1 IN THE CIRCUIT COURT OF THE STATE OF OREGON 2 FOR THE COUNTY OF WASHINGTON 3 4 STATE OF OREGON, ) ) 5 Plaintiff, ) ) 6 vs. ) No. C940322CR ) 7 RANDAL LEE SCHWARTZ, ) ) 8 Defendant. ) Volume 9 9 10 11 TRANSCRIPT OF PROCEEDINGS 12 13 BE IT REMEMBERED THAT on the 19th 14 day of July 1995, the above-entitled matter came on 15 for Hearing before the HONORABLE ALAN C. BONEBRAKE, 16 a Circuit Court Judge. 17 18 APPEARANCES 19 Thomas J. Tintera Washington County Deputy District Attorney 20 Representing the State of Oregon 21 Marc Sussman Attorney at Law 22 Representing the Defendant 23 24 25 2 1 MORNING SESSION 2 BEGINNING AT 9:30 A.M. 3 JULY 19, 1995 4 5 (Whereupon, the following 6 proceedings were held in 7 open court, out of the 8 presence of the jury:) 9 THE COURT: Good morning. Who has a 10 matter for the Court? 11 MR. TINTERA: I do, Your Honor. 12 Good morning. 13 THE COURT: Mr. Tintera. 14 MR. TINTERA: Judge, what Mr. Reilly 15 testified yesterday, he testified to the 16 truthfulness of the defendant. My reading of Rule 17 608 of the Evidence Code, that's improper, as 18 truthfulness has not been attacked by witness or 19 otherwise in this particular case. 20 The necessary foundation for the 21 application of 608 have not been met. They involve 22 witnesses. That hasn't happened in this case. 23 There is no occasion for any other witness to talk 24 about the truthfulness of the defendant, the 25 necessary preambles have not been met by the 3 1 defense, and I object to any testimony by any 2 witnesses in regard to the defendant's truthfulness 3 unless the prerequisites of Rule 608 have been 4 accomplished or put in motion, actually. 5 Some of them can be accomplished by 6 the defense, but some are put in motion by the 7 State through its questioning of witnesses. 8 THE COURT: Mr. Sussman. 9 MR. SUSSMAN: Your Honor, my 10 recollection was that I asked Mr. Reilly about his 11 opinion of the defendant's character for honesty. 12 I did not specifically ask him about his opinion of 13 his character for truthfulness. I think those are 14 two separate character traits, honesty generally 15 being an issue where one of the counts involves an 16 allegation of intent is an action with the intent 17 to commit theft. 18 The character for truthfulness is a 19 separate character. Closely related, it is 20 somewhat different and I do not believe that I 21 specifically asked Mr. Reilly for an opinion as to 22 Mr. Schwartz's character for truthfulness because 23 that was not at issue at the time. 24 However, even if there was some 25 concern about overlap, I believe that there is some 4 1 authority -- checking my notes here, I think there 2 is some authority under the federal rules involving 3 the application of equivalent of 608, which would 4 even allow me to ask the witness before 5 Mr. Schwartz testified if the witness, knowing the 6 person, knowing this defendant, knowing about their 7 reputation for truth and veracity, could ask the 8 witness if Mr. Schwartz testified and were to take 9 an oath to testify would they believe him, and that 10 was a line of questioning specifically allowed in 11 United States v. Walker, 10th Circuit case at 313 12 F2d 236, and similarly in United States v. 13 ***Van Bulis, 471 F2d 501, 504, Second Circuit 14 case. 15 That wasn't what we got to. It was 16 a different character for honesty. I think that's 17 distinct and because the character -- the charge 18 involves an accusation of a crime with an intent to 19 commit theft, that that was appropriate perfect 20 character trait to ask the witness about. 21 THE COURT: Mr. Tintera. He says he 22 didn't ask about truthfulness. 23 MR. TINTERA: He asked about honesty 24 and trustworthiness is what I wrote down. And if 25 they are drawing a distinction there, 5 1 trustworthiness and truthfulness sound pretty close 2 to me. And if honesty and trustworthiness are the 3 same, then I would ask the Court to -- let's define 4 what type of character trait the theft allegation 5 brings in and -- anticipate a number of witnesses 6 going into these areas and I need some -- 7 THE COURT: Sure. Well, here is 8 what I think. Honesty probably okay. 9 Trustworthiness starts to sound like truthfulness. 10 I know we're splitting hairs. We have to draw a 11 line somewhere. 12 With regard to your latter point, 13 Mr. Sussman, because I'm getting to be an old 14 timer, there was a time under Oregon law before we 15 had the Evidence Code where it was a common 16 practice to do just exactly what you suggested is 17 permitted under the federal law in some areas, and 18 that is the rule was generally that in any criminal 19 case, in any criminal case, the defendant's 20 character for truthfulness had been attacked just 21 simply by the filing of the charging document and 22 so the defendant could then bring in evidence of 23 good character for truthfulness and veracity. 24 Somehow when this Evidence Code got 25 enacted, they changed the rule and they didn't 6 1 comment on that at all. I know because I -- I 2 guess there is two reasons I know the prior law. 3 One was I went to the U of O law school behind 4 Orlando John Hollis who was dean, and Dean Hollis 5 was never wrong on anything, if you asked him. And 6 he drilled into us what that was, what the rule 7 was. And when I got out in the real world, that's 8 what the practice was. 9 I accepted that as a prosecutor and 10 as defense attorney, I used it commonly in nearly 11 every criminal case, the defendant produced 12 evidence of good character for truthfulness without 13 first having it attacked. 14 The rules are to the contrary now in 15 the Evidence Code. If you look in the comments, 16 you don't find anything about what the prior law 17 was and the rules have changed. That's all that's 18 happened, they've changed. 19 Whoever -- well, I know who wrote 20 the Evidence Code. I don't know why Judge Unis and 21 Jones, who were the primary sponsors of this in the 22 legislature, chose to adopt this rule that 23 substantially changed the evidence law in Oregon 24 without commenting on it, but that's what happened. 25 I accept. I didn't at first, but I do now. 7 1 The law is written and it's the law 2 that we follow and that is that first the State has 3 to attack the character of your client for 4 truthfulness and veracity before you can produce 5 evidence of good character for truthfulness and 6 honesty, veracity, believability. That's the rule 7 I'm going to follow on that. 8 With regard to other pertinent 9 character traits, in a charge of theft, a good 10 character for honesty. 11 MR. SUSSMAN: Honesty. 12 THE COURT: If we are talking about 13 something that's the opposite of being a thief, I 14 guess that's it, unless someone can think of 15 another word that better fits that category. I'd 16 permit you to bring out -- typically in cases 17 involving fraud, deceit, dishonest conduct, theft, 18 that sort of thing, it's permitted under the 19 Evidence Code to bring in evidence of a character 20 trait to offset that. Honesty probably doesn't. 21 Trust does it. Trustworthiness begins to sound 22 like truthfulness. 23 MR. SUSSMAN: Except that part of 24 the peculiarities of this case is we have a 25 situation that arises in the context of a person 8 1 working within the system where he has access to 2 security and the means to take advantage of those, 3 that access and -- 4 THE COURT: It's no different than a 5 clerk working at Nordstrom being -- having access 6 to -- 7 MR. SUSSMAN: It's similar and in 8 that particular case, either the characteristic of 9 trustworthiness is sort of linked to honesty, in 10 other words, can this person be trusted with 11 sensitive -- 12 THE COURT: I understand. 13 Mr. Tintera, anything else? 14 MR. TINTERA: I don't see a 15 distinguishment between the two, Judge. I think 16 that honesty may be raised by an allegation of 17 theft, but I don't -- the actual allegations, which 18 is what is required by the Evidence Code must 19 raise, I suppose trustworthiness with the 20 allegations that don't involve anything about him 21 selling or disseminating the information. 22 THE COURT: Well, you've alleged 23 that he had the purpose of doing that, of stealing. 24 MR. TINTERA: That he did steal. 25 We're alleging that he stole it. 9 1 THE COURT: That's not what the 2 indictment says. 3 MR. TINTERA: Yes, it is. That he 4 committed theft of the password file, then theft of 5 the individual passwords. 6 THE COURT: Well, the language says 7 that he unlawfully and knowingly accessed and used 8 a computer for the purpose of committing theft. 9 MR. TINTERA: Finish the sentence. 10 THE COURT: For the purpose of 11 committing theft of Intel's SSD password files. 12 MR. TINTERA: Right. 13 THE COURT: All you have to do is 14 that he accessed it for that purpose. You don't 15 have to prove a complete theft. A complete theft 16 certainly would be, if you could prove it, good 17 evidence of a person's purpose. 18 It's like -- I looked at this 19 statute, I've been thinking about this because it's 20 a novel case. Count 1 looks to me like criminal 21 mischief involving a computer. Counts 2 and 3 look 22 like burglary. 23 MR. TINTERA: Right. 24 THE COURT: Although the statute 25 doesn't say you committed an act with the intent to 10 1 commit, it says you committed an act, trespass to 2 somebody's computer for the purpose of committing 3 another crime, theft. 4 I don't know why the legislature 5 didn't use "intent" instead of "purpose," but 6 nevertheless, looks to me like the logical 7 inference of this crime could be completed if one 8 commits the act of accessing a person's computer or 9 computer network for the purpose of theft. 10 MR. TINTERA: Well, I agree with 11 you, Judge, but I'm having a hard time 12 distinguishing between a character trait for 13 honesty and character trait for trustworthiness. 14 THE COURT: Well, they are probably 15 not much different. Truthfulness -- here is the 16 way we're going to do it. I want you to talk to 17 your witnesses, Mr. Sussman. I don't want them to 18 say, "Oh, yeah, I believe anything he said," 19 because that's clearly not at issue yet because the 20 State hasn't challenged yet his character for 21 truthfulness and veracity. 22 I think it's fair game, though, for 23 them to give a background, that they worked with 24 him, employed him, let him have access to their 25 property, whatever, and they believe and they have 11 1 an opinion, if they do, that he is an honest person 2 and he's trustworthy in the context of having 3 access to their goods, property, valuables, that 4 sort of thing. 5 If we do it that way, I will 6 overrule the objections. But if you start -- 7 typically the witnesses get up here, you ask the 8 question, and we run into this frequently in 9 criminal cases where they answer the question wrong 10 and that means you need to talk to them in advance, 11 and that is clearly they may not answer the 12 question with an answer that says, "Yes, I believe 13 him. If he said it, it's true," that sort of 14 thing. "He has good character for truthfulness." 15 What they may answer the question -- 16 how they may answer the question has to do with his 17 character for honesty and trustworthiness with 18 regard to property rights and that sort of thing. 19 Do you understand that distinction 20 I'm making? 21 MR. SUSSMAN: I do. 22 THE COURT: If you talk with your 23 witnesses, it will make it go easier. And that's 24 how I intend to handle it. 25 Anything else? 12 1 MR. SUSSMAN: Before we bring the 2 jury out, though, we do have the logistics problem 3 of the witness who is -- with the time differences 4 we're calling in Israel. And I know the State has 5 one last witness and I'm just concerned if we wait 6 to take that, we're going to be running into a 7 period where it's like -- 8 THE COURT: That witness is only 9 available today? 10 MR. SUSSMAN: This is the last day 11 this witness is available and this morning we're 12 talking about a time difference of ten hours, so -- 13 THE COURT: I want to let the State 14 rest before we do that. You have to work with that 15 witness. The witness will have to take some 16 No-Doze or something. Take a nap and testify about 17 midnight Israel time. But I don't want to 18 interrupt the State's case again to take the 19 testimony of another witness by telephone. I want 20 to get the State's case done. I think we can work 21 around that. Thank you. 22 Bring in the jury. Let's proceed. 23 24 25 13 1 (Whereupon, the following 2 proceedings were held in 3 open court, the jury being 4 present at 9:50 a.m.:) 5 THE COURT: Good morning, everyone. 6 I think when we finished last night, 7 Mr. Tintera was still calling witnesses. So 8 Mr. Tintera, call your next witness. 9 MR. TINTERA: Paul Lazenby. 10 11 PAUL LAZENBY 12 called as a witness on behalf of the State, having 13 been first duly sworn under oath, was examined and 14 testified as follows: 15 16 THE CLERK: State your full name and 17 spell it for the record, please. 18 THE WITNESS: Paul Lazenby. 19 L-a-z-e-n-b-y. 20 21 22 23 24 25 14 1 DIRECT EXAMINATION 2 BY MR. TINTERA: 3 Q Mr. Lazenby, who do you work for? 4 A Washington County Sheriff's Office. 5 Q And what do you do for them? 6 A I'm a detective. 7 Q And in the course of your duties with the 8 Sheriff's Department, did you assist in the 9 execution of a search warrant on November 1st, 10 1993, at the home of Randal Schwartz? 11 A Yes, I did. 12 Q And could you tell the jury what you did 13 during the execution of the search warrant? 14 A I interviewed Mr. Schwartz shortly a 15 couple times and then I helped bag and tag and -- 16 all the computer stuff that we received. 17 Q Do you know, was there a period of time 18 when you spoke to Mr. Schwartz? 19 A Yes. 20 Q Were you -- do you know who the first 21 police officer to interview Mr. Schwartz was? 22 A Myself. 23 Q And who was present when you initially 24 talked to Mr. Schwartz? 25 A Myself and Mr. Schwartz the first time. 15 1 Q So you were one-on-one? 2 A Yes. 3 Q And where did that conversation take 4 place? 5 A In the back room at the end of the 6 hallway. 7 Q And that was after he was advised of his 8 constitutional rights? 9 A Yes. 10 Q Before questioning Mr. Schwartz, did you 11 give him any information about why you were there? 12 A Yes. 13 Q What did you tell him? 14 A Well, he had been told by Detective 15 Lilley where he was read a copy of the search 16 warrant and stuff and I introduced myself in the 17 back room and asked -- and we talked about the 18 incident, to start with. 19 Q What information did you give 20 Mr. Schwartz initially? 21 A When we first started talking? 22 Q Yes. 23 A I believe nothing. I just asked him -- I 24 told him that I had some questions for him and -- 25 Q Tell the jury what happened. 16 1 A He admitted to me that he had been using 2 the program called Crack to get passwords and that 3 he had obtained what he thought was 10 to 12 4 passwords. Our concern was how many passwords were 5 out there and where they were at. He advised me 6 that they were on the Snoopy program in a 7 subdirectory ***underplay under stuff.tar. 8 I then asked Randal if he felt he 9 was doing anything wrong in doing that and he told 10 me that he knew he was, in fact, violating Intel 11 policy and he thought there was a possibility that 12 he could be criminally prosecuted for that. 13 Want me to continue? 14 Q Hold on. 15 Was there a period of time during 16 this conversation that you asked Mr. Schwartz if he 17 had done anything wrong? 18 A Yes. 19 Q And before you did that, what type of 20 information did you provide him? 21 A Basically nothing. I just asked him to 22 tell me -- I told him what we're here for, because 23 of the passwords and stuff you'd be getting and -- 24 Q Okay. What did you tell him about why 25 you were there? 17 1 A That we wanted to make sure there was no 2 information that was missing from the systems at 3 Intel and why he was using the programs to access 4 passwords. And that's when he told me where the 5 passwords were and that he had been using Crack, 6 and that's about it. 7 Q So when you asked him if he had done 8 anything wrong, what was his response? 9 A He told me he knew he was, in fact, 10 violating Intel policy and that he possibly could 11 be criminally prosecuted for it. 12 Q After you received the location of where 13 the cracked passwords were kept, what did you do? 14 A I went back out and advised the people 15 from Intel there, they called over because they had 16 somebody on the machine, to check that out to see 17 how many passwords there were. 18 Q And then what happened? 19 A We found out there was 40 to 50 passwords 20 that had been taken. And because of that, I went 21 back into confront him on that issue because I was 22 concerned. 23 Q And when you went back in, who was 24 present with Mr. Schwartz at this time? 25 A Detective Lilley and I believe some of 18 1 the people from Intel, they were in the process of 2 starting their interview. 3 Q So the first interview was just you and 4 Mr. Schwartz? 5 A That's correct. 6 Q And then you went back in and there were 7 more people present? 8 A Yes. 9 Q And what was the conversation that you 10 had with Mr. Schwartz at this point? 11 A I -- I confronted him with the fact that 12 he had told me there was 10 to 12 and that we had 13 found 40 to 50, and that was a pretty big 14 discrepancy. And he told me at that time, "I don't 15 remember how many exactly because I was just 16 sticking them under the stuff.tar and not really 17 using them." 18 Again I asked him why he would need 19 40 to 50 passwords if he was only doing what he 20 said he was doing, why would he need 40 to 50. He 21 said, "I needed them in case they caught me doing 22 it and knew they would shut me down, so the more 23 passwords I had, the longer I could continue doing 24 what I wanted to do." 25 Q Did you write a report about your 19 1 interview with Mr. Schwartz? 2 A Yes. 3 Q And when did you write that report? 4 A That evening when I got back. 5 Q And contemporaneously with the interview, 6 were you taking any notes? 7 A I took a few notes. I took down some 8 quotes that he made and included those in my 9 report. 10 Q And when you were talking to him about 11 the 40 or 50 passwords, did you take down exactly 12 in place of quotation in your report anything that 13 the defendant said? 14 A Yes. 15 Q Could you tell the jury what his exact 16 words -- 17 A "I needed them in case they caught me 18 doing it and knew they would shut me down. So the 19 more passwords I had, the longer I could continue 20 doing what I wanted to do." 21 Q What did he say after that? 22 A He basically advised me that he had the 23 capability to do it and he knew he could do it. 24 Q And then did you ask him about his 25 knowledge of it being wrong? 20 1 A Well, because of that statement, I again 2 asked him about the -- if he knew it was wrong and 3 in violation of Intel policy. And I wrote down 4 exactly what he said at that point. 5 Q How did he respond when you asked him 6 about if he knew it was in violation of Intel 7 policy? 8 A He said, "Yes, it is, but I knew I could 9 do it anyway." 10 Q Is that in quotes in your report? 11 A Yes, it is. 12 Q Why? 13 A Because of the way he said it to me, I 14 put it in -- I wrote it down exactly because of the 15 way he said it. 16 Q And then what did you talk with 17 Mr. Schwartz about? 18 A Then we discussed -- he told me about he 19 wanted to be -- he wanted to do it because it was 20 efficient in getting his e-mail very fast and it 21 was important. And when they would shut him down, 22 he wanted to continue doing what he wanted to do, 23 and so that's why he was doing it. 24 Q Did he ever tell you that he sought 25 permission to do this? 21 1 A No. He told me he did it without 2 permission. 3 Q Did you talk about his history of running 4 the Crack program at the Intel division? 5 A Yes. 6 Q When you were talking about the Crack, 7 were you talking about the cracking of the 8 Supercomputer Division password file? 9 A Yes. 10 Q Did you talk to him about his prior use 11 of the Crack program at the Intel Corporation? 12 A Yeah. He actually started telling me 13 about that, so we discussed that. 14 Q What did he tell you? 15 A He told me about one to two years ago 16 that he was a Systems Administrator at Intel with 17 the SSD and that he would run the Crack program 18 back then. He advised me that it was a tool used 19 to keep passwords honest and he said that if you 20 can break it with Crack, bad guys could do it, too. 21 I asked -- I then told him if he 22 knew this and it was used for a security measure 23 back then, why was he doing it without 24 authorization now. And he advised me that he knew 25 it was totally wrong and could get in trouble if 22 1 caught doing it. I again asked him if he 2 remembered using Crack. 3 Want me to continue on that? 4 Q Of his other use of Crack? 5 A Yeah. 6 Q Let me check. 7 No. Let's stop with the Intel 8 Corporation. 9 Well, besides the quoted material, 10 did you take any extra care to memorialize or keep 11 what the defendant told you correct? 12 A Yeah. I put it into quotes, those 13 statements that really impacted me from the way he 14 said them to me. 15 Q Did he ever go -- did you ever talk to 16 him about the gate program? 17 A I think -- yes. Well, I asked him when 18 he first got caught doing it, and that was back 19 during the first interview, and he advised he first 20 had the gate program on the Mink computer and he 21 was caught and confronted by supervisors. 22 Q Is that his word or your word? 23 A That's his word, because I didn't know 24 anything about that stuff. He was telling me this 25 and I asked him when he first got caught and he 23 1 started telling me about that. 2 Q Okay. 3 A He then said he stopped using Mink and 4 switched over to gate -- to Hermeis and was doing 5 that, but Hermeis was too slow so he went back to 6 Mink. And he said he was caught again on Mink, so 7 he switched gate over to Brillig. Then he told me 8 his log on was Merlin. 9 Q Was there any conversation as to whether 10 he had used any of the cracked passwords for the 11 Supercomputer Division files? 12 A Yes. 13 Q And what was that? 14 A He told me that he had used one password. 15 He'd only logged in and out one time, but later 16 told me it was two to three times. And he said he 17 never copied anything or looked at anything. And I 18 asked him if he could remember any of the passwords 19 and the only one he could remember was Ron B. 20 MR. TINTERA: Thank you, Detective 21 Lazenby. I don't have any other questions. 22 MR. SUSSMAN: Your Honor, before I 23 start, may I have a moment? I have an exhibited 24 that I need to locate. 25 THE COURT: Sure. 24 1 MR. SUSSMAN: Your Honor, may we -- 2 we may need a moment or two to locate a document, 3 so perhaps we need to recover it from the Court 4 file and maybe it would be better to have the jury 5 out. 6 THE COURT: We need to get some 7 documents, ladies and gentlemen. We'll remove you 8 for a minute. Take a short break until we get 9 everything ready. 10 (Whereupon, the following 11 proceedings were held in 12 open court, out of the 13 presence of the jury:) 14 THE COURT: What's the problem, we 15 don't have an exhibit? 16 MR. SUSSMAN: I thought we had the 17 search warrant affidavit filed as an exhibit during 18 the motions hearing. That's not separately in the 19 files as an exhibit and I -- that I wanted to use 20 during cross-examination. 21 THE COURT: Get that at the clerk's 22 office. 23 MR. SUSSMAN: Well, there is 24 attached to a -- if I could just grab it from the 25 file. 25 1 THE COURT: Let's talk about that -- 2 the telephone conference, the telephone testimony. 3 I'm not sure how audible the voice 4 on the phone is going to be for the jury, so the 5 procedure I think we should follow is to have -- 6 once we get there is to have the jury taken out, 7 place the call, explain the circumstances to the 8 witness and have the witness speak up and we'll see 9 how audible the voice is to the jury box and then 10 we'll have to take it from there, but I think we'll 11 kind of do a test before we do that. 12 MR. TINTERA: Before -- I don't 13 recall asking Detective Lazenby anything about the 14 search warrant. I don't know how counsel is going 15 to be able to inquire based on what I asked 16 Detective Lazenby about anything -- 17 THE COURT: Well, I have an idea in 18 the back of my mind he's going to use it to try to 19 impeach him by saying something different in the 20 search warrant affidavit than what he's testified 21 to. 22 MR. TINTERA: He only testified to 23 things after the search warrant was executed, to 24 things that happened at the defendant's residence 25 after the search warrant was issued, Your Honor. 26 1 THE COURT: Let's see what 2 Mr. Sussman asks and if you want to object, object 3 and I'll rule. 4 MR. TINTERA: Thank you. 5 THE COURT: Five minutes. 6 (Recess taken.) 7 THE COURT: Proceed, Mr. Sussman. 8 MR. SUSSMAN: Thank you, Your Honor. 9 10 CROSS-EXAMINATION 11 BY MR. SUSSMAN: 12 Q Detective Lazenby, you indicated that you 13 assisted in the execution of the search warrant 14 that was obtained in this case. 15 A Yes. 16 Q You also assisted Detective Lilley in the 17 drafting of that search warrant, didn't you? 18 A Yes. 19 Q And during the course of the drafting of 20 that search warrant, you informed Detective Lazenby 21 about your experience and training in the 22 investigation of computer crimes? 23 A I told Detective Lilley about my 24 experience and training. 25 Q Did you tell him that this was the first 27 1 actual case of that computer crime? 2 A Nobody had been charged at the time of 3 the search warrant. 4 Q So this is the first case of computer 5 crimes that you've investigated? 6 A No. There has been other cases of 7 computer crimes, but those are not what the 8 ultimate charges have been. We have seized other 9 computers and other warrants related to computers. 10 Q Detective Lilley [sic], do you remember 11 testifying in this courtroom about a month ago and 12 being asked if this was the first case that you had 13 investigated of an actual charge of a computer 14 crime? 15 A Yes. 16 Q And at that time you answered yes? 17 A Yes, where a person has been charged with 18 a computer crime, that is correct. 19 Q Now, you have had also a lot of 20 training -- well, let me back up. 21 You reviewed the search warrant 22 affidavit before it was submitted to the Judge? 23 A I briefly read over it. I reviewed most 24 of the ***time that I gave Detective Lilley and I 25 read some of the other stuff, yes. 28 1 Q I would like to show you what has been 2 marked for identification as Defendant's Exhibit 3 113. Is this a copy of the search warrant 4 affidavit that was prepared by Detective Lilley? 5 A Yes. 6 Q And that you read over? 7 A I believe so. That looks look it. That 8 looks like it. 9 Q Thank you. 10 Now, when you went with Detective 11 Lilley to execute the search warrant, you were 12 accompanied by how many more officers? 13 A I believe there was about four or five 14 other officers from our department. 15 Q And these officers came with you into the 16 house when Mr. Schwartz's brother opened the door; 17 is that right? 18 A No. I believe a lot of them stayed 19 outside until after -- two or three of us entered, 20 Jim read the search warrant and stuff and brought 21 the rest in. 22 Q And Mr. Schwartz and his brother were 23 brought into the living room and both were advised 24 of their Miranda rights? 25 A Yes. 29 1 Q The rights that you read to people who 2 are being questioned or interrogated about 3 potential criminal activity? 4 A I believe the policy is anybody that's 5 being -- whenever a search warrant is being 6 executed, we advise everybody of their rights. 7 Q And you do that because the person where 8 a search warrant is being executed may see 9 themselves as being in custody? 10 A No. Mr. Schwartz's brother was not in 11 custody and wasn't suspected of a computer crime, 12 but we read him his rights also. I mean, if we 13 found something of a criminal -- I could find 14 something else in the house of a criminal nature, 15 so it is policy if there was ten people in the 16 house, if we had had some neighbor there, anybody 17 that's brought in, we read the warrants, we advise 18 everybody of their rights. And I've kicked people 19 free after we've done that, so it doesn't 20 necessarily have to be a person who is being 21 questioned of a crime or isn't free to go. 22 Q You nevertheless advised both 23 Mr. Schwartz and his brother of the Miranda rights. 24 Mr. Schwartz then, shortly after that, spoke with 25 you in this room at the end of the hall? 30 1 A Yeah. Detective Lilley advised of the 2 rights and I spoke to him at the end of the hall. 3 Q Your main responsibility was -- 4 throughout the time that you were there was the 5 execution of the search warrant? 6 A Yes. 7 Q Looking around for computers and computer 8 equipment? 9 A That's correct. 10 MR. SUSSMAN: I would like to offer 11 the search warrant affidavit at this time. 12 MR. TINTERA: It's not relevant, 13 Judge. 14 THE COURT: Sustained. No. 113 is 15 not received. 16 BY MR. SUSSMAN: 17 Q And you were there for several hours 18 during the course of the search, were you not? 19 A I believe that's correct. 20 Q And of the several hours, your 21 conversation with Mr. Schwartz lasted perhaps less 22 than ten minutes? 23 A The first time, five or ten minutes. The 24 next time, maybe five minutes. It wasn't long. 25 Q The first time that you spoke with him at 31 1 the end of the hall, you advised Mr. Schwartz that 2 he was not in custody? 3 A I don't know if I said that to him or 4 not. Let me see. 5 I don't think I specifically made 6 that statement. I did advise him that it was under 7 investigation. 8 Q In fact, you advised him that he was not 9 in custody but that he was -- you also advised him 10 that there could be misdemeanor felony and possible 11 federal charges? 12 A No, I didn't advise him he wasn't in 13 custody. I advised him that he was under 14 investigation, but under Oregon law, it could be a 15 misdemeanor or felony. And if there was phone 16 lines involved and transfer of data out of state, 17 you could have felony charges. I didn't -- I did 18 tell him that. 19 Q You remember again you testified in this 20 case last month, the prosecutor asked you the 21 question, "Did you make any statements to 22 Mr. Schwartz during the time of the search warrant 23 of his custody status? 24 "Answer: Yes. There in the back 25 there was a time I interviewed and told him he was 32 1 not under arrest but free to go at any time, but I 2 told him there could be ******" ***(reading) 3 A That's correct. 4 Q Then you questioned him about his use of 5 the Crack program? 6 A Okay. Yeah. 7 Q And during that conversation with 8 Mr. Schwartz, both the first time and the second 9 time, you took no notes, did you? 10 A Took no notes? 11 Q That's right. You took no notes? 12 A No. I wrote down his quotes and put 13 those into my report, I believe is how I did that. 14 Q When you testified in this courtroom last 15 month, Detective Lazenby, you were asked, "How many 16 times did you actually participate in the 17 interviews with Mr. Schwartz?" 18 Your answer was "Probably five to 19 ten minutes maximum the two times. 20 "Question: Did you take notes while 21 you were there? 22 "Answer: No, I wrote a report that 23 night. 24 "Question: Just from your memory 25 then? 33 1 "Answer: Yes." 2 Was that testimony accurate at the 3 time? 4 A It's accurate to the time that I took no 5 notes about all the statements. I did write down 6 the quotes. I think there is like two quotes that 7 are in there and I wrote those down. 8 Q So you testified last time truthfully 9 when you said you took no notes and you're 10 testifying truthfully today when you say you took 11 notes and wrote down the two quotes before writing 12 your report? 13 A I wrote down the two quotes and I did not 14 take down notes about the whole interview. 15 Q That's not what you said when you 16 testified under oath last time in response to the 17 questions I just read to you, is it? 18 A I guess if you consider all his 19 statements to me, I was thinking of the whole 20 thing. Like if I was interviewing a person for a 21 long time period, I might write a lot of stuff 22 down. I didn't do that. 23 Q You think you misunderstood the question? 24 A I may have. I spoke -- wrote down the 25 two statements, two quotes. 34 1 Q Maybe your statements were 2 misinterpreted? 3 A My statements? 4 Q Yes. 5 A On what? 6 Q You're saying that you -- you're saying 7 that you took no notes. 8 A I don't understand what you're asking me. 9 Q It's possible that maybe we 10 misinterpreted your responses? 11 A I don't know. I believe that I responded 12 accurately. 13 Q Now, you made a point of saying there 14 were certain remarks that were Mr. Schwartz's words 15 that you put in quotes. You also talked about him 16 saying that he -- in response to Mr. Tintera's 17 questions, that Mr. Schwartz said he was caught 18 running a certain program, saying those are his 19 words. The word "caught" is not in quotes in your 20 report, is it? 21 A That's correct, it's not. 22 Q You did testify that Mr. Schwartz told 23 you that he had used passwords that he had cracked 24 from the SSD password file to log in to the SSD 25 computers; is that right? He was referring to a 35 1 password for -- under Ron B? 2 A Yes. 3 Q Are you certain that he was not talking 4 about a password that he got from the Brillig 5 password file? 6 A I -- I don't -- he told me -- I don't 7 know if he used Ron B to go into SSD. I asked him 8 what passwords he could remember using. Ron B was 9 one he could remember using. Then he made the 10 other statement he did use the password, I don't 11 know if it was Ron B or another one, he said to 12 look at the SSD, go into SSD and look. That's all 13 he -- 14 Q To look at the SSD file? 15 A No, to use one of the SSD ***pardon filed 16 to go into the SSD to look into ill but didn't take 17 anything or -- 18 Q You're certain you didn't misunderstand 19 that? 20 A Yes. 21 MR. TINTERA: I object to him 22 interrupting the witness' answers. 23 THE COURT: Let him finish the 24 answer, Mr. Sussman. 25 36 1 BY MR. SUSSMAN: 2 Q Now, you also testified that Mr. Schwartz 3 said he was using Crack to get passwords so he 4 could access the SSD system because he wanted to 5 get his e-mail quicker. 6 A He was using Crack to get the passwords 7 so he could use the passwords to get into -- get 8 his e-mail. 9 Q Are you sure he was not talking about -- 10 that referencing the getting his e-mail was not in 11 this discussion about why he was running the gate 12 program on Mink and Brillig? 13 A I -- I don't know what you're saying 14 there. What does that relate to the passwords? 15 Q I'm asking you whether or not he was, 16 what -- that you were confusing his response to 17 getting his e-mail faster was the reason for 18 running the gate program on the other computers 19 Mink and Brillig. 20 A I don't believe so. The issue was was he 21 using Crack to take password files off the SSD 22 system, which he says yes, he was, and he was using 23 those passwords to get back into the system from 24 home. Now, whether it was Mink or Brillig, I don't 25 know. I don't know the systems. 37 1 Q When he was talking about getting access 2 to his e-mail, wasn't he talking about using the 3 outside access from the gate program? 4 A I don't know. I don't think we ever 5 discussed that. 6 Q Didn't Mr. Schwartz tell you that his 7 reason for running Crack was to test systems 8 security? 9 A Yes, he made that statement. 10 Q Did you put that in your report? 11 A I believe I did. It's in here somewhere. 12 I believe we were talking about the -- two years 13 ago, came up in the same thing when he was using it 14 for password honesty and stuff. 15 Q You did not put that report in your 16 statement, that Mr. Schwartz told you that the 17 reason he was running the Crack password file on 18 SSD was that he was testing the security system? 19 A Yes, I did. "Randal advised it was a 20 tool to use passwords honest," and I think that's 21 where that reference came up. ***(Last questions 22 answer answer all related) That's when I followed 23 up with the question about if he -- if you -- it 24 was for security back then and it was security, why 25 was he doing it without authorization now if it was 38 1 a security issue. 2 Q The question was when you first asked him 3 about why he was running the Crack program, didn't 4 he tell you at that point that the reason he was 5 running it was to test systems security? 6 A The first time, no. 7 Q Now, Mr. Schwartz was not -- Mr. Schwartz 8 during these interviews was being cooperative? 9 A Yes. 10 Q And open? 11 A Yes. 12 Q And you had no reason to think he was 13 being evasive? 14 A At any point? 15 Q Yes. 16 A Yes, at one point I did. 17 Q And that was because of the difference 18 over the number of passwords? 19 A Yes. 20 Q Did you actually have the correct number 21 of passwords? Did you learn what the correct 22 number of passwords was? 23 A Yes. That's when I went back and 24 confronted him. 25 Q You said it was 50 passwords? 39 1 A 40 to 50. 2 Q Well, in your report -- 3 A I think my report says at least 40 to 50 4 passwords. 5 Q And Mr. Schwartz told you that he had 6 only logged in once and hadn't looked at the -- 7 looked at the final number? 8 A No, that's not what he told me. He told 9 me he didn't remember exactly how many because he 10 was just sticking them under stuff.tar and not 11 really using them. 12 Q Didn't he tell you that he had logged in 13 just once in the beginning of the program run? 14 A No. He told me he had only logged in -- 15 I asked if ever logged onto the SSD using any of 16 the passwords and he said on that he had only 17 logged in one time and later changed it to two or 18 three times. 19 Q So you're certain you're not confusing 20 that with his answer about when he was logging onto 21 the Crack program? 22 A No. I don't think I'm confusing that. 23 We never got into the number of times he logged on 24 and used Crack. 25 Q Detective Lazenby, you have access to a 40 1 tape recorder at the Sheriff's Office, don't you? 2 A I have one on my desk, large one. 3 Q You use one when you write reports? 4 A I don't take it out in the field with me 5 because it's this big (indicating) and hooked up to 6 my phone. 7 Q But there are portable tape recorders you 8 can take with you when you are conducting 9 interviews in the field, aren't there? 10 A Probably some available if I wanted to, 11 yeah. 12 Q And you could have taken -- there is also 13 videotape equipment that you could have used and 14 brought with you during the course of the search to 15 videotape the equipment or any questioning that 16 took place? 17 A I guess if I want to I could. That's 18 available. 19 Q And those things, those means, those 20 videotape or audio tape would assure this jury that 21 when you related the statements that you got in an 22 interview that they would be precisely the 23 statements that were obtained during the interview, 24 wouldn't they? 25 A We have used those in the past and half 41 1 the time they fail or batteries go out and we don't 2 use them. 3 Q Would you answer the question. The 4 question is those would assure -- the tape 5 recording would provide the most accurate account 6 of what was stated during an interview? 7 A Yes. 8 Q And videotape recording of an interview 9 would also provide the most accurate account? 10 A Yes. 11 Q And that would provide a more accurate 12 account than your recollection of the statements 13 that were given to you two years ago? 14 A No, because I wrote them down that night. 15 Q But you didn't take any notes, you didn't 16 take any detailed notes of that conversation when 17 it was taking place? 18 A I remember pretty well and I wrote it 19 that night. 20 Q You talked about your training and 21 experience in this affidavit for the search warrant 22 about investigating computer crimes. You also have 23 training and experience in interrogation 24 techniques, don't you? 25 A Yes. 42 1 Q And you have training and experience that 2 when you go to talk to somebody who you are 3 investigating a crime on, the techniques that you 4 will use to get the answers that you are looking 5 for when you are investigating that crime, don't 6 you? 7 A I disagree with that. I don't go looking 8 for a specific answer. I go looking for the truth. 9 Q You went there because Mr. -- with an 10 affidavit that provided you the basis to look for 11 evidence that Mr. Schwartz had been taking Intel 12 secrets so you could seize his computers, correct? 13 A Correct. 14 Q You told him when you were there that he 15 could be prosecuted for crimes for doing these 16 things? 17 A If it had occurred, he could be 18 prosecuted, correct. 19 Q And you told him during the course of 20 that interview that you didn't believe him when he 21 told you about the number of passwords when you 22 confronted him about the larger number? 23 A Yeah, that was no trick. That was a 24 direct statement. He hadn't told me the truth. 25 That was going back and saying, "You said this and 43 1 this is what they say is there." That's 2 confronting a discrepancy, is all. Asking him to 3 explain it. 4 Q And you took -- and you went in there and 5 part -- and part of that training includes not 6 using the tape recording on initial interviews so 7 that you can see what happens during the course of 8 those interviews, doesn't it? 9 A I've never had any training that way. 10 Q But in fact, you did not use any tape 11 recordings that would have provided this jury a 12 record of precisely what Mr. Schwartz answered in 13 response to questions? 14 THE COURT: I think he already 15 answered that question, Mr. Sussman. 16 MR. SUSSMAN: I have nothing 17 further. 18 THE COURT: Redirect. 19 20 21 22 23 24 25 44 1 REDIRECT EXAMINATION 2 BY MR. TINTERA: 3 Q Mr. Lazenby, why didn't you use, 4 according to defense counsel, tape recording and 5 videotape, why did you not use those? 6 A I've been in police work 22 years and in 7 the past, kind of like we used to use video 8 recorders in DUI cars and different things. 9 ***PRAULD breaking down, tape recorders. Had 10 them -- tape recorder go off on me in the -- during 11 the middle of a homicide interview. Doesn't work. 12 Is there electricity at the house. They break down 13 during the interview. 14 I don't think there is a department 15 around that uses video and audio during a search 16 warrant and uses them. 17 Q You were asked about what the defendant 18 said the first time he was asked about running the 19 Crack program. And what did the defendant say the 20 first time he was asked about running the Crack 21 program? 22 A He said -- 23 MR. SUSSMAN: Your Honor, he 24 answered this question in response to my questions. 25 This is improper redirect. It's repeating the 45 1 testimony. I object. 2 MR. TINTERA: He asked about it. 3 THE COURT: Overruled. 4 THE WITNESS: He said he had been 5 using it to get passwords and he obtained what he 6 thought was 10 to 12 passwords. 7 MR. TINTERA: Thank you. I don't 8 have any other questions. 9 THE COURT: Mr. Sussman? 10 MR. SUSSMAN: I have nothing 11 further. 12 THE COURT: Thank you. You may step 13 down. 14 Call your next witness. 15 MR. TINTERA: I would offer State's 16 Exhibits 16 and 20. ****(back there he said he 17 used one in the middle of a homicide one time and 18 it broke down in the middle of the interview.) 19 MR. SUSSMAN: Your Honor, I have no 20 objection to Exhibit 16. 21 THE COURT: 16 is received. 22 (Whereupon, State's Exhibit 23 No. 16 was received in 24 evidence.) 25 MR. SUSSMAN: 20 -- 46 1 MR. TINTERA: It was Herb Mayer. 2 MR. SUSSMAN: He couldn't recognize 3 this or identify this and this is an invoice to Bob 4 Wilcox, so I don't think this has been properly 5 identified and -- 6 MR. TINTERA: Well, we have agreed 7 that the foundation of business records would not 8 be required to be produced for the trial. The 9 document is a document -- 10 THE COURT: I don't want to have an 11 argument over possible stipulations before the 12 jury. 13 MR. TINTERA: Well, that's in regard 14 to the foundational aspect. 15 MR. SUSSMAN: The objection isn't on 16 foundation grounds. I have no quarrel with the 17 fact that we have records produced by our subpoenas 18 and from Intel's business records, but my objection 19 was this wasn't identified by any of the witnesses 20 as to work that Mr. Schwartz had done. This refers 21 to Bob Wilcox and the State showed this to 22 Mr. Mayer and -- 23 THE COURT: May I see it? 24 MR. SUSSMAN: That seems to be my -- 25 and he couldn't identify it. That's my 47 1 recollection. 2 MR. TINTERA: Mr. Mayer identified 3 the SGI reference to that record in referencing the 4 Silicon Graphics computer, also known as Brillig. 5 Lines are difficult to read about two-thirds down 6 the page. 7 THE COURT: Overrule the objection. 8 20 is received. 9 (Whereupon, State's Exhibit 10 No. 20 was received in 11 evidence.) 12 MR. TINTERA: Judge, I have no 13 further evidence to offer at this time and nor 14 witnesses to call and I would rest. 15 MR. SUSSMAN: Your Honor, I have a 16 matter for the Court. 17 THE COURT: Typically when one party 18 rests, ladies and gentlemen of the jury, there are 19 matters that the Court has to consider before we go 20 further on the case. I will have to consider some 21 arguments and things now, so we'll take a recess. 22 Remove the jury. 23 24 25 48 1 (Whereupon, the following 2 proceedings were held in 3 open court, out of the 4 presence of the jury:) 5 THE COURT: Mr. Sussman. 6 MR. SUSSMAN: Your Honor, at this 7 point I would make my motion for judgment of 8 acquittal and on grounds the State has not proved 9 sufficiently that each of the elements of Count 1 10 to be proved to the jury beyond a reasonable doubt, 11 the evidence would not be sufficient on the issue 12 of Mr. Schwartz's knowledge or belief. 13 Also with respect to Counts 2 and 3, 14 more specifically there, the -- both of those 15 counts allege that Mr. Schwartz accessed and used 16 the computers for the purpose of committing theft. 17 And I think the evidence in this case, this -- this 18 fails on the grounds of showing there was a purpose 19 of committing theft. There is no evidence from 20 which the jury could draw that conclusion. 21 And number two, that in itself, the 22 copying and running the Crack on the password file 23 at SSD and copying and running the Crack password 24 file on the Brillig are not theft as a matter of 25 law, and that the Court should grant the judgment 49 1 of acquittal on both of those grounds. 2 THE COURT: Explain that last part 3 to me again. 4 MR. SUSSMAN: Well, Your Honor, I 5 think there is no evidence that that -- theft 6 requires that the State prove or the elements are 7 that somebody take property which -- for the intent 8 of appropriating it to themselves or with the 9 intent to permanently deprive the owner of the 10 usefulness of that. And in this particular case, 11 there is -- a password and password file are 12 information and are not objects which are subject 13 to theft. That the theft statute does not fit the 14 circumstances that you have or conditions that were 15 created by copying and running a password -- 16 running a Crack program on a password file. 17 And secondarily, the evidence is 18 lacking that there was any purpose to commit, or 19 intent to commit theft. 20 So on those grounds, that's the 21 basis for my motion. 22 THE COURT: Mr. Tintera. 23 MR. TINTERA: Judge, I think we have 24 established all the elements in this particular 25 case. The -- the evidence shows that he took the 50 1 property, he had no authority to take the property, 2 the property had value to the owner of it, and his 3 actions diminished that value. And also that he 4 appropriated property to himself for his own use. 5 That, in my mind, establishes theft. 6 THE COURT: Well, these issues came 7 into my awareness when we started this case and 8 I've been doing a lot of thinking about it since 9 then. 10 Obviously what the legislature has 11 done is adopted this new computer crime and sort of 12 related it to the theft statutes. And at least in 13 my court, this is a case of first impression of 14 trying to interpret just how the definitions used 15 there in the theft statute apply. 16 And I looked at "appropriate 17 property to oneself," I considered that, considered 18 the various definitions, other definitions that 19 apply to theft, and I tried to think of other 20 factual situations that more commonly come before 21 the Court that might be similar. And what I'm 22 suggesting here, that a jury could find that the 23 conduct of a defendant or a person in the 24 defendant's posture at this point where the 25 evidence that a jury could believe that he did 51 1 Crack, he copied the password file, put it in, had 2 it transferred within Intel to the computer that he 3 had access to in running the Crack password against 4 it is sort of like a store employee at Nordstrom 5 taking merchandise and not removing it from the 6 store but placing it somewhere else within the 7 store where the employee had access to it 8 preparatory to removing it from the store. 9 And clearly in that scenario -- we 10 have had those sorts of cases before the Court. 11 Typically it's the employer takes a TV set and puts 12 it in a dumpster and warehouse someplace with the 13 idea that he can come back later on that night and 14 take the TV set out. 15 This is sort of a high-tech version. 16 The jury could find this is a high-tech version of 17 taking a TV set and putting it in a dumpster with 18 the idea of coming back later that night and taking 19 it out. I know that's sort of a simple comparison, 20 but factually, it's very close to what Mr. Tintera 21 has attempted to prove here. 22 Defendant needs to know -- the 23 lawyers do, I think, that the defendant and others 24 that are not lawyers maybe in the courtroom need to 25 know that when I rule on these and when I deny a 52 1 motion for a judgment of acquittal, as I am in this 2 case, I'm not saying that the defendant is guilty, 3 what I'm saying is that based on the evidence 4 that's been produced, he could be found guilty. He 5 could be. The evidence has been legally sufficient 6 that if it's believed and if certain reasonable 7 inferences are drawn, he could be found guilty. 8 That's what I'm saying in this case. 9 I do believe the evidence that has 10 been produced here on all three counts is 11 sufficient for the case to go forward and I'm 12 denying the motion on all three counts. 13 Anything else? 14 MR. SUSSMAN: No. Before we bring 15 back the jury, I suppose we should get things set 16 up for the telephone testimony. 17 THE COURT: Yes. I'm fearful they 18 will not be able to hear. If that's the case -- 19 how long is the cord on that phone? Let's go off 20 the record. Take a short recess here. 21 (Recess taken.) 22 (Whereupon, the following 23 proceedings were held in 24 open court, the jury being 25 present:) 53 1 THE COURT: Ladies and gentlemen of 2 the jury, as I indicated earlier, the State has 3 rested and this is now the time that the defense 4 has an opportunity to call witnesses and produce 5 evidence. 6 The first witness that Mr. Sussman 7 wishes to call on behalf of the defendant is out of 8 the country, in fact, I think in Israel, and we 9 have arranged to have that person testify by 10 telephone and the State has agreed. This is a bit 11 unusual, but the parties occasionally do enter into 12 such agreements and so we have done that in this 13 case. 14 But because the witness is going to 15 testify by telephone, we'll ask the witness to 16 speak up. If at any time you can't hear, let me 17 know and I'll ask the witness to repeat the answer 18 and speak up. 19 You should treat this just as though 20 the witness was before you here on the witness 21 stand testifying, as any other witness has or will, 22 and treat it no differently than that. 23 As I understand it, the witness is 24 available; is that correct? 25 MR. SUSSMAN: Yes, Your Honor, the 54 1 witness is on the line as we speak. 2 THE COURT: Okay. Your first 3 witness then is. 4 MR. SUSSMAN: Tanya Herlick. 5 THE COURT: Actually it's the second 6 witness because you've already called Mr. Reilly, 7 is that correct? 8 MR. SUSSMAN: Yes. 9 THE COURT: Miss Herlick, can you 10 hear me? 11 THE WITNESS: Yes. Barely. I can't 12 hear you too well, to tell you the truth. 13 THE COURT: I'll speak up. Can you 14 hear me now? I'm Al Bonebrake, I'm a judge. I 15 want you to raise your right hand and take an oath 16 to tell the truth. Will you do that? 17 THE WITNESS: Yeah. 18 19 20 21 22 23 24 25 55 1 TANYA HERLICK 2 called as a witness on behalf of the Defendant, 3 having been first duly sworn under oath, was 4 examined and testified as follows: 5 6 THE CLERK: State your full name and 7 spell it for the record, please. 8 THE WITNESS: My name is Tanya 9 Herlick. H-e-r-l-i-c-k. 10 THE COURT: Miss Herlick, this is 11 Judge Bonebrake again. If at any time during the 12 testimony you hear an objection made, someone say, 13 "Objection, Your Honor," I'd like to have you stop 14 at that time, stop testifying and give me an 15 opportunity to rule on that and then give you 16 directions. Can you do that? 17 THE WITNESS: Yes. 18 THE COURT: It will be a little 19 difficult, but if I ask you to stop, listen as you 20 are speaking and if you hear an objection or I ask 21 you to stop for a moment, I'd ask that you do that. 22 Okay? 23 THE WITNESS: Sure. I'm wondering, 24 though, I think the phone is a one-way phone, so 25 while I'm speaking, I can't hear anything coming 56 1 through. I can't hear any interruptions, I think. 2 THE COURT: Okay, we'll try to give 3 you short questions if that's the case. All right? 4 THE WITNESS: Okay. I'll try to 5 take little breaks or something. 6 THE COURT: That would be fine. 7 Thank you. 8 Why don't counsel come up closer. 9 MR. SUSSMAN: Perhaps if I could use 10 the chair next to the phone. 11 THE COURT: That would be fine. 12 13 DIRECT EXAMINATION 14 BY MR. SUSSMAN: 15 Q Miss Herlick, this is Marc Sussman. Can 16 you hear me? 17 A Yes, I can. 18 Q I will ask you my questions now. And if 19 you don't hear it clearly or you don't understand, 20 please let me know. 21 A Okay. 22 Q Miss Herlick, how are you employed? 23 A I'm a Systems Administrator at O'Reilly 24 and Associates. 25 Q How long have you been a Systems 57 1 Administrator at O'Reilly? 2 A I've been a Systems Administrator there 3 for about two and a half years. 4 Q And how long have you been with O'Reilly? 5 A Two and a half years. 6 Q And what is O'Reilly, by the way? 7 A O'Reilly and Associates is a publisher. 8 Q And what kind of publishing does it do? 9 A We publish technical books, things having 10 to do with the Internet. We also now publish 11 mostly technical books. That's kind of our niche. 12 Q You're the Systems Administrator over the 13 computers at O'Reilly, and what type of system is 14 that -- computer system does it use? 15 A We have mostly a UNIX network. 16 Officially a -- it's a UNIX system. Our main 17 workstation, that's the computer that log into 18 that, people log into it. 19 Q Is your computer connected to the 20 Internet? 21 A Yes. 22 Q Was it connect to the Internet in 1993? 23 A Yes. 24 Q Do you have a computer in your system 25 that is called Ruby? 58 1 A Yes. 2 Q Do you know Randal Schwartz? 3 A Yes, somewhat. 4 Q How do you know Randal Schwartz? 5 A Randal is one of our authors and he has 6 an account on Ruby, our main system. I know him 7 because I know everybody that has an account there. 8 Q And you say he's one of your authors. Do 9 you know what kind of books he was writing for 10 O'Reilly? 11 A Yeah. Randal was working on Pearl. 12 Q And what is Pearl? 13 A Pearl is a script memory. It's very 14 commonly used by Systems Administrators. It's new, 15 fairly new language. Like a programming language. 16 Not exactly, but pretty much like one. And Randal 17 was working on a book call Learning Pearl, which is 18 a tutorial to teach people how to use it. 19 Q And did he write any books for you about 20 product design or that specifically dealt with 21 systems security? 22 A No, he did not. 23 Q Now, you mentioned that all of your 24 authors have accounts. What is the policy 25 regarding giving authors accounts? 59 1 A Basically it's opened. If an author 2 needs and account, he gets an account. There is 3 no -- that's it. 4 Q And what does the account give the person 5 access to? 6 A The account, like the typical author 7 account, which would be a gift account, gives you 8 access to e-mail, gives you access to like your own 9 personal area called your home directory. It would 10 give you access -- you can run programs from it, 11 program across the Internet and stuff like that. 12 Also it would give you access to any files on the 13 systems that are accessible by everybody. 14 Q By the way, is a password -- is your 15 password file accessible and readable to everybody 16 who has an account on the system? 17 A Yeah. 18 Q Did Randal Schwartz have an e-mail 19 address at O'Reilly? 20 A Yes. 21 Q And during -- thinking about during the 22 period of, say, prior to November 1st, 1993, to 23 what extent was he using that address at O'Reilly 24 for his e-mail? 25 A Well, I know he was using it for all his 60 1 book-related mail. I'm not sure, but it's possible 2 he was using it for all. 3 MR. TINTERA: Objection. If she's 4 not sure, she can't answer the question. 5 MR. SUSSMAN: Just a minute. There 6 is an objection. 7 THE COURT: I'm sustaining the 8 objection to the last answer and ask to disregard 9 it where the witness said it was possible that he 10 was doing something because that's conjecture. 11 BY MR. SUSSMAN: 12 Q Do you recall whether Mr. -- do you know 13 whether Mr. Schwartz was using his e-mail address 14 for other activities besides simply his 15 communication with O'Reilly about his books? 16 A Do I know 100 percent for sure? No. 17 Q Okay. What is your best recollection? 18 A (Pause.) I don't know. 19 Q Okay. That's fair. 20 Did O'Reilly have any policy 21 restricting the use of the Internet access of -- 22 let me rephrase this first. 23 Did Mr. Schwartz's account on -- at 24 O'Reilly and on Ruby give him access to the 25 Internet? 61 1 A Yes. 2 Q And were there any restrictions on his 3 use of that account to have access to the Internet? 4 A No. 5 Q Now, going back to your responsibilities 6 and duties as a Systems Administrator, does your 7 responsibility as a Systems Administrator involve 8 testing security of your systems? 9 A Yes. 10 Q And when you do that, are there any 11 particular tools or devices that you employ to test 12 your security of your system? 13 A The main ***who we use is a program 14 called Crack, which we run against the password 15 file. It attempts to crack passwords. Basically 16 its purpose is to identify passwords that are 17 easily crackable, not just by me but by anybody who 18 would want to break in. 19 Q And the passwords that are easily 20 crackable, is that something that causes you 21 concern or presents perhaps a liability to the 22 company? 23 A A -- yeah, certainly is. As long as 24 somebody has access to the password file -- first 25 of all, you need to have an account on the system 62 1 to have access to the file. Once you have access 2 to it, we don't want people to be able to figure 3 out each other's passwords or break into each 4 other's accounts. 5 Q So you want to make sure that your 6 passwords are secure? 7 A Yeah. 8 Q Now, did you become aware of an incident 9 in October, that occurred in October of 1993? Did 10 you learn about it sometime after Mr. Schwartz had 11 run a Crack program against the password file at 12 O'Reilly? 13 A Yes. I learned about it, I think, in 14 November, early November. 15 Q And did you have any discussions with 16 Mr. Schwartz about his actions? 17 A Yes. 18 Q Did you discuss the reasons that he was 19 doing this? 20 A Yes. 21 Q And what were those reasons? 22 MR. TINTERA: Objection. Hearsay. 23 THE COURT: Sustained. Don't answer 24 the question. 25 63 1 BY MR. SUSSMAN: 2 Q Did Mr. Schwartz inform you that he was 3 doing this? 4 A No. Before he did it, you mean? 5 Q No. At some point did he inform you that 6 he had done this? 7 A Yes. 8 Q And what actions did you take? 9 A He informed me -- 10 Q What was your response, how did you deal 11 with the situation? 12 MR. TINTERA: Judge, how is that 13 relevant with anything this jury has to decide? 14 THE WITNESS: Is there something 15 going on but I can't tell what it is? 16 MR. SUSSMAN: There is an objection, 17 so hold on for a second. 18 THE COURT: Is that an objection on 19 relevance? 20 MR. TINTERA: Yes, it is. 21 THE COURT: I thought so. 22 Mr. Sussman. 23 MR. SUSSMAN: Your Honor, it will go 24 to show Mr. Schwartz's response, why he was doing 25 this, and so that the jury can understand 64 1 Mr. Schwartz's state of mind, that he was in effect 2 acting to do something that he thought was 3 favorable or helpful to these persons he has an 4 account with and where the State is trying to 5 allege that Mr. Schwartz's activities -- 6 THE COURT: Okay. I understand your 7 argument. I'm sustaining the objection. 8 Don't answer that last question, if 9 you recall what it was. 10 Proceed, Mr. Sussman. 11 BY MR. SUSSMAN: 12 Q Let me rephrase the question. Did you 13 take any action against Mr. Schwartz? 14 A Yes. 15 MR. TINTERA: Objection. It's not 16 relevant. 17 THE COURT: I'm sustaining the 18 objection to that question. Don't answer that 19 question. 20 BY MR. SUSSMAN: 21 Q Does Mr. Schwartz still have an account 22 at O'Reilly? 23 A Yes. 24 Q And does he still -- is he still one of 25 your authors? 65 1 A Yes. 2 Q And does Mr. Schwartz still have an 3 account which allows him access to the Internet 4 through O'Reilly? 5 A Yes. 6 MR. SUSSMAN: Thank you. I have 7 nothing further. 8 THE COURT: There will be some other 9 questions here by the district attorney, if you 10 will wait just a minute. 11 Mr. Tintera. 12 MR. TINTERA: Thank you, Judge. 13 14 CROSS-EXAMINATION 15 BY MR. TINTERA: 16 Q Good evening, Miss Herlick. Is it 17 evening there? 18 A Yes, it is. 19 Q My name is Tom Tintera. I'm with the 20 District Attorney's Office. Could I ask you a 21 couple questions? 22 A Sure. 23 Q As a Systems Administrator, could you 24 tell me what file protection rights are? 25 A Yeah. File protection, that's a way that 66 1 we have of controlling who is allowed access to a 2 particular file. 3 Want me to explain further? 4 Q Well, let me ask the questions. What 5 does "RW" stand for? 6 A Read write. 7 Q What does that allow someone to do? 8 A Read allows somebody to view a file. 9 Write allows somebody to alter a file. 10 Q What does "R" stand for? 11 A Read. 12 Q And if you have the line of RW, R, R, 13 what does that mean? 14 A You mean RW-R--R? 15 Q Okay. 16 A That means -- the way it would work would 17 be RW-R--R--, it would have to go like that in sets 18 of three. The first one there refers to the owner 19 of the file. That's the permission that the owner 20 has. The second refers to the group rights. The 21 person can belong to a group. You can control 22 access to a file according to a group of people. 23 If you belong to that group, then that second 24 triplet, this defines the access that the group has 25 to that file. Then the third triplet refers to the 67 1 access that everybody else has. 2 Want me to explain what that means 3 all together? Basically means that the owner of 4 the file has permission to look at the file and to 5 alter the file. The group owner of the file has 6 permission to look at the file and everybody else 7 has permission to look at the file. 8 Q Now, as a Systems Administrator, if you 9 are running Crack against the password file, would 10 not you restrict the ability for the group or 11 everyone else to read or write that file? 12 A Let me think. I think one time -- this 13 is the kind of thing that I would try out, and I 14 can't say off the top of my head exactly what the 15 results would be, but I think one time fairly 16 recently I tried altering what are the normal 17 permissions on the file and people weren't able to 18 log in. 19 I think that like on the -- on the 20 diversion of the operating system that we were 21 running, these file permissions have to be left 22 wide open or people can't log in. 23 Q If you copy the password file to a 24 different machine, then the original password file 25 remains where it is and people can log in; is that 68 1 correct? 2 A Yes. 3 Q So if you copy it, you could change the 4 file protection rights so that people can't read 5 the passwords you've cracked, isn't that true? 6 A Well, people can't -- the passwords that 7 you crack aren't going to be in the password file 8 anyway, so I'm not quite sure I fully understand 9 the question, I guess. 10 Q Wouldn't you make it so people could not 11 read when you're running the Crack program the 12 results of the program? 13 A Crack default output I didn't -- does not 14 have the same permission as the password file. You 15 have to have special permission to read off of the 16 Crack program. 17 Q So how would you write the file 18 protection rights to read the output of the Crack 19 program? 20 A Well, Crack does it itself. I mean, I 21 typically log in as root and look at the results. 22 If I try to do it myself, I can't see them. 23 Now, if I were -- go ahead. That's 24 it. That's all I know off the top of my head for 25 sure. 69 1 Q So you run the Crack program right on the 2 system as it exists, on the password file; is that 3 correct? 4 A Right. 5 Q You don't copy it somewhere else to run 6 it? 7 A No. 8 Q And as a Systems Administrator, how many 9 times have you found it necessary to go into a 10 different group of computers that you don't 11 administer and copy their password files? 12 MR. SUSSMAN: Your Honor, this calls 13 for -- 14 THE WITNESS: Copy the passwords 15 file? 16 THE COURT: Just a minute, please. 17 Hold on. There is an objection. There has been an 18 objection and I need to rule on this objection. 19 MR. SUSSMAN: I think this question 20 calls for an answer as to speculation and -- 21 THE COURT: What was the question? 22 MR. TINTERA: How many times she's 23 had to go into a system that she did not administer 24 and copy a password file, how many times she's done 25 that. That's not speculation. 70 1 THE COURT: It's not relevant. 2 MR. TINTERA: Yes, it is. She's 3 testifying about what Systems Administrators do and 4 do not do in regard to running Crack. 5 THE COURT: If you want to ask her 6 that question, make it clear to answer it in her 7 duties as a Systems Administrator, I'd allow you to 8 do that. 9 BY MR. TINTERA: 10 Q As a Systems Administrator, how many 11 times have you found it necessary to go into a 12 computer system that you did not administer and 13 copy the password file? 14 A Never. 15 Q So that's not part of your duties as a 16 Systems Administrator? 17 A No. 18 Q Would you agree with this statement: 19 National computer crimes squads estimate that 20 between 85 and 97 percent of computer intrusions 21 are not even detected? 22 A I could only make a guess. I don't know 23 for sure. 24 Q My question is whether you agree with 25 that statement or not. 71 1 A I don't think I have enough information 2 to agree or disagree with it. 3 Q Do you know what a home page is? 4 A Yes. 5 Q Could you tell the jury what a home page 6 is? 7 A A home page is a -- let's see, it's a 8 person -- it's usually, it's like a biographical 9 sketch, automatic biographical sketch that somebody 10 that -- the terminology is they put it up on the 11 web. In other words, they make it accessible to 12 people on the Internet to be able to look at it. 13 And typically it's set up so that if you are a 14 consultant, you would want to put your information 15 there. If you just are -- whatever, whatever you 16 want to make public information, you put in on the 17 home page. 18 THE COURT: Wait a minute now. 19 There is another objection. 20 MR. SUSSMAN: I object to the 21 question. This is beyond the scope of direct and 22 it's not relevant. 23 THE COURT: How is it relevant? 24 MR. TINTERA: It's 25 cross-examination. This is from the home page of 72 1 her company and I'm asking her about information 2 that they put out as a company representative. 3 THE COURT: Well, sure it's 4 cross-examination, how is it within the scope of 5 anything that Mr. Sussman asked? 6 MR. TINTERA: She's been put on as a 7 Systems Administrator, a person who operates the 8 computer system of O'Reilly and Associates. Part 9 of that system -- and we have talked about Internet 10 access, part of that system involves this home page 11 ad and I wanted to ask her about information that's 12 on their home page. 13 THE COURT: Overrule the objection. 14 Proceed. 15 BY MR. TINTERA: 16 Q Miss Herlick, if I understand you, the 17 home page is like a billboard for whoever puts it 18 on the Internet? 19 A Yeah, that sounds right. 20 Q And O'Reilly and Associates has a home 21 page, does it not? 22 A Yes. 23 Q Are you familiar with it? 24 A To tell you the truth, I'm not. I didn't 25 write it and I never have occasion to look at it. 73 1 Q Do you administer it? 2 A No, actually, I don't. 3 Q Are you familiar with the publications 4 that O'Reilly puts out for their books? 5 A Yes. 6 Q Publication for the books? 7 A Somewhat familiar with them, yes. 8 Q Are you familiar with the latest one 9 that's entitled How to Get a Handle on Internet 10 Security? 11 A No. 12 Q Could you tell the jury what password 13 sniffers are? 14 A Password sniffers -- 15 MR. SUSSMAN: Your Honor, this is 16 going way beyond the scope of direct. 17 MR. TINTERA: Hold on. 18 THE COURT: There is an objection I 19 need to rule on again. 20 The objection is beyond the scope? 21 MR. SUSSMAN: Yes. 22 THE COURT: Mr. Tintera. 23 MR. TINTERA: I'm going to tie it 24 back into the efforts that she makes to keep her 25 systems secure. It's access to the Internet and I 74 1 want to ask her what she does to protect herself 2 from these types of -- whatever password sniffing 3 is, it's something used on the Internet and I 4 wanted to know what she does to protect O'Reilly 5 and Associates from this type of intrusion. 6 MR. SUSSMAN: Also object on 7 relevance, Your Honor. 8 THE COURT: Overruled. Go ahead. 9 BY MR. TINTERA: 10 Q Do you know what password sniffers are? 11 A I think so. If they are what I think 12 they are, then yes, I know what they are. 13 Q What do you think they are? 14 A I can't say that I've exactly heard that 15 terminology, but I've heard something similar. 16 Q What type of protection does O'Reilly 17 take to protect itself, if any, to protect itself 18 from intrusion into the Internet? 19 A Well, what little protection we have, we 20 very recently implemented like within the last 21 month or two. And what we have implemented are 22 some filters on our Internet connection on our 23 router that connects us to the Internet. 24 Q Are you involved in that as a Systems 25 Administrator? 75 1 A Yeah, somewhat. 2 Q You just don't have an open system to 3 anybody on the Internet, do you? 4 A We actually are pretty open. I mean, 5 like I said, this is very recently implemented, 6 like within the month before I left, and that was a 7 month ago, so in the last two months. 8 Q I assume that O'Reilly has more than one 9 computer in its group. 10 A That's true. 11 Q Would you agree that if one computer is 12 compromised, it's trivial to compromise the others? 13 A That depends. 14 Q So you would not agree? 15 A Right, I would not agree. 16 Q Did you know that's a statement in your 17 latest publication in regard -- in How to Get a 18 Handle on Internet Security? 19 A No. 20 Q Would you agree with this statement, 21 "Even if your systems are as secure as possible" -- 22 MR. SUSSMAN: Your Honor, now I 23 object. What he's trying to do is impeach this 24 person as though she's an expert witness. She was 25 not called as an expert. It's not relevant and not 76 1 proper cross-examination. 2 THE COURT: Mr. Tintera. 3 MR. TINTERA: She was asked about 4 what Systems Administrators do and how they use 5 Crack. That, in my mind, is a specialized witness 6 about Systems Administration. I should be able to 7 ask -- 8 THE COURT: Overrule the objection. 9 Proceed. 10 BY MR. TINTERA: 11 Q Would you agree with this statement, 12 "Even if your systems are secure as possible and 13 your user passwords are not guessable, you can be 14 ***impacted by a packet sniffer running at any site 15 that your users can log in from or at any site that 16 their packets will cross to get to you"? 17 A Yes, that sounds true. 18 Q Would you agree with this, "Password 19 sniffers may use programs provided for network 20 debugging as building blocks or may be written to 21 use the services directly. Special purpose 22 password sniffing tool kits are widely available to 23 attackers." 24 A I don't know. 25 Q Did you know that is in your publication 77 1 or your company's article on How to Get a Handle on 2 Internet Security? 3 A Nope. 4 Q Did you know that the -- 5 MR. SUSSMAN: Your Honor, again, the 6 problem we have is the witness has testified she 7 wasn't familiar with the article and I object to 8 the -- continuing the line because it's from 9 something that she's indicated that she -- she was 10 not involved with and had no familiarity with 11 and -- 12 THE COURT: Nevertheless, she has 13 been qualified as a Systems Administrator and these 14 questions, I believe, are fair questions of whether 15 or not they have been published in the article that 16 has been written. I'm overruling the objection. 17 MR. SUSSMAN: Your Honor, I just 18 want to clarify one thing. The question that was 19 asked of her is whether she, as a Systems 20 Administrator, did anything to protect certain 21 security, not what Systems Administrators generally 22 do, which is the way Mr. Tintera has argued this as 23 a basis for this line of questioning. 24 THE COURT: Well, it's fair to 25 cross-examine her with regard to the general duties 78 1 of a Systems Administrator, so I'm overruling the 2 objection. 3 Proceed. 4 BY MR. TINTERA: 5 Q Miss Herlick, what is CERT? 6 A CERT, it's an organization that tracks 7 computer security problems. 8 Q The Computer Emergency Response Team? 9 A Yeah, that's it. 10 Q Are you aware that CERT reports that as 11 many as 100,000 sites were targeted by password 12 sniffers in 1994? 13 A I probably read it, but I don't remember 14 exactly. 15 MR. TINTERA: Thank you. 16 THE COURT: Mr. Sussman, additional 17 questions? 18 MR. SUSSMAN: Yes, Your Honor. 19 THE COURT: There will be a few more 20 questions by Mr. Sussman, Miss Herlick. 21 22 23 24 25 79 1 REDIRECT EXAMINATION 2 BY MR. SUSSMAN: 3 Q Miss Herlick, when Mr. Schwartz spoke 4 with you about why he was running Crack, was 5 there -- was it your understanding that this was 6 done to try to break into your system? 7 A No. 8 MR. TINTERA: Objection. Could only 9 be based on hearsay. 10 MR. SUSSMAN: Goes to a state of 11 mind. 12 MR. TINTERA: It's not relevant. 13 MR. SUSSMAN: State of mind of 14 exactly what is at issue in this case. 15 THE COURT: It's a state of mind of 16 a different kind. 17 MR. SUSSMAN: But circumstantial 18 evidence of that and this is contemporaneous. 19 Mr. Tintera has brought up the question about CERT 20 and we have had testimony from the State's witness 21 that CERT was involved initially in contacting 22 O'Reilly about this activity. 23 THE COURT: I'm sustaining the 24 objection. The jury will disregard the last answer 25 by the witness. 80 1 MR. SUSSMAN: Your Honor, that would 2 conclude my questions. I'd like to make an offer 3 of proof when we're finished. 4 THE COURT: Do you need to have the 5 witness for the offer of proof? 6 MR. SUSSMAN: Yes, we will. We can 7 make that outside the presence of the jury. 8 THE COURT: Do you have any other 9 witnesses here available now or could we just break 10 for lunch and start about 1:15? 11 MR. SUSSMAN: The one witness I have 12 available is Alan Watson from the Sheriff's Office 13 and his testimony will take longer than 15 minutes. 14 THE COURT: Okay, ladies and 15 gentlemen of the jury, you can take your noon 16 recess. What I will have you do is, I'll have you 17 removed to the jury room just for a minute and then 18 I'll tell Lynda when I want you to go. But an 19 offer of proof requires the Court to listen to 20 evidence and I don't want you to be excused until 21 I've done that. You'll be removed and as soon as 22 Lynda lets you go, we'll be in recess until 1:30. 23 Remove the jury, but have them stay 24 in the jury room. 25 81 1 (Whereupon, the following 2 proceedings were held in 3 open court, out of the 4 presence of the jury:) 5 THE COURT: Mr. Sussman. Questions. 6 The record will show the jury has been removed. 7 This is your offer of proof. Go 8 ahead. 9 MR. SUSSMAN: Thank you, Your Honor. 10 11 OFFER OF PROOF 12 BY MR. SUSSMAN: 13 Q Miss Herlick, would you tell us how you 14 learned that Mr. Schwartz had run the Crack 15 program -- run a crack program on the password 16 files from O'Reilly? 17 A Okay. How I learned about this. I was 18 in California at a conference and somebody came up 19 to me in the middle of the day and said the FBI 20 just called, somebody broke into Ruby. So I 21 immediately had a fit because I was pretty new at 22 my job and I was in California and there wasn't 23 anything that I could do from there, so I just sort 24 of fretted about it. And people at home, somebody, 25 the guy whose job who I replaced was still around 82 1 and he did a couple things. 2 Anyway, what finally happened was I 3 heard later on that day or very early the next 4 morning, within a day at least, I got news from the 5 Cambridge office where I work that it was Randal 6 who broke in. That's how it was worded. 7 And then I saw Tim O'Reilly the next 8 morning and I was going to talk to him about it and 9 he had a funny look on his face like he knew 10 something. And when I told him I thought I knew 11 what had happened, he said that Randal had called 12 him and told him what was going on was that he was 13 the one that whatever and -- 14 Q So Mr. Schwartz contacted O'Reilly? 15 A Yes, right away. And he called me in the 16 Cambridge office. I wasn't there. I'm pretty sure 17 the same day that I got the news about the FBI with 18 a very -- nobody called. Never got a call from the 19 FBI. And anyway, I called him. He must have 20 called Tim like that night or in California, but 21 right away. 22 Q Now, after you learned about this, did 23 you eventually -- did you actually speak to 24 Mr. Schwartz about his using -- cracking the 25 passwords from the O'Reilly password file? 83 1 A I did talk to him. 2 Q And did you talk with him about why he 3 had done this? 4 A Yes, I did. 5 Q And what was his response? 6 A He said that he was -- I'm trying to 7 remember exactly, something like he was kind of 8 testing things out and he was curious to see how we 9 were maintaining our password security. And after 10 talking to him, I reinstated -- reinstated his 11 account. I had previously closed his account. 12 Q Why did you reinstate the account? 13 A Because I didn't think that what he had 14 done was so serious. And he was very up-front 15 about everything and I could kind of relate to 16 his -- I could kind of relate -- being a Systems 17 Administrator, I could kind of relate to what he 18 was trying to do, so that's why I did it. 19 And after talking with him, I really 20 didn't think that it was such a big deal, so I 21 reinstated his account. 22 MR. SUSSMAN: Thank you. 23 Your Honor, again, the -- my 24 argument is twofold. The evidence would be 25 objectionable to hearsay if it's being offered 84 1 strictly for the truth of the statements, but they 2 are also offered to show, as I've indicated, to 3 indicate Mr. Schwartz's state of mind. But also 4 Mr. Tintera has opened the door on this as proper 5 redirect when he started questioning Miss Herlick 6 about how she, as a Systems Administrator, would 7 handle probings from the Internet in attempts to 8 crack the passwords file. 9 And so it becomes proper redirect 10 based on that line of questioning and it also has 11 the additional relevance then. 12 THE COURT: Mr. Tintera. 13 MR. TINTERA: Judge, it is just -- 14 this has nothing to do with the case. In fact, the 15 defense filed a motion in limine to keep this -- 16 keep me from bringing this up in front of the jury, 17 which I did. That was one of their parts that they 18 didn't want to testify to. 19 THE COURT: About him running a 20 crack program against O'Reilly? 21 MR. TINTERA: Yes. 22 THE COURT: I recall that we 23 discussed -- you haven't offered any evidence to 24 that. 25 MR. TINTERA: I've tried not to. 85 1 THE COURT: I didn't ask whether you 2 tried. 3 MR. TINTERA: I don't think I have. 4 Now they're trying to bring in the defendant's 5 statements, which are hearsay, his state of mind in 6 regard to the O'Reilly case, which is not charged, 7 has nothing to do with the Intel case. 8 THE COURT: Mr. Sussman, is there 9 any indication that somewhere in the State's case 10 witnesses have talked about the defendant's conduct 11 in Cracking the password file at O'Reilly and 12 Associates? 13 MR. SUSSMAN: My recollection was 14 that was brought up during Detective Lilley's 15 testimony. And I would have to check my notes, but 16 when we were dealing with the motion in limine, it 17 was my recollection that the motion that the State 18 was going to be allowed to offer the evidence about 19 O'Reilly and James Deeble, the Tektronix book 20 incident, because they were contemporaneous and 21 showed the entire picture of what was happening at 22 that particular time. 23 What was not allowed was to be prior 24 acts involving ***Tandem and Tektronix, unless we 25 opened the door to that in our case. 86 1 THE COURT: I see here now, I'm 2 looking at this appendices that was supplied to me 3 when we were having argument on those issues, 4 Appendix A, first page, down -- Detective Lazenby's 5 testimony Item No. 2 reads, "Mr. Schwartz discussed 6 the use of the Crack program on the O'Reilly 7 system," and I wrote down "admissible." Did 8 Lazenby testify on that point today? 9 MR. TINTERA: No. I misunderstood 10 my notes. I did not ask him about that because I 11 put "okay" by it and I had assumed that meant that 12 the defendant's motion was okay and therefore not 13 to ask about it. 14 THE COURT: Now, nevertheless, 15 Mr. Sussman, you believe that Detective Lilley 16 talked about that? 17 MR. SUSSMAN: That is my 18 recollection. I do recall it being brought up and 19 I have a note here that there was some testimony 20 by -- certainly in Mark Morrissey's testimony, he 21 had talked about the password file from O'Reilly 22 being run with the Crack program as well. 23 Detective Lilley's testimony stuck in my mind, 24 but -- 25 THE COURT: I didn't see it there, 87 1 but -- 2 MR. SUSSMAN: But I don't see it in 3 my notes, which are incomplete, but it is in the 4 notes about Mark Morrissey's testimony. That was 5 in Mark Morrissey's testimony, he had testified 6 about going to the area of the -- where the Crack 7 program was running and he found it running in the 8 password file on O'Reilly. 9 THE COURT: And that was brought out 10 by Mr. Tintera, you believe? 11 MR. SUSSMAN: Yes, Your Honor. 12 THE COURT: Do you recall when that 13 was? Was that on -- initially on direct or 14 redirect or -- 15 MR. SUSSMAN: It was initially on 16 direct. 17 MR. TINTERA: Judge, my notes 18 indicate that he talked about the password file for 19 O'Reilly in the Supercomputer Division being on the 20 Snoopy computer. And that was in response to one 21 of my questions. 22 THE COURT: That was after they 23 found the Crack program running and they went to 24 his workstation, is that it? 25 MR. TINTERA: When he was talking 88 1 about the Snoopy computer. 2 THE COURT: When who was? 3 MR. TINTERA: On ***October 28 there 4 was a program running Crack and password file 5 existed from O'Reilly and the Supercomputer 6 Division. 7 THE COURT: I may not have written 8 that down. 9 Okay, I've sustained the objection. 10 You've made your offer of proof. It is a part of 11 the record. I'm not changing or modifying my 12 ruling. 13 We are in recess and -- 14 MR. SUSSMAN: Thank you, Your Honor. 15 Miss Herlick -- 16 MR. TINTERA: I don't have any 17 recross. 18 MR. SUSSMAN: Thank you very much. 19 That's the end of our testimony. 20 THE COURT: Thank you, Miss Herlick. 21 THE WITNESS: Thank you. You're 22 welcome. Bye-bye. 23 THE COURT: Thank you. We're in 24 recess until 1:30. 25 (Luncheon recess.) 89 1 AFTERNOON SESSION 2 BEGINNING AT 1:35 P.M. 3 JULY 19, 1995 4 5 (Whereupon, the following 6 proceedings were held in 7 open court, the jury being 8 present:) 9 THE COURT: Mr. Sussman, you may 10 call your next witness. 11 MR. SUSSMAN: We'd call Rick 12 Lahrson. 13 14 RICK LAHRSON 15 called as a witness on behalf of the Defendant, 16 having been first duly sworn under oath, was 17 examined and testified as follows: 18 19 THE CLERK: State your full name and 20 spell it for the record, please. 21 THE WITNESS: Rick Lahrson. 22 L-a-h-r-s-o-n. 23 24 25 90 1 DIRECT EXAMINATION 2 BY MR. SUSSMAN: 3 Q Where do you live? 4 A In Hillsboro. 5 Q How long have you lived in Hillsboro? 6 A Lived in Aloha 22 years and moved here a 7 year and a half ago. 8 Q What's your occupation? 9 A Computer consultant. 10 Q That covers a lot of things. What kind 11 of work do you do? 12 A Custom software and high-tech stuff, 13 mostly compilers. 14 Q Compilers? 15 A Those are language translators. 16 Q Now, do you know Randal Schwartz? 17 A Yes. 18 Q How do you know Randal Schwartz? 19 A We're friends. 20 Q How long have you known him? 21 A Probably around 15 years. 22 Q Now, has your association been strictly 23 friendly or through work or what areas? 24 A We haven't actually worked together in 25 computers. We're friends. We have worked together 91 1 in community service projects. Started a 2 charitable corporation together. 3 Q You and he share an interest in computers 4 and work that you talk about? 5 A Yes. We haven't worked together, but we 6 do understand each other's work and we talk about 7 that, sure. 8 Q Now, you mentioned that you and he set up 9 a charitable corporation, a community service 10 project together. How long were you and he 11 involved in this project together? 12 A Several years. I really don't know how 13 many. At least three. 14 Q How long ago was this? 15 A It was start in 1987. 16 Q And what was Mr. Schwartz's role and your 17 role in this project? 18 MR. TINTERA: Objection. Not 19 relevant. 20 MR. SUSSMAN: Just to lay the 21 foundation for the basis of the witness' opinion as 22 to character, Your Honor. 23 THE COURT: Overruled. Go ahead. 24 THE WITNESS: Say the question 25 again, please. 92 1 MR. SUSSMAN: Sure. 2 BY MR. SUSSMAN: 3 Q What was first your role, just in general 4 terms about your responsibilities in your role in 5 this charitable corporation that you were referring 6 to? 7 A Oh, I had the idea to start it and needed 8 help doing it. There was material to be written. 9 Randal is a writer, he's a friend, and I know that 10 he's concerned about the welfare of kids and the 11 general state of the world. So I asked him to help 12 me and he jumped on it. 13 Q Was his involvement limited to writing 14 things? 15 A No. He contributed ideas, too. 16 Q And anything else? 17 A He was my right hand on that. 18 Q Now, based upon your association with 19 Mr. Schwartz over the years and your conversations 20 with him and your work in this charitable 21 organization, do you have an opinion regarding 22 Mr. Schwartz's character for trustworthiness and 23 honesty? 24 A Yes. 25 Q And what is that opinion? 93 1 A I think he's a man of the highest 2 integrity, unimpeachable. 3 MR. SUSSMAN: Thank you. Nothing 4 further. 5 THE COURT: Mr. Tintera. 6 MR. TINTERA: Thank you, 7 Mr. Lahrson. I don't have any of questions for 8 you. 9 THE COURT: Thank you. You may step 10 down. 11 Call your next witness. 12 MR. SUSSMAN: We'd like to call 13 Allen Watson. 14 15 ALLEN WATSON 16 called as a witness on behalf of the Defendant, 17 having been first duly sworn under oath, was 18 examined and testified as follows: 19 20 THE CLERK: State your full name and 21 spell it for the record, please. 22 THE WITNESS: Allen Watson. 23 A-l-l-e-n W-a-t-s-o-n. 24 25 94 1 DIRECT EXAMINATION 2 BY MR. SUSSMAN: 3 Q Mr. Watson, how are you employed? 4 A I'm employed by the Washington County 5 Sheriff's Office. 6 Q In what capacity? 7 A Right now I'm assigned to the Detective 8 Division, Crime Analysis and Technical Support. 9 Q And what's involved in the Crime Analysis 10 and Technical Support? What responsibilities do 11 you have there? 12 A Basically, our task is to utilize 13 computers to attempt to develop crime trends and 14 then try to allocate man resources to those trends. 15 Also engaging computer systems throughout the 16 Sheriff's Office and provide training. 17 Q Do you have -- have you received any 18 specialized training for -- do you have any 19 specialized experience in working with computers 20 and analyzing computer evidence? 21 A Yes. In the early part of 1993, I 22 attended a two-week training session sponsored by 23 the International Association of Criminal 24 Investigations Specialists that deal with seizure 25 of computers and in the analysis of the data 95 1 contained on the computers. 2 Q And as a result of this training, have 3 you been basically the person in the Washington 4 County Sheriff's Office assigned to the analysis of 5 computer records and computer evidence? 6 A Actually, there is two of us. Myself and 7 Rick Smith. 8 Q In November of 1993, were you asked to do 9 any assessment of any evidence seized in the case 10 relating to Mr. Schwartz? 11 A Yes, I was. 12 Q What were you asked to do? 13 A Basically there were four computer 14 devices that had been seized, two notebook 15 computers and two hard drives, and I was asked to 16 take a look at the data contained on those hard 17 drives to see if there was any evidentiary value to 18 those hard drives. 19 Q And what did you have to do in order to 20 make a determination whether there was any 21 evidentiary value to those hard drives? 22 A Basically, the procedures that I 23 followed, and it varied a little bit from situation 24 to situation, but generally the first priority in 25 analyzing the data is to preserve the original data 96 1 that's on the system that you are analyzing. You 2 don't want to do any ***rights to the hard drive or 3 take a chance in erasing the data, so that was a 4 primary concern. 5 In other words, to accomplish that, 6 I would make copies of all the data that was 7 contained on the hard drives and copy it over to 8 another hard drive. In the process of doing that, 9 I used a program called Soft Lock, which is a 10 program that prevents any type of rights to the 11 hard drive that was employed on the devices that 12 were seized. 13 Once the copies were made of the 14 hard drive, then any erased files that were 15 contained -- that was still intact and contained on 16 the devices were then copied over to the working 17 drive. 18 So on the working drive, we have the 19 original files that were on the hard drive that I 20 was analyzing, plus any erased files that were 21 still present on the hard drive. Once I had those 22 in place, then I would run a program that would 23 check for viruses on the working drive that I was 24 working on. 25 I then employed a program called 97 1 Gopher, which you would specify keywords to the 2 Gopher program and the program would then go in and 3 search the hard drives for the occurrence of those 4 words anywhere on the hard drives, any of the 5 files. If it found the keywords, then it would -- 6 I'd prompt it to generate a list of those keywords, 7 along with three lines of text above and below 8 those keywords so you get an idea of how that key 9 word is being utilized. 10 Once that report was completed -- 11 and this program would do up to eight keywords at a 12 time, once that was complete, I would save it to a 13 floppy disk and take that floppy to another 14 computer and then print out a report. I would then 15 manually go through the report looking at the 16 occurrence of those keywords and looking for 17 anything that would be of evidentiary value. 18 After doing that, I would then go 19 back into the computer and look at the 20 applications, the programs, the files that were 21 contained within the hard drive and look for 22 anything else that may be of evidentiary value. 23 And basically that process was repeated four times, 24 once for each of the computers and also once for 25 each of the hard drives. 98 1 Q Now, not only did you do this process, 2 but when you were done, did you have somebody else 3 review the results of your searches? 4 A Yes. The hard copy, the printout of the 5 keywords that were searched presented a list to an 6 Intel employee by the name of Mark Morrissey, who 7 also reviewed that list. 8 Q Now, to do all of this kind of work, did 9 it require some special equipment and special 10 software? 11 A Yes, it did. 12 Q Was all of that software and equipment 13 available at the Washington County Sheriff's Office 14 when you were asked to do this? 15 A No, it was not. 16 Q Was it provided to you for the purpose 17 of -- 18 A Yes. 19 Q And who provided that? 20 A Basically the computer systems were 21 provided by Intel Corporation to assist us with the 22 analysis. And then the software, initially we paid 23 for it and Intel reimbursed it for us because we 24 didn't have a budget to purchase the software or 25 the hardware for this analysis. 99 1 Q By the way, you mentioned that this 2 program called Gopher, which allows you to retrieve 3 files and examine them for what was contained in 4 the files, did that program also take copies of 5 erased files and fragments of files and search for 6 them? 7 A The erased files were again copied from 8 the drives analysis, unerased and copied to the 9 working drive. So in essence they weren't erased 10 files, they were recovered files. 11 Q You were able to recovered all the files? 12 A Not all of them. If there was fragments 13 caused by writing programs over the top of them, 14 then I wouldn't be able to get all the files. 15 Q Now, you had mentioned that one of the 16 programs that you ran was a word search and you ran 17 a series of word searches. 18 A Correct, through Gopher. 19 Q And in preparing that word search, how 20 did you come up with what words to search or what 21 you were going to do? 22 A Well, basically, I contacted Intel and 23 asked for a list of words they felt were important. 24 But we also asked that the words not be common 25 place words. Obviously, if you were searching for 100 1 very common words, you would have a tremendous 2 amount of hits on that type. We're talking about 3 large amounts of data, so there is going to be a 4 large number of hits. 5 So we asked for words that were 6 fairly uncommon that would assist us in locating or 7 being able to locate the data contained on the 8 computers that may be of evidentiary value. 9 Q Now, if I submit to further help 10 illustrate this to the jury -- just to help 11 illustrate. 12 Do you recognize this list that's 13 been marked for purposes of identification 114? 14 A Yeah, looks like a list of the keywords 15 that were listed in my report. 16 Q These words, do you know what they were 17 supposed to be representing or why these words were 18 on the list? 19 A Some I did, some I didn't. Some didn't 20 make sense to me. 21 Q What was the list of names that you knew 22 were on there, what were they for? 23 A Some were names of computer systems and 24 some were obvious words like "profile" and "crack." 25 Some were names of individuals that were e-mail 101 1 names on the system. 2 Q And in general, through this list, what 3 were you searching for? 4 A Again, I was searching for these keywords 5 and once they were located, to look at the 6 occurrence of the keyword to see if they were with 7 the information contained on either side of that 8 keyword, whether it appeared to be something that 9 was of evidentiary value. 10 Q By that you mean you were looking for 11 information that might have been proprietary 12 information from Intel that was taken from the SSD 13 file? 14 A The proprietary information from Intel, 15 yeah, or an indication of cracking programs, that 16 type of thing. 17 Q As a result of your search, Detective 18 Watson -- you were a detective at the time? 19 A Actually, I'm a forensic science 20 technician. It's confusing. 21 Q As a result of that search, did you find 22 anything of evidentiary value in Mr. Schwartz -- in 23 the files from Mr. Schwartz's computers, computer 24 records that were seized from his home? 25 A No, I did not. 102 1 Q One last question just to clarify 2 something. You had mentioned that fragments of the 3 erased files that were written over, were they also 4 copied by the Soft Lock program? 5 A Not by Soft Lock. Again, without getting 6 into generalities -- or specifics, rather, in some 7 case we did what is called a mirror image of the 8 hard drives, which that would have copied 9 everything. However, on the computers themselves, 10 we were unable to do a mirror image, so we copied 11 files so then that particular case would not have 12 copied the fragments. 13 Q So you did look at the mirror image of 14 some of the computers and on others you looked at 15 all of the files that were recovered? 16 A Correct. Some of them we were able to 17 look at all the files. Some of them we weren't 18 able to look at everything. Again, we didn't want 19 to take a risk on damaging anything on the original 20 hard drives. 21 Q And again, in looking at all of those 22 materials, and using that word search, you were not 23 able to find anything? 24 A No. 25 MR. SUSSMAN: Thank you. Nothing 103 1 further. 2 THE COURT: Mr. Tintera. 3 4 CROSS-EXAMINATION 5 BY MR. TINTERA: 6 Q Mr. Watson, was one of the machines or 7 computers that you examined a MacIntosh 170 Power 8 Book? 9 A No. I believe it was a 160 and 165C. 10 The 170 was one donated by Intel to do the analysis 11 with. 12 Q And why was it that this equipment had to 13 be borrowed from Intel? 14 A Because we did not have the equipment in 15 place for the budget to do the analysis. The 16 MacIntosh system is not something we normally deal 17 with. 18 Q So you're set up to handle what types of 19 systems? 20 A Basically the X86 base systems, IBM-based 21 systems. 22 Q So MacIntosh and IBM are kind of like oil 23 and water when it comes to analysis? 24 A Correct. 25 Q Did the computers that you analyzed that 104 1 were Mr. Schwartz's, did they have anyplace to put 2 a floppy disk in? 3 A Yes, they did. 4 Q And if you -- show you State's Exhibit 5 17. What's this? 6 A Three-and-a-half floppy disk. 7 Q Is that the kind of thing the Power Book 8 on the MacIntosh would take? 9 A Yes, it is. 10 Q What does this floppy disk on a 11 MacIntosh, what does it do? 12 A Restores data programs. It's a storage 13 mechanism. 14 Q So stores it on the disk instead of the 15 hard drive? 16 A Correct. The hard drive and floppy disk 17 both store information. 18 Q If you copy information from a source to 19 the floppy disk, what trace does that leave on the 20 hard drive? 21 A It can be done without leaving any trace. 22 Q So you wouldn't know? 23 A Correct. 24 MR. TINTERA: That's all I have. 25 105 1 REDIRECT EXAMINATION 2 BY MR. SUSSMAN: 3 Q Mr. Watson, Mr. Schwartz's floppy disks 4 were also seized and presented to you for review? 5 A No, they were not. 6 Q And were any floppy disks presented to 7 you? 8 A I don't have the original file here to 9 look at exactly what was seized, but I don't -- 10 there may have been a few that were seized and I 11 believe that we looked at a few of them, but from 12 my understanding, it was very small sampling of 13 what was at the house. 14 MR. SUSSMAN: Thank you. Nothing 15 further. 16 17 RECROSS-EXAMINATION 18 BY MR. TINTERA: 19 Q So you didn't examine the 2,000 floppy 20 disks approximately that were at Mr. Schwartz's 21 house? 22 A No, they were not seized. 23 MR. TINTERA: That's all I have. 24 THE COURT: Thank you. You may step 25 down. 106 1 Call your next witness. 2 MR. SUSSMAN: Call Linda Cline. 3 4 LINDA CLINE 5 called as a witness on behalf of the Defendant, 6 having been first duly sworn under oath, was 7 examined and testified as follows: 8 9 THE CLERK: State your full name and 10 spell it for the record, please. 11 THE WITNESS: Linda Cline. 12 C-l-i-n-e. 13 14 DIRECT EXAMINATION 15 BY MR. SUSSMAN: 16 Q Miss Cline, how are you employed? 17 A I'm employed at Intel as a software 18 developer. 19 Q And what does a software developer do? 20 A Develop software. 21 Q For those of us who are not quite so 22 familiar with the software and computer industry, 23 what does that mean when you say you develop 24 software? 25 A Well, for me, it varies from working on 107 1 systems software to working on application level 2 programs, writing software from scratch or 3 modifying software that others have written. 4 Q How long have you been employed at Intel? 5 A For four years. 6 Q And are you working at a particular 7 section or division of Intel now? 8 A I just transferred. For the last four 9 years, I've been working at the Supercomputer 10 Division, hired on first at the IWARP group and 11 then working on the Paragon, and I just took a 12 transfer to a software lab working on PCs. 13 Q And when you were working at the 14 Supercomputer group, did you have the occasion to 15 work with or know Randal Schwartz? 16 A Yes. 17 Q And how was it, in what capacity was 18 that? 19 A He was our Systems Administrator. 20 Q And which group was that in when he was 21 the Systems Administrator? 22 A IWARP. 23 Q IWARP? 24 A Uh-huh. 25 Q And what kind of group -- what was IWARP? 108 1 A IWARP was a Supercomputer project that 2 was sponsored by ARPA and was a joint project 3 between Intel and Carnegie Mellon. 4 Q Carnegie Mellon? 5 A University. 6 Q Where is that located? 7 A Pittsburgh, Pennsylvania. 8 Q And what period of time were you working 9 with Mr. Schwartz when he was a Systems 10 Administrator? 11 A From the time I started, which was in 12 mid-1991, to the time that he left, which I think 13 was late 1992. I'm not sure exactly. 14 Q Now, while you were -- Mr. Schwartz was 15 your Systems Administrator at IWARP while you were 16 there, did you have any experience with 17 Mr. Schwartz working on or running tests or doing 18 anything to test the security of the passwords, 19 with the security of the group that he was 20 administering? 21 A He had a password-cracking program that 22 was run automatically and I received e-mail 23 notification, I think, about three times that my 24 password had been cracked. 25 Q And do you know what kind of password- 109 1 cracking program that was? 2 A I'm not familiar with it. 3 Q And how often would he run this password- 4 cracking program? 5 A I don't know exactly how often. I know 6 that -- I believe one time -- 7 MR. TINTERA: I think the question 8 has been answered. I'd object to any further -- 9 THE COURT: Sustained. Don't guess 10 or speculate. 11 BY MR. SUSSMAN: 12 Q How often do you remember the program 13 being run? 14 A I don't know how often it was run. 15 Q No. Clarify the question. You had 16 experience with it being run on more than one 17 occasion? 18 A Yes. 19 Q And what was your experience in how the 20 program was run and how it was implemented as it 21 affected you? 22 A I don't understand the question. 23 Q You were starting to say on one occasion 24 you recall the password-cracking program was run. 25 A Yes. 110 1 Q Would you explain what happened on that 2 occasion? 3 A I had received notification that my 4 password had been cracked and I changed my 5 password. And it was a short time later, probably 6 within a couple months, that I was cracked again. 7 Q And then was that -- were those the first 8 two times that this happened? 9 A I don't recall. 10 Q Was there another time after that that 11 the test had been done and you got a message that 12 your password was cracked? 13 A I don't recall if the other time that I 14 was cracked was before or after that. 15 Q Were those -- do you know how those 16 e-mail messages telling you your password was 17 cracked was generated? 18 A I believe that they were generated by use 19 of a ***cron job. 20 Q What does that mean? 21 A That is an automated way of running a 22 program with no human intervention where it is 23 based on periods of time between each time the 24 program is run. 25 Q So it would automatically send the e-mail 111 1 message telling you that your password was cracked? 2 A That's my belief. 3 Q Were you notified before these 4 password-cracking programs were run that this was 5 going to be done? 6 A I don't remember if I was warned. 7 Q Did Mr. Schwartz ever come to you or give 8 any notification to members of the group saying, 9 "I'm going to run a password-cracking program 10 to" -- 11 A Oh. I don't believe so, no. 12 Q Aside from testing the security of the 13 system that Mr. Schwartz was administering, did he 14 have any other responsibilities as far as the 15 systems for -- that you were working on, whether it 16 be for e-mail or access to the Internet or anything 17 like that? 18 A He maintained a number of programs for us 19 on the systems that had to do with our environment, 20 our working environment. 21 Q And when you refer to working 22 environment, again remember a lot of us don't 23 understand all the terminology. What do you mean 24 by "working environment"? 25 A Software such as X Windows and compilers 112 1 such as GCC for us to use. 2 Q And X Window does what? 3 A It's a window -- it's windowing software 4 that you can run on your display to use the 5 computer using Windows. 6 Q And the other thing, compiler program or 7 thing that you mentioned, what is that? 8 A A compiler will compile a program from 9 source, from a source language to an executable. 10 Q And an executable is? 11 A Is a file that can be executed on the 12 computer system. 13 Q So carrying out a function or read on the 14 screen? 15 A Right. 16 Q How would you describe Mr. Schwartz's 17 skills and abilities with UNIX and as an 18 administrator? 19 A Very highly. He was our best Systems 20 Administrator at the time. 21 Q Did you have the opportunity to deal with 22 Mr. Schwartz when -- if you had any technical 23 problems? 24 A If I had questions about the network or 25 certain software pieces, I would go to him with 113 1 questions. 2 Q And what was Mr. Schwartz's typical -- 3 sort of his habit of dealing with -- how he 4 responded to problems that you brought to him? 5 A He typically knew the answers. 6 Q And was he accessible and helpful in 7 helping solve those problems? 8 A He was helpful. 9 MR. SUSSMAN: Thank you. Nothing 10 further of this witness. 11 12 CROSS-EXAMINATION 13 BY MR. TINTERA: 14 Q How long have you been involved in 15 working with computers? 16 A For approximately 16 years. 17 Q And do you drive a car? 18 A Yes. 19 Q So you're licensed to drive a car? 20 A Yes. 21 Q Would you agree with me that over your 16 22 years of experience with computers, you've learned 23 things that are right and wrong about use of 24 computers? 25 A Yes. 114 1 Q So your experience in using computers has 2 taught you things to do and not do that you didn't 3 know when you were a neophyte user? 4 A That's probably true. 5 Q You're not with SSD anymore? 6 A That's correct. 7 Q And so can you go back to your accounts 8 there? 9 A Right now I am because I'm still in the 10 middle of transition work with them. 11 Q And what will happen when you are done 12 with transition? 13 A I don't know. 14 Q They'll be disabled, won't they? 15 A It could be. 16 Q And this e-mail notice of cracked 17 passwords, that was the best you recall an 18 automatic notice that you got? 19 A That was my belief. It would be a lot of 20 work to do it by hand. 21 Q When did Mr. Schwartz leave the 22 Supercomputer Division? 23 A I don't recall. I believe it was late 24 1992. 25 MR. TINTERA: Those are the only 115 1 questions I had. Thank you. 2 THE COURT: Mr. Sussman? 3 MR. SUSSMAN: Nothing further of 4 this witness. 5 THE COURT: Thank you. You may step 6 down. 7 Call your next witness. 8 MR. SUSSMAN: Call James Reinders. 9 10 JAMES REINDERS 11 called as a witness on behalf of the Defendant, 12 having been first duly sworn under oath, was 13 examined and testified as follows: 14 15 THE CLERK: State your full name and 16 spell it for the record, please. 17 THE WITNESS: James Reinders. 18 R-e-i-n-d-e-r-s. 19 20 21 22 23 24 25 116 1 DIRECT EXAMINATION 2 BY MR. SUSSMAN: 3 Q Mr. Reinders, how are you employed? 4 A I work for Intel. 5 Q And in what capacity do you work for 6 Intel? 7 A I'm an engineer. 8 Q Where you are you working now, what 9 section, what branch? 10 A I'm an employee of the Microprocessors 11 Division. 12 Q Where is that located? 13 A My office is in the Cornell Oaks 14 facilities. 15 Q How long have you worked at Intel? 16 A I've worked for Intel since February of 17 1989. A little over six years. 18 Q How long have you worked in your present 19 position? 20 A I just changed managers in the beginning 21 of this month, so I guess about 18 days that I was 22 at this position. 23 Q Still getting used to it? 24 A Yes. 25 Q Where had you worked -- well, when you 117 1 start there in 1989, where were you working at that 2 time? 3 A I was working on a project called IWARP. 4 Q Was that sort of overall within the SSD 5 part of Intel? 6 A It was not part of SSD at that time. 7 Q What was the circumstance? What were the 8 relationships then between IWARP and SSD? 9 A They were separate entities within Intel. 10 Separate projects. They had no formal 11 relationship. IWARP was started a few years after 12 SSD and IWARP was operated a lot like a startup. 13 We had pretty much our own engineers and designers 14 and Systems Administrators all in one group. 15 Q Sounded like it was pretty autonomous 16 for -- 17 A That would be accurate, yes. 18 Q Was that unusual at Intel at that time 19 that there were a lot of groups that were maybe 20 separate or autonomous or had -- acted like little 21 startups? 22 A It was my impression that it was perhaps 23 not normal in Intel, but it certainly wasn't the 24 only group like that. 25 Q Now, in the course of your employment at 118 1 Intel, did you happen to get to know Randal 2 Schwartz? 3 A Yes. 4 Q How do you know Randal Schwartz? 5 A Randal was employed as a contractor with 6 a Systems Administration group within the IWARP 7 project. 8 Q You mentioned that he was a contractor. 9 Were you a contractor or an employee? 10 A I was an employee. 11 Q Was there a difference in your 12 understanding between employees and contractors in 13 terms of how things were done and what their duties 14 or responsibilities were? 15 A There were certainly differences, yes. 16 Q What was your understanding of the 17 differences? 18 A I think the primary difference was an 19 employee was someone that you would develop and 20 would have a manager that would supervise and a 21 contractor is someone that you would hire to do a 22 set of tasks and that you were employing them for 23 their knowledge at that point, or what they would 24 develop on their own. 25 Q Now, what was Randal Schwartz's position 119 1 at IWARP when you arrived there? 2 A I don't think Randal worked for IWARP 3 when I started. 4 Q What period of time were you -- 5 A I start in February of 1989. As I 6 recall, Randal started sometime later that year. 7 Roughly within a year of my starting. 8 Q So what period of time did the two of you 9 work together? 10 A From when he started until, I think, 11 roughly mid-1992, when the IWARP project was 12 winding down. 13 Q And as it was winding down, was there a 14 change in the status of the overall SSD Division? 15 A Yes. Before the project was terminated, 16 we were reorganized and incorporated into the 17 Supercomputer Division called SSD. 18 Q So it was getting more centralized? 19 A Yes. 20 Q Before IWARP and SSD became more 21 centralized, how much, for want of better word, 22 local control was there over IWARP in the way you 23 got your jobs done? 24 A I'd say IWARP was very autonomous. We 25 made our own decision about staffing, about -- 120 1 about how we operated our equipment, how we managed 2 our people. I'd describe it as very autonomous to 3 Intel. 4 Q As part of the project at IWARP, was 5 there a particular client or academic institute 6 that you were particularly in close contact with? 7 A Yes. We were doing work for the 8 government under our contract and we worked with 9 Carnegie Mellon University, who were the 10 originators of the idea and who had come and 11 ultimately caused us to be part of the project. So 12 we worked very closely with a number of people at 13 Carnegie Mellon University. 14 Q When you worked closely with people at 15 Carnegie Mellon University, does that mean you were 16 always going back and forth to Pittsburgh, or was 17 there a lot of communication over -- through the 18 computer networks? 19 A We did both. We did quite a bit of 20 travel back and forth, especially some select 21 people, and we did an awful lot of communication 22 electronically. 23 Q How important was the electronic 24 communication in being able to do the work? 25 A It was critical to getting our jobs done. 121 1 Q And were you one of the people who did 2 some traveling? 3 A Yes. 4 Q You say you went to Pittsburgh? 5 A Yes. 6 Q What did you do when you went to 7 Pittsburgh as far as being able to have access to 8 your work site or workstation back here in Oregon? 9 A Some of our equipment at Intel was 10 available to us on the Internet and we would -- I 11 could establish connections back across the 12 Internet and work almost as effectively as I could 13 at my own workstation at the office. 14 We would do things called popping 15 windows where we could edit documents, work on 16 programs. I worked on some software that I would 17 build, but rather than put it all on a tape and 18 take it to Pittsburgh and work on it, that was 19 impractical, I would use the Internet to get access 20 to the systems back at IWARP and do my work while I 21 was in Pittsburgh. 22 Q Would you be making connection from -- 23 where were those connections made from, were they 24 made from Carnegie Mellon into Intel? 25 A Yes. 122 1 Q So then was there a two-way connection 2 set up at Intel allowing outbound information to 3 Carnegie Mellon and inbound connections from 4 Carnegie Mellon? 5 A Yes. From the select systems that were 6 in Intel, we could initiate communication in either 7 direction and we definitely did. 8 Q Did Randal Schwartz have any role in 9 helping to set up or work on the system that was -- 10 that would allow that two-way access to occur? 11 A Yes. It was part of Randal's job as a 12 contractor to help ensure that we could make these 13 connections. And on more than one occasion before 14 I traveled to Pittsburgh, I would discuss with 15 Randal the things that I wanted to do and Randal 16 would make sure that things like my electronic 17 e-mail or ***E-Max, which is our editor for 18 modifying programs, make sure those would be 19 available to me while I was in Pittsburgh. 20 Q So while you were in Pittsburgh through 21 this program, this thing that was set up, you could 22 kind of draw up like a window from your computer in 23 Oregon and look at material or information that was 24 in your computer back here? 25 A Yes. I could do essentially anything I 123 1 could have done from my desktop in my office and 2 could bring up charts, programs, read electronic 3 e-mail. 4 Q Now, were you aware of any policies at 5 Intel against having connections like that? 6 A The policy at Intel that I was aware of 7 was that Intel hooks most of its computers together 8 in the entire company around the world in a network 9 that we call our internal network. It was my 10 understanding that machines on the Internet and 11 machines on the internal net couldn't be the same 12 machine. So that's why I said there were a select 13 number of machines that we made available on the 14 Internet and they were logically connected to each 15 other. 16 And then there were machines that 17 held proprietary information that we would not make 18 available on the Internet. For instance, the IWARP 19 project was a design project to design a microchip 20 and the machines used by the people doing the 21 design of the microchip, I could not have accessed 22 while I was at Carnegie Mellon. 23 Q So steps were made to make sure that 24 nothing could get into -- also coming into Intel, 25 get into places where there was proprietary 124 1 information? 2 A Correct. 3 Q Was this two-way access essential to you, 4 to getting your job done? 5 A It was critical for us to maintain the 6 good relationship we had with Carnegie Mellon, the 7 open atmosphere that we used to conduct our 8 business under the contract. 9 Q Was Mr. Schwartz also responsible for 10 testing the security of your computer and computer 11 systems while you were there? 12 A Yes. Randal definitely played a role in 13 insuring that we had proper security. 14 Q And what was the role that he played? 15 A Well, one thing in particular that stands 16 out in a lot of people's mind at IWARP, and I 17 definitely remember is one of the most obvious 18 security holes in a security system is something 19 called a password, which is when I type in my name, 20 it will ask me to type in the code that I'm only 21 supposed to know. 22 But a common method of breaking into 23 computers is to -- once you know the name of a 24 person is to start guessing obvious things like 25 dates or words out of the dictionary. And since 125 1 there is only 365 days in a year and only so many 2 words in a condensed dictionary, doesn't take very 3 long to try all of those. Unfortunately, people 4 use those as passwords. 5 Randal had a program that would 6 automatically try to break into people's accounts, 7 and when it broke in, it would send us a piece of 8 electronic e-mail saying, "Your account has an 9 obvious password. Please change it." 10 And I was the recipient of one of 11 those pieces of e-mail for a project account that 12 we shared among team members, and unfortunately, we 13 chose a pretty obvious word that was in the 14 dictionary and his program cracked it. Even though 15 this was annoying to engineers, it was an important 16 piece of security. 17 Q So Mr. Schwartz had a reputation around 18 there for being very security conscious? 19 A Yes, he definitely enhanced the security 20 of the systems in the IWARP project. 21 Q And those obvious guessable passwords 22 then created perhaps a risk or were a detriment to 23 the security system? 24 A Yes, definitely. 25 Q When Mr. Schwartz would run these 126 1 password programs, did he let you know in advance 2 that he was going to do the testing now and check 3 on the passwords to see if they were any good? 4 A No. The program, to the best of my 5 knowledge, ran automatically. And every night we 6 have a process that we call a demon process. It's 7 an automatic process that would do this, so as far 8 as I knew, it was always running cracking people's 9 passwords every night. 10 Q So it would sort of set up these programs 11 to run automatically to function to help this part 12 of the job that he was doing? 13 A Yes. To make sure that we weren't -- one 14 thing an engineer will definitely do is change 15 their password back. If they get caught with an 16 obvious password, they might change it something 17 hard to remember for a while and change it back. 18 The only way to prevent that is to actively look to 19 see if they've done that. 20 Q So that warning you in advance that he 21 was going to run a crack program would kind of 22 defeat the purpose of testing the security? 23 A That would -- 24 MR. TINTERA: Objection. Leading. 25 THE COURT: Sustained. 127 1 BY MR. SUSSMAN: 2 Q How would warning you in advance of the 3 test on the password by running a crack program 4 affect the effectiveness of -- 5 A I definitely know that some of us would 6 change our passwords to something harder to 7 remember and then change them back after the danger 8 was passed. 9 MR. SUSSMAN: Thank you. I've got 10 nothing further of this witness. 11 THE COURT: Mr. Tintera. 12 13 CROSS-EXAMINATION 14 BY MR. TINTERA: 15 Q Mr. Reinders, the Carnegie Mellon 16 electronic connection that you mentioned from there 17 to Intel, when was that timeframe? 18 A The entire time I worked on the project 19 from '89 to '92, we had such a connection. 20 Q And was that secured at all? 21 A I'm not sure I understand. 22 Q Did it have any security associated with 23 it? 24 A When you want to log into a computer, you 25 give a password. That would be the security. So 128 1 someone coming in over the Internet, the only 2 security would be whether you knew the name of the 3 account and the password to get onto the account. 4 Q And that system is not in effect anymore, 5 is it? 6 A There are still machines within Intel 7 that can be accessed that way, but I don't believe 8 there is as many machines as there were when I 9 worked on the project. 10 Q Is that part of the Defender system, do 11 you know? 12 A The Defender system is a security system 13 used at Intel to allow you access to machines with 14 proprietary information on them. And that's not 15 what I was referring to. 16 Q So these machines do not contain any 17 proprietary information that you could access; is 18 that right? 19 A Right. The machines that are on the side 20 of the fire walls, what we call it, that are 21 accessible from the Internet would not contain any 22 proprietary information. 23 Q On what side of the fire wall? 24 A On the Internet side. 25 Q So they are on the outside of the fire 129 1 wall? 2 A Yes. 3 Q So these are machines that if you think 4 of the fire wall as the moat around the castle, 5 these machines are on the outside of the moat; is 6 that what you are saying? 7 A Yes. 8 Q And the king's gold being inside the 9 moat, that's the proprietary information? 10 A Correct. 11 MR. TINTERA: Thank you. That's all 12 I have. 13 14 REDIRECT EXAMINATION 15 BY MR. SUSSMAN: 16 Q Do you remember which machine was on the 17 inside -- the Intel side of the connection to CMU 18 when Mr. Schwartz was? 19 A On the inside, you mean like king's gold 20 side? 21 Q Right. 22 A The majority of the machines at Intel 23 would have been within the IWARP project. It would 24 have been the machines that contain the circuit 25 design information. I'm not sure I can remember 130 1 any specific names of the machines. 2 Q Do you remember was there a machine in 3 the group called IWARP-R? 4 A Yes, there was. I don't recall which 5 side of the ***to polling that was on. 6 Q Was that one of the machines that was 7 connected, had this two-way connection to Carnegie 8 Mellon? 9 A I honestly don't remember. It could have 10 been. It may not be. 11 MR. SUSSMAN: Thank you. Nothing 12 further. 13 MR. TINTERA: No further questions. 14 THE COURT: Thank you. You may step 15 down. 16 Call your next witness. 17 MR. SUSSMAN: Call Seth Bradley. 18 19 20 21 22 23 24 25 131 1 SETH BRADLEY 2 called as a witness on behalf of the Defendant, 3 having been first duly sworn under oath, was 4 examined and testified as follows: 5 6 THE CLERK: State your full name and 7 spell it for the record, please. 8 THE WITNESS: Seth Bradley. 9 B-r-a-d-l-e-y. 10 11 DIRECT EXAMINATION 12 BY MR. SUSSMAN: 13 Q Where do you live? 14 A In Aloha. 15 Q How long have you lived in the area? 16 A Over five years. 17 Q Are you employed now? 18 A Yes. 19 Q And will you tell the jury where you are 20 employed? 21 A Intel. 22 Q How long have you been working at Intel? 23 A Over seven years. 24 Q And what's your present position there? 25 A Senior Systems Administrator. 132 1 Q And which location or site are you senior 2 Systems Administrator? 3 A Cornell Oaks. 4 Q How long have you been in that position 5 at Cornell Oaks? 6 A At that particular campus? 7 Q Yes. 8 A Ever since I've been in Oregon, so over 9 five years. 10 Q And you would have been in that position 11 then in 1991 through 1992 at Cornell Oaks? 12 A That's correct. 13 Q Did you have -- during your time at 14 Intel, did you happen to know or have any 15 opportunity to get to know Randal Schwartz? 16 A Yes. 17 Q How was that? How did you get to know 18 Mr. Schwartz? 19 A I directed his work from the time I 20 started IWARP, which was in early '90, until when I 21 left that organization go for another in late '91. 22 MR. TINTERA: I didn't hear when he 23 left. 24 THE WITNESS: Late '91, fall of '91. 25 133 1 BY MR. SUSSMAN: 2 Q What was your position then and what was 3 Mr. Schwartz's position during the time that the 4 two of you were working together? 5 A I was the lead Systems Administrator for 6 IWARP at that time and Randal was a contractor 7 Systems Administrator. 8 Q You say he was a contractor Systems 9 Administrator. As a contractor Systems 10 Administrator, did he have -- was there a 11 difference in the way that you approached directing 12 Mr. Schwartz's work as opposed to somebody like 13 yourself who was, I gather, a full-time employee? 14 A Yes. With a contractor, it's a less 15 involved position because they are more 16 self-directed. You're not responsible for their 17 career growth. Not responsible for things of that 18 nature. 19 Q Are you able to direct the specific 20 day-to-day details of how an independent contractor 21 like Mr. Schwartz did his job? 22 A Yes. 23 Q And as an independent contractor, were 24 there limits on the amount of specific control you 25 had over how Mr. Schwartz did his job? 134 1 A Could you elaborate on that, please? I'm 2 not quite sure what the question is. 3 Q Were there limits, policy at Intel on the 4 extent that you could control the details of how an 5 independent contractor did his job? 6 A Not really. Generally you don't get into 7 as great a detail with a contractor as you do -- at 8 least in my experience, as you do with a 9 direct-report or something like that. 10 Q Putting it a different way, would you set 11 goals for an independent contractor, say, "This is 12 what we want"? 13 A Yes. 14 Q And in setting the goals, did you -- how 15 much control did you have over the -- or would you 16 have over the methods that the contractor used? 17 A Generally a fair amount of control. 18 Q What were Mr. Schwartz's responsibilities 19 in the area for the systems that he was 20 administering? 21 A He had a fairly broad set of 22 responsibilities. He did central network 23 administration. He wrote programs, scripts for 24 Systems Administration, including backups. He 25 maintained the public domain software. That's 135 1 mostly what he did. 2 Q And when you say maintaining of the 3 public domain software, what do you mean? 4 A That's software that's freely available 5 on the Internet. And a large part of the tools 6 they use in the UNIX environment is public domain 7 software. 8 Q And so did that -- did those 9 responsibilities include a responsibility for 10 keeping connections with the Internet and the 11 machines at IWARP? 12 A Yes. 13 Q Did Mr. Schwartz have any security 14 responsibilities for the systems that he was 15 administering? 16 A Yes. Along with myself, he was largely 17 responsible for security. 18 Q At the time that you arrived at SSD, was 19 there a particular group that Mr. Schwartz was 20 working in? 21 A Excuse me? 22 Q What was the group at SSD that -- 23 A IWARP was an independent organization. 24 Q Was Mr. Schwartz working at SSD or IWARP? 25 A IWARP. 136 1 Q Was there some kind of transition going 2 on in terms of IWARP and SSD at the time that you 3 arrived? 4 A No. 5 Q During the time that you were there, was 6 there some kind of transition then in terms of -- 7 A Not until after I had left. 8 Q At the time that you were leaving then, 9 what was taking place in terms of IWARP's 10 relationship to SSD? 11 A Nothing, really. It remained an 12 independent organization. 13 Q As an independent organization during the 14 time that you were there, was -- how would you 15 describe the kind of -- the relationship that IWARP 16 had to sort of the overall SSD Division -- was it 17 closely centralized authority, was there a lot of 18 local authority on how things were done? 19 A The organization was in some ways allied 20 with SSD, since we were working on similar 21 projects. However, it was largely independent. 22 Q I didn't hear the last part of your 23 answer. 24 A I said while we were somewhat allied with 25 SSD, working on similar projects, we were largely 137 1 independent. 2 Q That independent, did that have any 3 bearing on how you develop your practices within 4 that group that were required to get the specific 5 jobs done that you were working on? 6 A Not really. 7 Q Now, did IWARP at the time you were -- 8 you and Mr. Schwartz were at IWARP, did IWARP have 9 its own Internet connection? 10 A IWARP shared one with SSD. 11 Q Did IWARP have any kind of separate 12 connection to Carnegie Mellon University? 13 A It's hard to answer that without going 14 into a lot of technical detail. 15 Q Was there a connection from IWARP through 16 the Internet to Carnegie Mellon? 17 A Yes. 18 Q Was that a corporate connection or was 19 that a connection that was located -- that was sort 20 of separate for IWARP? 21 A You don't really have a connection, 22 separate connection via the Internet. We basically 23 shared the connection with SSD and that -- imagine 24 this as one connection, and we shared that to use 25 to connect to Carnegie Mellon. 138 1 Without going into a lot of depth, I 2 don't know how else to say it. 3 Q The link with Carnegie Mellon, was that a 4 one-way link, two-way link? 5 A Two-way. 6 Q Why was there a two-way link set up with 7 Carnegie Mellon? 8 A Basically because we were working at that 9 time with Carnegie Mellon and it was -- that was 10 basically -- we were working cooperatively with 11 Carnegie Mellon to develop the products we were 12 working on. 13 Q Was there a policy at Intel at that time 14 against having inbound connections on the Internet? 15 A Yes. 16 Q And so you had a two-way connection at -- 17 A At one time. Until I learned of the 18 nature of the connection, yes. 19 Q And was that two-way connection important 20 for IWARP to get the job that you were working on 21 done more efficiently? 22 A Again, it's a fairly complex issue. I 23 believe not. 24 Q But it just made it easier to do the job? 25 A That's correct. 139 1 Q Did Mr. Schwartz have any responsibility 2 as far as the programming or making of the network 3 or the routers, the hardware, the routers that set 4 up those connections for Carnegie Mellon? 5 A Yes, he set up the router. 6 Q Explain what that means. 7 A Explain -- 8 Q What does it mean when you say "set up 9 the router"? 10 A In this case, a router was a fire wall 11 between us and the rest of the Internet. How the 12 router is programed determines what connections can 13 come in and which connections can go out. 14 Q So it was Mr. Schwartz's job then to 15 program the router to -- that controlled the 16 inbound and outbound connections? 17 A That's correct. 18 Q You said that there was -- you made 19 reference to policies about connections. And at 20 the time that this was going on, were there 21 well-known central comprehensive security policies 22 in effect? 23 A There were policies that were available. 24 That's basically it. 25 Q Was it really clear about -- to the -- 140 1 was it clearly disseminated? 2 A It was disseminated by a number of 3 different means. They were generally available. 4 Q Did you specifically provide Mr. Schwartz 5 with copies of security manuals or security 6 memoranda or anything? 7 A We generally discussed those, the 8 contents of those policies, yes. 9 Q Do you recall specifically providing any 10 manuals or security memoranda to Mr. Schwartz? 11 A I don't recall that specifically. 12 Q How would you describe Mr. Schwartz's 13 level of skill, particularly with UNIX systems? 14 A Extremely high. 15 Q And is it sufficiently high that if 16 Mr. Schwartz was working on a -- chose to run a 17 program on a system, that he could cover his tracks 18 in a way where nobody would find it? 19 A It's my opinion that he could. 20 Q At the time that you were -- we're 21 talking about with you and Mr. Schwartz working 22 together, were there any differences in the type of 23 training that was given to contractors and regular 24 employees? 25 A As far as benefits is concerned, they 141 1 didn't have access to school compensation or 2 compensation for professional conferences. 3 Q Were there differences in terms of 4 meetings that contractors attended and employees 5 attended? 6 A Not to my knowledge. 7 Q You mentioned before that Mr. Schwartz 8 had responsibility for security on the systems that 9 he administered. What would -- in your experience 10 would Mr. Schwartz do in that capacity to test the 11 security of the systems that he was administering? 12 A He did a variety of functions. He ran 13 the Crack program to test passwords, to see if 14 anybody had any easily breakable password. He 15 later on set up routing fire walls so that we could 16 not be compromised from the outside. 17 Basically checked to make sure 18 that -- again, this is getting fairly technical, 19 that set user ID programs wouldn't be able to be 20 compromised by somebody who was hacking with the 21 system. 22 Q Did Mr. Schwartz have root access on the 23 system -- on the computer systems that he was 24 administering? 25 A Yes, he did. 142 1 Q So that -- what kind of access did that 2 give him to the computers that had proprietary 3 information? 4 A He had access to all the proprietary 5 information in our particular domain, which is 6 IWARP. Not outside that domain. 7 Q When Mr. Schwartz would run these crack 8 programs to test the passwords, was that something 9 that you specifically authorized him to do? 10 A No. He did it on his initiative and I 11 approved it. 12 Q Was it Mr. Schwartz's habit to advise you 13 or the other people in the group before he ran the 14 Crack program that he was going to do that? 15 A I've been trying to remember that and I 16 can't really recall. I'm sorry. 17 Q But you approved then of the way that he 18 ran the Crack program to test security? 19 A Yes. 20 Q And did he also need ultimately your 21 authorization when he set up the routers to allow 22 the Internet connections that existed at IWARP? 23 A At what time are you referring to? 24 Q During the period of time that you were 25 his supervisor. 143 1 A I'm not sure how much detail you want me 2 to go into on that. The two-way connection to 3 Carnegie Mellon was done without my authorization. 4 Q And -- 5 A But after that was reviewed, then 6 everything was done in conjunction with my 7 authorization. 8 Q So after it was reviewed, then you passed 9 on it? 10 A Yes. 11 Q In that connection that was done, was 12 there a connection to a machine called IWARP-R? 13 A Excuse me? 14 Q Do you remember one of the machines in 15 that group was called IWARP-R? 16 A Yes, it was one of our machines. 17 Q Was that one of the machines that had the 18 connection with Carnegie Mellon? 19 A Yes. 20 Q Was that inside or outside the fire wall? 21 A That was inside the fire wall. At least 22 that's my recollection of it. 23 Q Was it standard practice for Mr. Schwartz 24 in doing this job as Systems Administrator to have 25 to clear the method that he used in doing that job 144 1 with you before him? 2 A For those type of projects, yes. 3 Q Were you aware whether Intel had any 4 policies existing at the time that Mr. Schwartz was 5 working under you regarding independent contractors 6 being Systems Administrators or having root access? 7 A Not at that time. 8 Q Was there a policy that came into effect 9 later that you were aware of? 10 A Yes. 11 Q And what was that? 12 A If I remember the policy correctly, that 13 user not supposed to have contractors doing systems 14 administration except through special waivers. 15 Q Just to clarify the last answer, did you 16 have to clear -- did Mr. Schwartz have to clear 17 with you the day-to-day details of his activities? 18 A No. 19 MR. SUSSMAN: Thank you. I have 20 nothing further. 21 THE COURT: Mr. Tintera. 22 23 24 25 145 1 CROSS-EXAMINATION 2 BY MR. TINTERA: 3 Q Mr. Bradley, how would you classify your 4 relationship with Randal Schwartz? 5 A He is a former co-worker and a friend. 6 Q Is he currently still your friend? 7 A Yes. 8 Q And is that why during your testimony 9 when counsel was asking about the two-way relay to 10 Carnegie Mellon, you said, "I'm not sure you want 11 me to get into that"? 12 A No. It's because I'm not sure what level 13 they want me to get into technically. Some of it 14 can get involved. 15 Q So this is all back in -- you're talking 16 about a time period before the fall of 1991 at the 17 IWARP group? 18 A That's correct. 19 Q Now, this two-way connection to Carnegie 20 Mellon was put in without your authorization; is 21 that correct? 22 A Knowledge or authorization, that's 23 correct. 24 Q And Mr. Schwartz did that? 25 A Yes. 146 1 Q Now, you also said you were aware of a 2 policy that Intel had that prohibited that two-way 3 connection at that time. Is that true? 4 A That's correct. 5 Q And when you found out about this two-way 6 connection, you had a talk with Mr. Schwartz about 7 it, didn't you? 8 A Yes. 9 Q And you went over the policy of Intel 10 Corporation about that two-way connection with him, 11 didn't you? 12 A Yes. 13 Q And you explained to him that that was 14 against corporate policy? 15 A Yes. 16 Q Did you make it clear to him? You were 17 his supervisor, right? 18 A Yes. We changed the way the connection 19 was set up. 20 Q So after that point, he certainly knew 21 that that two-way connection was not within Intel 22 policy? 23 A Yes. 24 MR. TINTERA: Thank you. That's all 25 I have. 147 1 REDIRECT EXAMINATION 2 BY MR. SUSSMAN: 3 Q Mr. Bradley, after you had the discussion 4 with Mr. Schwartz about the way that two-way 5 connection was set up, was the two-way connection 6 eliminated? 7 A Yes. 8 Q Or did it continue in a different form? 9 A Well, it was -- there was still a two-way 10 connection to an isolated setting which only had a 11 signal machine on it. However, the rest of our 12 network was fire-walled from that machine, which 13 means that whatever somebody did to that outside 14 machine, they could not get to our proprietary data 15 within the main network. 16 Q So as I understand it, the change that 17 you made was to allow the two-way connection but to 18 isolate the proprietary information? 19 A Right, which also protects the rest of 20 Intel's network, which is why the policy is there. 21 Q Why did Mr. Schwartz set up that two-way 22 connection in the first place? 23 A He was directed to by one of the senior 24 managers in our department. 25 MR. SUSSMAN: Thank you. Nothing 148 1 further. 2 MR. TINTERA: I'm sorry. I lost the 3 question I was going to ask you. I don't have any 4 other questions. Thank you. 5 THE COURT: You may step down. 6 Call your next witness. 7 MR. SUSSMAN: Your Honor, I think we 8 may have gone through the witnesses that I had 9 available now and I have none here at the moment. 10 Could we take a break and -- 11 THE COURT: Take an afternoon 12 recess. Take 15 minutes, ladies and gentlemen. 13 Remove the jury. 14 (Whereupon, the following 15 proceedings were held in 16 open court, out of the 17 presence of the jury:) 18 THE COURT: Can you get more 19 witnesses? 20 MR. SUSSMAN: I needed to do some 21 checking. I originally had one more witness who 22 was a witness that I didn't expect to take very 23 long, but based on the Court's ruling on the 24 objections over part of Tanya Herlick's testimony 25 this morning, it was apparent to me that we would 149 1 need Mr. Schwartz's testimony first to lay a 2 complete foundation. However, I'm kind of left -- 3 that left me with no further witnesses this 4 afternoon. 5 MR. TINTERA: Mr. Schwartz is right 6 here. 7 MR. SUSSMAN: As Mr. Tintera felt 8 with Mr. Cower, the appropriate time to call my 9 client is later in the case. 10 At any rate, I may be able -- there 11 is a witness who might be available later this 12 afternoon. Just have to make a couple phone calls 13 to see whether I can get anybody else, but it would 14 be a while before I can get somebody here. 15 Otherwise, I had everything -- I've got my 16 witnesses pretty well scheduled for tomorrow now 17 and Friday. 18 THE COURT: Let's have them all here 19 tomorrow. 20 MR. SUSSMAN: You laugh. Some of 21 these are going pretty fast. Yes. These went 22 faster than I expected. ***(two Sussmans in a row) 23 THE COURT: I think we will be able 24 to get through a lot of them regarding ***limit 25 thing at Intel, that won't take very long. Some, 150 1 obviously. I don't know, some may take longer. I 2 expect the longest would be your client because -- 3 if you choose to put him on. 4 MR. SUSSMAN: And our expert 5 Mr. Johnson-Laird, who I have scheduled in the 6 afternoon, who I expect will take quite a while. 7 MR. TINTERA: Which afternoon? 8 MR. SUSSMAN: Tomorrow. 9 THE COURT: It's going faster now 10 than it has and I would like to see if we could get 11 the majority of this evidence on tomorrow, if it's 12 possible maybe do your client Friday morning. 13 MR. SUSSMAN: That's what I had 14 projected. 15 THE COURT: If that's the case, then 16 we could get this wrapped up Friday. 17 MR. SUSSMAN: After Mr. Schwartz 18 testifies, I would expect two additional witnesses 19 who would be character witnesses, and so I'm 20 confident that I can finish -- pretty confident 21 that I can finish my portion of the case on Friday. 22 THE COURT: By noon? 23 MR. SUSSMAN: Not by noon. 24 THE COURT: Mr. Tintera. 25 MR. SUSSMAN: I don't think 151 1 Mr. Schwartz -- 2 THE COURT: Mr. Tintera will have no 3 rebuttal, so we can go right into argument and 4 instructions, right? 5 (Whereupon, the following 6 proceedings were held in 7 open court, the jury being 8 present:) 9 THE COURT: Ladies and gentlemen of 10 the jury, Mr. Sussman has one more witness. Things 11 have gone faster than we anticipated this afternoon 12 and so he has one more witness that we can call 13 here in a minute. 14 And the reason we had to wait was 15 for the witness to get here because he was 16 scheduled to be here later. I think that will be 17 the witness that we have available for today. 18 Counsel and I during the recess also 19 talked scheduling and we recalled that somebody had 20 a problem being here Monday or next week. 21 JUROR: Mr. ***Speck. 22 THE COURT: Mr. Speck. We're hoping 23 to -- we're going to get done Friday, but starting 24 to look more and more that we may not. We all 25 remembered that, but we couldn't remember why it 152 1 was. 2 Do you have a vacation planned or -- 3 JUROR: Yes, and the deposits we 4 made are non-refundable. 5 THE COURT: We're going to keep that 6 in mind, obviously. 7 JUROR: Thank you. 8 THE COURT: The alternatives are to 9 make you stay here or we all go on vacation with 10 you. We could conclude this trial at -- 11 JUROR: At the San Juan Islands. 12 MR. SUSSMAN: Can we change venue 13 now? 14 THE COURT: Looks like right now 15 that we're teetering on the border. We're going to 16 do everything we can to get done. We'd obviously 17 like to have you stay. If for some reason we can't 18 do it, we can't do it. Will you keep that in mind, 19 though, as we go through here tomorrow and into 20 Friday. 21 Call your next witness. 22 MR. SUSSMAN: John Gray. 23 24 25 153 1 JOHN C. GRAY 2 called as a witness on behalf of the Defendant, 3 having been first duly sworn under oath, was 4 examined and testified as follows: 5 6 THE CLERK: State your full name and 7 spell it for the record, please. 8 THE WITNESS: John C. Gray. 9 G-r-a-y. 10 11 DIRECT EXAMINATION 12 BY MR. SUSSMAN: 13 Q Mr. Gray, I assume your employment hasn't 14 changed since yesterday. 15 A No. 16 Q Thank you for coming over on short notice 17 this afternoon. 18 I have a couple questions for you 19 about the circumstances that you encountered when 20 you took over -- when you came on to SSD and there 21 was the merger with IWARP going on. 22 Can you describe for the jury what 23 the circumstances were at IWARP and SSD when you 24 came in and took that over? Was it well 25 centralized or -- 154 1 A No. It was chaotic in terms of the 2 information services that were provided. There 3 were people scattered around the different parts of 4 the business. 5 THE COURT: I can hardly hear you. 6 I have to remind myself and everyone else that we 7 have to keep our voices up. 8 THE WITNESS: So pretty disparate, 9 no cohesive team efforts at providing support at 10 all. So the IWARP people were operating 11 independently from everybody else until the middle 12 of 1992 when the consolidation took place. 13 BY MR. SUSSMAN: 14 Q What effect did that have before you got 15 there, those conditions, on -- let me rephrase 16 that. 17 Under those conditions, were the 18 different groups like IWARP sort of functioning a 19 lot more with sort of going by their local 20 practices and procedures that worked for them as 21 opposed to strictly following the overall policy? 22 A Yes. 23 Q Now, one of the things that was a problem 24 where you were working on transition was in the 25 e-mail services, the delivery of e-mail. 155 1 A Right. 2 Q Traditionally how secure or insecure is 3 e-mail? 4 A E-mail has holes, pretty well-known, 5 especially UNIX, SMPT mail needs to be installed 6 properly or it can be broken into. Code hidden 7 there that will allow unauthorized access in the 8 future. Access that would be difficult to detect 9 in the future. 10 THE COURT: Can everyone hear? 11 A little louder. I didn't catch 12 every word, either. 13 THE WITNESS: E-mail, especially 14 UNIX mail, SMPT mail has -- the way the code is 15 structured, there are some holes there that are 16 pretty well known to UNIX experts where if someone 17 gets access, they can embed code that will give 18 them very difficult to detect access in the future, 19 unauthorized access. 20 So you want to be pretty careful 21 about how you manage the e-mail environment, 22 especially UNIX e-mail environment to prevent that 23 from happening. 24 BY MR. SUSSMAN: 25 Q When you testified yesterday, you 156 1 discussed the philosophical differences that 2 developed between Mr. Schwartz and Mr. Poehlitz and 3 others about the e-mail delivery. 4 A Yes. 5 Q You described those, how that should be 6 done, that there was a philosophical difference. 7 Did that disagreement between Mr. Schwartz and 8 Mr. Poehlitz spill over into security matters? 9 A There is a security aspect of the e-mail 10 question, and so it's related in that way. But I 11 don't think beyond that that there was a particular 12 security issue. 13 Q One last thing. I'd like to show you 14 what document that I've had marked as Defendant's 15 Exhibit 112 for identification. Would you take a 16 look at that and tell me if you recognize that 17 document. 18 A Yes. 19 Q What is that? 20 A It basically is the guidelines for 21 privileged access. 22 Q And is your signature -- does your 23 signature appear anywhere on that document? 24 A Yes. 25 Q During the time that you were working at 157 1 SSD and Mr. Schwartz was contractor and Systems 2 Administrator working under you, did you give him a 3 document like that to review and to sign? 4 A No. This wasn't in place at the time. 5 MR. SUSSMAN: Thank you. Nothing 6 further. 7 THE COURT: Mr. Tintera. 8 MR. TINTERA: Nice seeing you again. 9 I don't have any questions, though, Mr. Gray. 10 THE COURT: Thank you. You may step 11 down and you are free to go. 12 MR. SUSSMAN: Your Honor, I would 13 offer Exhibit 112 at this time. 14 THE COURT: I haven't seen it. I'll 15 need some time to look at it. I'll rule on that 16 tomorrow morning. 17 That concludes the testimony for 18 today. Thank you for being in here today. Come in 19 at 9:30 and we'll will try to start at that time 20 tomorrow morning. 21 Leave your notes in the jury room. 22 Don't talk about the case. Thank you. 23 24 25 158 1 (Whereupon, the following 2 proceedings were held in 3 open court, out of the 4 presence of the jury:) 5 6 THE COURT: We're in recess. We'll 7 take up that exhibit first thing in the morning and 8 after that we'll begin again. Try to have as many 9 witnesses that you think at all we could possibly 10 take tomorrow. And like I said, I'd rather 11 tomorrow send some home than run out of witnesses. 12 MR. SUSSMAN: I will have all that I 13 can possibly put on before Mr. Schwartz. 14 THE COURT: Thank you. 15 (Evening recess.) 16 17 18 19 20 21 22 23 24 25