 6 it -- if we can do it in an appropriate fashion. 7 I'd suggest you think in terms of having it printed 8 out. 9 Anything else? 10 MR. SUSSMAN: May I have a moment 11 with Mr. Tintera? 12 THE COURT: Sure. 13 (Discussion off the record 14 between counsel.) 15 MR. SUSSMAN: Your Honor, there is 16 the one other issue that Mr. Tintera and I have and 17 I've not had a chance to sit down with him to cover 18 yet. It's trying to work out the telephone 19 testimony of the out-of-state witness. 20 THE COURT: That will be during your 21 case? 22 MR. SUSSMAN: Yes. 23 THE COURT: See if you can resolve 24 that. 25 MR. TINTERA: My position has been, 33 1 if counsel would let me know what was going to be 2 asked of this witness, I could answer the question, 3 and I'm still waiting. 4 THE COURT: Well, keep working on 5 that. See if you can't resolve that. 6 MR. TINTERA: I do have one other 7 matter. During defendant's opening statements, to 8 put this in perspective, the Court had granted the 9 motion in limine to prohibit any reference to the 10 defendant's hacking or password-cracking activities 11 at Tektronix. The Court granted that motion in 12 limine. However, yesterday, in front of the jury, 13 the defendant's counsel indicated that he was an 14 employee at Tektronix and he did an exemplary job, 15 that he was very valuable to Tektronix. 16 Now, I believe the defense has now 17 opened the door to allow me to attack that 18 position. They shouldn't have brought up Tektronix 19 at all, and I didn't think they were in front of 20 the jury. Now that they have, I think that they've 21 opened the door and now I can walk through that 22 door. 23 THE COURT: Well, I'll think about 24 that one. I'll take that under advisement. I 25 don't have to rule on that yet. 34 1 MR. TINTERA: I'm not so sure. The 2 witness we were talking about, one was Jim Lilley, 3 and he is my first witness. 4 THE COURT: Does he have personal 5 knowledge? 6 MR. TINTERA: The defendant told 7 him. 8 THE COURT: Told him what? 9 MR. TINTERA: That he had been 10 cracking passwords while he was working at 11 Tektronix and that he had been suspended two weeks 12 for it. 13 THE COURT: Officer Lilley doesn't 14 plan on taking any vacation during the trial, does 15 he? 16 MR. TINTERA: He does, actually. 17 After his testimony this morning, he's going to 18 Bend. He will be back next week, however. 19 THE COURT: I'm not going to rule on 20 that just yet. I would caution counsel to, both of 21 you, be aware of what you're doing. You're both 22 experienced, obviously, but the open doors, 23 sometimes trucks get driven through them, so that 24 argument has a nice ring to it. 25 I haven't heard response from 35 1 Mr. Sussman yet. I suggest he will think -- I'm 2 sure he will have one. Evidence in opening 3 statements is usually brought out. I'd like to 4 wait to see what the evidence is brought by the 5 defense before I consider what sort of evidence on 6 that issue might be produced by the State, likely 7 on rebuttal. So I have some time to consider that 8 before I would do that. 9 Anything else? 10 MR. TINTERA: No, Your Honor. 11 (Whereupon, the following 12 proceedings were held in 13 open court, the jury being 14 present, at 10:20 a.m.:) 15 THE COURT: Sorry we had you in 16 there so long, ladies and gentlemen. Counsel 17 showed up, I asked them last night to show up at 18 9:15 because we had final matters to discuss and I 19 had to make decisions on matters that I thought 20 would take 15 minutes. Took an hour. I apologize. 21 We weren't reading the sports page or anything like 22 that while you were waiting. 23 I don't want you to guess what we 24 were doing, but as you might expect, from time to 25 time, I have to make decisions about evidence and 36 1 procedures and that sort of thing, and we 2 accumulated some that hadn't been decided yet and I 3 had to do that and needed to rely on argument and 4 consider the law and it took a while. I like to 5 keep that at a minimum during the trial and 6 sometimes it happens -- did this morning -- and 7 probably will happen again. We try to minimize it. 8 You've heard the opening statements 9 and now we're prepared to begin with the evidence. 10 So, Mr. Tintera, your first witness. 11 MR. TINTERA: That will be James 12 Lilley. 13 14 JAMES LILLEY 15 called as a witness on behalf of the Plaintiff, 16 having been first duly sworn under oath, was 17 examined and testified as follows: 18 19 THE CLERK: State your full name and 20 spell it for the record, please. 21 THE WITNESS: My name is Jim Lilley. 22 L-i-l-l-e-y. 23 24 25 37 1 DIRECT EXAMINATION 2 BY MR. TINTERA: 3 Q Mr. Lilley, you are employed with the 4 Sheriff's Department of Washington County? 5 A Yes, I am. 6 Q In what capacity? 7 A Senior Deputy working in investigations. 8 Q And how long have you been in law 9 enforcement? 10 A 17 years. 11 Q And in the course of your -- have you had 12 any training in regard to being a Senior Deputy or 13 investigator? 14 A Yes, I have. 15 Q During your 17 years, have you had 16 occasion to interview people who are suspected of 17 engaging in criminal conduct? 18 A Yes, I have. 19 Q And have you had any training or 20 experience in regard to how to accurately make 21 notes or memorialize those type of statements? 22 What do you do? 23 A Yes, I've had the training. Basically 24 what I do is conduct the interview, make notes of 25 the interview as I go along, and based on those 38 1 notes, generate a report that reflects the content 2 of the interview and then reduce that to writing so 3 that if it's down the road when I need to refer to 4 it, I'll have the information that I obtained at 5 that time. 6 Q If I can take you back to November 1st of 7 1993, did you have an occasion to be called to the 8 Intel Corporation here in Washington County? 9 A Yes, I did. 10 Q And where did you go? 11 A I went to the Intel facilities on Cornell 12 Road, Hawthorn Farms I believe is the name of that 13 particular complex, and met with Intel people 14 there. 15 Q In the course of your meetings, did you 16 eventually draft an affidavit for a judge's review 17 in regard to searching particular areas? 18 A Yes, I did. 19 Q And did one of those areas involve the 20 home of Randal Schwartz? 21 A Yes, it did. 22 Q And which judge authorized that search, 23 do you know? 24 A (Pause) I don't recall now. 25 Q When was the search warrant served on 39 1 Mr. Schwartz's residence? 2 A November 1st, 1993, at 6:35 p.m. 3 Q And where was the residence located? 4 A The residence was at 12290 Southwest 5 Butner Road, which is unincorporated Washington 6 County in the State of Oregon. 7 Q Who was present, not with the Police 8 Department but in the residence when you got there? 9 A Mr. Randal Schwartz and his brother. 10 Q Now, were they in custody, handcuffed? 11 A No. 12 Q But did you do anything to let them know 13 what their rights might have been? 14 A Yes, I did. 15 Q And what would that have been? 16 A I read the Miranda rights that I carry 17 and always read from a card. 18 Q Can you tell the jury what those rights 19 are? 20 A Yes, I can. I prefer to read them from 21 the card that I use. That's the only way that I 22 ever read them. 23 Q All right. 24 A "You have the right to remain silent. 25 Anything you say can and will be used against you 40 1 in a court of law. You have the right to talk to a 2 lawyer and have him or her present with you while 3 you are being questioned. If you cannot afford to 4 hire a lawyer, one will be appointed to represent 5 you before any questioning, if you wish." At which 6 point I ask each person who is present if they 7 understand those rights as I read them to them. 8 Q What about Randal Schwartz, what did he 9 say? 10 A He verbally indicated that he understood 11 the rights that I read to him. 12 Q And he was cooperative with the 13 investigation? 14 A Yes, he was, as a matter of fact. 15 Q Did you speak with him about the reason 16 you were there? 17 A Yes, I did. In fact, as is usually the 18 case when we serve the search warrant, the first 19 thing that people want to know is why are we there 20 and what are we doing? What's going on? And as is 21 usually the case, I took that opportunity to tell 22 Mr. Schwartz exactly why we were there. 23 Q What did you tell him? 24 A I told Mr. Schwartz that I had been out 25 at the Intel Corporation earlier in the day. That 41 1 I had talked with the Intel employees who had told 2 me that they, in essence, were accusing him of 3 breaking into computer systems, obtaining passwords 4 from those computer systems, and that this was 5 activity that he was not -- that they were alleging 6 that this was activity that he was not authorized 7 to do and was not allowed to do. 8 And I explained to Mr. Schwartz that 9 the reason that I was here was to, in effect, get 10 his side of the story, find out if what Intel was 11 telling me was the truth or not, or if there was a 12 different way to look at what Intel was telling me 13 from Mr. Schwartz's point of view. 14 Q And after you explained that to 15 Mr. Schwartz, then what happened? 16 A I explained to him what Intel was 17 alleging and that he accessed these two computer 18 systems without authorization where he was not 19 supposed to be doing it, that he was obtaining 20 password files that he was not entitled to, that he 21 was not supposed to do. And Mr. Schwartz's 22 response to that was that yes, in fact, he had done 23 the things that the Intel people were alleging that 24 he had done. 25 He went on to explain to me that the 42 1 reason that he had done that was in order to be 2 able to get access to his e-mail from within the 3 workplace instead of having to wait until he got 4 home to do it and that that was the reason why he 5 was accessing these systems and trying to get 6 passwords. 7 Q Now, was there any further questioning or 8 further explanation that Mr. Schwartz provided to 9 you about that? 10 A Yeah. We went back through that. When 11 he was telling me about accessing the e-mail or 12 trying to access the machines to get his e-mail 13 access, he told me that he knew what he was doing 14 was against Intel policy. And, in fact, I'll use 15 his exact words, "technically illegal." But he 16 again reiterated that his whole intent was just to 17 be able to access his computer mail from his 18 workstation rather than go back home. 19 Q Now, when you -- before he started 20 talking about his e-mail, did you go through the 21 sequence of information that you knew about his 22 activities on the computers Mink and Brillig with 23 him? 24 A I think when we started after this 25 initial conversation, that's when we started to get 43 1 into the specifics of it and that's when we 2 discussed the Mink system, and then we went on to 3 discuss Brillig and SSD. 4 Q Could you tell the jury about that, 5 please? 6 A We started back from scratch again and I 7 asked him about the password cracking program 8 called Crack and accessing Brillig at Intel's 9 Supercomputer Division. Mr. Schwartz admitted to 10 me that he had accessed the Brillig and for SSD and 11 told me the reason for doing that was to check the 12 security systems of those two systems to see 13 whether they were hardened enough to prevent other 14 people from doing what he was attempting to do, and 15 that was his purpose in doing that. 16 We started to get into more detail 17 on that. Mr. Schwartz told me that he had been 18 accessing Intel's Mink system by a method that he 19 referred to -- and I use his word -- back-dooring, 20 until about April of 1993. He stated again that 21 this was in order for him to be able to access 22 electronic mail at his workstation. But then he 23 also told me that while he was conducting this 24 back-dooring, he knew it was against Intel policy 25 and could possibly be considered a criminal act. 44 1 Mr. Schwartz admitted to me that he 2 had been contacted by Mark Morrissey and Dirk 3 Brandewie way back in April of 1993 about his 4 activities with the Mink system and accessing it, 5 and at which time they had told him that he had to 6 restore the system back; in other words, put the 7 gate or the blocks back onto the system because he 8 wasn't supposed to be doing that and didn't want 9 anybody else doing it, either, and that he, in 10 fact, did do that. 11 He then told me that he started 12 trying to use some other process to attempt to 13 crack passwords, found that they weren't very 14 efficient and, in fact, then went back and removed 15 the gates or again began to back-door the Mink 16 system. At which point, Mr. Schwartz told me that 17 about in July of 1993, he was again contacted by 18 Mr. Morrissey and Mr. Brandewie, who had conducted 19 follow-up checks on the Mink system, and they had 20 found that he had removed the gates again and was 21 doing what he had been told not to do in April and 22 that he was, again, in July was told to put those 23 gates back on and not to go back into that system. 24 We then went on to discuss about his 25 accessing to the Brillig system and the SSD system 45 1 and the use of the Intel Snoopy system, which I 2 needed him to explain to me. 3 Q Let me stop you for a minute. How 4 computer literate were you at this time? 5 A Not very. In fact, basically not. 6 Q Did you use -- Did you have to resort to 7 people to help you understand what it was that was 8 being explained to you? 9 A Yes, I did. In fact, I had two or three 10 Intel employees in the room with me throughout the 11 questioning process. They weren't always the same 12 three people or all three people, but there was 13 always somebody there from Intel who could help me 14 understand the answers I was getting from 15 Mr. Schwartz because -- I liken it to using an 16 interpreter for someone to doesn't speak English. 17 Q How do you know that what you got from 18 Mr. Schwartz was accurate? 19 A Because I made notes at the time of the 20 interview, notes of the terms that he used, and 21 made sure that I understood at least the outline of 22 what he was talking about so that I could reduce 23 that to writing and make it understandable not only 24 for myself, but anybody else who would be reading 25 my reports. 46 1 Q So from those notes, you generated a 2 report? 3 A That's right. 4 Q Is that what you have in front of you? 5 A That's what I'm referring to through 6 here, yes, is the report that I wrote. 7 Q So after the talk about his activities on 8 the Mink computer in July of 1993, you went to 9 talking about the Brillig computer in the SSD 10 division at Intel? 11 A That's correct. 12 Q What did he tell you about that? 13 A He then started to give me some more 14 information about what he was doing with the 15 Brillig and SSD computer systems and how he was 16 doing it and the reason he was doing it. 17 At this point, he told me he was 18 using the Intel Snoopy system to speed up the Crack 19 program because, apparently, if you don't have fast 20 enough equipment or fast enough system, it takes a 21 very, very long time to run that program to attempt 22 to crack passwords. 23 And it was at this point that 24 Mr. Schwartz acknowledged to me that, again, it was 25 not -- not only what he was doing was against Intel 47 1 policy, but that there -- but that he knew in his 2 own mind what he was doing was a criminal act. 3 That he could be held criminally liable for this 4 specific activity. But -- 5 Q And that was in reference to what? 6 A To running the Crack program to try to 7 access or obtain passwords from the Brillig system 8 and the SSD system. 9 Q And then what did you talk about? 10 A At this point, Mr. Schwartz again was 11 adamant with me that the reason that he was running 12 these programs and trying to crack the passwords 13 was to find out how security-hardened the two 14 systems were against exactly that kind of activity. 15 However, he also acknowledged that another reason 16 he was doing that was that he was working under 17 contract in the Brillig system and that his 18 contract was soon due to expire, at which point his 19 personal password for that system would be revoked 20 and he was trying to get alternative passwords to 21 the Brillig system so he would be able to continue 22 to access it even after he had finished working on 23 it and his contract to do that had expired. 24 Q Let's stop here. He said what about 25 alternative passwords? 48 1 A That the reason he was running the Crack 2 password program against Brillig specifically was 3 because his contract, the Brillig account contract 4 that he was working on was soon to expire and when 5 it did expire, he had to turn -- he had to 6 relinquish his password. He lost his personal 7 password. And so what he wanted to do was to make 8 sure that even after he had officially stopped 9 working on that system, he would still be able to 10 access it by using one of the passwords he was able 11 to obtain by running the Crack program against the 12 Brillig system. 13 Q Someone else's password? 14 A Somebody else's password. 15 Q You've mentioned the Mink computer, the 16 Brillig computer, the Supercomputer Division. Are 17 those portions or parts of Intel located in 18 Washington County, State of Oregon? 19 A Yes, they are. 20 Q What was your understanding when he was 21 talking about the Crack program, what is a Crack 22 program, do you know? 23 A I certainly didn't at that time. I 24 learned very quickly, both prior to contacting 25 Mr. Schwartz and then through talking with 49 1 Mr. Schwartz. In fact, Mr. Schwartz kind of helped 2 me further understand the Crack program and how it 3 was used and what it was used for. 4 Q So what does it do? 5 A It's a program -- as best that I can 6 understand and try to explain to anybody else, 7 basically is a program that deluges the system with 8 multiple variations of numbers and letters and 9 codes until one of those combinations comes up and 10 will access that system. 11 Q So it deciphers codes? 12 A Yeah. 13 Q Now, after you had this interview with 14 Mr. Schwartz, we talked about what you've told the 15 jury. While you were having the interview, were 16 you doing anything to keep track of what 17 Mr. Schwartz had told you? 18 A Yes, I was. I was making notes. I had a 19 yellow pad and I would make notes of specific 20 responses to questions or specific statements, 21 either as a result of -- in response to a question 22 or that were voluntarily made. 23 Q Well, in your report, for instance, you 24 have in quotes in regard to Mr. Schwartz's 25 statements "technically illegal." Why is that in 50 1 quotes? 2 A Because that was the exact words that 3 Mr. Schwartz used when we were talking about the 4 allegation that Intel was making about his activity 5 with the Brillig -- with Mink and Brillig and SSD. 6 Q And how long did you talk to 7 Mr. Schwartz? 8 A We were probably in interview for two 9 hours. 10 Q And after the interview was over, in 11 regard to your report, what did you do to generate 12 your report? 13 A Once we had finished serving the search 14 warrant, I had finished the interviews, we went 15 back to the Sheriff's Office to log the evidence. 16 And in this particular instance, I went back to my 17 desk and sat down with my tape recorder and I 18 dictated the results of my interview, the contents 19 of my interview onto tape so that -- while it was 20 fresh in my mind so that it could be typed up the 21 next day by the secretaries and then I could review 22 it and make any editing processes to it after the 23 fact. 24 But I -- because I was not computer 25 literate, because I did not -- that some of my 51 1 understanding of what was being told to me was very 2 temporary, I was understanding it at the time but 3 was not confident that I would necessarily fully 4 understand it the next morning, I wanted to get 5 everything down on tape while it was fresh in my 6 mind, while I could recollect it all accurately, 7 and so that's what I did. And once that was on 8 tape, that was it. We all went home for the day. 9 Q When you did the tape, did you rely on 10 your memory to make sure you were accurate in 11 creating the tape which later turned out to be your 12 report? 13 A No, I used my notes. And the reason I 14 used my notes is, when I dictate my reports, I 15 always -- my narrative always runs chronologically. 16 In other words, I did this, this is when I did this 17 thing, all the way down the line in chronological 18 order. 19 My notes, while cryptic, are also in 20 chronological order of the interview. In other 21 words, as statements are made and I make notes on 22 those statements, there is a chronological order to 23 them. And I used those notes to create this report 24 and to keep it in chronological order and to make 25 sure that I was not forgetting something that 52 1 needed to go into the report. 2 Q When you were talking about after he had 3 cracked the passwords for the Supercomputer 4 Division computers, did you ever talk to 5 Mr. Schwartz about whether he had used those 6 passwords? 7 A Yes, I did. 8 Q Could you tell the jury what he said 9 about that? 10 A Mr. Schwartz was adamant that at no time 11 did he ever access any of the files using any of 12 the cracked passwords that he obtained through the 13 Crack program. He was very adamant about that. 14 Q Did that discussion go any further as to 15 whether he had in the past accessed files? I'm 16 talking about the IWARP system. 17 A I don't recall him ever at any point 18 stating that he had ever used Crack passwords to 19 access any system that -- 20 Q What did he say about the IWARP system? 21 A He told me that he had previously worked 22 at an organization called IWARP, which he described 23 as being a subsidiary of Intel, and that he, in 24 fact, accessed files in that IWARP system through a 25 program called Root. And he did say at that time 53 1 he had taken the further step of actually viewing 2 information from files that he had accessed. 3 Q Did he indicate, in regard to that 4 particular activity, whether he knew that was 5 illegal or against Intel policy? 6 A He admitted to me that he knew that was 7 both against Intel policy and also was illegal. 8 MR. TINTERA: Those are the only 9 questions I have. 10 THE COURT: Mr. Sussman. 11 MR. SUSSMAN: Thank you, Your Honor. 12 13 CROSS-EXAMINATION 14 BY MR. SUSSMAN: 15 Q Detective Lilley, you testified that you 16 were -- when you began this investigation, this was 17 approximately two years ago now, so you had been 15 18 years a police officer, but your familiarity with 19 computers, computer crimes, material you're dealing 20 with in this case was almost nonexistent; is that 21 right? 22 A That's correct. 23 Q And, in fact, this is the first computer 24 crimes case that you had been involved in at the 25 time? 54 1 A That's correct. 2 Q When you were called to go to Intel to 3 meet with them on November 1st to take a report 4 about what happened, you really had no 5 understanding about the nature of the systems they 6 were talking about, correct? 7 A At the time that I arrived, that's 8 correct. 9 Q And you had trouble understanding what 10 you were being informed about, the nature, even the 11 activities that were going on? 12 A It certainly took me a while to be able 13 to grasp what it was that they were telling me, 14 specifically understanding terminology and making 15 distinctions between things like systems and 16 programs and things like that. 17 Q And you had to rely on the Intel people 18 to explain to you what had happened and what the 19 significance of that was; is that right? 20 A That's correct. 21 Q At the time that you arrived there and 22 began this investigation, in fact, you were told 23 that the Intel people had done an investigation and 24 were reporting to you that in their view, 25 Mr. Schwartz had committed illegal acts in 55 1 violation of Oregon statutes; is that right? 2 A I don't recall whether they were -- 3 whether Intel was specifying that they had -- that 4 he had violated specific Oregon statutes or whether 5 that was something that we looked at during the 6 process of taking the report. 7 Q Well, you prepared an Affidavit for 8 Search Warrant in which you had to swear to under 9 oath, correct? 10 A That's correct. 11 Q And the second paragraph of the 12 affidavit, you said that when you spoke with Mark 13 Morrissey, senior engineer at Intel, he advised you 14 that he had found evidence of violation of ORS 15 164.377, computer crimes, at Intel Corporation, 16 with the address. That's what you stated in your 17 sworn affidavit; is that correct? 18 A That's correct. 19 Q So was that not accurate then? 20 A No. What that is reflecting is that when 21 I was talking with Mr. Morrissey -- 22 Q The question is, was that accurate? Is 23 that exactly what Mr. Morrissey told you? 24 A I don't recall if that's exactly what he 25 told me or whether that was what the two of us 56 1 determined had taken place. 2 Q So that was your interpretation of what 3 he told you? 4 A In one sense, yes. 5 Q Now, you took pains to understand what 6 you were being told by the Intel people before you 7 prepared this affidavit; is that correct? 8 A That's correct. 9 Q And in the particular affidavit, you 10 indicated that in one place that Mr. Schwartz -- 11 let me withdraw that. We'll come back to that. 12 Now, let me back up. Would you 13 describe briefly for the jury what the 14 participation of the various Intel employees were 15 in the preparation of the search warrant affidavit? 16 Who did you meet with first? 17 A I don't now recall who I met first and in 18 what order I spoke with them, primarily because 19 most of them were already there as a group and I 20 was getting information from all these people. The 21 exact order of obtaining that information, I don't 22 recall, and my affidavit is not going to reflect 23 that. What my affidavit is going to reflect is the 24 substance of what I was told by the various named 25 individuals employed by Intel. 57 1 Q So you don't remember exactly what was 2 said in the preparation of that search warrant 3 affidavit? 4 A Not specific quotes. I couldn't make 5 specific quotes, no. 6 Q Did you check into Mr. Schwartz's 7 background before obtaining that search warrant 8 affidavit? 9 A Not an independent check. I made no 10 specific inquiry into Mr. Schwartz's background. 11 Q Did Mr. Morrissey, when you were 12 preparing that affidavit, did he tell you what 13 Mr. Schwartz's position was at Intel? 14 A Yes, he did. 15 Q And what did he tell you? 16 A I'm going to have to refer to the 17 affidavit now -- 18 Q Please do. 19 A -- to be specific. 20 Q Please do. 21 A You're referring to what went into the 22 affidavit, correct, or are you talking about my 23 report? 24 Q No. I asked you specifically if -- when 25 you prepared the affidavit, whether Mr. Morrissey 58 1 told you what Mr. Schwartz's position was at Intel. 2 A In rereading through the affidavit here, 3 I don't see where they told me specifically what 4 Mr. Schwartz's job was at Intel. What they told me 5 was what he was not entitled to. 6 Q They just told you that he worked there? 7 A That's correct. 8 Q Did Mr. Morrissey tell you specifically 9 what his own position was? 10 MR. TINTERA: Objection. I don't 11 see how this was raised by any of the questions 12 that I went into with this witness. 13 THE COURT: I think it's within the 14 realm of cross-examination and proper. Overruled. 15 MR. TINTERA: Thank you. 16 THE WITNESS: Mr. Morrissey told me 17 he was a senior engineer with Intel. 18 BY MR. SUSSMAN: 19 Q Who else was at that -- did you meet with 20 that morning? 21 A John Kent. 22 Q Did John Kent tell you what his position 23 was? 24 A Yes, he did, Systems Network 25 Administrator for SSD. 59 1 Q Who else did you meet with? 2 A Mr. Rich Cower. 3 Q Anybody else? 4 A There were other people there, but 5 they're not mentioned in the affidavit. 6 Q Did Mr. Morrissey tell you what a Systems 7 Administrator does? 8 A Just told me what part of his duties 9 were. Didn't give me a full job description of 10 exactly what it was that he did. 11 Q Did Mr. Kent tell you what a network 12 administrator was? 13 A No, I don't believe he did. 14 Q Were you told that -- Did anybody tell 15 you there that Mr. Schwartz had a contract at Intel 16 that allowed him to do work when he was not 17 actually at the Intel site? 18 A I don't recall at this time. 19 Q Okay. Detective Lilley, do you recall 20 testifying in this courtroom in hearings related to 21 this case about a month ago, on June 13th, 1995? 22 A Yes. 23 Q And at that time, do you recall being 24 asked the question, "Did any of the Intel personnel 25 inform you that Randal Schwartz worked on Intel 60 1 business from home?" And you answered, "I believe 2 that I recall that they did say that." 3 A At another point in time, they did, but 4 as far as what went into the affidavit at the time 5 I was doing the affidavit, that was not information 6 that was included in the affidavit. And I don't 7 recall whether I had that information at the time 8 that I was doing the affidavit as opposed to the 9 time later during the investigation. 10 Q That question followed the question when 11 I asked you during the investigation of the reports 12 from Intel and in preparing your search warrant, 13 whether you were asked -- told what Mr. Schwartz's 14 position was at Intel and then whether he was 15 authorized to do work from home. Do you recall 16 that now? 17 A Not without referring to the transcript, 18 no. 19 Q Do you recall saying that -- When you 20 were gathering up this information, this 21 information was new to you and you were trying to 22 assimilate a great deal of new information, 23 correct? 24 A Correct. 25 Q A lot of information you were not 61 1 familiar with? 2 A That's correct. 3 Q And, for example, that you were trying to 4 understand basically in broad strokes? 5 A That's correct. 6 Q And that is, in essence, again, because 7 of your understanding of computers and computer 8 systems and their operation was limited? 9 A Is what? 10 Q Is very limited. 11 A That's correct. 12 Q And you had trouble at times following 13 what you were told -- 14 A That's correct. 15 Q -- and the information that was given to 16 you? 17 A That's correct. 18 Q When you were interviewing Mr. Morrissey 19 in preparation for the interview, did he tell you 20 that Mr. Schwartz was security conscious? 21 A Yes, he did. I believe so, yes. 22 Q And did he tell you what that meant? 23 A My understanding at that time was that he 24 had experience in the field of security. That he 25 understood the need for security, why it was set 62 1 up. And I believe at that time he said that 2 they -- I just lost my train there. Give me the 3 question again. I'm sorry. 4 Q You were explaining -- telling me whether 5 Mr. Morrissey explained what that meant, what that 6 meant when he said that Mr. Schwartz was security 7 conscious. 8 A That he understood security, why it was 9 there, and that, in fact, he -- one of his areas of 10 expertise was in establishing security systems. 11 Q And he communicated to you that 12 Mr. Schwartz was very clever when it came to 13 computers? 14 A That's correct. 15 Q And that he was very sophisticated in 16 network security? 17 A Yes. 18 Q And that he had previously worked in that 19 area? 20 A Yes. 21 Q And other areas of Intel? 22 A I don't specifically remember whether it 23 was in other areas of Intel or not, to be honest 24 with you. 25 Q And he told you that in the context of 63 1 Mr. Schwartz that he was a contractor for them and 2 did very sophisticated work for Intel? 3 A That's correct. 4 Q And that, in essence, that Mr. Schwartz 5 was very savvy about computers and computer 6 security? 7 A Yes. 8 Q And did he tell you that Mr. Schwartz was 9 certainly sophisticated enough to know how to cover 10 his tracks if he were trying to break into a 11 system? 12 A I don't specifically recall that at that 13 point. 14 Q But you recall being told that? 15 A At some point in time, yes. But not 16 necessarily at that point in time. 17 Q Now, did Mr. Morrissey tell you that when 18 he discovered this Crack program running, which 19 they were reporting to you that Mr. Schwartz was 20 running that program under his own user identity; 21 is that correct? 22 A That's correct. 23 Q And it was on the machine that was 24 running the program that was clearly marked 25 "Crack"; is that correct? 64 1 A I believe so, yes. 2 Q And was running it against a file that 3 was clearly marked "password SSD"? 4 A Yes. 5 Q And completely out in the open? 6 A That's correct. 7 Q And at that time, did he tell you that 8 Mr. Schwartz, as of the date that you met with him, 9 had not removed a Crack program from his files? 10 A That's correct. 11 Q And he had not removed any of the 12 password files from his files? 13 A That he had not? 14 Q That he had not removed the password 15 files, themselves, that the Crack was running 16 against from his files? 17 A That's correct. 18 Q And he told you that those password files 19 had been copied from the password file that was in 20 SSD; is that correct? 21 A I believe so, yes. 22 Q And the original password file was still 23 at SSD? 24 A That's correct. 25 Q The password that Mr. Schwartz had used 65 1 to look at that password file was still at SSD? 2 A That's correct. 3 Q And Mr. Schwartz had merely copied them? 4 A That's correct. 5 Q At the time that you prepared the search 6 warrant affidavit and obtained the search warrant, 7 did the people at Intel tell you that they had made 8 any effort to determine whether or not Mr. Schwartz 9 had looked at the material in the files behind the 10 Crack passwords? 11 A My understanding was from them at that 12 time that they were -- they would not necessarily 13 know if he had or not. 14 Q In fact, they were worried that 15 Mr. Schwartz had cracked the passwords in order to 16 get into those files to take sensitive information; 17 is that right? 18 A They expressed their concern as the 19 potential for him to do that. 20 Q In fact, you had a discussion with 21 Mr. Cower in which he told you that Mr. Schwartz 22 had a portable laptop computer? 23 A That's correct. 24 Q And that based on his experience, he 25 would expect that Mr. Schwartz would copy material 66 1 from those files onto his computer and take them 2 home? 3 A The way it was explained, and as I 4 understood it at that time, was that Mr. Schwartz 5 had the opportunity and there was the potential to 6 do that. Whether or not he had done it is another 7 matter. 8 Q The reason for the search warrant was so 9 that you could go seize his computers and his 10 computer files to determine that, whether he had 11 done that? 12 A That's correct. 13 Q Because that's what they were concerned 14 was the problem? 15 A That's correct. 16 Q And that's what they were looking for? 17 A Yes. 18 Q And in fact, you put in your affidavit 19 that Mr. Cower told you that based on his 20 experience in computer security that in order to 21 avoid detection in the workplace, Mr. Schwartz 22 would transfer the information to his Apple 23 computer in order to work with the information in 24 the privacy of his own home or office? 25 A That's what the affidavit says, yes. 67 1 Q And that Mr. Cower told you that this 2 would be a convenient way for Mr. Schwartz to move 3 the information to his office or home without being 4 detected by Intel's electronic safeguards? 5 A Yes. 6 Q They told you that Mr. Schwartz often 7 works out of his home or office? 8 A That's correct. 9 Q And you put that in the affidavit, so 10 that the password file from SSD was still at Intel? 11 A As I understood it, yes. 12 Q The password was still at Intel? 13 A That's correct. 14 Q You didn't need a search warrant to look 15 for those? 16 A Not the originals, no. 17 Q You needed a search warrant to see if 18 there was any information from the files, from the 19 passwords that were cracked that had been taken? 20 A That's correct. 21 Q And that was the crime that you were 22 investigating -- 23 A That's correct. 24 Q -- when you went to Mr. Schwartz's home? 25 A That's correct. @ 68 1 Q And when you went there, it was about 2 6:30 in the evening? 3 A That's correct. 4 Q Did you know that Mr. Schwartz's 5 activities during the day at Intel had been 6 monitored? 7 A Yes, I did. 8 Q The people at Intel had made copies of 9 all of his files? 10 A I believe so, yes. 11 Q And that they had been able to monitor 12 actually what he was doing that day by logging in, 13 by what computers he logged in? 14 A That's correct. 15 Q And when he logged off? 16 A That's correct. 17 Q And at that time, by the time you were 18 preparing that search warrant, had anybody at Intel 19 told you that Mr. Schwartz had not logged back into 20 the computer where the Crack program was running 21 since the first day that the program had started 22 running? 23 A I believe so. 24 Q That program started running on October 25 21st; is that correct? 69 1 A I don't recall the exact date, but it was 2 prior to November 1st. 3 Q It had been running for quite sometime 4 prior to that? 5 A Yes. 6 Q And it had been running for quite 7 sometime before Mr. Morrissey checked the system 8 and found it running? 9 A That's correct. 10 Q And that during that entire time the 11 program was running out in the open on 12 Mr. Schwartz's -- under Mr. Schwartz's own 13 password, own identification? 14 A That's correct. 15 Q And Mr. Schwartz had not checked back in 16 since the very beginning? 17 A As I recall, no. 18 Q Did anybody give you any specific 19 information when you prepared that affidavit for 20 the search warrant to indicate that Mr. Schwartz 21 had, in fact, copied any sensitive information from 22 those files? 23 A No. 24 Q So that when that search warrant was 25 prepared, the two things that Intel people knew for 70 1 sure was that there had been some incident that 2 they didn't -- that they were concerned about in 3 the spring when Mr. Schwartz was running and 4 developing a gate program to get access to e-mail 5 from outside of Intel? 6 A I don't believe they stated that he was 7 using -- no, they did, for e-mail, that's correct. 8 Q And that he was running this Crack 9 program? 10 A That's correct. 11 Q And they were particularly concerned 12 because of some of the people -- some of the 13 passwords that were cracked; is that right? 14 A Yes. 15 Q One of the passwords belonged to a fellow 16 by the name of Ed Masi? 17 A Yes. 18 Q Vice president of SSD? 19 A Yes. 20 Q And the other was Justin Rattner? 21 A That's correct. 22 Q He was the scientist, chief architect for 23 SSD? 24 A Yes. 25 Q And so they were worried that 71 1 Mr. Schwartz was stealing secret information? 2 A That's correct. 3 Q And when that search warrant was executed 4 that night, the search warrant was executed so that 5 you could seize Mr. Schwartz's computer? 6 A Correct. 7 Q Actually, all of his computers? 8 A Correct. 9 Q All of his computer files? 10 A Correct. 11 Q All of the disks that the computer 12 information was stored on? 13 A Correct. 14 Q And what was the purpose for seizing all 15 that? 16 A To determine whether, in fact, he had 17 stolen or obtained information from those systems 18 that he wasn't entitled to. 19 Q And nobody told Mr. Schwartz that anybody 20 was coming? 21 A No. 22 Q Of course not. And your understanding 23 was when you went over there to execute the search 24 warrant that nobody had spoken to Mr. Schwartz from 25 Intel before this time? 72 1 A That was my understanding, yes. 2 Q Now, when you showed up to Mr. Schwartz's 3 house about 6:30 or so in the evening, how many 4 officers were there? 5 A Seven. 6 Q And you knocked at the door? 7 A Correct. 8 Q Mr. Schwartz answered the door? 9 A No. I believe his brother answered the 10 door. 11 Q Are you certain of that? 12 A Yes. 13 Q As certain as you are about -- 14 A No, I'm sorry. He answered the door. 15 Let me refer to my report. 16 I'm sorry, I don't recall 17 specifically. That's not in there. My 18 recollection is that it was Mr. Schwartz's brother 19 that answered the door and that Mr. Schwartz was 20 upstairs. 21 Q But you're not certain of that? 22 A Not absolutely positive. That's my 23 recollection, that it was his brother that answered 24 the door. 25 Q And in your report, you said it was 73 1 Mr. Schwartz's brother that answered the door; 2 isn't that correct? 3 A I think I just said that my report 4 doesn't reflect who answered the door. 5 Q Now, when Mr. Schwartz answered the door, 6 the seven deputies were at the door? 7 A I don't believe that all of us were 8 there. I think two or three of us initially and 9 the others joined us once we made contact. 10 Q As soon as you made contact, the others 11 followed you? 12 A Yes. 13 Q And you announced to him that you had a 14 search warrant? 15 A Yes. 16 Q And you read the search warrant? 17 A That's correct. 18 Q And told him you were there to search for 19 evidence of a crime? 20 A That's correct. 21 Q Some of the others went upstairs to see 22 if anybody else was in the house? 23 A Correct. 24 Q You brought Mr. Schwartz's brother 25 downstairs into the living room? 74 1 A That's correct. 2 Q Both were there? 3 A That's correct. 4 Q Then you advised both of them of the 5 Miranda rights that you described previously? 6 A Yes, I did. 7 Q Rights that you read to somebody who is 8 suspected of a crime before you interrogate them; 9 is that correct? 10 A Rights that are read to an individual who 11 is either in custody or, in their own mind, would 12 feel that they were in custody and were not free to 13 leave. Does not necessarily mean that they are in 14 custody. 15 Q No, but means you read it to them because 16 you are questioning somebody -- 17 A The rights are read to them after the 18 service -- I always read the contents of the search 19 warrant, immediately followed by reading of their 20 constitutional rights, because I'm serving a search 21 warrant, I'm seizing the house and the people in 22 the house are no longer free to leave, and under 23 case law, I'm required to read them their Miranda 24 rights. 25 Q So you do this as part of your 75 1 investigation when you believe that there is 2 criminal activity? 3 A When I'm serving a search warrant 4 specifically. 5 Q After you came in and advised 6 Mr. Schwartz of his rights and you told him you 7 wanted to speak with him -- 8 A Yes. 9 Q -- and he offered to speak with you in 10 the kitchen area right next to the living room; is 11 that correct? 12 A I don't specifically recall whether he 13 made that suggestion or not. 14 Q But you wanted to go to another place 15 that was more private? 16 A That's correct. 17 Q So you went into a back room? 18 A That's correct. 19 Q A back room in the house and that's where 20 the questioning of Mr. Schwartz took place for the 21 next two hours? 22 A Yes. 23 Q Now, that -- I noted when you started 24 talking about Mr. Schwartz's testimony it was about 25 25 after 10:00, and when you finished, it was 76 1 approximately 20 to 11:00. During that two hours 2 that you were in there with Mr. Schwartz, was the 3 questioning and the interaction with Mr. Schwartz 4 going on just about all of that time? 5 A Not nonstop. There were breaks in those 6 conversations as people came in and out of the 7 room. There were matters that I would have to 8 attend to that would cause me to leave the room to 9 check on something and one of the other officers 10 would come in. 11 Q But it went on for the better part of two 12 hours? 13 A That's correct. 14 Q And so your notes summarized the essence 15 of what was said? 16 A My report is a summary of the essence of 17 what was said. My notes were specifics that I 18 based the report on. 19 Q And the text of your report covers about 20 four and a half pages in describing the activities 21 going on; is that right? 22 A That's correct. 23 Q And would you look at Page 2 of that 24 report and tell me where in your report you 25 summarize or you say anything about what you told 77 1 Mr. Schwartz about the reasons you were there and 2 the nature of the investigation. 3 A It doesn't say that. 4 Q Also like you to take a quick look at 5 your report and tell me other -- where you -- 6 looking at your use of quotation marks, the only 7 place that you have any of the statements in quotes 8 referring to the discussion and the discussion of 9 the specifics under investigation, the activities 10 at Intel under investigation at that time, that 11 "technically illegal" statement that you referred 12 to is the only statement that is in quotes. 13 A No, there is also the statement 14 "back-dooring." 15 Q Okay. So those are the only two, other 16 than putting like "Crack" or "Root" or words like 17 that? 18 A Correct. Those are in quotation marks, 19 but those were to designate specific terms. There 20 are other quotations in there, but -- 21 Q That don't relate to the specifics of 22 running the Crack program or that particular 23 investigation? 24 A Yes. 25 Q We have had a couple hearings where we 78 1 have had a chance to talk about this and -- 2 A Yeah. 3 Q -- we have previously had some discussion 4 about this back in September, a hearing on 5 September 20 of last year, and I asked you some 6 questions about some specifics -- about some 7 specific conversations that you had with 8 Mr. Schwartz at that time and you said that your 9 report is a summary, the results of the interview 10 with Mr. Schwartz. Is that accurate when you said 11 that -- 12 A Yes. 13 Q -- at times it was specific and at times 14 on technical points or other matters it was not? 15 A That's correct. 16 Q The report is really a substantive 17 summary of the outcome of your interview? 18 A That's correct. 19 Q Now, it's been two years since that 20 interview. You can't recall everything that was 21 specifically said during that, can you? 22 A No. 23 Q Mr. Schwartz was pretty cooperative 24 during the course of that discussion? 25 A Yes, he was. 79 1 Q When you went over to Mr. Schwartz's 2 house -- At the Washington County Sheriff's 3 Department, you have access to some tape recorders? 4 A Yes. 5 Q Ever use tape recorders in conducting 6 interviews? 7 A On occasion, yes. 8 Q Do you have access to video cameras? 9 A Yes. 10 Q Sometimes you bring those along on 11 searches? 12 A I never used one, no. 13 Q But they are available? 14 A They are available for that purpose, yes. 15 Q And you can have video and audio? 16 A Correct. 17 Q Did you bring a tape recorder along with 18 you? 19 A If I had one, it wasn't for the purpose 20 of tape recording the conversation, no. 21 Q Did you bring a tape recorder with you? 22 A I don't recall whether I -- the reason I 23 say this, I normally carry a tape recorder in my 24 car should I need it to dictate a report or tape 25 record a conversation, yes, but I did not have one 80 1 in the house with me, no. 2 Q You had one available and didn't bring it 3 in the house? 4 A That's correct. I may have had one 5 available or could have had one available, but I 6 didn't bring it in. 7 Q And a video camera is available to the 8 Sheriff's Office to bring along to also record what 9 happened during the course of the search and the 10 discussions; is that correct? 11 A That would also have been available. 12 Q You didn't use a tape recorder and tape 13 record any conversations with Mr. Schwartz, did 14 you? 15 A No. 16 Q That would have been a much more accurate 17 way to record the precise conversation, wouldn't 18 it? 19 A That's the most accurate way to do it, 20 yes. 21 Q Particularly in an area where you are 22 discussing subject matter with which you are not 23 familiar? 24 A Correct. 25 Q A video camera could have accomplished 81 1 the same thing, couldn't it? 2 A Correct. 3 Q Didn't use that, either? 4 A No, I didn't. 5 Q Now, I note that -- I recall in your 6 testimony and your report you refer to Mr. Schwartz 7 saying that he ran -- you looked at some files at 8 IWARP when he ran a program called Root. You have 9 "Root" in quotes. Your recollection is you're 10 certain that Root -- he told you that Root was a 11 program that he used to run? 12 A "Root" was a word that he used as the 13 means for which he ran the Crack program. 14 Q So that when you say the Root was a 15 program, that maybe you misunderstood? 16 A That's quite possible, given my 17 experience at that point in time, yeah. 18 Q Or maybe you misspoke yourself? 19 A No. That was my understanding as to what 20 Mr. Schwartz had told me and as reflected in the 21 report. 22 Q And you also said that Mr. Schwartz told 23 you his contract to run Brillig was about to 24 expire. 25 A That's correct. 82 1 Q You're certain that's what he told you? 2 A Yes. 3 Q As certain as you are about the other 4 statements that he -- 5 MR. TINTERA: Objection. Not a 6 proper statement to comment about one statement in 7 regard to other statements. 8 THE COURT: Sustained. 9 BY MR. SUSSMAN: 10 Q You may have been wrong about that, about 11 your understanding of Mr. Schwartz's -- what 12 program, which computer, which area of Intel 13 Mr. Schwartz had a contract with at that time; is 14 that right? 15 A You mean about Brillig? 16 Q Yes. 17 A No. 18 Q Thank you. 19 MR. SUSSMAN: One moment, please. 20 (Discussion off the record 21 between counsel and 22 Mr. Olstad.) 23 MR. SUSSMAN: Excuse me. 24 BY MR. SUSSMAN: 25 Q Now, one other thing. In talking about 83 1 running this program called Root, did he explain to 2 you what Root was? 3 A I don't recall. All I recall and all 4 that is reflected in the report is that that was 5 the name of the program that he used to access 6 files at IWARP. 7 Q And that Root allowed him to get access 8 to these files? 9 A Again, the report -- he told me that Root 10 was the name of the program that he used to access 11 the files. 12 Q Now, in that paragraph where you describe 13 the discussion where Mr. Schwartz described getting 14 access to IWARP, the files in IWARP, do you 15 anywhere mention -- you have in quotes the words 16 that it was "technically illegal". 17 Let me rephrase. The words that he 18 said it was "technically illegal" do not appear in 19 that paragraph, do they? 20 A Not in that paragraph, no. 21 Q And you are -- are you certain -- In your 22 previous testimony in this report, you say that 23 Mr. Schwartz said that was against Intel policy and 24 illegal. 25 A What was specifically? 84 1 Q Looking at the files through Root. 2 A Through Root, that's correct. 3 Q And that was your understanding of his 4 statement at the time? 5 A Yes, it was. 6 Q Do you know now what "root" is? 7 A No, I don't. 8 Q Do you know now whether -- if it is a 9 program or not? 10 A No, I don't. 11 MR. SUSSMAN: I have nothing 12 further. 13 THE COURT: Mr. Tintera. 14 15 REDIRECT EXAMINATION 16 BY MR. TINTERA: 17 Q Mr. Lilley, counsel is asking you about 18 the part of your report where you talk about the 19 defendant's access to the IWARP system. 20 A That's correct. 21 Q And you were talking to Mr. Schwartz on 22 November 1st, 1993. He indicated that activity was 23 when? 24 A Three years prior to that. 25 Q So that would have been 1990? 85 1 A That's correct. 2 Q And you talked about him actually taking 3 a step, a further step. What was that about? 4 A A further step at IWARP? 5 Q Yes. 6 A Aside from -- he had taken the further 7 step of actually viewing the contents, yes. 8 Q Contents of other people's files? 9 A That's correct. 10 Q And then he made an admission about that 11 conduct. What did he say? 12 A He said in words to the effect, he 13 acknowledged that what he was doing was against 14 Intel policy and that it was illegal. 15 Q And that he had no right to do that? 16 A That's correct. 17 Q Now, you were asked about the 18 availability of the tape recorder or video camera. 19 Why didn't you use those? 20 A Those aren't -- I don't use them a lot in 21 my interviews. For one reason, I find that people 22 find them inhibiting. It's not as much of a free 23 flow of information, particularly on an initial 24 interview where, in all honesty, I don't know where 25 the interview is going to go. 86 1 Mainly an initial interview is to 2 get a feel for what's going on, what one person has 3 to say about an incident as opposed to what other 4 people have told me about an incident. Mainly a 5 fact-finding thing. I make notes so that I'm able 6 to write a report that is an overview of that 7 interview, specific where it needs to be specific. 8 But as far as tape recording, as a general rule, I 9 don't use a tape recorder or a video camera for 10 those kinds of interviews. I would use those 11 devices at a further point in the investigation, 12 possibly. 13 Q Now, the defense attorney has elicited 14 that the interview of Mr. Schwartz took two hours. 15 A Approximately. 16 Q Approximately two hours. Then he 17 mentioned that your testimony was only from 10:25 18 to 10:50 about those statements. Do you remember 19 that? 20 A Yes. 21 Q Are there areas of the statements of 22 Mr. Schwartz's that you have not told the jury 23 about? 24 A That's correct. 25 Q So there are other aspects of the 87 1 conversation that have not been testified to; is 2 that correct? 3 A That's correct. 4 Q You were also asked about did anybody 5 from Intel or yourself speak to the defendant 6 before the search warrant was executed and your 7 answer was no. 8 A That's correct. 9 Q And why was that? 10 A Because we didn't want him to know that 11 we knew about his activity and give him an 12 opportunity to cease it and get rid of any evidence 13 that might be incriminating. In other words, if he 14 knew we were coming, we would run the risk of 15 losing evidence. 16 Q Is it your understanding when the 17 Supercomputer Division password file was copied, 18 could you tell how many times it had been copied? 19 A I don't recall now whether I do or not. 20 I mean, the password file had been copied and how 21 many times and on what occasions, I don't recall 22 now, no. 23 Q So you had no way of knowing whether it 24 was on a laptop computer or on a little computer 25 disk, did you? 88 1 A That's correct. 2 Q But your best guess was, "Let's look at 3 this and let's look at this house and see what's 4 there"? 5 A That's correct. 6 Q You were asked about what Mr. Kent or 7 Mr. Morrissey may have told you about what 8 Mr. Schwartz's duties were at Intel or 9 responsibilities. Did they tell you anything about 10 whether the information they gave you about him 11 setting up the Gate programs on Brillig and Mink or 12 him copying the Supercomputer Division password 13 files were authorized or not? 14 A Yes. 15 Q And what was that? 16 A That he was not authorized to do that. 17 Q So you did know that? 18 A Yes. 19 MR. TINTERA: Thank you. I don't 20 have any other questions. 21 22 23 24 25 89 1 RECROSS-EXAMINATION 2 BY MR. SUSSMAN: 3 Q Detective Lilley, when you talked 4 about -- going back to the question about 5 Mr. Schwartz's activity while working at IWARP, 6 during that conversation, did Mr. Schwartz tell you 7 specifically what his job was when he was -- 8 A I don't recall him doing that. 9 Q You don't recall what that was? 10 A No, I don't. 11 Q Do you recall him -- do you have any 12 recollection of the discussion about what those 13 duties and his position at IWARP involved? 14 A No, I don't. 15 Q You indicated that you tend not to use 16 tape recorders because it can be intimidating when 17 you have interviews. In this case, it was true 18 that Mr. Schwartz, according to your testimony, was 19 very cooperative? 20 A That's correct. 21 Q It was a free-flowing conversation, you 22 were saying? 23 A That's correct. 24 Q You were saying he was not reluctant to 25 respond to questions? 90 1 A That's correct. 2 Q No reason to think that he wouldn't agree 3 to tape record a conversation then, was there? 4 A Probably not. 5 MR. SUSSMAN: Nothing further. 6 THE COURT: Mr. Tintera. 7 MR. TINTERA: No further questions. 8 THE COURT: Thank you. You may step 9 down. 10 Let's take a ten-minute break. 11 Since we got started late, we'll probably go into 12 the noon hour, so about ten minutes. 13 (Recess.) 14 THE COURT: Call your next witness, 15 Mr. Tintera. 16 MR. TINTERA: Bob Wilcox. 17 18 ROBERT H. WILCOX, JR. 19 called as a witness on behalf of the State, having 20 been first duly sworn under oath, was examined and 21 testified as follows: 22 23 THE CLERK: State your full name and 24 spell it for the record, please. 25 THE WITNESS: Robert H. Wilcox, Jr. 91 1 W-i-l-c-o-x. 2 3 DIRECT EXAMINATION 4 BY MR. TINTERA: 5 Q Mr. Wilcox, have you ever been an 6 employee of the Intel Corporation? 7 A Yes. 8 Q And when was that? 9 A I was an employee in 1993. I left in 10 January of 1995, this year. 11 Q And what are you doing now? 12 A I'm setting up a consulting business. 13 Q And in what area of consulting is this 14 that you will be in? 15 A Computer network planning. 16 Q And could you tell the jury while you 17 were working with Intel, what were your duties or 18 what were your responsibilities? We're looking at 19 really the period of 1993. 20 A I was the computer networking manager for 21 the Hawthorn Farms building complex at Intel. 22 Q Translate that, please. 23 A I was responsible for the operation of 24 the computer networks for that building and their 25 connections to other Intel buildings. 92 1 Q So when you talk about computer networks, 2 are you saying how the various computers at Intel 3 talk to each other or the users talk through the 4 computers with each other? 5 A That's correct. All the equipment and 6 software that allows the computers to talk to each 7 other is the computer network in this case. 8 Q And how many computers are you talking 9 about are connected to that network? 10 A In our building complex, there are 11 approximately 3,000 computers and approximately 12 1500 people. 13 Q So at Hawthorn Farms there are 3,000 14 computers? 15 A Approximately. 16 Q And as a network administrator, you make 17 sure that the roads between the computers are free 18 of debris? 19 A It was more a case of expanding the roads 20 as the traffic became heavier and heavier and to 21 try to group people who are doing similar work 22 together so that their traffic would be local to 23 their neighborhood, in effect. And, finally, to 24 measure the traffic and see where we need to 25 improve things. 93 1 Q So if the traffic is heavier between 2 computer A and B, you might make computer B be able 3 to handle more traffic, is that it? 4 A Right. Or put them on the same road, put 5 them on the same part of the network. 6 Q And in the course of those particular 7 duties, did you ever have an occasion to work with 8 Randal Schwartz? 9 A Yes. 10 Q And do you remember when that started, 11 when that -- 12 A I don't have an independent recollection 13 of the date that I hired him. 14 Q Well, if I could show you what has been 15 marked State's Exhibit 14. Could you look at 16 State's Exhibit 14, which is four documents stapled 17 together. 18 A Yes. 19 Q What are those? 20 A These are the documents -- the Intel 21 documents that I used to hire Randal at the time, 22 and I'm not sure, there are several dates on here, 23 but apparently 2-20-92 is the start date. 24 Q And did you have a name for the group 25 that you were operating on the network as the 94 1 networking manager or not? 2 A I think just the Hawthorn Farms network 3 group. I don't recall it had a specific name. 4 Q And so in February of 1992, you hired 5 Mr. Schwartz into that group? 6 A Correct. 7 Q Is this a large group of people or small 8 group? 9 A No, it was quite small. I think at that 10 time there were probably around four of us, or 11 maybe three at that time. 12 Q Was Mr. Schwartz hired with any 13 particular purpose? 14 A Yes. Yes. 15 Q And what purpose was that? 16 A To monitor the computer networks. We 17 needed to have several UNIX workstations. 18 Q Wait a minute. What does that mean. 19 What's a UNIX workstation? 20 A It's a specific type of computer and it 21 requires an expert in order to administer it or 22 operate it, and I was not an expert in that area. 23 Q Is UNIX a particular computer language? 24 A UNIX is the so-called operating software 25 for the computer. Another example of operating 95 1 software for a computer would be DOS or Windows. 2 So if you have the computer, you need to have the 3 operating system to do anything, and then you would 4 add the programs that you want to do the real work 5 with. 6 Q So what operating system are you familiar 7 with? 8 A I'm more familiar with the DOS, Windows 9 and VMS operating systems. 10 Q And so to do your job, you needed 11 somebody that was familiar with a UNIX operating 12 system? 13 A Yes. 14 Q If I've got this right, is this like 15 having different car engines? You have maybe a 16 Chevy and a Mazda engine and they are kind of 17 different, so you need different technicians to 18 work on the different engines; is that right? 19 A Absolutely. I wouldn't be qualified to 20 administer a UNIX system. 21 Q But Mr. Schwartz was? 22 A Yes. 23 Q Why didn't you just have one operating 24 system? It's not really relevant to this case, but 25 why didn't you just have one? 96 1 A Well, different operating systems have 2 different strengths and weaknesses. And the second 3 reason is that sometimes this software that you 4 want to run to do the work will only run on one 5 operating system and not on just any of them. 6 Q So Mr. Schwartz is your UNIX operating 7 systems person? 8 A Correct. 9 Q What was he supposed to be doing to 10 assist you in the computer network managing? 11 A Well, there were three responsibilities 12 that Randal Schwartz had: The first was to 13 administer the UNIX computer systems, and that 14 means to install the software, make it work, back 15 up the computer systems so that if the system 16 malfunctioned, we'd be able to go to a tape backup 17 and bring everything back to start it again. And 18 to put these computer systems on the Intel network 19 so that they operated harmoniously with the rest of 20 the Intel computers. 21 Second area was to get network 22 monitoring software working on the computers so 23 that we could measure the network traffic that we 24 had. And the software involved there is Spectrum, 25 which is a brand name for a particular piece of 97 1 software, and Sun Net Manager, which is another 2 brand name for another piece of network. 3 Q I didn't hear that, Spectrum and what? 4 A Sun Net Manager. 5 Q So that system is like one of those black 6 cords across the highway to count the cars going 7 by, is that -- 8 A It's a system which communicates with the 9 network equipment and gathers the statistics of how 10 much traffic has been going by. 11 Q So it's a black cord across the highway 12 with the box connected to the control center? 13 A The control center would be the UNIX 14 workstation, and the network itself had its own 15 built-in intelligence for counting each car going 16 by. 17 Q What's the third area that Mr. Schwartz 18 is supposed to do? 19 A The third area was to automate the 20 administration of the network. 21 Q What does that mean? 22 A Well, it's a broad task. One of the 23 parts of that was to bring up the DNS system, and 24 you'll hear more about that later, for Hawthorn 25 Farms and to make that work with the rest of the 98 1 DNS systems within Intel. And there were a few 2 other areas. 3 Q A DNS system, you're talking about a 4 Domain Name Server; is that correct? 5 A Correct. 6 Q Now, when computers talk to each other -- 7 I know people at Intel give computers names. 8 A Correct. 9 Q Like people names? 10 A Yeah. 11 Q Tell me a couple. 12 A Well, some of the names I use were the 13 names of artists, so I used Kandinsky, which is a 14 famous artist, or Manray. 15 Q But when computer Kandinsky talks to 16 computer Manray, do they use those names? 17 A Yes, they do. 18 Q And are those names attached to numbers? 19 A Yes. 20 Q What are those numbers called? 21 A The numbers are the addresses of the 22 computer or the full name would be the IP address, 23 and they are exactly like phone numbers. 24 Q So each computer has its own like 25 address, an IP address? 99 1 A Yes, that's correct. 2 Q So computer Kandinsky has one and 3 computer Manray has its own address? 4 A That's correct. 5 Q On the network? 6 A Yes. 7 Q And what does the Domain Name Server do? 8 A Well, in the simplest case, when the 9 Kandinsky computer wants to talk to the Manray 10 computer, the Kandinsky computer asks the DNS 11 system, the DNS server, "What's the telephone 12 number? What's the IP address of Manray?" And the 13 Domain Name Service returns the number, the IP 14 address of Manray back to Kandinsky and Kandinsky 15 uses the number to communicate with Manray. 16 Q So the Domain Name Server is an 17 operator -- 18 A Yes. 19 Q -- that the computer calls to get the 20 number for where to complete its call; is that 21 fair? 22 A Correct. 23 Q So what was Mr. Schwartz supposed to be 24 doing with this DNS, Domain Name Server? 25 A The operation of DNS could consume weeks 100 1 of discussion, and I am not really even an expert, 2 myself, in this area, but all of the computers in 3 the Hawthorn Farms building complex had numbers and 4 each of these numbers was registered in the Domain 5 Name Service, along with the name of the computer. 6 So anybody in our building complex, 7 if they wanted to talk with one computer to 8 another, they would call the Domain Name System and 9 get the numerical address, the IP address, the 10 number from the Domain Name System from the user 11 that they wanted to talk to. 12 As well, if a computer outside our 13 building complex wanted to talk with a computer, it 14 would go to that same system. Or if we wanted to 15 talk to -- from our building to another, a call 16 would be made to our local Domain Name Service and 17 then from there, that request would be relayed to 18 other domain name services outside our building 19 within Intel, or even outside Intel if you wanted 20 to communicate with the system outside of Intel. 21 Q Kind of like if you wanted to go to the 22 overseas operator? 23 A That's exactly it. 24 Q So those were the three areas of 25 responsibility for Mr. Schwartz? 101 1 A In the area of this -- this third area of 2 automation, there was also a program to look for 3 addresses that had been given out or numbers that 4 had been given out that were no longer in use, so 5 we could reuse the number, and I believe that this 6 was the main project at the end of the time period 7 when Randal worked for me at that time. 8 Q So we're talking the end of the time 9 period being the fall of 1993? 10 A Correct. And I believe that we would 11 call that project the IP address administration 12 automation. 13 Q The IP address automation? 14 A Correct. 15 Q So that sounds like the phone company 16 going around to find out who is not -- who has been 17 disconnected from a number so they can give the 18 number to a new subscriber. 19 A That's exactly it. 20 Q What was the relationship to Mr. Schwartz 21 and yourself as far as were you equal co-workers 22 or -- 23 A Randal worked for me. 24 Q So he was -- he first responded to you, 25 as you were his supervisor? 102 1 A Correct. 2 Q State's Exhibit 14 references part of his 3 duties on the last page as a Systems Administrator. 4 What does that mean, the third page of that 5 document, "UNIX Systems Administrator"? 6 A This was the first area I spoke of, which 7 is to install new software on these UNIX computers 8 to make sure that they operate properly, to be sure 9 that if one failed, another could take over the 10 job. That's the area of computer backups of 11 putting data onto tape. It's a fairly broad 12 classification, so -- but within the people who do 13 that kind of job, it's fairly well-known what's 14 involved. 15 Q Of the three specific areas that 16 Mr. Schwartz was hired for that you spoke to the 17 jury about, which one of those areas, if any, 18 involved security? 19 A Well, each of those areas involved 20 security in the sense that as you were doing that 21 job, you would have to take into account security 22 considerations. 23 Q Because Intel wants its internal network 24 secure from -- 25 MR. SUSSMAN: Objection to leading 103 1 on this one. 2 THE COURT: Sustained. 3 BY MR. TINTERA: 4 Q Why is that? 5 A Like many businesses now, Intel uses its 6 computer networks to actually do the work, so if 7 the network were to stop working because of a 8 security incident, then the company would, in 9 effect, stop working. 10 And the second reason is that as all 11 these people are working there every day doing 12 their job, they're storing their work on computers 13 and so that information is considered to be an 14 Intel secret. And if a competitor were to obtain 15 that information, they would know what Intel was 16 doing or they might be able to recreate a product 17 that Intel had been developing without actually 18 doing the work. 19 Q And when you talk about a security 20 incident, what did you have in mind? 21 A Well, security incident could be somebody 22 who was not authorized to access information 23 accessing it, or somebody causing other people not 24 to be able to access their work or their computers. 25 Q Did the computer network that you were 104 1 administering involve the Supercomputer Division at 2 Cornell Oaks? 3 A No. I was only responsible for the 4 computer networks in the Hawthorn Farms complex and 5 the connections between Hawthorn Farms and any 6 other Intel building. 7 Q Cornell Oaks is away from Hawthorn Farms? 8 A Correct. 9 Q Did any of the areas that Mr. Schwartz 10 was hired to work on involve any responsibilities 11 in the Supercomputer Division? 12 A No. 13 Q Did any of the three responsibilities or 14 areas that Mr. Schwartz was working under you for 15 involve him setting up -- do you know what a Gate 16 program is? 17 A No. 18 Q Did any of those -- Do you know if any of 19 his work involved setting up a gate in your system? 20 A No. I can't think of a case where that 21 would be. 22 Q And what about operating a Crack program, 23 is that something that you would do? 24 A No, not for computers outside my 25 building. If I was concerned about the security of 105 1 computers in my building -- 2 Q Your building being? 3 A The Hawthorn Farms building, I might test 4 their security, but if I was going to do that, I 5 would ask permission, certainly, of the person I 6 was working for as well as the corporate security 7 people. And then if I found a security problem, 8 then I would tell the person whose password, for 9 instance, was not a good one, too easy to guess, 10 "You should change that password," because somebody 11 else might guess it, too. 12 The Crack program is that kind of 13 program, it's a program for guessing common 14 passwords. 15 Q Did any of the responsibilities of 16 Mr. Schwartz that you hired him for involve running 17 the Crack program? 18 A No. 19 Q Did Mr. Schwartz ever come to you and 20 say, "I have run that program. Here are passwords 21 that are insecure"? 22 A No. 23 Q Do you know when Mr. Morrissey joined 24 your group? 25 A I don't recall the exact date, but I 106 1 believe -- 2 Q Can you give me a timeframe? 3 A I believe it was during the summer -- 4 spring or summer of 1993. 5 Q And what was Mr. Morrissey to do with 6 your group? 7 A Well, of the three areas that I mentioned 8 that I hired Randal to work on, UNIX system 9 administration, network management software and 10 automating some of the network administration 11 tasks, Mark was responsible for taking over the 12 first two areas, the UNIX systems administration 13 and installing and getting -- operating the network 14 management software. 15 Q So in the spring or summer of 1993, what 16 is on the third page of State's Exhibit 14, UNIX 17 system administration, that was taken over by 18 Mr. Morrissey for Mr. Schwartz? 19 A For the most part. The systems that we 20 had in our group were used for two different 21 purposes. One group of systems was used for the 22 DNS service, as I mentioned earlier, this look-up 23 service, the Domain Name System, and the second 24 group of computers was used for network management, 25 in effect measuring and counting the network 107 1 traffic to see how busy our networks were. 2 And so Mark Morrissey took over the 3 UNIX system administration for those systems which 4 were used for network management and took over the 5 job of installing the network software on those 6 systems. However, the Domain Name Service system 7 was still under Randal's administration, UNIX 8 systems administration. 9 Q When you hired Mr. Schwartz in 1992, what 10 type of education did you give him in regard to 11 Intel policies and procedures? 12 A I didn't explicitly go over Intel 13 policies beyond those covered in the nondisclosure 14 agreement. However, he had come from another Intel 15 group and I'm not sure if any of that occurred 16 before. I expect that it had. 17 MR. TINTERA: Thank you. I don't 18 have any other questions. 19 THE COURT: Mr. Sussman. 20 MR. SUSSMAN: Your Honor, my cross 21 will probably take a while. 22 THE COURT: Let's take our noon 23 recess at this time. Leave your notes in the jury 24 room. Check in about 1:30. We'll start about that 25 time. 108 1 Remove the jury. 2 We're in recess until 1:30. 3 (Luncheon recess.) 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 109 1 AFTERNOON SESSION 2 BEGINNING AT 1:40 P.M. 3 JULY 13, 1995 4 5 (Whereupon, the following 6 proceedings were held in 7 open court, the jury being 8 present:) 9 THE COURT: We need to have the 10 witness resume the stand, Mr. Tintera. 11 Resume the stand, please, sir. 12 You're still under oath. 13 Mr. Sussman, you may begin your 14 cross-examination. 15 MR. SUSSMAN: Thank you, Your Honor. 16 17 CROSS-EXAMINATION 18 BY MR. SUSSMAN: 19 Q Mr. Wilcox, when you were first 20 testifying explaining about the UNIX as opposed to 21 other operating systems, you said that different 22 systems have different strengths. Do you also find 23 that in different sites around Intel, different 24 systems were operating with -- using different 25 operating systems? 110 1 A Usually you found, believe it or not, all 2 the operating systems in each site. My building 3 complex would have all of those ones that I 4 mentioned and many other Intel sites were the same. 5 Q Now, you had mentioned that you were 6 responsible for computer network management for 7 Hawthorn Farms, about 3,000 computers at Hawthorn 8 Farms. Was one of the computers in the network at 9 Hawthorn Farms a computer called Mink? 10 A Mink? 11 Q Yes. 12 A I can't say for sure. The name sounds 13 familiar, but without any other context, I can't 14 remember it. 15 Q Mink would have been the machine that 16 would have been used at Hawthorn Farms to provide 17 access to the Internet. 18 A If this is a computer that Dirk Brandewie 19 administered. 20 Q That's right, Dirk Brandewie administered 21 that. 22 A I have a memory of that. I didn't have 23 any direct -- 24 Q That's fine. 25 I'd like to show you what has been 111 1 marked as State's Exhibit 14. You've been shown 2 initially what has been marked for identification 3 State's Exhibit 14. This is a contract 4 authorization form. Now, this top sheet -- let me 5 back up. 6 Was Mr. Schwartz actually an 7 employee of Intel? 8 A No. He was a contractor and his company 9 provided contracting services to Intel. 10 Q What was called an independent 11 contractor? 12 A That's correct. 13 Q And contractors were subjected to 14 different employee rules in terms of aspects of 15 their service? 16 A I believe there were differences, but I'm 17 not an expert in that area. 18 Q You had to review, though, the documents, 19 the paperwork when you contracted with Mr. Schwartz 20 for his services and including the usual paperwork 21 approving these contracts; is that right? 22 A Yes. 23 Q Now, one of the -- when a contract was 24 approved and Mr. Schwartz was going to begin 25 working with you, the top page that we have here on 112 1 Exhibit 14 entitled the "Contractor Authorization 2 Form" deals with some specific authorization for 3 Mr. Schwartz to have access to Intel at odd times; 4 is that right? 5 A Yes. 6 Q And what you sought was authorization for 7 Mr. Schwartz, the contractor, to be able to have 8 access 24 hours a day to the Intel campus? 9 A That's correct, yes. 10 Q And your reason for that, as you 11 mentioned here, was, "The contractor may need to 12 work and respond at off hours to maintain that 13 network." 14 A Yes. 15 Q So he had to be also in constant contact 16 with the machines at Intel that he was working on 17 in order to know if there was an emergency? 18 A Not necessarily, but what we had was an 19 arrangement where I could call his pager if there 20 was a problem in the off hours. So anybody could 21 detect a problem. 22 Q Sure. And if there was a problem, would 23 it be common to send him a message, besides 24 telephone, by e-mail? 25 A Not usually, because I didn't believe 113 1 that an e-mail message would be delivered in a 2 predictable time, so believe it or not, in this 3 high-tech world, telephones and pagers -- 4 Q That's what you rely on? 5 A Yes. 6 Q Was it common for other people that you 7 were aware of to use e-mail to send these messages? 8 A Not what -- what's your specific question 9 again? Would anybody send e-mail messages or -- 10 Q Was it common for other people working 11 under you, for Randal Schwartz to communicate with 12 e-mail messages? 13 A The people who were working with me -- 14 Q Not -- I'll rephrase it. 15 Was it common in your experience 16 with Randal Schwartz for him to rely on e-mail 17 messages to communicate regarding his work? 18 A Not usually to me. Most of the 19 communication between Randal and I was in person or 20 in the form of invoices that he sent me. 21 Q Now, when you were going through this 22 initial paperwork, you had to fill out -- I see 23 there was attached to this agreement an independent 24 contractor questionnaire. Are you familiar with 25 this portion of the document that's been marked 114 1 State's Exhibit 14? 2 A I haven't seen it for some time. I'll 3 quickly review it. 4 Uh-huh. 5 Q And I'd also like to show you what we 6 have had marked for identification as Defendant's 7 Exhibit 103, and what is that? 8 A This is a form that's headed "Test for 9 Independent Contractors and Consultants," and 10 within Intel, there are different kinds of 11 contractors and this allows you to separate one 12 type from another, and the main issue is tax 13 status. 14 Q Exactly. When somebody is not an 15 employee and they are hired as an independent 16 contractor, there are tests for tax purposes, for 17 payment of benefits, that the IRS sets to determine 18 who is an employee and who is a contractor? 19 A Right. 20 Q And those tests are very strict. When 21 you hire somebody as an independent contractor, you 22 have to be -- you have to show the IRS that these 23 tests are being satisfied; is that correct? 24 A That's correct. 25 Q Now, if we answer -- going through these 115 1 tests, if we answer yes, these are the things that 2 they look for to show that somebody is an employee; 3 and if you answer no, they're the things that the 4 IRS looks for to determine if they are an 5 independent contractor; is that right? 6 A I couldn't tell you for sure. My 7 understanding is that Randal had qualified in the 8 past for this status and I couldn't tell you, 9 myself, which -- how you're supposed to answer 10 these one way or the other. 11 Q Did you sign off on these? 12 A Yes. 13 Q This form that you signed off on shows -- 14 for instance, under "Training," says, "Contractor 15 will receive training from the company or will be 16 required to regularly attend meetings. Work 17 methods are controlled by the company," and the 18 checkoff is "no." Correct? 19 A Correct. 20 Q And -- 21 A It's checked as no. 22 Q And where it asks, "Will the company 23 determine the order of work," how is it checked? 24 A That's checked "no." 25 Q Where it says, "The company sets work 116 1 hours," how -- 2 MR. TINTERA: Judge, I object to 3 this. The document speaks for itself and I don't 4 object to its admissibility. I don't know that we 5 need to go through and ask a witness who didn't 6 fill it out and ask how it was checked. The jury 7 can look at that. 8 THE COURT: Do you wish to offer 9 that document? 10 MR. SUSSMAN: I'll rephrase the 11 question. 12 BY MR. SUSSMAN: 13 Q As an independent contractor, you also 14 know that Mr. Schwartz would set -- that the 15 company wouldn't necessarily set his hours; is that 16 right? 17 A Would not set his hours, that's correct. 18 He wouldn't have to be there from 8:00 to 5:00 19 Monday through Friday. 20 Q And you knew that as an independent 21 contractor, Mr. Schwartz would sometimes work at 22 the company location? 23 A Yes. 24 Q But he would also work off-site. He 25 would sometimes work at home? 117 1 A I can't think of a case where we ever 2 talked about him doing that. It certainly would be 3 possible, but all the work that he did when he was 4 working with me, everything I can remember was 5 always on site. 6 Q There were also times when Mr. Schwartz, 7 during the period he was working for you, had to 8 travel out of town? 9 A Yes. 10 Q And while he was gone at those times, if 11 it was necessary, he could do his work from off 12 site out of town; is that correct? 13 A We never made explicit arrangements for 14 him to be able to work outside. 15 Q But he was not restricted from doing 16 that? 17 A He was not. I didn't tell him, "You're 18 not allowed to work when you're not inside." 19 Q And, in fact, if he had to be out of town 20 or off site because you didn't control the manner 21 or place of his work, he might have to do that, 22 right? 23 A Yes. 24 Q You had -- As I recall your testimony, 25 was that you -- the only form involving security 118 1 that you personally reviewed with Mr. Schwartz was 2 the page marked "Nondisclosure Form," which is the 3 fourth page attached to State's Exhibit 14. 4 A Yes, that's correct. On these four 5 documents, that's the one that covers security. 6 Q And that was the extent of it? 7 A Yes. 8 Q Now, I'd like to show you what has been 9 marked for identification as Defendant's Exhibit 10 102. Just take a moment to look at that because 11 there are several pages of documents attached to 12 that. 13 A (Witness complies.) Thank you. 14 Q And would you just tell the jury what 15 this document includes? 16 A Well, the initial page is the page that 17 authorizes the payroll department at Intel to issue 18 checks to Randal's company, but it has an 19 expiration date. Looks like it's around four 20 months. And then the pages after that are renewing 21 his contract in effect and informing the payroll 22 department to extend it or to add money to the 23 account so the money wouldn't run out. 24 Q Before I ask you the next question, let 25 me show you this document. Show you what has been 119 1 marked as Defendant's Exhibit 106 for 2 identification. Take a look at that for a moment. 3 MR. TINTERA: Your Honor, I cannot 4 hear what counsel is saying. 5 MR. SUSSMAN: I was telling the 6 witness to just look through the documents. 7 MR. TINTERA: Thank you. 8 BY MR. SUSSMAN: 9 Q Are you familiar with the documents 10 included in Defendant's Exhibit 106? 11 A Not in detail, no. 12 Q But you have seen them. Are these 13 documents that you have worked with in hiring 14 independent contractors? 15 A I can't say that I have. I can't say 16 that I have never seen this document before, but I 17 can't say that I have, either. 18 Q Let me ask you then specifically about 19 the last page of the document, which is a statement 20 about independent contractors. Are you familiar 21 with that page of the document? 22 A Uh-huh. 23 Q Now, would you read for the jury what the 24 definitions are of "employee" and "independent 25 contractor"? 120 1 A This has several sections here. There is 2 a purpose and then there is definitions, and under 3 the definitions under "Employee," says, 4 "Individuals are employees if Intel Corporation has 5 the right to direct them in the way they work both 6 as to the final results and the details of when, 7 where and how the work is to be done. An employee 8 is hired for an undefined period of time to perform 9 ongoing specific tasks generally during regular 10 Intel work hours and an employee must be placed on 11 Intel Corporation's payroll and have the required 12 taxes withheld. If individuals fit this 13 definition, they must be treated as employees 14 regardless of what their contract states." So 15 that's the employees' section. 16 The next section is independent 17 contractor. "Individuals are individual 18 contractors if they are subject to the control and 19 direction of Intel only as to the results of their 20 work and not as to the means. In essence, they 21 provide a service for fee and independent 22 contractors are not placed on the Intel payroll and 23 do not receive employee benefits. They are paid 24 through the accounts payable systems upon 25 submission of an invoice. Independent contractors 121 1 are typically self-employed and are generally 2 contracted by Intel to work on specific projects 3 and/or for a limited period of time. Under no 4 circumstances should an individual who fits the 5 employee definition be treated as an independent 6 contractor." 7 Q Wasn't the policy at Intel that 8 independent contractor contracts were not to extend 9 beyond a period of only six months? 10 A I couldn't say exactly what the period 11 was, but my understanding is they were to be of a 12 limited duration. 13 Q And Mr. Schwartz's first contract was for 14 a limited duration, but you renewed that? 15 A That's correct. 16 Q And when that contract period came up, 17 you renewed it again? 18 A Right. But the period of each of those 19 contracts, I'm not an expert on how that period of 20 time -- the initial one was four months -- relates 21 to Intel's maximum length of contract. 22 Q Was Mr. Schwartz still working for you 23 under a contract on November 1st, 1993? 24 A Yes. 25 MR. SUSSMAN: Your Honor, at this 122 1 time I would offer Defendant's Exhibits 103, 102 2 and 106. 3 MR. TINTERA: In regard to 4 Defendant's Exhibits 102 and 103, I have no 5 objection. There has been no authentification of 6 the first pages of 106. Only been referred to as 7 the last page. In spite of no authentification, I 8 don't object to No. 106. 9 THE COURT: 102, 103 and 106 are all 10 received. 11 (Whereupon, Defendant's 12 Exhibit Nos. 102, 103 and 13 106 were received in 14 evidence.) 15 BY MR. SUSSMAN: 16 Q When Mr. Schwartz was originally 17 initially hired as a contractor, he was hired to do 18 systems administrative work; is that correct? 19 A All three of those areas, systems 20 administration -- 21 Q Network administration? 22 A -- network software, getting that 23 working, and the third is the network 24 administration and automation. 25 Q And in November or October of 1993, you 123 1 mentioned that there was some transition going on 2 with Mark Morrissey taking over some 3 responsibilities. In terms of the structure of the 4 workplace, was Mr. Morrissey -- he worked 5 underneath you? 6 A Right. 7 Q He was working for you? 8 A Mark Morrissey worked for me. 9 Q You say he was a peer or equal of in 10 terms of Mr. Schwartz, in terms of the kind of 11 responsibilities and where they fit in the 12 structure of things? 13 A That's correct. Both Randal and Mark 14 were peers working for me. 15 Q And in November of 1993, Mr. Schwartz's 16 contract with Intel was under you and only had a 17 limited duration before it expired; is that right? 18 A That's correct. 19 Q How would you have assessed 20 Mr. Schwartz's computer skills on the UNIX 21 computers? 22 A Although I'm not an expert in UNIX, 23 Randal had an excellent reputation for his UNIX 24 ability, both within Intel as well as in the larger 25 UNIX professional community. He was considered an 124 1 expert in UNIX, probably one of the best. 2 Q And that's why you asked him to come on 3 to contract with you? 4 A That's correct. 5 Q So you had to rely on that expertise? 6 A Yes. 7 Q Because you didn't know how UNIX worked 8 so well, so you had to rely on Mr. Schwartz's 9 expertise and how he did his job? 10 A That's correct. 11 Q And that was also consistent with the 12 requirements of Mr. Schwartz being an independent 13 contractor? 14 A Yes. 15 Q To your knowledge, did Intel at that time 16 have a policy against independent contractors doing 17 Systems Administrator work? 18 A I don't believe it had a policy at that 19 time against independent contractors being Systems 20 Administrators. 21 Q Did they have one subsequently? 22 A I couldn't answer that. I don't know. 23 Q You were asked some questions about 24 Mr. Schwartz's involvement in security. 25 A Yes. 125 1 Q And you had mentioned that, of course, 2 each area somebody works on doesn't necessarily 3 involve or is concerned about security. 4 Mr. Schwartz was somebody who had quite a bit of 5 experience and extensive background in network 6 security; is that right? 7 A Yes. 8 Q But his -- and his work with you in the 9 areas he was involved with dealt with networks and 10 the computers themselves and not in product data; 11 is that right? 12 A That's correct. My group was a service 13 group to Intel and so we didn't develop products. 14 Q Mr. Schwartz's experience before you -- 15 you mentioned that he was also working on a 16 parallel contract at the time. 17 A Yes. 18 Q And that also developed with services and 19 not products? 20 A Yes. He was working on developing the 21 Domain Name Service for the rest of Intel. 22 Q And the Domain Name Service, as you 23 indicated, was the service which was being set up 24 company-wide to facilitate sending, among other 25 things, sending e-mail? 126 1 A Yes. 2 Q And there was a problem with keeping up 3 with people's addresses because people moved so 4 frequently? 5 A Yes. The addresses stored in this Domain 6 Name System also have the names of the computers, 7 as I mentioned before. But in addition to that, 8 they also had the e-mail addresses of people, and 9 with that many people moving around, you want to be 10 sure that those are always up to date. 11 Q And they need to be up to date so the 12 people can get their e-mail in a timely manner? 13 A Correct. 14 Q Because in a company like that relying on 15 computer electronic communication, the e-mail 16 becomes a very vital way to communicate among the 17 various locations -- 18 A That's correct. 19 Q -- that Intel has? 20 A Yes. 21 Q And so we're clear, Mr. Schwartz was 22 providing that service for you at your site at 23 Hawthorn Farms? 24 A Yes. 25 Q And he was also providing that service in 127 1 terms of setting up the Domain Name Server system 2 for the rest of Intel on another contract; is that 3 right? 4 A Yes. 5 Q You mentioned that sometimes a system -- 6 as an administrator, you would run a program like 7 Crack to test the security passwords. 8 A I've never run a program like Crack to 9 test the security of passwords, but -- When I was a 10 Systems Administrator of another type of system, I 11 did not run that type of program. But under 12 certain circumstances, that could be within the 13 domain of a UNIX Systems Administrator to run such 14 a program for the purposes of improving security. 15 Q For the purposes of improving systems 16 security? 17 A Correct. 18 Q For the purpose of also testing systems 19 security to see if there are vulnerable passwords? 20 A Right. 21 Q Now, for a Systems Administrator who is 22 using a program like Crack to test systems 23 security, you mentioned some people would ask 24 permission or tell somebody, "I'm going to run 25 Crack now and we'll check the passwords." That 128 1 kind of telegraphs what you're going to do? 2 A That's correct. 3 Q And so if somebody wanted to, they could 4 easily change their password and diminish the 5 effectiveness of running that test on the security 6 system? 7 A That would be possible. 8 Q So not every Systems Administrator takes 9 that approach in testing or running Crack or 10 similar program on passwords in their system; is 11 that right? 12 A Right. It's not a universal practice 13 that every system administrator would do. 14 THE COURT: I don't understand that. 15 They wouldn't all run the program or wouldn't all 16 seek authority to run the program? 17 THE WITNESS: They wouldn't all run 18 the program. 19 THE COURT: Were you asking about 20 that? 21 BY MR. SUSSMAN: 22 Q What I'm asking is, they also wouldn't 23 all announce first that they are running the 24 program. There would be -- different individual 25 Systems Administrators might have a different way 129 1 of approaching that test. 2 A That might be true. If it was me, I'd 3 ask, but -- 4 Q At the time, again in November of 1993, 5 while Mr. Schwartz's contract had a limited period 6 before it was to expire, at that time you did not 7 have anyone readily available to take over his 8 responsibilities for the Domain Name Server 9 project, did you? 10 A For the Domain Name Server project, no. 11 Eventually someone was found to do that work, but 12 it was sometime later. 13 Q And at that particular time, as of 14 November 1st, 1993, your expectations were that 15 Mr. Schwartz would continue to work for you under 16 that contract? 17 A Well, his hours had been declining, so I 18 think I felt that eventually, he would phase out 19 entirely and we would find somebody. But there was 20 nobody in place or specifically planned to take 21 over that responsibility at the time. 22 Q Now, I'd like to show you some notes that 23 are on a page that are marked Defendant's Exhibit 24 104 for purposes of identification. Do you 25 recognize what that is? 130 1 A I have not seen this before. I can guess 2 what it is to a certain extent. 3 Q Does the information on this page tell 4 you what this is referring to? 5 A No. There is nothing on the page that 6 would tell me exactly what this is. I would be 7 guessing. 8 Q Did Mr. Schwartz, referring to this, have 9 dial-up access to the Intel modems from home? 10 A I don't believe so, not that I was aware 11 of. 12 Q Now, the next thing I'd like to do is 13 show you what has been marked for identification 14 this Exhibit 105. Take a look at that. 15 A Okay. 16 Q This is an invoice that covers the period 17 of work that Mr. Schwartz did for you in October 18 and up to November 1st, 1993; is that correct? 19 A Yes. 20 Q And this invoice shows that on October 4, 21 Mr. Schwartz configured Snoopy; is that accurate? 22 A I don't remember exactly what that means 23 in that case, what work was involved. 24 Q But he did work on setting up the 25 computer that was referred to as Snoopy? 131 1 A I believe that computer was set up by 2 Mark Morrissey. He would probably be -- was more 3 involved. He'd be able to answer that better. 4 Q You received a copy of this invoice -- 5 A Yes. 6 Q -- for services that Mr. Schwartz 7 provided? 8 A Yes. 9 Q And does that show that he had provided 10 services for doing work and configuring the machine 11 Snoopy? 12 A Yes. I couldn't say what that means, but 13 it's certainly there. 14 Q What does "configure" mean to you? 15 A Well, it's quite a broad description. 16 Typically when computers come from the factory, 17 they really don't do anything. So first they need 18 all the software installed and then they need to be 19 customized for the site and then integrated with 20 all the other computers that they work with. 21 Q Do you know what a Defender call access 22 system is? 23 A Yes. 24 Q What is that? 25 A It's a way for people to dial in from 132 1 home or wherever they might be traveling by 2 telephone into Intel systems in a way that is 3 fairly secure. 4 Q Do you need an ID number to call in on 5 this Defender call-back system? 6 A Yes. 7 Q And would that ID number correspond to a 8 telephone number from which the call originated? 9 A I think that's one of the ways that that 10 system can be used. 11 Q Now, do you -- you authorized Randal 12 Schwartz to have access to this Defender call-back 13 system, didn't you? 14 A I can't remember that one way or the 15 other, but it's possible. 16 Q This document I'm showing you is 17 Defendant's Exhibit 104, came from Mr. Schwartz's 18 personnel file at Intel. This has an ID number 19 corresponding to a telephone number 648-2786, and 20 another one, ID number corresponding to a second 21 telephone number. 22 Now, would these be the ID numbers 23 associated with the authorization ID numbers 24 associated with these telephone numbers for that 25 Defender call-back system? 133 1 A That's possible. I couldn't say that for 2 sure, but it may be that that is what that is. 3 Q We did mention, talking about 4 Mr. Schwartz's work, only the DNS system outside of 5 Hawthorn Farms. Would it be accurate to say if 6 Mr. Schwartz was to be working on the DNS system at 7 the rest of Intel, as well as Hawthorn Farms, he 8 would have to know what is going on at other Intel 9 sites with the Domain Name Service? 10 A Yes. 11 Q Now, would it also be fair to say that 12 the ability to -- the receipt of e-mail is very 13 important as a communication tool? Would you agree 14 with that? 15 A Probably. As I said, I wouldn't rely on 16 it myself, but other people might. 17 Q Do you know how many IP addresses Intel 18 has? 19 A Personally, I don't know. It's probably 20 in the range of 20,000. 21 Q Would that be a guess? 22 A That would be a guess. 23 Q Let me clarify that question. We may 24 need to be more specific. 25 When you guessed that figure of 134 1 20,000, were you referring to IP addresses that are 2 actually in use? 3 A That's correct. 4 Q And how many possible IP addresses are 5 there in Intel? 6 A I believe it's -- 7 MR. TINTERA: Wait a minute. If 8 he's guessing to the 20,000, I don't think we can 9 compound the guess by asking him to guess how many 10 addresses that would be further. I would object on 11 the basis of knowledge. 12 THE COURT: Don't guess. If you 13 have to guess, we don't want that. Is it just a 14 guess? 15 THE WITNESS: That's a guess. 16 BY MR. SUSSMAN: 17 Q Is it a larger number? 18 A Much larger number. 19 Q Do you know what it means to have root 20 privileges on a system? 21 A Yes. 22 Q What does that mean? 23 A This is something specific to the UNIX 24 systems. What that means is, on that computer 25 system, you can do anything. In effect, you're the 135 1 God for that computer system. 2 Q Is root a program? 3 A No. It's a kind of priority or 4 authorization or access, way to access the 5 computer. 6 Q So root is not a program, but it is sort 7 of like a super-password that lets you get in 8 wherever you want to go? 9 A With that password, you activate the root 10 capability to allow you to do anything on the 11 computer. 12 Q And Mr. Schwartz had root access on 13 Snoopy, didn't he? 14 A I wouldn't be able to say, but the 15 administrator of that system, Mark Morrissey, would 16 probably be able to say. 17 Q A person with root access, with root 18 authority on a system -- let me rephrase this 19 differently. 20 A person with root authority -- 21 having root authority would imply the person has 22 Systems Administrator duties, wouldn't it? 23 A No. There are -- certainly to do systems 24 administration, you would need the root access, but 25 there are small tasks that still might require root 136 1 access. It would not be systems administration. 2 Q Typically a person with root access is a 3 Systems Administrator? 4 A Yes. 5 Q I asked you about this Defender dial-up 6 service. Was there any Intel policy, to your 7 knowledge, that independent contractors were not 8 permitted to have Defender dial-up access? 9 A Not to my knowledge. There was no policy 10 to that effect at that time. 11 MR. SUSSMAN: Thank you. I have 12 nothing further. 13 THE COURT: Redirect? 14 15 REDIRECT EXAMINATION 16 BY MR. TINTERA: 17 Q Just when you thought you could leave, 18 Mr. Wilcox. 19 A I'm very flexible. 20 Q Let me ask you this. You were asked 21 about cracking, using a Crack program as a tool of 22 systems security. Is there a second step in regard 23 if you are going to be running the Crack program 24 that's really necessary for that to be effective, 25 and that would be letting the person whose password 137 1 has been cracked know that they have a bad 2 password? 3 A Absolutely. There would be no point 4 otherwise. 5 Q There is no point running it unless -- 6 A Unless you're going to tell people to 7 change their password to make it better. 8 Q There is no systems security reason to 9 run it unless you're telling the people that their 10 passwords are bad; is that correct? 11 A No. There is no other reason to run it, 12 in my mind, as a Systems Administrator. 13 Q Exactly. But someone else could run a 14 Crack program for another reason; isn't that true? 15 A Correct. If you want to find passwords 16 to break into the system, you could use it for that 17 purpose. Then, of course, you wouldn't tell people 18 that they had a bad password. You'd just start 19 using it. 20 Q You'd just keep that to yourself, 21 wouldn't you? 22 A Yeah. 23 Q How many bad passwords did Mr. Schwartz 24 tell you about? 25 A He didn't mention any bad passwords or 138 1 that he was running the program. 2 MR. TINTERA: Those are the only 3 questions I have. 4 THE COURT: Mr. Sussman. 5 MR. SUSSMAN: I have nothing 6 further. 7 THE COURT: Thank you. You may step 8 down. And you are free to go. 9 Call your next witness. 10 MR. TINTERA: Brad Benson. 11 12 BRAD BENSON 13 called as a witness on behalf of the State, having 14 been first duly sworn under oath, was examined and 15 testified as follows: 16 17 THE CLERK: State your full name and 18 spell it for the record, please. 19 THE WITNESS: My name is Brad 20 Benson. B-e-n-s-o-n. 21 22 23 24 25 139 1 DIRECT EXAMINATION 2 BY MR. TINTERA: 3 Q Mr. Benson, how are you employed, sir? 4 A I'm employed with Intel Corporation. 5 Q And how long have you been with Intel 6 now? 7 A A little over 13 years. 8 Q And did you see the witness who just left 9 the courtroom? 10 A Yes, I did. 11 Q Do you know him? 12 A Yes, that's Bob Wilcox. 13 Q How do you know him? 14 A He used to work for me when I was 15 managing IPG Network Service in Hawthorn Farms. 16 Q When you were managing what? 17 A IPG Network Services, Intel Products 18 Group. 19 Q IPG equals Intel Products Group? 20 A That's correct. 21 Q And that was located at Hawthorn Farms? 22 A That's correct. 23 Q And what did Mr. Wilcox do for you? 24 A Bob managed what I call our network 25 intrastructure. Essentially the wires of all the 140 1 communication the servers and clients' use within 2 the building and to the outside, and he was 3 managing a small group of people to do that. 4 Q And did you authorize or were you aware 5 of Mr. Wilcox hiring a contractor to assist in 6 those duties? 7 A Yes. 8 Q And do you know who Randal Schwartz is? 9 A Yes, I do. 10 Q How does he fit in with my previous 11 question as to the contractor? 12 A There was a -- We had a need to put 13 together what we call a DNS service. It allows 14 UNIX workstations to share addresses, and this was 15 a project that we needed to accomplish in Hawthorn 16 Farms and so Bob brought Randal Schwartz in to do 17 that project. 18 Q And that was sometime in 1992? 19 A Yeah, I believe so. I'm unsure of the 20 dates. 21 Q Were you aware of the specifics of what 22 Mr. Schwartz should be doing? 23 A Not the details. Bob managed his 24 day-to-day activities and I knew -- I knew in a 25 high-level sense that, yeah, we had the DNS project 141 1 that Randal was working on, but other than that, I 2 didn't get into the details. 3 Q Does the DNS, Domain Name Server 4 products, does that involve how the computers 5 inside of Intel are communicating with each other, 6 at least at Hawthorn Farms? 7 A Essentially, yes. What happens is, with 8 the UNIX workstation, they have an address called 9 IP address and it's a specific number, basically, 10 and when people move, even within a building, that 11 number changes and there is a lot of administrative 12 overhead to keep the computers updated with this 13 address and DNS keeps track of that using a system 14 to accomplish that. That's what DNS is there for, 15 so people could move and the computers, themselves, 16 will update the address. 17 Q So does that service really extend beyond 18 the firewall that protects Intel from outside 19 intrusion? 20 A No, it does not. It's just internal. 21 Q Would any of Mr. Schwartz's duties be 22 involved in putting in a Gate program in any 23 computer that would allow inside access? 24 A Not within the DNS services, no. 25 Q And did any of that, of the DNS service 142 1 at Hawthorn Farms that Mr. Schwartz was handling or 2 hired to handle, involve the Supercomputer Division 3 at Cornell Oaks? 4 A No. 5 Q Do you know whether Mr. Schwartz's duties 6 in setting up the Domain Name Server involved him 7 being authorized to run a Crack program? 8 A No. 9 Q You don't know or he was not authorized? 10 A He -- In the duties specific to those 11 servers, it may be consistent to run that program 12 to see if there is any intrusion within that given 13 server. That's possible. But in the overall 14 project, there was very -- other than maintaining 15 those, what services were dedicated for DNS, you 16 wouldn't need to. 17 Q Did Mr. Schwartz ever come to you to 18 alert you to any security problems specifically in 19 regard to Intel security passwords? 20 A No. 21 MR. TINTERA: Those are the only 22 questions I have. Thank you. Defense counsel may 23 have a couple. 24 THE COURT: Mr. Sussman. 25 143 1 CROSS-EXAMINATION 2 BY MR. SUSSMAN: 3 Q Mr. Benson, you had indicated that 4 Mr. Schwartz was hired to do IPG systems, that 5 Intel Product Groups, to do work for that -- 6 A Well, the group that I managed was called 7 the IPG Network Services. Our responsibilities 8 were in Hawthorn Farms. There were many other 9 groups within IPG doing similar activities. 10 Q Is SSD also one of the groups within IPG? 11 A Yes. SSD is in IPG, but they had their 12 own -- 13 Q They are in a different campus? 14 A Correct. 15 Q But it's still within IPG? 16 A Correct. 17 Q Now, you were Mr. Wilcox's supervisor? 18 A Correct. 19 Q You had virtually no direct contact with 20 Mr. Schwartz; is that right? 21 A For the most part, yes. I mean, we would 22 see each other in the hallway and celebrate 23 birthdays when those came about, and for the most 24 part, yes, not beyond that. 25 Q And as far then as how he did his work, 144 1 that was not something that you were directly 2 involved with? 3 A That's correct. 4 Q And, of course, you knew Mr. Schwartz was 5 an independent contractor? 6 A Yes. 7 Q And so there were some limits on how he 8 did his work that could be dictated by Intel 9 because of that status? 10 A Yes. Absolutely. 11 Q Did Intel have a policy at the time 12 Mr. Schwartz was working in your area that 13 independent contractors could not be Systems 14 Administrators? 15 A Yes. There was an overriding policy, 16 particularly for servers, because of the sensitive 17 nature of how you would be able -- what access you 18 would get as a Systems Administrator, that's right. 19 Q And yet Mr. Schwartz was hired by 20 Mr. Wilcox to do work as a Systems Administrator; 21 is that correct? 22 A That was part of his responsibility. His 23 major responsibility was -- 24 Q That he was hired to do work as a Systems 25 Administrator; is that right? 145 1 MR. TINTERA: I think the witness 2 can answer the question. 3 THE COURT: I think he did. He 4 answered yes. 5 MR. TINTERA: I didn't hear it all. 6 THE COURT: It's because the 7 airplane went over. 8 MR. TINTERA: No, it's because 9 counsel interrupted. 10 THE COURT: You'll have a chance to 11 redirect examine the witness. 12 BY MR. SUSSMAN: 13 Q Did Intel also have a specific policy 14 that independent contractors would have a six-month 15 duration, their contracts? 16 A I believe that's correct. The policy 17 changes from time to time and I can't remember all 18 the details, but -- 19 Q Now -- And some of those policies are set 20 down in policy manuals at Intel? 21 A Correct. 22 Q In 1993, there were some policy manuals 23 written involving systems security, were there not? 24 A Yes, they've had those for a number of 25 years. 146 1 Q Did you, personally, give any of those 2 policy manuals to Mr. Schwartz? 3 A No, I, personally, did not. 4 Q Was it also a policy at Intel, at the 5 time Mr. Schwartz was working for Mr. Wilcox, not 6 to hire independent contractors if they had been 7 terminated elsewhere within Intel? 8 A That's not necessarily true. Someone 9 could be terminated for many different reasons, and 10 it's really up to the hiring manager to determine 11 that statement. I mean, if he was hired for -- 12 excuse me, if he was fired for a cause that would 13 be clearly against Intel's policies, then I would 14 say he would be very reluctant to try to hire one 15 in spite of that. If they were terminated because 16 of a personal problem with a manager or wasn't -- 17 didn't have the skills in that particular job, then 18 they may be perfectly suitable in another role. 19 Q You recall having a meeting with Phil 20 Agrue, an investigator working for me and 21 Mr. Olstad? 22 A Yes. 23 Q And you indicated it would have been a 24 mistake for Mr. Wilcox to have hired Mr. Schwartz 25 after he had been terminated at SSD because that 147 1 would be a violation of the policy. 2 A I wasn't aware that he had been 3 terminated at SSD. 4 Q Did you know for a fact that he was? 5 A Not until after. 6 Q Mr. Wilcox had made an investigation or 7 was familiar with the circumstances of Mr. Schwartz 8 leaving SSD when he hired him; is that correct? 9 A Yes. I believe he was, yes. 10 Q One last question. The Domain Name 11 Server system, that also extends throughout Intel? 12 A Yes. 13 Q And also extends outside of Intel, 14 doesn't it? 15 A I'm not -- I can't answer that. I don't 16 know the technical details. 17 MR. SUSSMAN: Thank you. Nothing 18 further. 19 20 21 22 23 24 25 148 1 REDIRECT EXAMINATION 2 BY MR. TINTERA: 3 Q Mr. Benson, you were asked about the 4 termination policies and rehiring contractors if 5 they had been terminated in a different group, 6 particularly SSD. What were the circumstances of 7 Mr. Schwartz being terminated from SSD? 8 MR. SUSSMAN: May I ask a question 9 in aid of objection? 10 THE COURT: You may. 11 EXAMINATION IN AID OF OBJECTION 12 BY MR. SUSSMAN: 13 Q At the time -- Do you have personal 14 knowledge of the circumstances of Mr. Schwartz's -- 15 the termination of his contract with SSD? 16 A What I learned was from John Gray, who 17 was managing the computer group over there and -- 18 Q So you have no personal knowledge of 19 that? 20 A No. I wasn't there at the time other 21 than what John told me. 22 MR. SUSSMAN: I'd object to the 23 question, calling for a hearsay answer. 24 MR. TINTERA: I'm not asking that 25 for the truth. Defense counsel got into those 149 1 particular facts on his cross-examination. I think 2 I'm entitled to go back to that area and finish the 3 inquiry. It doesn't end with what defense counsel 4 has asked, and he brought it up, and so I think I 5 can finish the circle. 6 THE COURT: Nevertheless, the 7 question you're asking, it's obvious the answer the 8 witness is relying on is hearsay to answer the 9 question. 10 MR. TINTERA: Exactly. But I'm not 11 offering it for the truth. I'm offering it to 12 finish the circle that counsel has begun to draw 13 for the jury. 14 THE COURT: I'm sustaining the 15 objection. 16 Any further questions? 17 MR. TINTERA: Yeah, I do. 18 BY MR. TINTERA: 19 Q You were asked about whether Mr. Schwartz 20 was hired as a Systems Administrator and then you 21 started to say something about his primary duties. 22 What was the rest of that? 23 A Right. Any time someone is working on a 24 UNIX system, you need to manage that system and 25 those functions are in systems administration. 150 1 It's like keeping a house in order. But his 2 responsibilities didn't extend beyond the DNS 3 system that he was working on. 4 Q And you've indicated that your IPG group 5 was extended, Intel Product Group, extended to the 6 Supercomputer Division. 7 A No. Intel Products Group is a large 8 organization. There are smaller groups within that 9 and SSD is one of those. There are a number of 10 groups in Hawthorn Farms. There are a number of 11 groups in Jones Farm. My specific group was called 12 IPG Network Service, but my responsibilities were 13 only at Hawthorn Farms. 14 Q So of the people -- You did have Systems 15 Administrators working for you, right? 16 A Yes. 17 Q And how many of those people had 18 responsibilities in the Supercomputer Division? 19 A None. 20 MR. TINTERA: Those are the only 21 questions I have. 22 THE COURT: Anything further? 23 MR. SUSSMAN: Nothing further. 24 THE COURT: Thank you. You may step 25 down. 151 1 Call your next witness. 2 MR. TINTERA: Lou Poehlitz. 3 4 LOUIS POEHLITZ 5 called as a witness on behalf of the State, having 6 been first duly sworn under oath, was examined and 7 testified as follows: 8 9 THE CLERK: State your full name and 10 spell it for the record, please. 11 THE WITNESS: Louis Poehlitz. 12 P-o-e-h-l-i-t-z. L-o-u-i-s. 13 14 DIRECT EXAMINATION 15 BY MR. TINTERA: 16 Q Mr. Poehlitz, how are you employed, sir? 17 A With Intel Corporation. 18 Q And what do you do for them? 19 A I'm a Systems Administrator. 20 Q And do you have a particular division of 21 Intel that you work at? 22 A Over at the Cornell Oaks Campus. 23 Q And is that the same campus as Hawthorn 24 Farms? 25 A No. 152 1 Q Where is Cornell Oaks located? 2 A It's located off 158th in Beaverton. 3 Q And do you work at any particular group 4 at Cornell Oaks at Intel? 5 A I work for the SSU, SSU group. 6 Q What does that stand for? 7 A Systems Services Utility, IT, information 8 technology, (SSUIT). I also have dotted line 9 responsibility to the Cornell Oaks Campus manager. 10 Q You have what? 11 A What we call dotted line responsibility 12 at Intel, matrix reporting responsibility. 13 Q Hold it. We're going to have to back up 14 a long way here. On that systems -- at Systems 15 Service Utility, what does that mean? 16 A When IT was formed a couple years ago, 17 they decided to break it up. They wanted to get 18 synergy from being in the same group of people that 19 did the same thing you did. So there is a bunch of 20 Systems Administrators that wanted them all in the 21 same group, all to have the same manager. But they 22 also wanted to keep a campus focus, you know, 23 because the customers want the campus. They want a 24 campus focus also, in addition to the functional 25 focus. 153 1 So they essentially have two 2 managers. One is the campus manager, who makes 3 sure that things run right at the campus, and the 4 other one is my functional manager, who makes sure 5 I'm doing things like the rest of the Systems 6 Administrators are doing. 7 Q Do you have anything to do with the 8 Supercomputer Division? 9 A Yes. The Supercomputer Division is the 10 customer at the Cornell Oaks Campus. 11 Q And if I can take you back to 1992 and 12 1993, did Randal Schwartz -- was he a contractor 13 with your group then? 14 A At that time it was not formed yet and I 15 worked directly for SSD. 16 Q So you were working directly for SSD at 17 that time period? 18 A Yes. 19 Q And was Randal Schwartz a contractor for 20 that group then? 21 A Yes. 22 Q Are you aware of the circumstances 23 that -- well, are you aware that he left the SSD 24 group? 25 A Yes. 154 1 Q Are you aware of the circumstances that 2 led up to his departure? 3 A Yes. 4 Q Could you tell the jury what that was? 5 A Okay. Randal had worked for some time 6 there as a Systems Administrator contractor for a 7 division called IWARP and IWARP and SSD merged. I 8 was one of the Systems Administrators at SSD. 9 Q Slow down. We're at IWARP merged with 10 SSD. 11 A Yes. 12 Q And then what happened? 13 A So we started merging the networks, more 14 tightly integrating them. 15 Q And when you do that, are there 16 communications that you also have to integrate? 17 A Yes. 18 Q And what did you do? 19 A The communication link to the rest of 20 Intel from the Cornell Oaks Campus was in the 21 IWARP -- was off a IWARP computer system, went 22 directly into an IWARP computer system, and we 23 moved that to a higher-speed dedicated 24 communication box to give us -- 25 Q "Box" is a computer, right? 155 1 A Well, it's a router. Technically, it's a 2 router. It's a dedicated computer that does packet 3 switching. 4 Q Like a switchboard? 5 A Well, it's a dedicated communications 6 computer. 7 Q You don't like switchboard? 8 A No plugs. There are wires that come into 9 it, yes. 10 Q Computer switchboard? 11 A Yeah. There are lots of wires that come 12 into it. It does switch what we call packets, 13 pieces of information between different wires. 14 Q So a router is like a computer 15 switchboard, yes? 16 A In a way. 17 Q In a way that the jury can understand? 18 A Yeah, I hear you. 19 THE COURT: In a way that the Judge 20 can understand. 21 BY MR. TINTERA: 22 Q So continue. 23 A The computer that the connection was on 24 was what received IWARP's mail. All the mail that 25 the rest of Intel sent to IWARP was received on 156 1 this computer system. 2 Q When you're talking about mail, you're 3 not talking about the postman coming up with a 4 truck from the U.S. Postal Service, are you? 5 A Electronic mail. 6 Q That's what computers use, right? 7 A That's right. 8 Q So you had a problem with the electronic 9 mail? 10 A It came into this computer. When we 11 moved that connection to the router, the router 12 didn't receive mail. The router is dedicated to 13 switching, it doesn't receive mail at all, and so a 14 few days after we switched it, some of the IWARP 15 users got real upset and said, "Why don't we 16 receive mail?" They usually received 20 to 30 17 electronic messages from the rest of Intel and they 18 hadn't gotten any. 19 Q So what was the problem? 20 A That was because we moved the connection 21 to the router and the mail was still going -- 22 trying to be delivered to the router and the router 23 doesn't understand how to accept mail. 24 Q So your new computer switchboard -- 25 MR. SUSSMAN: Is Mr. Tintera going 157 1 to show the witness an exhibit or -- I thought we 2 were supposed to question from counsel table. 3 MR. TINTERA: I thought it was up to 4 Your Honor. 5 THE COURT: Well, it is, and I have 6 permitted each counsel to do it on occasion. I 7 would prefer that most of the questioning go on 8 from counsel table, unless it's important to be 9 close to the witness to view exhibits, and I 10 have -- 11 MR. TINTERA: When we were at the 12 counsel table, we were having a communication 13 problem. Seems to work better the closer that I 14 am. If you would like me to sit down -- 15 THE COURT: Proceed. Doesn't appear 16 that you're intimidating the witness. 17 MR. TINTERA: No. 18 BY MR. TINTERA: 19 Q Your router or computer switchboard was 20 not doing its job? 21 A No, it was doing its job. It's that -- 22 Q Why weren't people getting their e-mail? 23 A Okay. The connection was on a 24 general-purpose computer that routed packets plus 25 accepted mail. 158 1 Q What's the difference between a packet 2 and a mail? 3 A A packet is a fragment of information. 4 So a mail message might consist of multiple 5 packets. It's a way that the computer sends 6 information. Can't necessarily send it all as a 7 big stream. It has to break it up into little 8 pieces. 9 Q Your switchboard could accept the 10 packets, parts of the message, but not the whole 11 thing, is that what you're saying? 12 A No. It was -- it doesn't have programs 13 running on it to receive the mail and relay it to 14 where it needs to go. 15 Q So it wasn't working right? 16 A Yeah. 17 Q So you had to fix it? 18 A The fix was to change the -- have the 19 IWARP address changed at the corporate level to 20 point to a different general purpose machine. 21 Q Maybe we don't need to know all these 22 details. I think you're leading up to some 23 situation with Mr. Schwartz in this electronic 24 switchboard. 25 A Right. 159 1 Q Why don't you bring us right there. What 2 happened? 3 A So the customers had wanted this fixed 4 immediately. They were real upset by this time. 5 They weren't receiving the mail, didn't know where 6 it was going. Needed it. Out of touch with the 7 rest of the organization. They were real upset. 8 Randal was gone that day and my 9 manager, who is John Gray, got involved in this 10 issue and I suggested that we update, have this -- 11 the IWARP pointer address update and so that the 12 mail would go to a different computer that could 13 accept it, and that's what John and I decided to 14 do. 15 Q Now, when Mr. Schwartz came back and 16 noticed this, what happened? 17 A Later that day, I saw Mr. Schwartz and he 18 was real upset, very upset about this and -- 19 Q About this change you made? 20 A Yeah, this change. He said words along 21 the line of, "Why do you even bother having me if 22 you don't consult me," and kind of stormed out of 23 the building. 24 Q Did he come back to work the next day? 25 A I didn't see much of him after that. 160 1 Q But you did see him? He was over there 2 again? 3 A I can't remember. I don't think I saw 4 him for the next few days. 5 Q Well, did he continue to work with the 6 SSD Division at that point? 7 A No. 8 Q I know this is a long time ago. Do you 9 have any idea when that was? 10 A No. 11 MR. TINTERA: Those are the only 12 questions I have for this witness. 13 THE COURT: Mr. Sussman. 14 CROSS-EXAMINATION 15 BY MR. SUSSMAN: 16 Q I want to make sure that I understood 17 your answers, so bear with me. 18 There was -- IWARP was a separate 19 section when Mr. Schwartz was a Systems 20 Administrator there, separate from the rest of SSD? 21 A Right. 22 Q So they had some practices that were 23 different than the practices that you had over 24 where you were in SSD? 25 A Yes. 161 1 Q And after the two groups were -- when he 2 was at SSD as a Systems Administrator, were you and 3 he kind of like equal Systems Administrators, only 4 in different groups? 5 A Yes. 6 Q And you had mentioned something about 7 when IT was formed, that there was some effort to 8 get the Systems Administrators cooperating across 9 their group lines or something. 10 A When IT was formed? 11 Q Yeah. Did I understand that correctly? 12 A Yes. 13 Q So there was an effort to get Systems 14 Administrators to kind of work together, help each 15 other out? 16 A Right. 17 Q Share problems? 18 A Yes. 19 Q So if something came up, that could help 20 somebody else in another section, to let them know 21 about it? 22 A Yes. 23 Q So that was across the boundaries of 24 different groups? 25 A Yes. When IT was formed, that happened, 162 1 yes. 2 Q And Mr. Schwartz was working as a Systems 3 Administrator when that was going on; is that 4 right? 5 A This happened before IT was formed. 6 Q But that's what you had to do when you 7 were working, when SSD and IWARP were -- 8 A When SSD and IWARP merged, Randal, the 9 SSD Systems Administrator and IWARP Systems 10 Administrator, helped merge the environment. 11 Q When IT was formed, that thrust of 12 cooperation was kind of a continuation of the -- of 13 that effort that had been in existence at SSD 14 when -- 15 A I'm not sure that connected, but -- 16 Q Now, the difference -- there was a 17 difference in views or a difference in approach 18 between you and Randal Schwartz about how the 19 e-mail system should be implemented or how it 20 should be -- 21 A A configuration issue, yeah. 22 Q I guess how it should be set up and 23 operated? 24 A Right. 25 Q And Mr. Schwartz wanted to set it up 163 1 under a Domain Name Server system; is that right? 2 A Yes. 3 Q And, in fact, that's the direction that 4 Intel has gone since then, isn't it? 5 A That's right. 6 Q And so the dispute arose when this change 7 was made to a different system -- or at least the 8 changes that were made involved a different system 9 and that was the change made while he was away? 10 A Yes. 11 Q And was that system of using -- kind of 12 putting it into a host file and main corporate 13 machine, the procedure that was used when the IWARP 14 e-mail messages got lost? 15 A Are you asking me a question? 16 Q Yes. You described how there was a 17 switch made in the routers. 18 A Right. 19 Q And was that done to have the e-mail go 20 through this host file in the corporate -- 21 A The router change was done so by putting 22 it on the dedicated communication switchboard, if 23 you would, that was done to improve our 24 communication with the rest of Intel, to improve 25 the packet, the communication through so we could 164 1 communicate better. So the mail was really a bad 2 side effect of that. 3 Q But the people at IWARP were accustomed 4 to getting lots of e-mail messages each day because 5 that's what they relied on to get their work done? 6 A Yes. 7 Q And it seemed then the difference in 8 philosophy or approach between you and Mr. Schwartz 9 was over what was going to be the most efficient 10 way to get the e-mail moving around Intel? 11 A That's correct. 12 Q And it was over that dispute that he left 13 the position, ended his contract at SSD? 14 A I don't know. You're asking me to read 15 his -- I just know he was upset and he left. 16 MR. SUSSMAN: Thank you, 17 Mr. Poehlitz. I have nothing further. 18 MR. TINTERA: I don't have any 19 further questions. 20 THE COURT: Thank you. You may step 21 down. 22 MR. TINTERA: May this witness be 23 excused? 24 MR. SUSSMAN: I have no problem. 25 THE COURT: You're free to go. 165 1 Thank you for being here. 2 Let's take our mid-afternoon recess. 3 About 10 or 15 minutes. 4 (Recess.) 5 (Whereupon, the following 6 proceedings were held in 7 open court, out of the 8 presence of the jury:) 9 THE COURT: Matters for the Court? 10 MR. TINTERA: I almost 11 miscalculated. I only have one more witness left 12 for today. 13 THE COURT: Good. 14 MR. TINTERA: Did I say one? I 15 meant two. I'm kidding. I only have one. 16 THE COURT: I'm terribly 17 disappointed. It's gone rather quick. I 18 appreciate the way you gentlemen have done this. 19 You have more witnesses for 20 tomorrow, I trust? 21 MR. TINTERA: Yes, Your Honor. 22 THE COURT: Probably beneficial not 23 for the testimony to run on and on. I note the 24 jury getting blinky in the eye, as I was. 25 166 1 (Whereupon, the following 2 proceedings were held in 3 open court, the jury being 4 present:) 5 THE COURT: Mr. Tintera, you may 6 call your next witness. 7 MR. TINTERA: Richard Greco. 8 9 RICHARD J. GRECO 10 called as a witness on behalf of the State, having 11 been first duly sworn under oath, was examined and 12 testified as follows: 13 14 THE CLERK: State your full name and 15 spell it for the record, please. 16 THE WITNESS: Richard J. Greco. 17 G-r-e-c-o. 18 19 20 21 22 23 24 25 167 1 DIRECT EXAMINATION 2 BY MR. TINTERA: 3 Q Mr. Greco, how are you employed? 4 A I'm employed as a software engineer for 5 Intel Corporation. 6 Q Are your duties or where you work the 7 same today as they were back in 1993? 8 A Similar, yet different. I'm a software 9 engineer specializing in computer graphics and 10 visualization -- drawing pictures of data with 11 computers -- and at the time, I worked for the 12 Supercomputer Division of Intel. I now work for 13 Intel Architecture Labs in a similar type of 14 position on different kinds of computers. 15 Q Now, some of our jurors are not computer 16 literate. When you talk about visual graphics in 17 computers, what are you talking about? 18 A The simplest way to think about it is, we 19 take numbers and draw pictures from them, so 20 something as simple as a bar graph of how many 21 people live in the United States of America. The 22 kind of things that I work with are very different 23 than that. 24 We mathematically model something 25 like a wing of an airplane and how the wing of the 168 1 airplane reacts under stresses. We then can look 2 at what the stresses are and put colors on what's 3 high stress, what's low stress, and an engineer who 4 is designing the airplane can look at that wing and 5 say, "This wing is going to fall off the airplane." 6 So we can use a different design or they could say 7 this is a good design and it's very stable. 8 Q So you do that all through numbers? 9 A Yes. 10 Q And translates, looks like the wing and 11 the stresses -- 12 A Yes, if you did simple geometry. 13 Q There is no geometry that's simple. 14 A Simple geometry, you are working with 15 points in X, Y and Z, take generally a measure of 16 squares and lay a measure of squares along 17 something like the wing of an airplane, since that 18 was the example that I used earlier, and each 19 corner of that has a position in X, Y and Z. So we 20 can use that corner of what is called a patch, a 21 little square piece to form them all together and 22 draw a picture of what the wing would look like. 23 And by knowing where the wing starts 24 and where the air starts and how fast the air is 25 moving across, the aeronautical engineer can use 169 1 that information to model how that material will 2 deform or the stress that will be applied to that 3 material under those conditions, and then based on 4 their results by color. 5 So if you have seen a picture on TV, 6 commercial of a person running where they are 7 showing you this computer-enhanced imagery of the 8 body temperature, taken the temperature of the body 9 and mapped it to a color. So the parts that are 10 hot are red and the parts that are cool are green 11 and in the middle is yellow. We'll do the same 12 type of coloring to the wing where there is high 13 pressure and low pressure on the wing. 14 Q I think that's helpful. 15 Back when you were with the 16 Supercomputer Division in 1993 -- 17 A Yes. 18 Q -- were you familiar at all with the 19 computer that was named Brillig? 20 A Yes. 21 Q And how do you spell that? 22 A B-r-i-l-l-i-g. It's from The 23 Jabberwocky, it was Brillig and the Mimsy Toes. 24 Q And what was your function with the 25 Brillig computer? 170 1 A I was doing some research. I was part of 2 a team at Intel that was building a supercomputer, 3 the fastest class of computers in the world. We 4 had a grant from ARPA to build a computer capable 5 of one trillion floating point operations in a 6 second, about three times faster than the fastest 7 computer you could buy today. 8 Q Who were you building this for? 9 A We were building it under a grant from 10 ARPA, under ARPA's accelerated technology program. 11 Q What is ARPA? 12 A The Applied Research Projection Agency. 13 It's a government agency in the United States of 14 America. 15 Q It's part of our government? 16 A Part of our government. 17 Q I guess that's good enough for me. You 18 had a grant to do this for part of our government? 19 A Right. I was working on the group that 20 was designing the architecture of that machine, 21 making sure the architecture of that machine would 22 work well for the graphics and visualization 23 components of the work that people would want to do 24 on that supercomputer. 25 To do that work, I needed a graphics 171 1 workstation similar to the kind the people who 2 would use the computer would have, and that 3 graphics workstation was Brillig. And since it was 4 a one-of-a-kind machine inside of Intel, it fell to 5 myself and the other people who used the machine to 6 do the administration on that machine in terms of 7 account administration and those types of things. 8 Q Were you ever in a position where you 9 developed an account for that machine with Randal 10 Schwartz? 11 A Yes. 12 Q What's that for? 13 A We shared the machine with the group 14 of -- that were the compilers. The compilers is a 15 program that lets a programmer write statements of 16 what you want the computer to do and the compiler 17 takes those and translates them into the 1-0 binary 18 code that computers actually operate in and -- 19 Q Let's stop there, the 1-0. So computers 20 only understand one and zero; is that correct? 21 A Right. 22 Q But they do all that with just one and 23 zero, all the things that they do? 24 A Yes, because the patterns of ones and 25 zeros that you use and instructions -- part is an 172 1 instruction and part is a number that points to a 2 memory location that you would pick the data value 3 up from. 4 Q I interrupted you. If you remember where 5 you were -- 6 A We shared this much with the group that 7 did the compilers. Randal was hired as a 8 contractor for what we would call a regression 9 suite for the compilers to Brillig, which was a 10 Silicon Graphics workstation because we had 11 cross-compilers available for Silicon Graphics 12 machine. 13 A cross-compiler is a compiler that 14 runs on one computer, yet it generates instructions 15 for different kinds of computers. So this compiler 16 would work on a Silicon Graphics workstation, yet 17 produce programs that ran on supercomputers. 18 Q Let's go back a minute. What is a 19 compiler? You've lost me early on here. 20 A Compiler is a program that lets a 21 programmer write a program in a language. While it 22 doesn't look like English, it looks enough like 23 English that you can understand it. If you want to 24 add two numbers together, you write A plus C equals 25 A plus B. If you want to print out a value, you 173 1 say print C and the value gets printed. 2 So we get to write our programs in a 3 language that makes sense to us and that we can 4 think about. And even though what the computer 5 wants to see are patterns of ones and zeros and the 6 compiler transforms that program into efficient 7 patterns of ones and zeros that are then the 8 executable program. 9 Q The compiler takes words that a person -- 10 a computer programmer can understand and changes 11 them into ones and zeros that the computer can 12 understand? 13 A Correct. 14 Q So you wanted this type of translator on 15 this machine; is that right? 16 A Yes. Because supercomputer time is very 17 expensive to do something mundane like run a 18 compiler on. It is not an efficient use of a 19 supercomputer. So typically we build what are 20 called programming environments, compilers, tools 21 used to build programs that work on lower-cost 22 workstations and people develop programs there and 23 then run them on the supercomputer. 24 Q And what was Mr. Schwartz supposed to be 25 doing with this compiler or this translator? 174 1 A One aspect of product development is 2 determining whether or not the product you have 3 works. And an aspect of determining if it works 4 isn't just testing the new things you've done, but 5 testing all the things that the program used to do 6 to make sure that it still does those things 7 properly, and we call that progress testing. 8 Q So when you add something to a program 9 you know works, you want to test it to see if that 10 addition has hurt or helped? 11 A Correct. 12 Q And that's what regression testing is? 13 A The regression testing is determining 14 whether it has hurt anything. Typically, when you 15 add something to a program, you could be fixing a 16 problem with the program so that it was something 17 that the program didn't do correctly and you fixed 18 it and now it does it correctly and it will pass. 19 More than likely, you're adding new 20 capabilities to a program so it does things it 21 didn't used to do before. It's important under 22 that case, where you have changed a lot of things, 23 to go back in and make sure you haven't broken 24 anything. 25 Q Is that what the regression does, it 175 1 tests -- 2 A That's the purpose of a regression test, 3 to make sure that you have not -- that the things 4 that used to work still work. 5 Q And that's what Mr. Schwartz was supposed 6 to be doing? 7 A The compiler group has a very extensive 8 set of tests and Mr. Schwartz was taking those 9 tests which ran on a different computer than a 10 Silicon Graphics workstation and making them work 11 on a Silicon Graphics workstation so they could 12 test their compiler, the cross-compiler that they 13 had developed for that workstation. 14 Q What's a Silicon Graphics workstation? 15 A It's a manufacturer. There is an IBM PC 16 and MacIntosh and Omega. There is a kind of 17 computer called a Silicon Graphics computer. 18 Q All right. So that's what he was 19 supposed to do. Is that what his contract was 20 about? 21 A That was my understanding. I 22 administered -- 23 MR. SUSSMAN: Question in aid of 24 objection? 25 THE COURT: You may. 176 1 EXAMINATION IN AID OF OBJECTION 2 BY MR. SUSSMAN: 3 Q You say it was your understanding. Did 4 you directly administer the contracts with 5 Mr. Schwartz? 6 A No, I did not administer the contract 7 with Mr. Schwartz. 8 Q Was it your responsibility to -- Were you 9 in charge of the group doing the compilers that 10 hired Mr. Schwartz? 11 A No, I was not. 12 Q So do you have any personal knowledge 13 then of the arrangements made when Mr. Schwartz was 14 contracted? 15 A I have the request from the manager who 16 hired Mr. Schwartz for an account on my workstation 17 so that Mr. Schwartz could perform the function. I 18 just stated what he was supposed to do on it. 19 Q Other than that, that's the extent of 20 your personal knowledge? 21 A That's the extent of my personal 22 knowledge, correct. 23 MR. SUSSMAN: I'll reserve. 24 THE COURT: Go ahead. 25 177 1 BY MR. TINTERA: 2 Q Can you tell me -- I assume at the 3 Supercomputer Division, back in 1992 and '93, there 4 were some computers that were used more than 5 others. 6 A Correct. 7 Q And where would you put Brillig in that? 8 A It was not used often. It was a 9 programming -- it was an environment we needed for 10 testing in-product development, but it was not the 11 kind of computer that we used to do product 12 development, so it was used infrequently compared 13 to other computers on site. 14 Q Were you the Systems Administrator for 15 that computer? 16 A I'm what passed for a Systems 17 Administrator for that computer, yes. Machines 18 that exist in the lab solely for test environment, 19 our site computing staff, who are formally trained 20 on the systems, maintain an environment for us. 21 Q So this was a lab machine? 22 A Correct. 23 Q It's behind Intel's firewall or not? 24 A It's behind Intel's firewall. 25 Q Do you know if it was connected through 178 1 the firewall at all? 2 A All machines at SSD have the ability to 3 reach out from the firewall to public locations, 4 and this machine could do that, but you couldn't 5 reach into this machine through the firewall 6 through any of the standard ways you would connect 7 to a computer. 8 Q So you can go out but not back in? 9 A Correct. 10 Q And could you tell the jury what a 11 password file is? 12 A Computers that are shared by multiple 13 people. Every user has an account and every user 14 has a place where they can store their own files. 15 And when you walk up to the computer, it requires 16 you to enter a user name and it requires you to 17 enter a password which you get to choose so that it 18 can -- before allowing you access to your files, 19 it's a way that I can keep my work separate from 20 someone else who wants to use the computer but 21 shouldn't see my files. I have the ability to set 22 protection on files so I can choose who sees and 23 who doesn't see particular files in my storage 24 area. 25 Q So would the password account or file on 179 1 the Brillig machine show who has a password on the 2 machine? 3 A Yes. It would list the account name and 4 an encrypted password for everyone on the machine 5 who had an account. 6 Q A coded password? 7 A Yes. 8 Q Do you know what a Crack program is? 9 A Yes. You want me to answer? 10 Q Yes. What is it? 11 A It's a program that comes in two flavors. 12 One will log onto a computer and successively try 13 passwords to log onto the computer and other types 14 of crack programs. You can give them a password 15 file and it will figure out what the password is 16 that's encoded in the file. 17 Q Could you tell me if the Brillig password 18 file that's part of SSD included all the members of 19 SSD? 20 A No. The password file located on Brillig 21 was -- only contained names and accounts for people 22 who had reason to use Brillig as a computer. 23 Q And that wasn't everyone in SSD? 24 A No. 25 Q Did you ever give Mr. Schwartz -- do you 180 1 know what a Gate program is? 2 A Yes, I do. 3 Q Did you ever give Mr. Schwartz the 4 authority to install a Gate program on the Brillig 5 computer? 6 A I did not and I would not have had the 7 authority to give him the ability to do that. 8 Q Did you ever authorize Mr. Schwartz to 9 run a Crack program against the passwords on the 10 Brillig computer? 11 A Again, I did not and would not have had 12 the authority to do so. 13 MR. TINTERA: Those are the only 14 questions I had. 15 THE COURT: Mr. Sussman. 16 17 CROSS-EXAMINATION 18 BY MR. SUSSMAN: 19 Q You indicated that you were not the 20 administrator for the group doing the compilers. 21 There was somebody else doing that. There was 22 somebody else that was the administrator of that 23 group? 24 A Someone who was the Systems Administrator 25 for the group doing the compilers? 181 1 Q Yes. 2 A That's correct. I was the administrator 3 for this machine. I was not part of the systems 4 administration group at SSD which would have 5 maintained the other machines on site. 6 Q But you were asked to give Mr. Schwartz 7 an active account on Brillig? 8 A Correct. 9 Q And that would have been by the person 10 who was in charge of that group? 11 A Yes. The request came from Herb Mayer, 12 who was the manager of the compilers group. 13 THE COURT: Explain giving someone 14 an active account on a computer. Does that mean 15 giving them the ability to access it or use it 16 or -- 17 THE WITNESS: The person who does 18 not have a user name and a password cannot get 19 access to a computer. So by giving a person an 20 account on the computer, I give them a user name 21 and a password and I give them a place on the disk 22 on the computer where they can store information. 23 BY MR. SUSSMAN: 24 Q And what was Mr. -- Mr. Schwartz then had 25 a password that was recognized on the Brillig 182 1 machine? 2 A Correct. 3 Q Was that password Merlyn? 4 A If I remember correctly, his account name 5 was Merlyn. I never knew Mr. Schwartz's password. 6 Q But then if he logged onto the Brillig 7 machine, in other words, got access to it by 8 logging onto it, it would show up as Merlyn? 9 A If that was his account name. But my 10 memory is that is the account name Randal 11 preferred. 12 Q Now, as part of your job there, did you 13 monitor who was logging on and logging off of the 14 Brillig machine? 15 A No, I did not. The only time we really 16 monitored who was on or off the machine was during 17 the times that one of the users of the machine 18 would request the ability to use the machine 19 completely by themselves. An example would be the 20 compilers group needs to run a time benchmark, so 21 they would like exclusive use to the machine. 22 Q Simple answer is, you didn't do any 23 monitoring, right? 24 A That's correct. I did not. 25 Q And you personally had really no contact 183 1 with Mr. Schwartz? 2 A Correct. 3 Q And that includes having no either direct 4 personal contact, correct -- 5 A Correct. 6 Q -- or any direct contact when you 7 communicated with him about what he was or was not 8 to be doing on Brillig? 9 A That's correct. The only time that I 10 would send -- the only contact I may have had with 11 Randal during this period of time was sending him 12 electronic mail. 13 I would like to add, though, that in 14 order to get an account on Brillig, you were 15 required to have an account on the internal network 16 at SSD so that you had a user ID and they were 17 entered into the site's database. And that at the 18 time we gave him the account, we told him we expect 19 him to abide by the rules of all the other machines 20 that were explained to him at the time that he got 21 his account at SSD. 22 Q Now, when somebody had privilege to use 23 Brillig, they could get onto the machine and read 24 anybody -- read any files that were on there? 25 A Any of the files that had read access to. 184 1 Q So Randal Schwartz had access to the 2 files on Brillig that anybody else could read? 3 A Assuming that Randal had the files 4 protected so that other people could read them. 5 Randal has the ability to say that -- to protect 6 the file in such a way that only he can read it on 7 the machine. 8 Q You as the administrator could have 9 looked at any of the files on there. You had that 10 kind of privilege to do that? 11 A I had the privilege to do that. 12 Q I asked you if you could. I asked you if 13 you could do that. 14 A But I am prohibited from doing so because 15 I'm not a member of the site IT organization. As a 16 member of the site IT organization with root access 17 to the network, I signed a statement saying that I 18 will not abuse that privilege by looking at files I 19 don't normally have the access to read. 20 Q Was that an agreement that a person who 21 has root access to a system is required to sign? 22 A Yes. It's a standard Intel form. 23 Q And that goes into kind of a personnel 24 record so it's on file there? 25 A It's filed somewhere. I don't know who 185 1 actually files it. 2 Q You were asked about password files. 3 A Correct. 4 Q Anybody who has an active account, valid 5 password account on Brillig can look at and read 6 the password file? 7 A That's correct. 8 Q You also mentioned that -- Did I hear 9 correctly there are two different types of Crack 10 programs, one that actually tries to get logged 11 into the machine and into the files? 12 A One actually tries to log into a 13 computer. It opens up -- it opens a connection to 14 the computer like a user would to log in at a 15 terminal and then supplies the characters for an 16 account name, and you try out a password. 17 Q And the other simply tries to crack 18 passwords? 19 A Tries to crack a password file, yes. 20 Q Now, you also then had the responsibility 21 for deleting passwords when an account is closed? 22 A Correct. Although I have no knowledge of 23 when the account should be closed other than 24 someone -- as I was requested to create an account, 25 someone needs to contact me and request that I 186 1 delete the account. 2 Q But the standard practice is when a 3 person's account is closed and they no longer have 4 access, the practice is to disable the password? 5 A Correct. 6 Q Did anybody ask you to disable Randal 7 Schwartz's account and his password on Brillig? 8 A No. 9 Q Did anybody ask you to notify him in any 10 other way that he no longer had a valid password 11 account on Brillig? 12 A No, they did not. 13 MR. SUSSMAN: Thank you. Nothing 14 further. 15 THE COURT: Mr. Tintera. 16 17 REDIRECT EXAMINATION 18 BY MR. TINTERA: 19 Q You've been asked about if anyone had an 20 account on Brillig they could look at the password 21 file. 22 A Correct. 23 Q Do you distinguish whether -- looking at 24 a password file, do you make a distinction between 25 that and a person at a separate campus, let's say 187 1 Hawthorn Farms, actually copying the password file 2 over to their work station? 3 A Yes, we do. There are programs that a 4 normal user would run, such as the program to find 5 out who was logged onto the machine that needs -- 6 that would read the password file and only 7 accessing the non-encoded piece of the file to be 8 able to display the user name of the people logged 9 onto the machine and such a program. 10 Or if I needed to -- say, you had an 11 account on my machine and I couldn't remember your 12 name, I could look at this file in order to find 13 out what your account name was. 14 Those are all considered normal and 15 fair uses of the file. There is no reason for a 16 person to copy the file off of the machine and move 17 it to another machine except were that person 18 performing a software upgrade of it or somehow 19 transferring those accounts to another machine. 20 Q And you've indicated that a person had to 21 have an account with the Supercomputer Division to 22 have an account on the Brillig machine; is that 23 correct? 24 A That's correct. 25 Q And if your account with the 188 1 Supercomputer Division was discontinued or 2 disabled, your password was disabled, what was the 3 situation with the Brillig machine? 4 A We would need -- because it was a lab 5 machine and not administered by the site computing 6 people, the person on, an employee exited, you 7 actually needed to be -- when a normal employee 8 exits Intel, automatically every place they have an 9 account managed by Intel Systems Administrator 10 people is deleted, and it would be up to the 11 manager who hired the person to follow that up for 12 any secondary machines that were on the lab. 13 Normally that wouldn't be a problem 14 for a machine that was completely behind the 15 firewall because there would be no way to get to 16 the machine completely behind the firewall, if your 17 accounts on the rest of the network were disabled. 18 Q You mentioned ARPA. What branch of the 19 government is that with? 20 A Department of Defense. 21 MR. TINTERA: Those are the only 22 questions I had. 23 24 25 189 1 RECROSS-EXAMINATION 2 BY MR. SUSSMAN: 3 Q Did you ever personally give Mr. Schwartz 4 any authority to access Brillig? 5 A I was requested to give Mr. Schwartz 6 access to use Brillig for the specific purpose of 7 this compiler test suite, and I did that. Is your 8 question covering something more broad than that? 9 Q In your previous testimony, you said you 10 were asked to give him an active account, active 11 password. You did that? 12 A Correct. 13 Q But did you personally have any 14 interaction with Mr. Schwartz to give him any 15 authority as far as using Brillig? 16 A I sent -- Customarily when I created an 17 account on this machine, I had a form letter I 18 would send people that explained, one, let them 19 know they had an account. Let them know that I had 20 duplicated their password from the internal 21 network, which is something you can do without 22 having to know what the password is so they would 23 have a secure account on the machine and wouldn't 24 have to worry about someone breaking in on the 25 machine. Let them know there were no backups and 190 1 how they could reserve exclusive time on the 2 machine. And that was a form letter I sent to all 3 users. 4 Q So simply a general information letter? 5 A Yes. In order to get an account on the 6 machine, someone needed to send a request to me and 7 explain why you had to use that machine in order to 8 get the account. 9 Q And in answer to the questions, you 10 mentioned the limitations on what was 11 appropriate -- 12 A That we expected the use of the machine 13 to be followed by the guidelines for any other 14 machines. 15 Q That leads to my question. You had no 16 personal communication with Mr. Schwartz regarding 17 those limitations? 18 A No, I did not. It was my assumption 19 that -- 20 Q And you sent him no letters outlining 21 those limitations? 22 A No, because -- 23 Q And -- 24 A -- those would have been outlined to 25 Mr. Schwartz at the time he was given an account on 191 1 SSD, which is one of the reasons why I had the 2 requirement that anyone who had an account on this 3 machine had to have an account on the network, 4 because they would have already been told what fair 5 use on the networks were. 6 Q So you had to assume that was done in 7 Mr. Schwartz's case? 8 A Correct. 9 MR. SUSSMAN: Nothing further. 10 MR. TINTERA: No further questions. 11 THE COURT: Thank you. You may step 12 down. 13 Is that your last witness for the 14 day, Mr. Tintera? 15 MR. TINTERA: Yes, Your Honor. 16 THE COURT: Counsel and I always try 17 to work together to anticipate how many witnesses 18 we need for a particular day and try to schedule 19 them so we can work through the day, but we have 20 gone faster today than anticipated, so we're out of 21 witnesses for today. 22 We'll excuse you a little early. 23 See you tomorrow morning. Leave your notes in the 24 jury room. Remember, don't talk with anyone about 25 the case or read up on the subject. Avoid media 192 1 accounts on the case and come back and check in 2 tomorrow a little before 9:30. We'll try to start 3 at 9:30. 4 Thank you. Have a good evening. 5 You're excused. 6 (Jurors excused.) 7 THE COURT: Okay, we're in recess. 8 Thank you. 9 (Evening recess.) 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25