1 IN THE CIRCUIT COURT OF THE STATE OF OREGON 2 FOR THE COUNTY OF WASHINGTON 3 4 STATE OF OREGON, ) ) 5 Plaintiff, ) ) 6 vs. ) No. C940322CR ) 7 RANDAL LEE SCHWARTZ, ) ) 8 Defendant. ) Volume 9 9 10 11 TRANSCRIPT OF PROCEEDINGS 12 13 BE IT REMEMBERED THAT on the 19th 14 day of July 1995, the above-entitled matter came on 15 for Hearing before the HONORABLE ALAN C. BONEBRAKE, 16 a Circuit Court Judge. 17 18 APPEARANCES 19 Thomas J. Tintera Washington County Deputy District Attorney 20 Representing the State of Oregon 21 Marc Sussman Attorney at Law 22 Representing the Defendant 23 24 25 2 1 MORNING SESSION 2 BEGINNING AT 9:30 A.M. 3 JULY 19, 1995 4 5 (Whereupon, the following 6 proceedings were held in 7 open court, out of the 8 presence of the jury:) 9 THE COURT: Good morning. Who has a 10 matter for the Court? 11 MR. TINTERA: I do, Your Honor. 12 Good morning. 13 THE COURT: Mr. Tintera. 14 MR. TINTERA: Judge, what Mr. Reilly 15 testified yesterday, he testified to the 16 truthfulness of the defendant. My reading of Rule 17 608 of the Evidence Code, that's improper, as 18 truthfulness has not been attacked by witness or 19 otherwise in this particular case. 20 The necessary foundation for the 21 application of 608 have not been met. They involve 22 witnesses. That hasn't happened in this case. 23 There is no occasion for any other witness to talk 24 about the truthfulness of the defendant, the 25 necessary preambles have not been met by the 3 1 defense, and I object to any testimony by any 2 witnesses in regard to the defendant's truthfulness 3 unless the prerequisites of Rule 608 have been 4 accomplished or put in motion, actually. 5 Some of them can be accomplished by 6 the defense, but some are put in motion by the 7 State through its questioning of witnesses. 8 THE COURT: Mr. Sussman. 9 MR. SUSSMAN: Your Honor, my 10 recollection was that I asked Mr. Reilly about his 11 opinion of the defendant's character for honesty. 12 I did not specifically ask him about his opinion of 13 his character for truthfulness. I think those are 14 two separate character traits, honesty generally 15 being an issue where one of the counts involves an 16 allegation of intent is an action with the intent 17 to commit theft. 18 The character for truthfulness is a 19 separate character. Closely related, it is 20 somewhat different and I do not believe that I 21 specifically asked Mr. Reilly for an opinion as to 22 Mr. Schwartz's character for truthfulness because 23 that was not at issue at the time. 24 However, even if there was some 25 concern about overlap, I believe that there is some 4 1 authority -- checking my notes here, I think there 2 is some authority under the federal rules involving 3 the application of equivalent of 608, which would 4 even allow me to ask the witness before 5 Mr. Schwartz testified if the witness, knowing the 6 person, knowing this defendant, knowing about their 7 reputation for truth and veracity, could ask the 8 witness if Mr. Schwartz testified and were to take 9 an oath to testify would they believe him, and that 10 was a line of questioning specifically allowed in 11 United States v. Walker, 10th Circuit case at 313 12 F2d 236, and similarly in United States v. 13 ***Van Bulis, 471 F2d 501, 504, Second Circuit 14 case. 15 That wasn't what we got to. It was 16 a different character for honesty. I think that's 17 distinct and because the character -- the charge 18 involves an accusation of a crime with an intent to 19 commit theft, that that was appropriate perfect 20 character trait to ask the witness about. 21 THE COURT: Mr. Tintera. He says he 22 didn't ask about truthfulness. 23 MR. TINTERA: He asked about honesty 24 and trustworthiness is what I wrote down. And if 25 they are drawing a distinction there, 5 1 trustworthiness and truthfulness sound pretty close 2 to me. And if honesty and trustworthiness are the 3 same, then I would ask the Court to -- let's define 4 what type of character trait the theft allegation 5 brings in and -- anticipate a number of witnesses 6 going into these areas and I need some -- 7 THE COURT: Sure. Well, here is 8 what I think. Honesty probably okay. 9 Trustworthiness starts to sound like truthfulness. 10 I know we're splitting hairs. We have to draw a 11 line somewhere. 12 With regard to your latter point, 13 Mr. Sussman, because I'm getting to be an old 14 timer, there was a time under Oregon law before we 15 had the Evidence Code where it was a common 16 practice to do just exactly what you suggested is 17 permitted under the federal law in some areas, and 18 that is the rule was generally that in any criminal 19 case, in any criminal case, the defendant's 20 character for truthfulness had been attacked just 21 simply by the filing of the charging document and 22 so the defendant could then bring in evidence of 23 good character for truthfulness and veracity. 24 Somehow when this Evidence Code got 25 enacted, they changed the rule and they didn't 6 1 comment on that at all. I know because I -- I 2 guess there is two reasons I know the prior law. 3 One was I went to the U of O law school behind 4 Orlando John Hollis who was dean, and Dean Hollis 5 was never wrong on anything, if you asked him. And 6 he drilled into us what that was, what the rule 7 was. And when I got out in the real world, that's 8 what the practice was. 9 I accepted that as a prosecutor and 10 as defense attorney, I used it commonly in nearly 11 every criminal case, the defendant produced 12 evidence of good character for truthfulness without 13 first having it attacked. 14 The rules are to the contrary now in 15 the Evidence Code. If you look in the comments, 16 you don't find anything about what the prior law 17 was and the rules have changed. That's all that's 18 happened, they've changed. 19 Whoever -- well, I know who wrote 20 the Evidence Code. I don't know why Judge Unis and 21 Jones, who were the primary sponsors of this in the 22 legislature, chose to adopt this rule that 23 substantially changed the evidence law in Oregon 24 without commenting on it, but that's what happened. 25 I accept. I didn't at first, but I do now. 7 1 The law is written and it's the law 2 that we follow and that is that first the State has 3 to attack the character of your client for 4 truthfulness and veracity before you can produce 5 evidence of good character for truthfulness and 6 honesty, veracity, believability. That's the rule 7 I'm going to follow on that. 8 With regard to other pertinent 9 character traits, in a charge of theft, a good 10 character for honesty. 11 MR. SUSSMAN: Honesty. 12 THE COURT: If we are talking about 13 something that's the opposite of being a thief, I 14 guess that's it, unless someone can think of 15 another word that better fits that category. I'd 16 permit you to bring out -- typically in cases 17 involving fraud, deceit, dishonest conduct, theft, 18 that sort of thing, it's permitted under the 19 Evidence Code to bring in evidence of a character 20 trait to offset that. Honesty probably doesn't. 21 Trust does it. Trustworthiness begins to sound 22 like truthfulness. 23 MR. SUSSMAN: Except that part of 24 the peculiarities of this case is we have a 25 situation that arises in the context of a person 8 1 working within the system where he has access to 2 security and the means to take advantage of those, 3 that access and -- 4 THE COURT: It's no different than a 5 clerk working at Nordstrom being -- having access 6 to -- 7 MR. SUSSMAN: It's similar and in 8 that particular case, either the characteristic of 9 trustworthiness is sort of linked to honesty, in 10 other words, can this person be trusted with 11 sensitive -- 12 THE COURT: I understand. 13 Mr. Tintera, anything else? 14 MR. TINTERA: I don't see a 15 distinguishment between the two, Judge. I think 16 that honesty may be raised by an allegation of 17 theft, but I don't -- the actual allegations, which 18 is what is required by the Evidence Code must 19 raise, I suppose trustworthiness with the 20 allegations that don't involve anything about him 21 selling or disseminating the information. 22 THE COURT: Well, you've alleged 23 that he had the purpose of doing that, of stealing. 24 MR. TINTERA: That he did steal. 25 We're alleging that he stole it. 9 1 THE COURT: That's not what the 2 indictment says. 3 MR. TINTERA: Yes, it is. That he 4 committed theft of the password file, then theft of 5 the individual passwords. 6 THE COURT: Well, the language says 7 that he unlawfully and knowingly accessed and used 8 a computer for the purpose of committing theft. 9 MR. TINTERA: Finish the sentence. 10 THE COURT: For the purpose of 11 committing theft of Intel's SSD password files. 12 MR. TINTERA: Right. 13 THE COURT: All you have to do is 14 that he accessed it for that purpose. You don't 15 have to prove a complete theft. A complete theft 16 certainly would be, if you could prove it, good 17 evidence of a person's purpose. 18 It's like -- I looked at this 19 statute, I've been thinking about this because it's 20 a novel case. Count 1 looks to me like criminal 21 mischief involving a computer. Counts 2 and 3 look 22 like burglary. 23 MR. TINTERA: Right. 24 THE COURT: Although the statute 25 doesn't say you committed an act with the intent to 10 1 commit, it says you committed an act, trespass to 2 somebody's computer for the purpose of committing 3 another crime, theft. 4 I don't know why the legislature 5 didn't use "intent" instead of "purpose," but 6 nevertheless, looks to me like the logical 7 inference of this crime could be completed if one 8 commits the act of accessing a person's computer or 9 computer network for the purpose of theft. 10 MR. TINTERA: Well, I agree with 11 you, Judge, but I'm having a hard time 12 distinguishing between a character trait for 13 honesty and character trait for trustworthiness. 14 THE COURT: Well, they are probably 15 not much different. Truthfulness -- here is the 16 way we're going to do it. I want you to talk to 17 your witnesses, Mr. Sussman. I don't want them to 18 say, "Oh, yeah, I believe anything he said," 19 because that's clearly not at issue yet because the 20 State hasn't challenged yet his character for 21 truthfulness and veracity. 22 I think it's fair game, though, for 23 them to give a background, that they worked with 24 him, employed him, let him have access to their 25 property, whatever, and they believe and they have 11 1 an opinion, if they do, that he is an honest person 2 and he's trustworthy in the context of having 3 access to their goods, property, valuables, that 4 sort of thing. 5 If we do it that way, I will 6 overrule the objections. But if you start -- 7 typically the witnesses get up here, you ask the 8 question, and we run into this frequently in 9 criminal cases where they answer the question wrong 10 and that means you need to talk to them in advance, 11 and that is clearly they may not answer the 12 question with an answer that says, "Yes, I believe 13 him. If he said it, it's true," that sort of 14 thing. "He has good character for truthfulness." 15 What they may answer the question -- 16 how they may answer the question has to do with his 17 character for honesty and trustworthiness with 18 regard to property rights and that sort of thing. 19 Do you understand that distinction 20 I'm making? 21 MR. SUSSMAN: I do. 22 THE COURT: If you talk with your 23 witnesses, it will make it go easier. And that's 24 how I intend to handle it. 25 Anything else? 12 1 MR. SUSSMAN: Before we bring the 2 jury out, though, we do have the logistics problem 3 of the witness who is -- with the time differences 4 we're calling in Israel. And I know the State has 5 one last witness and I'm just concerned if we wait 6 to take that, we're going to be running into a 7 period where it's like -- 8 THE COURT: That witness is only 9 available today? 10 MR. SUSSMAN: This is the last day 11 this witness is available and this morning we're 12 talking about a time difference of ten hours, so -- 13 THE COURT: I want to let the State 14 rest before we do that. You have to work with that 15 witness. The witness will have to take some 16 No-Doze or something. Take a nap and testify about 17 midnight Israel time. But I don't want to 18 interrupt the State's case again to take the 19 testimony of another witness by telephone. I want 20 to get the State's case done. I think we can work 21 around that. Thank you. 22 Bring in the jury. Let's proceed. 23 24 25 13 1 (Whereupon, the following 2 proceedings were held in 3 open court, the jury being 4 present at 9:50 a.m.:) 5 THE COURT: Good morning, everyone. 6 I think when we finished last night, 7 Mr. Tintera was still calling witnesses. So 8 Mr. Tintera, call your next witness. 9 MR. TINTERA: Paul Lazenby. 10 11 PAUL LAZENBY 12 called as a witness on behalf of the State, having 13 been first duly sworn under oath, was examined and 14 testified as follows: 15 16 THE CLERK: State your full name and 17 spell it for the record, please. 18 THE WITNESS: Paul Lazenby. 19 L-a-z-e-n-b-y. 20 21 22 23 24 25 14 1 DIRECT EXAMINATION 2 BY MR. TINTERA: 3 Q Mr. Lazenby, who do you work for? 4 A Washington County Sheriff's Office. 5 Q And what do you do for them? 6 A I'm a detective. 7 Q And in the course of your duties with the 8 Sheriff's Department, did you assist in the 9 execution of a search warrant on November 1st, 10 1993, at the home of Randal Schwartz? 11 A Yes, I did. 12 Q And could you tell the jury what you did 13 during the execution of the search warrant? 14 A I interviewed Mr. Schwartz shortly a 15 couple times and then I helped bag and tag and -- 16 all the computer stuff that we received. 17 Q Do you know, was there a period of time 18 when you spoke to Mr. Schwartz? 19 A Yes. 20 Q Were you -- do you know who the first 21 police officer to interview Mr. Schwartz was? 22 A Myself. 23 Q And who was present when you initially 24 talked to Mr. Schwartz? 25 A Myself and Mr. Schwartz the first time. 15 1 Q So you were one-on-one? 2 A Yes. 3 Q And where did that conversation take 4 place? 5 A In the back room at the end of the 6 hallway. 7 Q And that was after he was advised of his 8 constitutional rights? 9 A Yes. 10 Q Before questioning Mr. Schwartz, did you 11 give him any information about why you were there? 12 A Yes. 13 Q What did you tell him? 14 A Well, he had been told by Detective 15 Lilley where he was read a copy of the search 16 warrant and stuff and I introduced myself in the 17 back room and asked -- and we talked about the 18 incident, to start with. 19 Q What information did you give 20 Mr. Schwartz initially? 21 A When we first started talking? 22 Q Yes. 23 A I believe nothing. I just asked him -- I 24 told him that I had some questions for him and -- 25 Q Tell the jury what happened. 16 1 A He admitted to me that he had been using 2 the program called Crack to get passwords and that 3 he had obtained what he thought was 10 to 12 4 passwords. Our concern was how many passwords were 5 out there and where they were at. He advised me 6 that they were on the Snoopy program in a 7 subdirectory ***underplay under stuff.tar. 8 I then asked Randal if he felt he 9 was doing anything wrong in doing that and he told 10 me that he knew he was, in fact, violating Intel 11 policy and he thought there was a possibility that 12 he could be criminally prosecuted for that. 13 Want me to continue? 14 Q Hold on. 15 Was there a period of time during 16 this conversation that you asked Mr. Schwartz if he 17 had done anything wrong? 18 A Yes. 19 Q And before you did that, what type of 20 information did you provide him? 21 A Basically nothing. I just asked him to 22 tell me -- I told him what we're here for, because 23 of the passwords and stuff you'd be getting and -- 24 Q Okay. What did you tell him about why 25 you were there? 17 1 A That we wanted to make sure there was no 2 information that was missing from the systems at 3 Intel and why he was using the programs to access 4 passwords. And that's when he told me where the 5 passwords were and that he had been using Crack, 6 and that's about it. 7 Q So when you asked him if he had done 8 anything wrong, what was his response? 9 A He told me he knew he was, in fact, 10 violating Intel policy and that he possibly could 11 be criminally prosecuted for it. 12 Q After you received the location of where 13 the cracked passwords were kept, what did you do? 14 A I went back out and advised the people 15 from Intel there, they called over because they had 16 somebody on the machine, to check that out to see 17 how many passwords there were. 18 Q And then what happened? 19 A We found out there was 40 to 50 passwords 20 that had been taken. And because of that, I went 21 back into confront him on that issue because I was 22 concerned. 23 Q And when you went back in, who was 24 present with Mr. Schwartz at this time? 25 A Detective Lilley and I believe some of 18 1 the people from Intel, they were in the process of 2 starting their interview. 3 Q So the first interview was just you and 4 Mr. Schwartz? 5 A That's correct. 6 Q And then you went back in and there were 7 more people present? 8 A Yes. 9 Q And what was the conversation that you 10 had with Mr. Schwartz at this point? 11 A I -- I confronted him with the fact that 12 he had told me there was 10 to 12 and that we had 13 found 40 to 50, and that was a pretty big 14 discrepancy. And he told me at that time, "I don't 15 remember how many exactly because I was just 16 sticking them under the stuff.tar and not really 17 using them." 18 Again I asked him why he would need 19 40 to 50 passwords if he was only doing what he 20 said he was doing, why would he need 40 to 50. He 21 said, "I needed them in case they caught me doing 22 it and knew they would shut me down, so the more 23 passwords I had, the longer I could continue doing 24 what I wanted to do." 25 Q Did you write a report about your 19 1 interview with Mr. Schwartz? 2 A Yes. 3 Q And when did you write that report? 4 A That evening when I got back. 5 Q And contemporaneously with the interview, 6 were you taking any notes? 7 A I took a few notes. I took down some 8 quotes that he made and included those in my 9 report. 10 Q And when you were talking to him about 11 the 40 or 50 passwords, did you take down exactly 12 in place of quotation in your report anything that 13 the defendant said? 14 A Yes. 15 Q Could you tell the jury what his exact 16 words -- 17 A "I needed them in case they caught me 18 doing it and knew they would shut me down. So the 19 more passwords I had, the longer I could continue 20 doing what I wanted to do." 21 Q What did he say after that? 22 A He basically advised me that he had the 23 capability to do it and he knew he could do it. 24 Q And then did you ask him about his 25 knowledge of it being wrong? 20 1 A Well, because of that statement, I again 2 asked him about the -- if he knew it was wrong and 3 in violation of Intel policy. And I wrote down 4 exactly what he said at that point. 5 Q How did he respond when you asked him 6 about if he knew it was in violation of Intel 7 policy? 8 A He said, "Yes, it is, but I knew I could 9 do it anyway." 10 Q Is that in quotes in your report? 11 A Yes, it is. 12 Q Why? 13 A Because of the way he said it to me, I 14 put it in -- I wrote it down exactly because of the 15 way he said it. 16 Q And then what did you talk with 17 Mr. Schwartz about? 18 A Then we discussed -- he told me about he 19 wanted to be -- he wanted to do it because it was 20 efficient in getting his e-mail very fast and it 21 was important. And when they would shut him down, 22 he wanted to continue doing what he wanted to do, 23 and so that's why he was doing it. 24 Q Did he ever tell you that he sought 25 permission to do this? 21 1 A No. He told me he did it without 2 permission. 3 Q Did you talk about his history of running 4 the Crack program at the Intel division? 5 A Yes. 6 Q When you were talking about the Crack, 7 were you talking about the cracking of the 8 Supercomputer Division password file? 9 A Yes. 10 Q Did you talk to him about his prior use 11 of the Crack program at the Intel Corporation? 12 A Yeah. He actually started telling me 13 about that, so we discussed that. 14 Q What did he tell you? 15 A He told me about one to two years ago 16 that he was a Systems Administrator at Intel with 17 the SSD and that he would run the Crack program 18 back then. He advised me that it was a tool used 19 to keep passwords honest and he said that if you 20 can break it with Crack, bad guys could do it, too. 21 I asked -- I then told him if he 22 knew this and it was used for a security measure 23 back then, why was he doing it without 24 authorization now. And he advised me that he knew 25 it was totally wrong and could get in trouble if 22 1 caught doing it. I again asked him if he 2 remembered using Crack. 3 Want me to continue on that? 4 Q Of his other use of Crack? 5 A Yeah. 6 Q Let me check. 7 No. Let's stop with the Intel 8 Corporation. 9 Well, besides the quoted material, 10 did you take any extra care to memorialize or keep 11 what the defendant told you correct? 12 A Yeah. I put it into quotes, those 13 statements that really impacted me from the way he 14 said them to me. 15 Q Did he ever go -- did you ever talk to 16 him about the gate program? 17 A I think -- yes. Well, I asked him when 18 he first got caught doing it, and that was back 19 during the first interview, and he advised he first 20 had the gate program on the Mink computer and he 21 was caught and confronted by supervisors. 22 Q Is that his word or your word? 23 A That's his word, because I didn't know 24 anything about that stuff. He was telling me this 25 and I asked him when he first got caught and he 23 1 started telling me about that. 2 Q Okay. 3 A He then said he stopped using Mink and 4 switched over to gate -- to Hermeis and was doing 5 that, but Hermeis was too slow so he went back to 6 Mink. And he said he was caught again on Mink, so 7 he switched gate over to Brillig. Then he told me 8 his log on was Merlin. 9 Q Was there any conversation as to whether 10 he had used any of the cracked passwords for the 11 Supercomputer Division files? 12 A Yes. 13 Q And what was that? 14 A He told me that he had used one password. 15 He'd only logged in and out one time, but later 16 told me it was two to three times. And he said he 17 never copied anything or looked at anything. And I 18 asked him if he could remember any of the passwords 19 and the only one he could remember was Ron B. 20 MR. TINTERA: Thank you, Detective 21 Lazenby. I don't have any other questions. 22 MR. SUSSMAN: Your Honor, before I 23 start, may I have a moment? I have an exhibited 24 that I need to locate. 25 THE COURT: Sure. 24 1 MR. SUSSMAN: Your Honor, may we -- 2 we may need a moment or two to locate a document, 3 so perhaps we need to recover it from the Court 4 file and maybe it would be better to have the jury 5 out. 6 THE COURT: We need to get some 7 documents, ladies and gentlemen. We'll remove you 8 for a minute. Take a short break until we get 9 everything ready. 10 (Whereupon, the following 11 proceedings were held in 12 open court, out of the 13 presence of the jury:) 14 THE COURT: What's the problem, we 15 don't have an exhibit? 16 MR. SUSSMAN: I thought we had the 17 search warrant affidavit filed as an exhibit during 18 the motions hearing. That's not separately in the 19 files as an exhibit and I -- that I wanted to use 20 during cross-examination. 21 THE COURT: Get that at the clerk's 22 office. 23 MR. SUSSMAN: Well, there is 24 attached to a -- if I could just grab it from the 25 file. 25 1 THE COURT: Let's talk about that -- 2 the telephone conference, the telephone testimony. 3 I'm not sure how audible the voice 4 on the phone is going to be for the jury, so the 5 procedure I think we should follow is to have -- 6 once we get there is to have the jury taken out, 7 place the call, explain the circumstances to the 8 witness and have the witness speak up and we'll see 9 how audible the voice is to the jury box and then 10 we'll have to take it from there, but I think we'll 11 kind of do a test before we do that. 12 MR. TINTERA: Before -- I don't 13 recall asking Detective Lazenby anything about the 14 search warrant. I don't know how counsel is going 15 to be able to inquire based on what I asked 16 Detective Lazenby about anything -- 17 THE COURT: Well, I have an idea in 18 the back of my mind he's going to use it to try to 19 impeach him by saying something different in the 20 search warrant affidavit than what he's testified 21 to. 22 MR. TINTERA: He only testified to 23 things after the search warrant was executed, to 24 things that happened at the defendant's residence 25 after the search warrant was issued, Your Honor. 26 1 THE COURT: Let's see what 2 Mr. Sussman asks and if you want to object, object 3 and I'll rule. 4 MR. TINTERA: Thank you. 5 THE COURT: Five minutes. 6 (Recess taken.) 7 THE COURT: Proceed, Mr. Sussman. 8 MR. SUSSMAN: Thank you, Your Honor. 9 10 CROSS-EXAMINATION 11 BY MR. SUSSMAN: 12 Q Detective Lazenby, you indicated that you 13 assisted in the execution of the search warrant 14 that was obtained in this case. 15 A Yes. 16 Q You also assisted Detective Lilley in the 17 drafting of that search warrant, didn't you? 18 A Yes. 19 Q And during the course of the drafting of 20 that search warrant, you informed Detective Lazenby 21 about your experience and training in the 22 investigation of computer crimes? 23 A I told Detective Lilley about my 24 experience and training. 25 Q Did you tell him that this was the first 27 1 actual case of that computer crime? 2 A Nobody had been charged at the time of 3 the search warrant. 4 Q So this is the first case of computer 5 crimes that you've investigated? 6 A No. There has been other cases of 7 computer crimes, but those are not what the 8 ultimate charges have been. We have seized other 9 computers and other warrants related to computers. 10 Q Detective Lilley [sic], do you remember 11 testifying in this courtroom about a month ago and 12 being asked if this was the first case that you had 13 investigated of an actual charge of a computer 14 crime? 15 A Yes. 16 Q And at that time you answered yes? 17 A Yes, where a person has been charged with 18 a computer crime, that is correct. 19 Q Now, you have had also a lot of 20 training -- well, let me back up. 21 You reviewed the search warrant 22 affidavit before it was submitted to the Judge? 23 A I briefly read over it. I reviewed most 24 of the ***time that I gave Detective Lilley and I 25 read some of the other stuff, yes. 28 1 Q I would like to show you what has been 2 marked for identification as Defendant's Exhibit 3 113. Is this a copy of the search warrant 4 affidavit that was prepared by Detective Lilley? 5 A Yes. 6 Q And that you read over? 7 A I believe so. That looks look it. That 8 looks like it. 9 Q Thank you. 10 Now, when you went with Detective 11 Lilley to execute the search warrant, you were 12 accompanied by how many more officers? 13 A I believe there was about four or five 14 other officers from our department. 15 Q And these officers came with you into the 16 house when Mr. Schwartz's brother opened the door; 17 is that right? 18 A No. I believe a lot of them stayed 19 outside until after -- two or three of us entered, 20 Jim read the search warrant and stuff and brought 21 the rest in. 22 Q And Mr. Schwartz and his brother were 23 brought into the living room and both were advised 24 of their Miranda rights? 25 A Yes. 29 1 Q The rights that you read to people who 2 are being questioned or interrogated about 3 potential criminal activity? 4 A I believe the policy is anybody that's 5 being -- whenever a search warrant is being 6 executed, we advise everybody of their rights. 7 Q And you do that because the person where 8 a search warrant is being executed may see 9 themselves as being in custody? 10 A No. Mr. Schwartz's brother was not in 11 custody and wasn't suspected of a computer crime, 12 but we read him his rights also. I mean, if we 13 found something of a criminal -- I could find 14 something else in the house of a criminal nature, 15 so it is policy if there was ten people in the 16 house, if we had had some neighbor there, anybody 17 that's brought in, we read the warrants, we advise 18 everybody of their rights. And I've kicked people 19 free after we've done that, so it doesn't 20 necessarily have to be a person who is being 21 questioned of a crime or isn't free to go. 22 Q You nevertheless advised both 23 Mr. Schwartz and his brother of the Miranda rights. 24 Mr. Schwartz then, shortly after that, spoke with 25 you in this room at the end of the hall? 30 1 A Yeah. Detective Lilley advised of the 2 rights and I spoke to him at the end of the hall. 3 Q Your main responsibility was -- 4 throughout the time that you were there was the 5 execution of the search warrant? 6 A Yes. 7 Q Looking around for computers and computer 8 equipment? 9 A That's correct. 10 MR. SUSSMAN: I would like to offer 11 the search warrant affidavit at this time. 12 MR. TINTERA: It's not relevant, 13 Judge. 14 THE COURT: Sustained. No. 113 is 15 not received. 16 BY MR. SUSSMAN: 17 Q And you were there for several hours 18 during the course of the search, were you not? 19 A I believe that's correct. 20 Q And of the several hours, your 21 conversation with Mr. Schwartz lasted perhaps less 22 than ten minutes? 23 A The first time, five or ten minutes. The 24 next time, maybe five minutes. It wasn't long. 25 Q The first time that you spoke with him at 31 1 the end of the hall, you advised Mr. Schwartz that 2 he was not in custody? 3 A I don't know if I said that to him or 4 not. Let me see. 5 I don't think I specifically made 6 that statement. I did advise him that it was under 7 investigation. 8 Q In fact, you advised him that he was not 9 in custody but that he was -- you also advised him 10 that there could be misdemeanor felony and possible 11 federal charges? 12 A No, I didn't advise him he wasn't in 13 custody. I advised him that he was under 14 investigation, but under Oregon law, it could be a 15 misdemeanor or felony. And if there was phone 16 lines involved and transfer of data out of state, 17 you could have felony charges. I didn't -- I did 18 tell him that. 19 Q You remember again you testified in this 20 case last month, the prosecutor asked you the 21 question, "Did you make any statements to 22 Mr. Schwartz during the time of the search warrant 23 of his custody status? 24 "Answer: Yes. There in the back 25 there was a time I interviewed and told him he was 32 1 not under arrest but free to go at any time, but I 2 told him there could be ******" ***(reading) 3 A That's correct. 4 Q Then you questioned him about his use of 5 the Crack program? 6 A Okay. Yeah. 7 Q And during that conversation with 8 Mr. Schwartz, both the first time and the second 9 time, you took no notes, did you? 10 A Took no notes? 11 Q That's right. You took no notes? 12 A No. I wrote down his quotes and put 13 those into my report, I believe is how I did that. 14 Q When you testified in this courtroom last 15 month, Detective Lazenby, you were asked, "How many 16 times did you actually participate in the 17 interviews with Mr. Schwartz?" 18 Your answer was "Probably five to 19 ten minutes maximum the two times. 20 "Question: Did you take notes while 21 you were there? 22 "Answer: No, I wrote a report that 23 night. 24 "Question: Just from your memory 25 then? 33 1 "Answer: Yes." 2 Was that testimony accurate at the 3 time? 4 A It's accurate to the time that I took no 5 notes about all the statements. I did write down 6 the quotes. I think there is like two quotes that 7 are in there and I wrote those down. 8 Q So you testified last time truthfully 9 when you said you took no notes and you're 10 testifying truthfully today when you say you took 11 notes and wrote down the two quotes before writing 12 your report? 13 A I wrote down the two quotes and I did not 14 take down notes about the whole interview. 15 Q That's not what you said when you 16 testified under oath last time in response to the 17 questions I just read to you, is it? 18 A I guess if you consider all his 19 statements to me, I was thinking of the whole 20 thing. Like if I was interviewing a person for a 21 long time period, I might write a lot of stuff 22 down. I didn't do that. 23 Q You think you misunderstood the question? 24 A I may have. I spoke -- wrote down the 25 two statements, two quotes. 34 1 Q Maybe your statements were 2 misinterpreted? 3 A My statements? 4 Q Yes. 5 A On what? 6 Q You're saying that you -- you're saying 7 that you took no notes. 8 A I don't understand what you're asking me. 9 Q It's possible that maybe we 10 misinterpreted your responses? 11 A I don't know. I believe that I responded 12 accurately. 13 Q Now, you made a point of saying there 14 were certain remarks that were Mr. Schwartz's words 15 that you put in quotes. You also talked about him 16 saying that he -- in response to Mr. Tintera's 17 questions, that Mr. Schwartz said he was caught 18 running a certain program, saying those are his 19 words. The word "caught" is not in quotes in your 20 report, is it? 21 A That's correct, it's not. 22 Q You did testify that Mr. Schwartz told 23 you that he had used passwords that he had cracked 24 from the SSD password file to log in to the SSD 25 computers; is that right? He was referring to a 35 1 password for -- under Ron B? 2 A Yes. 3 Q Are you certain that he was not talking 4 about a password that he got from the Brillig 5 password file? 6 A I -- I don't -- he told me -- I don't 7 know if he used Ron B to go into SSD. I asked him 8 what passwords he could remember using. Ron B was 9 one he could remember using. Then he made the 10 other statement he did use the password, I don't 11 know if it was Ron B or another one, he said to 12 look at the SSD, go into SSD and look. That's all 13 he -- 14 Q To look at the SSD file? 15 A No, to use one of the SSD ***pardon filed 16 to go into the SSD to look into ill but didn't take 17 anything or -- 18 Q You're certain you didn't misunderstand 19 that? 20 A Yes. 21 MR. TINTERA: I object to him 22 interrupting the witness' answers. 23 THE COURT: Let him finish the 24 answer, Mr. Sussman. 25 36 1 BY MR. SUSSMAN: 2 Q Now, you also testified that Mr. Schwartz 3 said he was using Crack to get passwords so he 4 could access the SSD system because he wanted to 5 get his e-mail quicker. 6 A He was using Crack to get the passwords 7 so he could use the passwords to get into -- get 8 his e-mail. 9 Q Are you sure he was not talking about -- 10 that referencing the getting his e-mail was not in 11 this discussion about why he was running the gate 12 program on Mink and Brillig? 13 A I -- I don't know what you're saying 14 there. What does that relate to the passwords? 15 Q I'm asking you whether or not he was, 16 what -- that you were confusing his response to 17 getting his e-mail faster was the reason for 18 running the gate program on the other computers 19 Mink and Brillig. 20 A I don't believe so. The issue was was he 21 using Crack to take password files off the SSD 22 system, which he says yes, he was, and he was using 23 those passwords to get back into the system from 24 home. Now, whether it was Mink or Brillig, I don't 25 know. I don't know the systems. 37 1 Q When he was talking about getting access 2 to his e-mail, wasn't he talking about using the 3 outside access from the gate program? 4 A I don't know. I don't think we ever 5 discussed that. 6 Q Didn't Mr. Schwartz tell you that his 7 reason for running Crack was to test systems 8 security? 9 A Yes, he made that statement. 10 Q Did you put that in your report? 11 A I believe I did. It's in here somewhere. 12 I believe we were talking about the -- two years 13 ago, came up in the same thing when he was using it 14 for password honesty and stuff. 15 Q You did not put that report in your 16 statement, that Mr. Schwartz told you that the 17 reason he was running the Crack password file on 18 SSD was that he was testing the security system? 19 A Yes, I did. "Randal advised it was a 20 tool to use passwords honest," and I think that's 21 where that reference came up. ***(Last questions 22 answer answer all related) That's when I followed 23 up with the question about if he -- if you -- it 24 was for security back then and it was security, why 25 was he doing it without authorization now if it was 38 1 a security issue. 2 Q The question was when you first asked him 3 about why he was running the Crack program, didn't 4 he tell you at that point that the reason he was 5 running it was to test systems security? 6 A The first time, no. 7 Q Now, Mr. Schwartz was not -- Mr. Schwartz 8 during these interviews was being cooperative? 9 A Yes. 10 Q And open? 11 A Yes. 12 Q And you had no reason to think he was 13 being evasive? 14 A At any point? 15 Q Yes. 16 A Yes, at one point I did. 17 Q And that was because of the difference 18 over the number of passwords? 19 A Yes. 20 Q Did you actually have the correct number 21 of passwords? Did you learn what the correct 22 number of passwords was? 23 A Yes. That's when I went back and 24 confronted him. 25 Q You said it was 50 passwords? 39 1 A 40 to 50. 2 Q Well, in your report -- 3 A I think my report says at least 40 to 50 4 passwords. 5 Q And Mr. Schwartz told you that he had 6 only logged in once and hadn't looked at the -- 7 looked at the final number? 8 A No, that's not what he told me. He told 9 me he didn't remember exactly how many because he 10 was just sticking them under stuff.tar and not 11 really using them. 12 Q Didn't he tell you that he had logged in 13 just once in the beginning of the program run? 14 A No. He told me he had only logged in -- 15 I asked if ever logged onto the SSD using any of 16 the passwords and he said on that he had only 17 logged in one time and later changed it to two or 18 three times. 19 Q So you're certain you're not confusing 20 that with his answer about when he was logging onto 21 the Crack program? 22 A No. I don't think I'm confusing that. 23 We never got into the number of times he logged on 24 and used Crack. 25 Q Detective Lazenby, you have access to a 40 1 tape recorder at the Sheriff's Office, don't you? 2 A I have one on my desk, large one. 3 Q You use one when you write reports? 4 A I don't take it out in the field with me 5 because it's this big (indicating) and hooked up to 6 my phone. 7 Q But there are portable tape recorders you 8 can take with you when you are conducting 9 interviews in the field, aren't there? 10 A Probably some available if I wanted to, 11 yeah. 12 Q And you could have taken -- there is also 13 videotape equipment that you could have used and 14 brought with you during the course of the search to 15 videotape the equipment or any questioning that 16 took place? 17 A I guess if I want to I could. That's 18 available. 19 Q And those things, those means, those 20 videotape or audio tape would assure this jury that 21 when you related the statements that you got in an 22 interview that they would be precisely the 23 statements that were obtained during the interview, 24 wouldn't they? 25 A We have used those in the past and half 41 1 the time they fail or batteries go out and we don't 2 use them. 3 Q Would you answer the question. The 4 question is those would assure -- the tape 5 recording would provide the most accurate account 6 of what was stated during an interview? 7 A Yes. 8 Q And videotape recording of an interview 9 would also provide the most accurate account? 10 A Yes. 11 Q And that would provide a more accurate 12 account than your recollection of the statements 13 that were given to you two years ago? 14 A No, because I wrote them down that night. 15 Q But you didn't take any notes, you didn't 16 take any detailed notes of that conversation when 17 it was taking place? 18 A I remember pretty well and I wrote it 19 that night. 20 Q You talked about your training and 21 experience in this affidavit for the search warrant 22 about investigating computer crimes. You also have 23 training and experience in interrogation 24 techniques, don't you? 25 A Yes. 42 1 Q And you have training and experience that 2 when you go to talk to somebody who you are 3 investigating a crime on, the techniques that you 4 will use to get the answers that you are looking 5 for when you are investigating that crime, don't 6 you? 7 A I disagree with that. I don't go looking 8 for a specific answer. I go looking for the truth. 9 Q You went there because Mr. -- with an 10 affidavit that provided you the basis to look for 11 evidence that Mr. Schwartz had been taking Intel 12 secrets so you could seize his computers, correct? 13 A Correct. 14 Q You told him when you were there that he 15 could be prosecuted for crimes for doing these 16 things? 17 A If it had occurred, he could be 18 prosecuted, correct. 19 Q And you told him during the course of 20 that interview that you didn't believe him when he 21 told you about the number of passwords when you 22 confronted him about the larger number? 23 A Yeah, that was no trick. That was a 24 direct statement. He hadn't told me the truth. 25 That was going back and saying, "You said this and 43 1 this is what they say is there." That's 2 confronting a discrepancy, is all. Asking him to 3 explain it. 4 Q And you took -- and you went in there and 5 part -- and part of that training includes not 6 using the tape recording on initial interviews so 7 that you can see what happens during the course of 8 those interviews, doesn't it? 9 A I've never had any training that way. 10 Q But in fact, you did not use any tape 11 recordings that would have provided this jury a 12 record of precisely what Mr. Schwartz answered in 13 response to questions? 14 THE COURT: I think he already 15 answered that question, Mr. Sussman. 16 MR. SUSSMAN: I have nothing 17 further. 18 THE COURT: Redirect. 19 20 21 22 23 24 25 44 1 REDIRECT EXAMINATION 2 BY MR. TINTERA: 3 Q Mr. Lazenby, why didn't you use, 4 according to defense counsel, tape recording and 5 videotape, why did you not use those? 6 A I've been in police work 22 years and in 7 the past, kind of like we used to use video 8 recorders in DUI cars and different things. 9 ***PRAULD breaking down, tape recorders. Had 10 them -- tape recorder go off on me in the -- during 11 the middle of a homicide interview. Doesn't work. 12 Is there electricity at the house. They break down 13 during the interview. 14 I don't think there is a department 15 around that uses video and audio during a search 16 warrant and uses them. 17 Q You were asked about what the defendant 18 said the first time he was asked about running the 19 Crack program. And what did the defendant say the 20 first time he was asked about running the Crack 21 program? 22 A He said -- 23 MR. SUSSMAN: Your Honor, he 24 answered this question in response to my questions. 25 This is improper redirect. It's repeating the 45 1 testimony. I object. 2 MR. TINTERA: He asked about it. 3 THE COURT: Overruled. 4 THE WITNESS: He said he had been 5 using it to get passwords and he obtained what he 6 thought was 10 to 12 passwords. 7 MR. TINTERA: Thank you. I don't 8 have any other questions. 9 THE COURT: Mr. Sussman? 10 MR. SUSSMAN: I have nothing 11 further. 12 THE COURT: Thank you. You may step 13 down. 14 Call your next witness. 15 MR. TINTERA: I would offer State's 16 Exhibits 16 and 20. ****(back there he said he 17 used one in the middle of a homicide one time and 18 it broke down in the middle of the interview.) 19 MR. SUSSMAN: Your Honor, I have no 20 objection to Exhibit 16. 21 THE COURT: 16 is received. 22 (Whereupon, State's Exhibit 23 No. 16 was received in 24 evidence.) 25 MR. SUSSMAN: 20 -- 46 1 MR. TINTERA: It was Herb Mayer. 2 MR. SUSSMAN: He couldn't recognize 3 this or identify this and this is an invoice to Bob 4 Wilcox, so I don't think this has been properly 5 identified and -- 6 MR. TINTERA: Well, we have agreed 7 that the foundation of business records would not 8 be required to be produced for the trial. The 9 document is a document -- 10 THE COURT: I don't want to have an 11 argument over possible stipulations before the 12 jury. 13 MR. TINTERA: Well, that's in regard 14 to the foundational aspect. 15 MR. SUSSMAN: The objection isn't on 16 foundation grounds. I have no quarrel with the 17 fact that we have records produced by our subpoenas 18 and from Intel's business records, but my objection 19 was this wasn't identified by any of the witnesses 20 as to work that Mr. Schwartz had done. This refers 21 to Bob Wilcox and the State showed this to 22 Mr. Mayer and -- 23 THE COURT: May I see it? 24 MR. SUSSMAN: That seems to be my -- 25 and he couldn't identify it. That's my 47 1 recollection. 2 MR. TINTERA: Mr. Mayer identified 3 the SGI reference to that record in referencing the 4 Silicon Graphics computer, also known as Brillig. 5 Lines are difficult to read about two-thirds down 6 the page. 7 THE COURT: Overrule the objection. 8 20 is received. 9 (Whereupon, State's Exhibit 10 No. 20 was received in 11 evidence.) 12 MR. TINTERA: Judge, I have no 13 further evidence to offer at this time and nor 14 witnesses to call and I would rest. 15 MR. SUSSMAN: Your Honor, I have a 16 matter for the Court. 17 THE COURT: Typically when one party 18 rests, ladies and gentlemen of the jury, there are 19 matters that the Court has to consider before we go 20 further on the case. I will have to consider some 21 arguments and things now, so we'll take a recess. 22 Remove the jury. 23 24 25 48 1 (Whereupon, the following 2 proceedings were held in 3 open court, out of the 4 presence of the jury:) 5 THE COURT: Mr. Sussman. 6 MR. SUSSMAN: Your Honor, at this 7 point I would make my motion for judgment of 8 acquittal and on grounds the State has not proved 9 sufficiently that each of the elements of Count 1 10 to be proved to the jury beyond a reasonable doubt, 11 the evidence would not be sufficient on the issue 12 of Mr. Schwartz's knowledge or belief. 13 Also with respect to Counts 2 and 3, 14 more specifically there, the -- both of those 15 counts allege that Mr. Schwartz accessed and used 16 the computers for the purpose of committing theft. 17 And I think the evidence in this case, this -- this 18 fails on the grounds of showing there was a purpose 19 of committing theft. There is no evidence from 20 which the jury could draw that conclusion. 21 And number two, that in itself, the 22 copying and running the Crack on the password file 23 at SSD and copying and running the Crack password 24 file on the Brillig are not theft as a matter of 25 law, and that the Court should grant the judgment 49 1 of acquittal on both of those grounds. 2 THE COURT: Explain that last part 3 to me again. 4 MR. SUSSMAN: Well, Your Honor, I 5 think there is no evidence that that -- theft 6 requires that the State prove or the elements are 7 that somebody take property which -- for the intent 8 of appropriating it to themselves or with the 9 intent to permanently deprive the owner of the 10 usefulness of that. And in this particular case, 11 there is -- a password and password file are 12 information and are not objects which are subject 13 to theft. That the theft statute does not fit the 14 circumstances that you have or conditions that were 15 created by copying and running a password -- 16 running a Crack program on a password file. 17 And secondarily, the evidence is 18 lacking that there was any purpose to commit, or 19 intent to commit theft. 20 So on those grounds, that's the 21 basis for my motion. 22 THE COURT: Mr. Tintera. 23 MR. TINTERA: Judge, I think we have 24 established all the elements in this particular 25 case. The -- the evidence shows that he took the 50 1 property, he had no authority to take the property, 2 the property had value to the owner of it, and his 3 actions diminished that value. And also that he 4 appropriated property to himself for his own use. 5 That, in my mind, establishes theft. 6 THE COURT: Well, these issues came 7 into my awareness when we started this case and 8 I've been doing a lot of thinking about it since 9 then. 10 Obviously what the legislature has 11 done is adopted this new computer crime and sort of 12 related it to the theft statutes. And at least in 13 my court, this is a case of first impression of 14 trying to interpret just how the definitions used 15 there in the theft statute apply. 16 And I looked at "appropriate 17 property to oneself," I considered that, considered 18 the various definitions, other definitions that 19 apply to theft, and I tried to think of other 20 factual situations that more commonly come before 21 the Court that might be similar. And what I'm 22 suggesting here, that a jury could find that the 23 conduct of a defendant or a person in the 24 defendant's posture at this point where the 25 evidence that a jury could believe that he did 51 1 Crack, he copied the password file, put it in, had 2 it transferred within Intel to the computer that he 3 had access to in running the Crack password against 4 it is sort of like a store employee at Nordstrom 5 taking merchandise and not removing it from the 6 store but placing it somewhere else within the 7 store where the employee had access to it 8 preparatory to removing it from the store. 9 And clearly in that scenario -- we 10 have had those sorts of cases before the Court. 11 Typically it's the employer takes a TV set and puts 12 it in a dumpster and warehouse someplace with the 13 idea that he can come back later on that night and 14 take the TV set out. 15 This is sort of a high-tech version. 16 The jury could find this is a high-tech version of 17 taking a TV set and putting it in a dumpster with 18 the idea of coming back later that night and taking 19 it out. I know that's sort of a simple comparison, 20 but factually, it's very close to what Mr. Tintera 21 has attempted to prove here. 22 Defendant needs to know -- the 23 lawyers do, I think, that the defendant and others 24 that are not lawyers maybe in the courtroom need to 25 know that when I rule on these and when I deny a 52 1 motion for a judgment of acquittal, as I am in this 2 case, I'm not saying that the defendant is guilty, 3 what I'm saying is that based on the evidence 4 that's been produced, he could be found guilty. He 5 could be. The evidence has been legally sufficient 6 that if it's believed and if certain reasonable 7 inferences are drawn, he could be found guilty. 8 That's what I'm saying in this case. 9 I do believe the evidence that has 10 been produced here on all three counts is 11 sufficient for the case to go forward and I'm 12 denying the motion on all three counts. 13 Anything else? 14 MR. SUSSMAN: No. Before we bring 15 back the jury, I suppose we should get things set 16 up for the telephone testimony. 17 THE COURT: Yes. I'm fearful they 18 will not be able to hear. If that's the case -- 19 how long is the cord on that phone? Let's go off 20 the record. Take a short recess here. 21 (Recess taken.) 22 (Whereupon, the following 23 proceedings were held in 24 open court, the jury being 25 present:) 53 1 THE COURT: Ladies and gentlemen of 2 the jury, as I indicated earlier, the State has 3 rested and this is now the time that the defense 4 has an opportunity to call witnesses and produce 5 evidence. 6 The first witness that Mr. Sussman 7 wishes to call on behalf of the defendant is out of 8 the country, in fact, I think in Israel, and we 9 have arranged to have that person testify by 10 telephone and the State has agreed. This is a bit 11 unusual, but the parties occasionally do enter into 12 such agreements and so we have done that in this 13 case. 14 But because the witness is going to 15 testify by telephone, we'll ask the witness to 16 speak up. If at any time you can't hear, let me 17 know and I'll ask the witness to repeat the answer 18 and speak up. 19 You should treat this just as though 20 the witness was before you here on the witness 21 stand testifying, as any other witness has or will, 22 and treat it no differently than that. 23 As I understand it, the witness is 24 available; is that correct? 25 MR. SUSSMAN: Yes, Your Honor, the 54 1 witness is on the line as we speak. 2 THE COURT: Okay. Your first 3 witness then is. 4 MR. SUSSMAN: Tanya Herlick. 5 THE COURT: Actually it's the second 6 witness because you've already called Mr. Reilly, 7 is that correct? 8 MR. SUSSMAN: Yes. 9 THE COURT: Miss Herlick, can you 10 hear me? 11 THE WITNESS: Yes. Barely. I can't 12 hear you too well, to tell you the truth. 13 THE COURT: I'll speak up. Can you 14 hear me now? I'm Al Bonebrake, I'm a judge. I 15 want you to raise your right hand and take an oath 16 to tell the truth. Will you do that? 17 THE WITNESS: Yeah. 18 19 20 21 22 23 24 25 55 1 TANYA HERLICK 2 called as a witness on behalf of the Defendant, 3 having been first duly sworn under oath, was 4 examined and testified as follows: 5 6 THE CLERK: State your full name and 7 spell it for the record, please. 8 THE WITNESS: My name is Tanya 9 Herlick. H-e-r-l-i-c-k. 10 THE COURT: Miss Herlick, this is 11 Judge Bonebrake again. If at any time during the 12 testimony you hear an objection made, someone say, 13 "Objection, Your Honor," I'd like to have you stop 14 at that time, stop testifying and give me an 15 opportunity to rule on that and then give you 16 directions. Can you do that? 17 THE WITNESS: Yes. 18 THE COURT: It will be a little 19 difficult, but if I ask you to stop, listen as you 20 are speaking and if you hear an objection or I ask 21 you to stop for a moment, I'd ask that you do that. 22 Okay? 23 THE WITNESS: Sure. I'm wondering, 24 though, I think the phone is a one-way phone, so 25 while I'm speaking, I can't hear anything coming 56 1 through. I can't hear any interruptions, I think. 2 THE COURT: Okay, we'll try to give 3 you short questions if that's the case. All right? 4 THE WITNESS: Okay. I'll try to 5 take little breaks or something. 6 THE COURT: That would be fine. 7 Thank you. 8 Why don't counsel come up closer. 9 MR. SUSSMAN: Perhaps if I could use 10 the chair next to the phone. 11 THE COURT: That would be fine. 12 13 DIRECT EXAMINATION 14 BY MR. SUSSMAN: 15 Q Miss Herlick, this is Marc Sussman. Can 16 you hear me? 17 A Yes, I can. 18 Q I will ask you my questions now. And if 19 you don't hear it clearly or you don't understand, 20 please let me know. 21 A Okay. 22 Q Miss Herlick, how are you employed? 23 A I'm a Systems Administrator at O'Reilly 24 and Associates. 25 Q How long have you been a Systems 57 1 Administrator at O'Reilly? 2 A I've been a Systems Administrator there 3 for about two and a half years. 4 Q And how long have you been with O'Reilly? 5 A Two and a half years. 6 Q And what is O'Reilly, by the way? 7 A O'Reilly and Associates is a publisher. 8 Q And what kind of publishing does it do? 9 A We publish technical books, things having 10 to do with the Internet. We also now publish 11 mostly technical books. That's kind of our niche. 12 Q You're the Systems Administrator over the 13 computers at O'Reilly, and what type of system is 14 that -- computer system does it use? 15 A We have mostly a UNIX network. 16 Officially a -- it's a UNIX system. Our main 17 workstation, that's the computer that log into 18 that, people log into it. 19 Q Is your computer connected to the 20 Internet? 21 A Yes. 22 Q Was it connect to the Internet in 1993? 23 A Yes. 24 Q Do you have a computer in your system 25 that is called Ruby? 58 1 A Yes. 2 Q Do you know Randal Schwartz? 3 A Yes, somewhat. 4 Q How do you know Randal Schwartz? 5 A Randal is one of our authors and he has 6 an account on Ruby, our main system. I know him 7 because I know everybody that has an account there. 8 Q And you say he's one of your authors. Do 9 you know what kind of books he was writing for 10 O'Reilly? 11 A Yeah. Randal was working on Pearl. 12 Q And what is Pearl? 13 A Pearl is a script memory. It's very 14 commonly used by Systems Administrators. It's new, 15 fairly new language. Like a programming language. 16 Not exactly, but pretty much like one. And Randal 17 was working on a book call Learning Pearl, which is 18 a tutorial to teach people how to use it. 19 Q And did he write any books for you about 20 product design or that specifically dealt with 21 systems security? 22 A No, he did not. 23 Q Now, you mentioned that all of your 24 authors have accounts. What is the policy 25 regarding giving authors accounts? 59 1 A Basically it's opened. If an author 2 needs and account, he gets an account. There is 3 no -- that's it. 4 Q And what does the account give the person 5 access to? 6 A The account, like the typical author 7 account, which would be a gift account, gives you 8 access to e-mail, gives you access to like your own 9 personal area called your home directory. It would 10 give you access -- you can run programs from it, 11 program across the Internet and stuff like that. 12 Also it would give you access to any files on the 13 systems that are accessible by everybody. 14 Q By the way, is a password -- is your 15 password file accessible and readable to everybody 16 who has an account on the system? 17 A Yeah. 18 Q Did Randal Schwartz have an e-mail 19 address at O'Reilly? 20 A Yes. 21 Q And during -- thinking about during the 22 period of, say, prior to November 1st, 1993, to 23 what extent was he using that address at O'Reilly 24 for his e-mail? 25 A Well, I know he was using it for all his 60 1 book-related mail. I'm not sure, but it's possible 2 he was using it for all. 3 MR. TINTERA: Objection. If she's 4 not sure, she can't answer the question. 5 MR. SUSSMAN: Just a minute. There 6 is an objection. 7 THE COURT: I'm sustaining the 8 objection to the last answer and ask to disregard 9 it where the witness said it was possible that he 10 was doing something because that's conjecture. 11 BY MR. SUSSMAN: 12 Q Do you recall whether Mr. -- do you know 13 whether Mr. Schwartz was using his e-mail address 14 for other activities besides simply his 15 communication with O'Reilly about his books? 16 A Do I know 100 percent for sure? No. 17 Q Okay. What is your best recollection? 18 A (Pause.) I don't know. 19 Q Okay. That's fair. 20 Did O'Reilly have any policy 21 restricting the use of the Internet access of -- 22 let me rephrase this first. 23 Did Mr. Schwartz's account on -- at 24 O'Reilly and on Ruby give him access to the 25 Internet? 61 1 A Yes. 2 Q And were there any restrictions on his 3 use of that account to have access to the Internet? 4 A No. 5 Q Now, going back to your responsibilities 6 and duties as a Systems Administrator, does your 7 responsibility as a Systems Administrator involve 8 testing security of your systems? 9 A Yes. 10 Q And when you do that, are there any 11 particular tools or devices that you employ to test 12 your security of your system? 13 A The main ***who we use is a program 14 called Crack, which we run against the password 15 file. It attempts to crack passwords. Basically 16 its purpose is to identify passwords that are 17 easily crackable, not just by me but by anybody who 18 would want to break in. 19 Q And the passwords that are easily 20 crackable, is that something that causes you 21 concern or presents perhaps a liability to the 22 company? 23 A A -- yeah, certainly is. As long as 24 somebody has access to the password file -- first 25 of all, you need to have an account on the system 62 1 to have access to the file. Once you have access 2 to it, we don't want people to be able to figure 3 out each other's passwords or break into each 4 other's accounts. 5 Q So you want to make sure that your 6 passwords are secure? 7 A Yeah. 8 Q Now, did you become aware of an incident 9 in October, that occurred in October of 1993? Did 10 you learn about it sometime after Mr. Schwartz had 11 run a Crack program against the password file at 12 O'Reilly? 13 A Yes. I learned about it, I think, in 14 November, early November. 15 Q And did you have any discussions with 16 Mr. Schwartz about his actions? 17 A Yes. 18 Q Did you discuss the reasons that he was 19 doing this? 20 A Yes. 21 Q And what were those reasons? 22 MR. TINTERA: Objection. Hearsay. 23 THE COURT: Sustained. Don't answer 24 the question. 25 63 1 BY MR. SUSSMAN: 2 Q Did Mr. Schwartz inform you that he was 3 doing this? 4 A No. Before he did it, you mean? 5 Q No. At some point did he inform you that 6 he had done this? 7 A Yes. 8 Q And what actions did you take? 9 A He informed me -- 10 Q What was your response, how did you deal 11 with the situation? 12 MR. TINTERA: Judge, how is that 13 relevant with anything this jury has to decide? 14 THE WITNESS: Is there something 15 going on but I can't tell what it is? 16 MR. SUSSMAN: There is an objection, 17 so hold on for a second. 18 THE COURT: Is that an objection on 19 relevance? 20 MR. TINTERA: Yes, it is. 21 THE COURT: I thought so. 22 Mr. Sussman. 23 MR. SUSSMAN: Your Honor, it will go 24 to show Mr. Schwartz's response, why he was doing 25 this, and so that the jury can understand 64 1 Mr. Schwartz's state of mind, that he was in effect 2 acting to do something that he thought was 3 favorable or helpful to these persons he has an 4 account with and where the State is trying to 5 allege that Mr. Schwartz's activities -- 6 THE COURT: Okay. I understand your 7 argument. I'm sustaining the objection. 8 Don't answer that last question, if 9 you recall what it was. 10 Proceed, Mr. Sussman. 11 BY MR. SUSSMAN: 12 Q Let me rephrase the question. Did you 13 take any action against Mr. Schwartz? 14 A Yes. 15 MR. TINTERA: Objection. It's not 16 relevant. 17 THE COURT: I'm sustaining the 18 objection to that question. Don't answer that 19 question. 20 BY MR. SUSSMAN: 21 Q Does Mr. Schwartz still have an account 22 at O'Reilly? 23 A Yes. 24 Q And does he still -- is he still one of 25 your authors? 65 1 A Yes. 2 Q And does Mr. Schwartz still have an 3 account which allows him access to the Internet 4 through O'Reilly? 5 A Yes. 6 MR. SUSSMAN: Thank you. I have 7 nothing further. 8 THE COURT: There will be some other 9 questions here by the district attorney, if you 10 will wait just a minute. 11 Mr. Tintera. 12 MR. TINTERA: Thank you, Judge. 13 14 CROSS-EXAMINATION 15 BY MR. TINTERA: 16 Q Good evening, Miss Herlick. Is it 17 evening there? 18 A Yes, it is. 19 Q My name is Tom Tintera. I'm with the 20 District Attorney's Office. Could I ask you a 21 couple questions? 22 A Sure. 23 Q As a Systems Administrator, could you 24 tell me what file protection rights are? 25 A Yeah. File protection, that's a way that 66 1 we have of controlling who is allowed access to a 2 particular file. 3 Want me to explain further? 4 Q Well, let me ask the questions. What 5 does "RW" stand for? 6 A Read write. 7 Q What does that allow someone to do? 8 A Read allows somebody to view a file. 9 Write allows somebody to alter a file. 10 Q What does "R" stand for? 11 A Read. 12 Q And if you have the line of RW, R, R, 13 what does that mean? 14 A You mean RW-R--R? 15 Q Okay. 16 A That means -- the way it would work would 17 be RW-R--R--, it would have to go like that in sets 18 of three. The first one there refers to the owner 19 of the file. That's the permission that the owner 20 has. The second refers to the group rights. The 21 person can belong to a group. You can control 22 access to a file according to a group of people. 23 If you belong to that group, then that second 24 triplet, this defines the access that the group has 25 to that file. Then the third triplet refers to the 67 1 access that everybody else has. 2 Want me to explain what that means 3 all together? Basically means that the owner of 4 the file has permission to look at the file and to 5 alter the file. The group owner of the file has 6 permission to look at the file and everybody else 7 has permission to look at the file. 8 Q Now, as a Systems Administrator, if you 9 are running Crack against the password file, would 10 not you restrict the ability for the group or 11 everyone else to read or write that file? 12 A Let me think. I think one time -- this 13 is the kind of thing that I would try out, and I 14 can't say off the top of my head exactly what the 15 results would be, but I think one time fairly 16 recently I tried altering what are the normal 17 permissions on the file and people weren't able to 18 log in. 19 I think that like on the -- on the 20 diversion of the operating system that we were 21 running, these file permissions have to be left 22 wide open or people can't log in. 23 Q If you copy the password file to a 24 different machine, then the original password file 25 remains where it is and people can log in; is that 68 1 correct? 2 A Yes. 3 Q So if you copy it, you could change the 4 file protection rights so that people can't read 5 the passwords you've cracked, isn't that true? 6 A Well, people can't -- the passwords that 7 you crack aren't going to be in the password file 8 anyway, so I'm not quite sure I fully understand 9 the question, I guess. 10 Q Wouldn't you make it so people could not 11 read when you're running the Crack program the 12 results of the program? 13 A Crack default output I didn't -- does not 14 have the same permission as the password file. You 15 have to have special permission to read off of the 16 Crack program. 17 Q So how would you write the file 18 protection rights to read the output of the Crack 19 program? 20 A Well, Crack does it itself. I mean, I 21 typically log in as root and look at the results. 22 If I try to do it myself, I can't see them. 23 Now, if I were -- go ahead. That's 24 it. That's all I know off the top of my head for 25 sure. 69 1 Q So you run the Crack program right on the 2 system as it exists, on the password file; is that 3 correct? 4 A Right. 5 Q You don't copy it somewhere else to run 6 it? 7 A No. 8 Q And as a Systems Administrator, how many 9 times have you found it necessary to go into a 10 different group of computers that you don't 11 administer and copy their password files? 12 MR. SUSSMAN: Your Honor, this calls 13 for -- 14 THE WITNESS: Copy the passwords 15 file? 16 THE COURT: Just a minute, please. 17 Hold on. There is an objection. There has been an 18 objection and I need to rule on this objection. 19 MR. SUSSMAN: I think this question 20 calls for an answer as to speculation and -- 21 THE COURT: What was the question? 22 MR. TINTERA: How many times she's 23 had to go into a system that she did not administer 24 and copy a password file, how many times she's done 25 that. That's not speculation. 70 1 THE COURT: It's not relevant. 2 MR. TINTERA: Yes, it is. She's 3 testifying about what Systems Administrators do and 4 do not do in regard to running Crack. 5 THE COURT: If you want to ask her 6 that question, make it clear to answer it in her 7 duties as a Systems Administrator, I'd allow you to 8 do that. 9 BY MR. TINTERA: 10 Q As a Systems Administrator, how many 11 times have you found it necessary to go into a 12 computer system that you did not administer and 13 copy the password file? 14 A Never. 15 Q So that's not part of your duties as a 16 Systems Administrator? 17 A No. 18 Q Would you agree with this statement: 19 National computer crimes squads estimate that 20 between 85 and 97 percent of computer intrusions 21 are not even detected? 22 A I could only make a guess. I don't know 23 for sure. 24 Q My question is whether you agree with 25 that statement or not. 71 1 A I don't think I have enough information 2 to agree or disagree with it. 3 Q Do you know what a home page is? 4 A Yes. 5 Q Could you tell the jury what a home page 6 is? 7 A A home page is a -- let's see, it's a 8 person -- it's usually, it's like a biographical 9 sketch, automatic biographical sketch that somebody 10 that -- the terminology is they put it up on the 11 web. In other words, they make it accessible to 12 people on the Internet to be able to look at it. 13 And typically it's set up so that if you are a 14 consultant, you would want to put your information 15 there. If you just are -- whatever, whatever you 16 want to make public information, you put in on the 17 home page. 18 THE COURT: Wait a minute now. 19 There is another objection. 20 MR. SUSSMAN: I object to the 21 question. This is beyond the scope of direct and 22 it's not relevant. 23 THE COURT: How is it relevant? 24 MR. TINTERA: It's 25 cross-examination. This is from the home page of 72 1 her company and I'm asking her about information 2 that they put out as a company representative. 3 THE COURT: Well, sure it's 4 cross-examination, how is it within the scope of 5 anything that Mr. Sussman asked? 6 MR. TINTERA: She's been put on as a 7 Systems Administrator, a person who operates the 8 computer system of O'Reilly and Associates. Part 9 of that system -- and we have talked about Internet 10 access, part of that system involves this home page 11 ad and I wanted to ask her about information that's 12 on their home page. 13 THE COURT: Overrule the objection. 14 Proceed. 15 BY MR. TINTERA: 16 Q Miss Herlick, if I understand you, the 17 home page is like a billboard for whoever puts it 18 on the Internet? 19 A Yeah, that sounds right. 20 Q And O'Reilly and Associates has a home 21 page, does it not? 22 A Yes. 23 Q Are you familiar with it? 24 A To tell you the truth, I'm not. I didn't 25 write it and I never have occasion to look at it. 73 1 Q Do you administer it? 2 A No, actually, I don't. 3 Q Are you familiar with the publications 4 that O'Reilly puts out for their books? 5 A Yes. 6 Q Publication for the books? 7 A Somewhat familiar with them, yes. 8 Q Are you familiar with the latest one 9 that's entitled How to Get a Handle on Internet 10 Security? 11 A No. 12 Q Could you tell the jury what password 13 sniffers are? 14 A Password sniffers -- 15 MR. SUSSMAN: Your Honor, this is 16 going way beyond the scope of direct. 17 MR. TINTERA: Hold on. 18 THE COURT: There is an objection I 19 need to rule on again. 20 The objection is beyond the scope? 21 MR. SUSSMAN: Yes. 22 THE COURT: Mr. Tintera. 23 MR. TINTERA: I'm going to tie it 24 back into the efforts that she makes to keep her 25 systems secure. It's access to the Internet and I 74 1 want to ask her what she does to protect herself 2 from these types of -- whatever password sniffing 3 is, it's something used on the Internet and I 4 wanted to know what she does to protect O'Reilly 5 and Associates from this type of intrusion. 6 MR. SUSSMAN: Also object on 7 relevance, Your Honor. 8 THE COURT: Overruled. Go ahead. 9 BY MR. TINTERA: 10 Q Do you know what password sniffers are? 11 A I think so. If they are what I think 12 they are, then yes, I know what they are. 13 Q What do you think they are? 14 A I can't say that I've exactly heard that 15 terminology, but I've heard something similar. 16 Q What type of protection does O'Reilly 17 take to protect itself, if any, to protect itself 18 from intrusion into the Internet? 19 A Well, what little protection we have, we 20 very recently implemented like within the last 21 month or two. And what we have implemented are 22 some filters on our Internet connection on our 23 router that connects us to the Internet. 24 Q Are you involved in that as a Systems 25 Administrator? 75 1 A Yeah, somewhat. 2 Q You just don't have an open system to 3 anybody on the Internet, do you? 4 A We actually are pretty open. I mean, 5 like I said, this is very recently implemented, 6 like within the month before I left, and that was a 7 month ago, so in the last two months. 8 Q I assume that O'Reilly has more than one 9 computer in its group. 10 A That's true. 11 Q Would you agree that if one computer is 12 compromised, it's trivial to compromise the others? 13 A That depends. 14 Q So you would not agree? 15 A Right, I would not agree. 16 Q Did you know that's a statement in your 17 latest publication in regard -- in How to Get a 18 Handle on Internet Security? 19 A No. 20 Q Would you agree with this statement, 21 "Even if your systems are as secure as possible" -- 22 MR. SUSSMAN: Your Honor, now I 23 object. What he's trying to do is impeach this 24 person as though she's an expert witness. She was 25 not called as an expert. It's not relevant and not 76 1 proper cross-examination. 2 THE COURT: Mr. Tintera. 3 MR. TINTERA: She was asked about 4 what Systems Administrators do and how they use 5 Crack. That, in my mind, is a specialized witness 6 about Systems Administration. I should be able to 7 ask -- 8 THE COURT: Overrule the objection. 9 Proceed. 10 BY MR. TINTERA: 11 Q Would you agree with this statement, 12 "Even if your systems are secure as possible and 13 your user passwords are not guessable, you can be 14 ***impacted by a packet sniffer running at any site 15 that your users can log in from or at any site that 16 their packets will cross to get to you"? 17 A Yes, that sounds true. 18 Q Would you agree with this, "Password 19 sniffers may use programs provided for network 20 debugging as building blocks or may be written to 21 use the services directly. Special purpose 22 password sniffing tool kits are widely available to 23 attackers." 24 A I don't know. 25 Q Did you know that is in your publication 77 1 or your company's article on How to Get a Handle on 2 Internet Security? 3 A Nope. 4 Q Did you know that the -- 5 MR. SUSSMAN: Your Honor, again, the 6 problem we have is the witness has testified she 7 wasn't familiar with the article and I object to 8 the -- continuing the line because it's from 9 something that she's indicated that she -- she was 10 not involved with and had no familiarity with 11 and -- 12 THE COURT: Nevertheless, she has 13 been qualified as a Systems Administrator and these 14 questions, I believe, are fair questions of whether 15 or not they have been published in the article that 16 has been written. I'm overruling the objection. 17 MR. SUSSMAN: Your Honor, I just 18 want to clarify one thing. The question that was 19 asked of her is whether she, as a Systems 20 Administrator, did anything to protect certain 21 security, not what Systems Administrators generally 22 do, which is the way Mr. Tintera has argued this as 23 a basis for this line of questioning. 24 THE COURT: Well, it's fair to 25 cross-examine her with regard to the general duties 78 1 of a Systems Administrator, so I'm overruling the 2 objection. 3 Proceed. 4 BY MR. TINTERA: 5 Q Miss Herlick, what is CERT? 6 A CERT, it's an organization that tracks 7 computer security problems. 8 Q The Computer Emergency Response Team? 9 A Yeah, that's it. 10 Q Are you aware that CERT reports that as 11 many as 100,000 sites were targeted by password 12 sniffers in 1994? 13 A I probably read it, but I don't remember 14 exactly. 15 MR. TINTERA: Thank you. 16 THE COURT: Mr. Sussman, additional 17 questions? 18 MR. SUSSMAN: Yes, Your Honor. 19 THE COURT: There will be a few more 20 questions by Mr. Sussman, Miss Herlick. 21 22 23 24 25 79 1 REDIRECT EXAMINATION 2 BY MR. SUSSMAN: 3 Q Miss Herlick, when Mr. Schwartz spoke 4 with you about why he was running Crack, was 5 there -- was it your understanding that this was 6 done to try to break into your system? 7 A No. 8 MR. TINTERA: Objection. Could only 9 be based on hearsay. 10 MR. SUSSMAN: Goes to a state of 11 mind. 12 MR. TINTERA: It's not relevant. 13 MR. SUSSMAN: State of mind of 14 exactly what is at issue in this case. 15 THE COURT: It's a state of mind of 16 a different kind. 17 MR. SUSSMAN: But circumstantial 18 evidence of that and this is contemporaneous. 19 Mr. Tintera has brought up the question about CERT 20 and we have had testimony from the State's witness 21 that CERT was involved initially in contacting 22 O'Reilly about this activity. 23 THE COURT: I'm sustaining the 24 objection. The jury will disregard the last answer 25 by the witness. 80 1 MR. SUSSMAN: Your Honor, that would 2 conclude my questions. I'd like to make an offer 3 of proof when we're finished. 4 THE COURT: Do you need to have the 5 witness for the offer of proof? 6 MR. SUSSMAN: Yes, we will. We can 7 make that outside the presence of the jury. 8 THE COURT: Do you have any other 9 witnesses here available now or could we just break 10 for lunch and start about 1:15? 11 MR. SUSSMAN: The one witness I have 12 available is Alan Watson from the Sheriff's Office 13 and his testimony will take longer than 15 minutes. 14 THE COURT: Okay, ladies and 15 gentlemen of the jury, you can take your noon 16 recess. What I will have you do is, I'll have you 17 removed to the jury room just for a minute and then 18 I'll tell Lynda when I want you to go. But an 19 offer of proof requires the Court to listen to 20 evidence and I don't want you to be excused until 21 I've done that. You'll be removed and as soon as 22 Lynda lets you go, we'll be in recess until 1:30. 23 Remove the jury, but have them stay 24 in the jury room. 25 81 1 (Whereupon, the following 2 proceedings were held in 3 open court, out of the 4 presence of the jury:) 5 THE COURT: Mr. Sussman. Questions. 6 The record will show the jury has been removed. 7 This is your offer of proof. Go 8 ahead. 9 MR. SUSSMAN: Thank you, Your Honor. 10 11 OFFER OF PROOF 12 BY MR. SUSSMAN: 13 Q Miss Herlick, would you tell us how you 14 learned that Mr. Schwartz had run the Crack 15 program -- run a crack program on the password 16 files from O'Reilly? 17 A Okay. How I learned about this. I was 18 in California at a conference and somebody came up 19 to me in the middle of the day and said the FBI 20 just called, somebody broke into Ruby. So I 21 immediately had a fit because I was pretty new at 22 my job and I was in California and there wasn't 23 anything that I could do from there, so I just sort 24 of fretted about it. And people at home, somebody, 25 the guy whose job who I replaced was still around 82 1 and he did a couple things. 2 Anyway, what finally happened was I 3 heard later on that day or very early the next 4 morning, within a day at least, I got news from the 5 Cambridge office where I work that it was Randal 6 who broke in. That's how it was worded. 7 And then I saw Tim O'Reilly the next 8 morning and I was going to talk to him about it and 9 he had a funny look on his face like he knew 10 something. And when I told him I thought I knew 11 what had happened, he said that Randal had called 12 him and told him what was going on was that he was 13 the one that whatever and -- 14 Q So Mr. Schwartz contacted O'Reilly? 15 A Yes, right away. And he called me in the 16 Cambridge office. I wasn't there. I'm pretty sure 17 the same day that I got the news about the FBI with 18 a very -- nobody called. Never got a call from the 19 FBI. And anyway, I called him. He must have 20 called Tim like that night or in California, but 21 right away. 22 Q Now, after you learned about this, did 23 you eventually -- did you actually speak to 24 Mr. Schwartz about his using -- cracking the 25 passwords from the O'Reilly password file? 83 1 A I did talk to him. 2 Q And did you talk with him about why he 3 had done this? 4 A Yes, I did. 5 Q And what was his response? 6 A He said that he was -- I'm trying to 7 remember exactly, something like he was kind of 8 testing things out and he was curious to see how we 9 were maintaining our password security. And after 10 talking to him, I reinstated -- reinstated his 11 account. I had previously closed his account. 12 Q Why did you reinstate the account? 13 A Because I didn't think that what he had 14 done was so serious. And he was very up-front 15 about everything and I could kind of relate to 16 his -- I could kind of relate -- being a Systems 17 Administrator, I could kind of relate to what he 18 was trying to do, so that's why I did it. 19 And after talking with him, I really 20 didn't think that it was such a big deal, so I 21 reinstated his account. 22 MR. SUSSMAN: Thank you. 23 Your Honor, again, the -- my 24 argument is twofold. The evidence would be 25 objectionable to hearsay if it's being offered 84 1 strictly for the truth of the statements, but they 2 are also offered to show, as I've indicated, to 3 indicate Mr. Schwartz's state of mind. But also 4 Mr. Tintera has opened the door on this as proper 5 redirect when he started questioning Miss Herlick 6 about how she, as a Systems Administrator, would 7 handle probings from the Internet in attempts to 8 crack the passwords file. 9 And so it becomes proper redirect 10 based on that line of questioning and it also has 11 the additional relevance then. 12 THE COURT: Mr. Tintera. 13 MR. TINTERA: Judge, it is just -- 14 this has nothing to do with the case. In fact, the 15 defense filed a motion in limine to keep this -- 16 keep me from bringing this up in front of the jury, 17 which I did. That was one of their parts that they 18 didn't want to testify to. 19 THE COURT: About him running a 20 crack program against O'Reilly? 21 MR. TINTERA: Yes. 22 THE COURT: I recall that we 23 discussed -- you haven't offered any evidence to 24 that. 25 MR. TINTERA: I've tried not to. 85 1 THE COURT: I didn't ask whether you 2 tried. 3 MR. TINTERA: I don't think I have. 4 Now they're trying to bring in the defendant's 5 statements, which are hearsay, his state of mind in 6 regard to the O'Reilly case, which is not charged, 7 has nothing to do with the Intel case. 8 THE COURT: Mr. Sussman, is there 9 any indication that somewhere in the State's case 10 witnesses have talked about the defendant's conduct 11 in Cracking the password file at O'Reilly and 12 Associates? 13 MR. SUSSMAN: My recollection was 14 that was brought up during Detective Lilley's 15 testimony. And I would have to check my notes, but 16 when we were dealing with the motion in limine, it 17 was my recollection that the motion that the State 18 was going to be allowed to offer the evidence about 19 O'Reilly and James Deeble, the Tektronix book 20 incident, because they were contemporaneous and 21 showed the entire picture of what was happening at 22 that particular time. 23 What was not allowed was to be prior 24 acts involving ***Tandem and Tektronix, unless we 25 opened the door to that in our case. 86 1 THE COURT: I see here now, I'm 2 looking at this appendices that was supplied to me 3 when we were having argument on those issues, 4 Appendix A, first page, down -- Detective Lazenby's 5 testimony Item No. 2 reads, "Mr. Schwartz discussed 6 the use of the Crack program on the O'Reilly 7 system," and I wrote down "admissible." Did 8 Lazenby testify on that point today? 9 MR. TINTERA: No. I misunderstood 10 my notes. I did not ask him about that because I 11 put "okay" by it and I had assumed that meant that 12 the defendant's motion was okay and therefore not 13 to ask about it. 14 THE COURT: Now, nevertheless, 15 Mr. Sussman, you believe that Detective Lilley 16 talked about that? 17 MR. SUSSMAN: That is my 18 recollection. I do recall it being brought up and 19 I have a note here that there was some testimony 20 by -- certainly in Mark Morrissey's testimony, he 21 had talked about the password file from O'Reilly 22 being run with the Crack program as well. 23 Detective Lilley's testimony stuck in my mind, 24 but -- 25 THE COURT: I didn't see it there, 87 1 but -- 2 MR. SUSSMAN: But I don't see it in 3 my notes, which are incomplete, but it is in the 4 notes about Mark Morrissey's testimony. That was 5 in Mark Morrissey's testimony, he had testified 6 about going to the area of the -- where the Crack 7 program was running and he found it running in the 8 password file on O'Reilly. 9 THE COURT: And that was brought out 10 by Mr. Tintera, you believe? 11 MR. SUSSMAN: Yes, Your Honor. 12 THE COURT: Do you recall when that 13 was? Was that on -- initially on direct or 14 redirect or -- 15 MR. SUSSMAN: It was initially on 16 direct. 17 MR. TINTERA: Judge, my notes 18 indicate that he talked about the password file for 19 O'Reilly in the Supercomputer Division being on the 20 Snoopy computer. And that was in response to one 21 of my questions. 22 THE COURT: That was after they 23 found the Crack program running and they went to 24 his workstation, is that it? 25 MR. TINTERA: When he was talking 88 1 about the Snoopy computer. 2 THE COURT: When who was? 3 MR. TINTERA: On ***October 28 there 4 was a program running Crack and password file 5 existed from O'Reilly and the Supercomputer 6 Division. 7 THE COURT: I may not have written 8 that down. 9 Okay, I've sustained the objection. 10 You've made your offer of proof. It is a part of 11 the record. I'm not changing or modifying my 12 ruling. 13 We are in recess and -- 14 MR. SUSSMAN: Thank you, Your Honor. 15 Miss Herlick -- 16 MR. TINTERA: I don't have any 17 recross. 18 MR. SUSSMAN: Thank you very much. 19 That's the end of our testimony. 20 THE COURT: Thank you, Miss Herlick. 21 THE WITNESS: Thank you. You're 22 welcome. Bye-bye. 23 THE COURT: Thank you. We're in 24 recess until 1:30. 25 (Luncheon recess.) 89 1 AFTERNOON SESSION 2 BEGINNING AT 1:35 P.M. 3 JULY 19, 1995 4 5 (Whereupon, the following 6 proceedings were held in 7 open court, the jury being 8 present:) 9 THE COURT: Mr. Sussman, you may 10 call your next witness. 11 MR. SUSSMAN: We'd call Rick 12 Lahrson. 13 14 RICK LAHRSON 15 called as a witness on behalf of the Defendant, 16 having been first duly sworn under oath, was 17 examined and testified as follows: 18 19 THE CLERK: State your full name and 20 spell it for the record, please. 21 THE WITNESS: Rick Lahrson. 22 L-a-h-r-s-o-n. 23 24 25 90 1 DIRECT EXAMINATION 2 BY MR. SUSSMAN: 3 Q Where do you live? 4 A In Hillsboro. 5 Q How long have you lived in Hillsboro? 6 A Lived in Aloha 22 years and moved here a 7 year and a half ago. 8 Q What's your occupation? 9 A Computer consultant. 10 Q That covers a lot of things. What kind 11 of work do you do? 12 A Custom software and high-tech stuff, 13 mostly compilers. 14 Q Compilers? 15 A Those are language translators. 16 Q Now, do you know Randal Schwartz? 17 A Yes. 18 Q How do you know Randal Schwartz? 19 A We're friends. 20 Q How long have you known him? 21 A Probably around 15 years. 22 Q Now, has your association been strictly 23 friendly or through work or what areas? 24 A We haven't actually worked together in 25 computers. We're friends. We have worked together 91 1 in community service projects. Started a 2 charitable corporation together. 3 Q You and he share an interest in computers 4 and work that you talk about? 5 A Yes. We haven't worked together, but we 6 do understand each other's work and we talk about 7 that, sure. 8 Q Now, you mentioned that you and he set up 9 a charitable corporation, a community service 10 project together. How long were you and he 11 involved in this project together? 12 A Several years. I really don't know how 13 many. At least three. 14 Q How long ago was this? 15 A It was start in 1987. 16 Q And what was Mr. Schwartz's role and your 17 role in this project? 18 MR. TINTERA: Objection. Not 19 relevant. 20 MR. SUSSMAN: Just to lay the 21 foundation for the basis of the witness' opinion as 22 to character, Your Honor. 23 THE COURT: Overruled. Go ahead. 24 THE WITNESS: Say the question 25 again, please. 92 1 MR. SUSSMAN: Sure. 2 BY MR. SUSSMAN: 3 Q What was first your role, just in general 4 terms about your responsibilities in your role in 5 this charitable corporation that you were referring 6 to? 7 A Oh, I had the idea to start it and needed 8 help doing it. There was material to be written. 9 Randal is a writer, he's a friend, and I know that 10 he's concerned about the welfare of kids and the 11 general state of the world. So I asked him to help 12 me and he jumped on it. 13 Q Was his involvement limited to writing 14 things? 15 A No. He contributed ideas, too. 16 Q And anything else? 17 A He was my right hand on that. 18 Q Now, based upon your association with 19 Mr. Schwartz over the years and your conversations 20 with him and your work in this charitable 21 organization, do you have an opinion regarding 22 Mr. Schwartz's character for trustworthiness and 23 honesty? 24 A Yes. 25 Q And what is that opinion? 93 1 A I think he's a man of the highest 2 integrity, unimpeachable. 3 MR. SUSSMAN: Thank you. Nothing 4 further. 5 THE COURT: Mr. Tintera. 6 MR. TINTERA: Thank you, 7 Mr. Lahrson. I don't have any of questions for 8 you. 9 THE COURT: Thank you. You may step 10 down. 11 Call your next witness. 12 MR. SUSSMAN: We'd like to call 13 Allen Watson. 14 15 ALLEN WATSON 16 called as a witness on behalf of the Defendant, 17 having been first duly sworn under oath, was 18 examined and testified as follows: 19 20 THE CLERK: State your full name and 21 spell it for the record, please. 22 THE WITNESS: Allen Watson. 23 A-l-l-e-n W-a-t-s-o-n. 24 25 94 1 DIRECT EXAMINATION 2 BY MR. SUSSMAN: 3 Q Mr. Watson, how are you employed? 4 A I'm employed by the Washington County 5 Sheriff's Office. 6 Q In what capacity? 7 A Right now I'm assigned to the Detective 8 Division, Crime Analysis and Technical Support. 9 Q And what's involved in the Crime Analysis 10 and Technical Support? What responsibilities do 11 you have there? 12 A Basically, our task is to utilize 13 computers to attempt to develop crime trends and 14 then try to allocate man resources to those trends. 15 Also engaging compu