1 IN THE CIRCUIT COURT OF THE STATE OF OREGON 2 FOR THE COUNTY OF WASHINGTON 3 4 STATE OF OREGON, ) ) 5 Plaintiff, ) ) 6 vs. ) No. C940322CR ) 7 RANDAL LEE SCHWARTZ, ) ) 8 Defendant. ) Volume 11 9 10 11 TRANSCRIPT OF PROCEEDINGS 12 13 BE IT REMEMBERED THAT on the 24th 14 day of July, 1995, the above-entitled matter came 15 on for Hearing before the HONORABLE ALAN C. 16 BONEBRAKE, a Circuit Court Judge. 17 18 APPEARANCES 19 Thomas J. Tintera Washington County Deputy District Attorney 20 Representing the State of Oregon 21 Marc Sussman Attorney at Law 22 Representing the Defendant 23 24 25 2 1 AFTERNOON SESSION 2 BEGINNING AT 2:00 P.M. 3 JULY 24, 1995 4 5 (Whereupon, the following 6 proceedings were held in 7 open court, the jury being 8 present:) 9 THE COURT: Be seated, ladies and 10 gentlemen. Thank you. 11 When we broke last week, I think 12 Mr. Sussman was still calling witnesses. So, 13 Mr. Sussman, your next witness. 14 MR. SUSSMAN: Lyle Settle. 15 16 LYLE SETTLE 17 called as a witness on behalf of the Defendant, 18 having been first duly sworn under oath, was 19 examined and testified as follows: 20 21 THE CLERK: State your full name and 22 spell it for the record, please. 23 THE WITNESS: My name is Lyle 24 Settle. S-e-t-t-l-e. 25 3 1 DIRECT EXAMINATION 2 BY MR. SUSSMAN: 3 Q Mr. Settle, if you have trouble hearing 4 my questions or -- please let me know and I'll 5 repeat it so you will understand. 6 A I have some impaired hearing. I heard 7 what you just said, however. 8 Q Thank you. 9 Mr. Settle, where do you live? 10 A I live in Silicon Valley, in San Jos=82. 11 Q What is your occupation? 12 A I'm a technical writer. I have been for 13 30 years. 14 Q When you say you're a technical writer, 15 what kind of technical writing do you do? 16 A It's been in the computer business. 17 Q Now, are you currently employed? 18 A Yes, I'm currently employed under 19 contract with the Visa Corporation in San Mateo, 20 which is 30 miles from San Jos=82. 21 Q You say you're under contract. Does that 22 mean you have your own business or are you an 23 employee of Visa? 24 A I'm not an employee of Visa. I'm -- the 25 way this business kind of works is they have an 4 1 intermediate person and they pay me. 2 Q Do you have your own consulting firm? 3 A Yes. It's called Lyle Settle Writing 4 Services. 5 Q Mr. Settle, how long have you had your 6 own business of -- Lyle Settle business? 7 A About three or four years. 8 Q And prior to that, where are some of the 9 places that you have -- prior to that, were you 10 employed by other businesses? 11 A Yes. 12 Q What are some of the places that you have 13 been employed? 14 A University of Chicago in Chicago, 15 Hewlitt-Packard in ***Coopertino, Tektronix here in 16 Oregon, Tandem Computers in Silicon Valley, 17 Stanford University in Palo Alto. Do you want 18 more? 19 Q How long have you been in this computer 20 business as a technical writer? 21 A Over 30 years. 22 Q And in the course of your career, have 23 you had the occasion to meet and get to know Randal 24 Schwartz? 25 A Yes, I certainly have. 5 1 Q And how is it that you met Randal 2 Schwartz? How is it that you know him? 3 A Well, I was employed at Tektronix and 4 given a responsibility to form a team of writers to 5 get some work done. Randal was 15, I think, 15 or 6 16, recently graduated from high school. He was 7 around there for the summer and we met over lunch 8 and I noticed extraordinary qualities about this, 9 at that time, young man, and I asked management if 10 he could be added to the writing team. 11 Q About when was this? 12 A 1978. 13 Q And so was Mr. Schwartz added to your 14 writing team? 15 A Yes, he was. 16 Q And how long did Mr. Schwartz work 17 directly with you while he was -- while you were at 18 Tektronix? 19 A Almost the entire time I was at 20 Tektronix, except for the last six months. 21 Q And why was that? 22 A Well, he was offered -- he was so good 23 and so well respected that the engineering people 24 managed to woo him way from the writing group. 25 Q Mr. Settle, during the time that 6 1 Mr. Schwartz was working with you at Tektronix, did 2 you have the opportunity to observe his work 3 carefully and how -- the kind of characteristics or 4 habits he had in terms of approaching his work? 5 A I certainly did. 6 Q How would you describe his -- the kind -- 7 Mr. Schwartz's skills in technical writing and 8 other areas of working with computers? 9 A His skills? 10 Q Yes. 11 A Well, most conspicuous at first was his 12 mind-boggling technical ability. He had tremendous 13 insight. Here he came into a business, he just 14 knew everything and understood it all. 15 Q Now, did you have to give him any kind of 16 training or -- 17 A I certainly did. I trained him in the 18 writing skills. He had some writing ability, but 19 there are certain things you do in ***business to 20 get business publications out. And I also trained 21 him in how you function, how you do business. 22 Q And what kind of training did you give 23 him? 24 A How to interact with other groups, which 25 was a constant necessity for writing. In writing, 7 1 you're always seeking information and people are 2 busy and doesn't come automatically, you have to 3 find ways of getting it. So I trained Randal and 4 all the other writers. I said, "You should 5 proceed -- once you're given an assignment, you 6 should proceed on the assumption that you have the 7 authority to do whatever has to be done to get the 8 work done. You cannot just be asking permission 9 for everything because you'll never get anything 10 done. Because it's always easiest to turn you 11 down." So he was very effective at that. 12 Q Now, how would you describe the quality 13 of work that Mr. Schwartz did at Tektronix? 14 A Outstanding. 15 Q How many years did he actually work with 16 you at Tektronix? 17 A I'd say three and a half years. 18 Q Do you recall whether or not Mr. Schwartz 19 received any kind of awards or recognition while he 20 was there? 21 MR. TINTERA: Objection. Not 22 relevant. 23 THE COURT: Sustained. 24 BY MR. SUSSMAN: 25 Q Did you have any contact with 8 1 Mr. Schwartz after he completed or after the time 2 that he worked with you at Tektronix? 3 A Yes, I did. 4 Q And in what capacity was that? 5 A Well, I took a position in Coopertino 6 working for Tandem Computers, and among the 7 assignments that came my way was to write a 8 security administration guide. This was a very 9 important book because it was part of a package to 10 get what's called C-2 certification by the 11 Department of Defense. 12 Tandem is in the transaction 13 business and they do business with companies and 14 some of these companies do business with the 15 Department of Defense. 16 MR. TINTERA: Your Honor, I object. 17 This is unresponsive at this point. 18 THE COURT: Sustained. Ask another 19 question. 20 BY MR. SUSSMAN: 21 Q We'll get back to that in a minute. 22 Did you have contact with him then 23 during -- with Mr. Schwartz during the period that 24 you were working with Tandem? 25 A Yes, I was the lead writer on the book 9 1 and Randal was the technical authority. 2 Q So what was the job that you were working 3 on that led to your contact with Mr. Schwartz at 4 Tandem? 5 A Well, I knew of his ability from 6 Tektronix, and in particularly in the areas of 7 security. 8 Q And so what was it that you needed to 9 have him do for you at Tandem? 10 A I needed to have him investigate the 11 system so he could write down what you have to do 12 to secure a Tandem system, and so that was his job. 13 Q And as part of that job, what were -- 14 what did you -- did you give him any specific 15 direction on what he needed to do or how to 16 approach that job? 17 MR. TINTERA: I don't see how that's 18 relevant to the issues of this case. 19 THE COURT: Overruled. Go ahead. 20 THE WITNESS: Did I give him 21 specific direction? 22 BY MR. SUSSMAN: 23 Q Yes, in terms of how to do the job, in 24 testing the security or how to approach the task 25 that you had for him? 10 1 A Well, to study the system in great 2 detail. He spent about three months just going way 3 down to everything about the system. 4 Q What do you mean by going way down into 5 the system and studying it? 6 A He had to to know the possible roots, the 7 weak spots where somebody could possibly invade the 8 system so that people could take the ad -- the 9 administrators would be able to take the proper 10 action to protect the system. 11 Q How would you describe the work that he 12 did for you there in terms of his performance of 13 that job? 14 A It was outstanding. By the time we 15 turned the book over to the government 16 certification -- 17 MR. TINTERA: Your Honor, I object. 18 He's answered the question. 19 THE COURT: Sustained. He already 20 answered the question. 21 BY MR. SUSSMAN: 22 Q What happened when you completed the job 23 and turned the book over to the government? 24 MR. TINTERA: Objection. Not 25 relevant. 11 1 THE COURT: Well, it probably isn't, 2 but I don't know what the answer is going to be. 3 Overruled. Go ahead. 4 THE WITNESS: It's overruled? 5 THE COURT: Yeah, you can answer 6 that. 7 THE WITNESS: The government people 8 said, "This is exactly what we need." 9 BY MR. SUSSMAN: 10 Q And that was based on what Mr. Schwartz 11 had done? 12 A Yes. 13 Q And since the period of time that 14 Mr. Schwartz was working -- let me back up. 15 Was this a single job that 16 Mr. Schwartz did for you at Tandem? 17 A It was a series of two contracts, as I 18 recall, back-to-back. It was a big piece of work, 19 yes. 20 Q And over what period of time was it that 21 he worked with you at Tandem? 22 A I'm a little fuzzy. I think a year, 23 probably. 24 Q Have you seen Mr. Schwartz since the time 25 that you were working at Tandem? 12 1 A Yes. 2 Q By the way, when was that? Do you 3 remember the years or the approximate dates that he 4 did those jobs? 5 A Mid-'80s. 6 Q And since then, you've been -- you've had 7 contact with Mr. Schwartz on any kind of regular 8 basis? 9 A Yes. I received a call from another 10 department of the Tandem, they asked for his name 11 and they wanted him to come down and see if he 12 could -- 13 MR. TINTERA: Your Honor, I object 14 to this. 15 THE COURT: Sustained. 16 BY MR. SUSSMAN: 17 Q Just what has been the nature of your 18 contact with Mr. Schwartz over these approximate 19 ten years since then? 20 A Well, I recommended him for another job 21 within Tandem, which he got another contract. 22 MR. TINTERA: I object. He's not 23 answering the question that has been asked of him. 24 THE COURT: The question is what 25 other contact have you had with him. The answer 13 1 calls for you to tell when you associated with him, 2 have you met him someplace, did you do a job with 3 him, did you talk with him on the telephone, what 4 did you do? Did you talk with him by computers, 5 e-mail? 6 THE WITNESS: All of those. 7 THE COURT: Any other questions? 8 BY MR. SUSSMAN: 9 Q During the time that Mr. Schwartz was 10 working for -- on that contract with you on this 11 security manual, was Mr. Schwartz ever suspended or 12 disciplined at Tandem? 13 A No. 14 Q Were you aware of any incidents in which 15 he was -- in which he was terminated from the 16 contract or any reasons for dissatisfaction with 17 his work? 18 A No. He was offered a job, full-time job. 19 Q Was there any kind of incident that 20 occurred around the 1st of April which created any 21 problems or that led to any kind of disciplinary or 22 other action by Tandem? 23 THE COURT: 1st of April when? What 24 year? 25 THE WITNESS: I don't remember the 14 1 exact year when he was down there. I'm saying 2 mid-'80s, about 1985. 3 BY MR. SUSSMAN: 4 Q But during the years that you had that 5 contract involving this security manual that you 6 were writing. 7 A Well, there was an incident on April 1st, 8 anybody who logged onto Tandem system anyplace in 9 the world, there was suddenly appeared in their 10 what's called home directory a little file that 11 said "April Fools." This was significant because 12 they thought the system -- that that would be 13 impossible in the system. And it turned out that 14 they welcomed this -- 15 Q Well, how did that get there? Did you 16 learn how that got there or who was responsible for 17 that? 18 A Oh, Randal had done that. Suddenly 19 Singapore, China, Japan, everybody had a little 20 file that said "April Fools." 21 Q So this was on a system that was supposed 22 to be absolutely secured? 23 A Yes, each of the individual systems was 24 supposed to be secured. 25 Q So what was the response of Tandem, if 15 1 you know personally, to this event? 2 A Well, the senior executive asked him to 3 write a report on how it was done so that they 4 could take corrective action, which they did. 5 Q And did Mr. Schwartz, in fact, write such 6 a report? 7 A Yes, he did. 8 Q Now, over the years again since you 9 worked for him at Tandem, have you seen 10 Mr. Schwartz frequently? 11 A Sometimes every year and sometimes more 12 frequently. 13 Q Now, based upon your -- besides Tandem, 14 were you aware during the period of time that 15 Mr. Schwartz was at Tektronix, were there any times 16 or occasion that you're aware of where Mr. Schwartz 17 was terminated or was suspended from his contract 18 or his employment at Tektronix? 19 A He most assuredly was not. 20 Q Over the period of time in your contact 21 with Mr. Schwartz, based -- and your association, 22 your knowledge of his work, your discussions with 23 him, and your awareness of how he has performed his 24 job, have you been able to form an opinion as to 25 Mr. Schwartz's character for trustworthiness? 16 1 A For what? 2 Q Trustworthiness. 3 A Yes, I have. 4 Q And what is that opinion? 5 A I've always trusted him. He's never 6 betrayed that trust. As far as -- 7 MR. TINTERA: I object. He's 8 answered the question. 9 THE COURT: You've already answered 10 the questions. 11 BY MR. SUSSMAN: 12 Q Have you been able to form an opinion as 13 to Mr. Schwartz's character for honesty? 14 A Yes, I have. 15 Q And what is that opinion? 16 A He's an honest man. 17 Q Have you been able to form an opinion for 18 his character for truthfulness, for telling the 19 truth? 20 A Yes. 21 Q What is that? 22 A He tells the truth. 23 MR. SUSSMAN: Thank you. I have 24 nothing further. 25 THE COURT: Mr. Tintera. 17 1 MR. TINTERA: Thank you, Judge. 2 Mr. Settle answered all my questions already. 3 THE COURT: Thank you. You may step 4 down. 5 Call your next witness. 6 MR. SUSSMAN: Your Honor, that 7 completes the witnesses that I have to offer. 8 There may be some perhaps additional exhibits that 9 are loose that need to be taken care of. 10 THE COURT: I'll grant you lead to 11 do that housekeeping during the next recess. We'll 12 check those. Thank you. 13 Mr. Tintera. 14 THE WITNESS: Can I leave? 15 THE COURT: You may leave. 16 MR. SUSSMAN: May the witness be 17 excused? 18 THE COURT: He is. 19 Rebuttal witnesses. 20 MR. TINTERA: There is one ruling 21 you need yet to make. 22 THE COURT: I need to confer with 23 counsel before the State goes into rebuttal 24 evidence here. Probably about ten minutes, ladies 25 and gentlemen. 18 1 Remove the jury. 2 (Whereupon, the following 3 proceedings were held in 4 open court, out of the 5 presence of the jury:) 6 THE COURT: Mr. Tintera, I have it 7 written down here someplace, but refresh my memory 8 as to what the specifics are of what you would like 9 to do. 10 MR. TINTERA: The State has been 11 wondering, if the Court is satisfied that the 12 defense has opened the door into what the defendant 13 said in regard to his activities at Tandem 14 Corporation and Tektronix Corporation. 15 THE COURT: Seems to me, based upon 16 the last witness' testimony, that that's all in the 17 area or realm of discussion now and -- 18 MR. TINTERA: Does to me also, but 19 the motion in limine, I agreed with the Court that 20 I would not bring up any of that information 21 without first bringing it up before the Court 22 outside the presence of the jury. 23 THE COURT: That's right. And we're 24 doing that. 25 Mr. Sussman, do you wish to be heard 19 1 on that? 2 MR. SUSSMAN: No, Your Honor. 3 THE COURT: I will permit you to go 4 into the areas. 5 Did you look at the exhibit list, 6 Mr. Sussman? 7 MR. SUSSMAN: Yes. I know there are 8 three exhibits I haven't offered yet. 107, 108 and 9 109, which are the various security manuals 10 provided pursuant to subpoena by Intel to which 11 would he referred during examination of various 12 witnesses. 13 MR. TINTERA: I don't object to 14 those. 15 THE COURT: 107, 8 and 9 are 16 received. 17 (Whereupon, Defendant's 18 Exhibit Nos. 107, 108 and 19 109 were received in 20 evidence.) 21 THE COURT: Did you review the 22 exhibit list to see if there are any others? 23 MR. SUSSMAN: Yes. I do want to 24 renew my offer to the search warrant affidavit. I 25 don't know the number offhand. I had offered it 20 1 and Mr. Tintera objected on relevance and the Court 2 sustained that. I'd like to renew the offer. 3 I believe that it would be relevant, 4 it's relevant in light of these matters. During 5 Mr. Cower's testimony in the State's case, he 6 testified about making -- that the information he 7 provided to Detective Lilley in providing the 8 search warrant affidavit about what Mr. Schwartz 9 may do to avoid detection in the workplace and that 10 this was then retained a basis for a 11 ***remuneration of items that would contain 12 information that would be evidence of crimes, 13 including a suggestion of crimes would be that 14 there would be information that would be contained 15 in those materials that would show Mr. Schwartz may 16 have secreted information from the workplace to 17 home. 18 Now, we have offered the testimony 19 of Detective -- Officer Watson about this ultimate 20 search, but this becomes an important link to 21 having got from first to second. 22 In addition, I believe that -- my 23 recollection is Mr. Morrissey testified about 24 Mr. Schwartz's sophistication in security matters 25 and that was provided as a basis for the search 21 1 also in the affidavit. And so I think that the 2 affidavit becomes an important piece of information 3 for the jury to understand what the link was 4 between the initial -- between the request for the 5 assistance of police to search for certain items, 6 the kind of things being sought, and the basis for 7 the belief that Mr. Schwartz was taking things 8 outside of Intel and becomes very relevant to the 9 issue of what was Mr. Schwartz's intent in this 10 case because it ties in and relates -- I think the 11 circumstantial evidence that the search produced 12 nothing becomes even more significant about having 13 that connection made as circumstantial evidence 14 that Mr. Schwartz -- that these were items searched 15 for included and produced no information. So for 16 those reasons. 17 THE COURT: So you're offering it 18 under the umbrella of substantive evidence, not as 19 impeachment evidence. 20 MR. SUSSMAN: It's a combination, 21 combination of things. It provides both, and I 22 think it can be offered on either ground or both 23 grounds. 24 THE COURT: Mr. Tintera. 25 MR. TINTERA: Well, it's hearsay, 22 1 Judge, and we object. It has nothing to do with 2 the evidence that we're producing for the charges. 3 It's just hearsay. For whatever reason, defense 4 wants to have it before the jury, it's just not 5 admissible. I can't find any rule that would 6 permit this and I haven't heard one cited that 7 would permit this to be submitted into evidence. 8 THE COURT: Well, it's under the 9 good stuff exception to the evidence rules, I 10 think, Mr. Sussman, isn't it? 11 MR. SUSSMAN: Well, I wouldn't 12 exactly call it the good stuff exception, but it's 13 not being offered again solely to show the truth of 14 the statements in the affidavit. It does show some 15 inconsistencies, but it also again shows that this 16 has become circumstantial evidence of the basis for 17 the action that was taken here and in a sense part 18 of our -- I think it's evidence which is important 19 to us to support our theory of the case and 20 relevant to show that the evidence that was being 21 sought was evidence of activity that didn't exist. 22 That there was no evidence that -- of 23 Mr. Schwartz's taking anything that he shouldn't 24 have. 25 We submit this is also important 23 1 circumstantial evidence going to show what 2 Mr. Schwartz's state of mind was, what his purpose 3 was with respect to the passwords and password 4 files that are still listed as the objects of his 5 actions and for the jury to make that assessment 6 for us to link that together to make that showing. 7 I think this is the flip side of the 8 cases that say that in terms of relevant evidence 9 that the State is entitled to put on its case and 10 make its showing that -- to show its theory of the 11 case. And if the evidence is relevant and it makes 12 those points more likely, and in a sense here, the 13 State is trying to say we have -- we have narrowed 14 our theory, therefore, this evidence that might 15 rebut that is no longer relevant, and I would say 16 that because the State -- 17 THE COURT: I don't know, I caught 18 you off, I'm sorry, but the state of mind is saying 19 that it's a big issue here, but I'm having 20 difficulty understanding how an affidavit for 21 search drafted by a police officer is somehow 22 evidence of the defendant's state of mind. 23 It may be evidence of what the 24 police officer thought the state of mind was. It's 25 good argument, it's creative argument, I'll grant 24 1 you that, but I don't think it's evidence of the 2 defendant's state of mind. 3 MR. SUSSMAN: Also indicates what 4 the Mr. Cower -- representation that Mr. Cower made 5 and -- 6 THE COURT: Didn't you ask him about 7 all of those? Isn't it cumulative in that respect? 8 I don't remember everything that was asked, but my 9 recollection is that the police officers and 10 Mr. Cower you cross-examined at some length on all 11 of those things, the fact all the stuff they listed 12 in the search warrant and didn't find any evidence 13 at his house or in his computer is zero. It's all 14 in the record. 15 It's cumulative, hearsay, not good 16 evidence of state of mind. I give you an A for 17 creativity. I don't think it's admissible, 18 Mr. Sussman, so the search warrant, Exhibit 113, is 19 not received. 20 MR. SUSSMAN: If I might take a 21 quick look at the exhibit list. 22 THE COURT: Sure. 23 MR. SUSSMAN: I noticed that we 24 hadn't offered Defendant's Exhibit 114, which is 25 the list that Mr. Watson identified as the keyword 25 1 search that he conducted. 2 THE COURT: Any objection to that? 3 MR. TINTERA: I don't see the 4 relevance but I'm not objecting. 5 THE COURT: Exhibit 114 is received. 6 (Whereupon, Defendant's 7 Exhibit No. 114 was received 8 in evidence.) 9 THE COURT: I will grant leave for 10 counsel -- both counsel to work with Lynda because 11 there have been a lot of exhibits, and make sure 12 what you think is in really is in. And if there is 13 any differences of opinion, I'll look at my notes 14 or we can check the transcript or reoffer it. So I 15 would permit counsel up until tomorrow morning 16 probably just before argument if there is a 17 disagreement, conflict in the record over whether 18 some of these have been received that you thought 19 were received or not, we can take that up. 20 MR. SUSSMAN: I found there was one 21 other that I was looking for that we haven't 22 offered. There was a note that Mr. Schwartz 23 identified as having written to Bob Wilcox, Exhibit 24 No. 178, which we would also offer. 25 MR. TINTERA: This is hearsay. 26 1 THE COURT: May I see the exhibit? 2 MR. TINTERA: I didn't write down 3 the number of that one, Judge. 4 THE COURT: This is Exhibit 178. 5 MR. SUSSMAN: There is an entry in 6 the note that shows Mr. Schwartz can be reached at 7 an address of merlin.ora.com. Being offered to 8 show his prior outside e-mail address. 9 THE COURT: How is that relevant? 10 MR. SUSSMAN: Goes to the evidence 11 that we offered Mr. Schwartz's communication about 12 his need, his -- 13 THE COURT: Let me back up. Instead 14 of answering that question, answer this one. If 15 you are offering it for that purpose, then it is 16 where he says, "I'll be reachable at merlin.com 17 50377" -- his writing is worse than mine. Looks 18 like 0095. That's offered to prove the truth of 19 that. You are offering this document to prove that 20 statement. 21 MR. SUSSMAN: It's corroboration of 22 Mr. Schwartz's testimony that he was using this 23 e-mail address. 24 THE COURT: May be, but it's 25 hearsay. It's not received. 178 is not received. 27 1 Anything else? Again, I'll grant 2 you leave until we begin argument tomorrow morning 3 to check with Lynda and if there is any of those -- 4 I'm not suggesting bring in new ones, but if there 5 are any that you previously had marked that the 6 records aren't clear on, you can clear that up. 7 Mr. Tintera, are you ready to 8 proceed? 9 MR. TINTERA: We're ready to go, 10 Judge. 11 THE COURT: Bring in the jury and 12 we'll proceed. 13 (Whereupon, the following 14 proceedings were held in 15 open court, the jury being 16 present:) 17 THE COURT: Defense has rested. 18 Mr. Tintera, do you have rebuttal 19 evidence? 20 MR. TINTERA: I do. I'd like to 21 call Rich Cower. 22 THE COURT: Step forward, sir. 23 24 25 28 1 RICHARD COWER 2 called as a rebuttal witness on behalf of the 3 State, having been first duly sworn under oath, was 4 examined and testified as follows: 5 6 THE CLERK: State your full name and 7 spell it for the record, please. 8 THE WITNESS: Richard Cower. 9 C-o-w-e-r. 10 11 DIRECT EXAMINATION 12 BY MR. TINTERA: 13 Q Mr. Cower, refresh my memory, what do you 14 do for Intel? 15 A I'm a network security specialist. 16 Q How come you've been sitting over here? 17 A I'm sorry. 18 Q How come you've been sitting over here? 19 A I think it was because you asked me to. 20 Q To kind of help me out and understand 21 this stuff? 22 A I believe so. 23 Q Let me show you some exhibits, if I 24 could. 25 A Sure. 29 1 Q 29, 30 and 31. Could you identify 2 State's Exhibit 29 for me, please? 3 A This is a directory listing of the 4 directory Merlin. I believe this was made on 5 10-28-93. 6 Q Is that off the TAR tapes that Mark 7 Morrissey said he made of the defendant's 8 directory? 9 A Yes, it is. 10 Q And is there -- we heard from Tanya 11 Herlick about the various things that you could 12 write to a file, what an owner would write and what 13 a group and what everyone else as far as what you 14 can do with a file that's on a computer. 15 A Yes. 16 Q And does this -- we talked about the Play 17 directory as part of the start of where the Crack 18 program was running. Do you remember that? 19 A Yes, I remember that. 20 Q Does that, from the defendant's 21 directory, indicate where the Play directory is? 22 A Well, it indicates that it's underneath 23 the Merlin directory. It's a subdirectory. The 24 directories are usually trees. Want me to draw it 25 over there? 30 1 Q Yeah, could you? 2 A Want me to draw it? 3 Q Let's move the board over there and if 4 you could -- 5 THE COURT: The procedure that works 6 the best is draw what you want to draw, then when 7 it's done you can move it where everybody can see 8 and then you can explain it. 9 THE WITNESS: I think you've got 10 Merlin, the protections on the Merlin directory 11 are -- 12 BY MR. TINTERA: 13 Q What protection did the owner have? 14 A Read, write, execute. 15 Q Write that next to "Merlin." 16 A Sure. 17 Q So "R" stands for what? 18 A Read. 19 Q "W" stands for? 20 A Write. 21 Q And "X"? 22 A "X" in this case is a directory, means he 23 can look at the directory, ***statistic the 24 directory or CD to the directory. There is three 25 more letters after that. Actually nine associated 31 1 with this and the next is read, write, execute. 2 This is owner. This is group. 3 Q What does "group" stand for? 4 A That's anybody in his group. Anybody in 5 his group. The next is world. And he had read-X. 6 Q And so the world couldn't write to it? 7 A That's right. 8 Q Could you explain that for me? 9 A That means that the world -- anybody in 10 the world, anybody that can get access to a machine 11 couldn't open up a file against Merlin and change 12 it. 13 Q Could they look at it? 14 A Sure, because it says "read." 15 Q What about the X? 16 A They could CD the direct -- or statistic 17 the directory to look at the contents of the 18 directory or execute out of it. 19 Q What does that mean? 20 A They could run a program. 21 Q So under the broader Merlin directory, 22 you found a subdirectory? 23 A Well, there is a number of 24 subdirectories. 25 Q Was there one called Play? 32 1 A Yes. 2 Q And -- 3 A Play is the same as this. 4 Q And Merlin to the Play directory and 5 within the Play directory, was there another 6 subdirectory? 7 A Yes, there was, but it's not on this 8 piece of paper. 9 Q What is State's Exhibit 30? 10 A This is the Play directory. 11 Q And that's where, does that show? 12 A Yeah, under Play there was a Crack. 13 Mr. Schwartz had put Crack in a directory called 14 CR. It was also read, write, execute, read, write, 15 execute and read, execute. 16 Q What is State's Exhibit 31? 17 A This is the CR, Crack. Normally you draw 18 these as trees, an upside-down tree. I don't know 19 if this is doing justice to it. And CR had in it a 20 number of files here of interest. It had 21 ora.guest. These are actually files. It had an 22 ssd.guest. Another one of p-a-s-s, o-r-d. Those 23 are files contained in the directory tree. 24 Q Does this tree show where the password 25 file for the Supercomputer Division was kept? 33 1 A Yes passwd.ssd. It's a big file. 2 Q And does it show what the owner and the 3 group and the world could do with those files in 4 there? 5 A Yeah. 6 Q Is it the same for all of them? 7 A It's not the same as these, no. 8 Q What is it? 9 A Read, write for the owner, read for the 10 group, and read for the world. I think all of 11 these are that. Let me look. 12 Yes, all of these are the same. 13 Q So if it's read for the group, what would 14 keep someone from reading -- the ssd.guest, is that 15 the output of the Crack file? 16 A From what I remember, I believe that is 17 the list of user names and Crack passwords in the 18 SSD password file. 19 Q So what would keep somebody in the group 20 from reading the results of the Crack program on 21 the SSD password file? 22 A Nothing. 23 Q And what would keep someone in the world, 24 if they had access to the machine, from reading the 25 results of the Crack program that was run on the 34 1 Supercomputer Division file? 2 A Nothing. There is no special protection 3 on these files. 4 MR. TINTERA: I'd offer State's 5 Exhibits 29, 30 and 31. And if I could have the 6 diagram also marked as State's Exhibit 33. I'd 7 offer that also. 8 THE COURT: Do we have a 32? 9 MR. TINTERA: I do. We're getting 10 there. 11 THE COURT: Any objection to 29, 30 12 and 31 and 32 [sic]? 13 MR. SUSSMAN: No, Your Honor. 14 THE COURT: 29, 30, 31 and 33 are 15 all received. 16 THE CLERK: That's 32, not 33. 17 THE COURT: Yes. I'm sorry. 33. 18 (Whereupon, State's Exhibit 19 Nos. 29, 30, 32 and 33 were 20 received in evidence.) 21 BY MR. TINTERA: 22 Q Mr. Cower, you were here when 23 Mr. Johnson-Laird spoke about fire walls? 24 A Yes. That was a good presentation. 25 Q Have you had an opportunity to -- I know 35 1 you haven't had a ton of time, but have you had an 2 opportunity to kind of explain to the jury Intel's 3 perspective on the fire wall and Internet security? 4 A Sure. Yes. 5 Q And what program did you use to make the 6 little things to go on this overhead projector? 7 A I didn't use any. I used Rich Drawing. 8 Q And "Rich" being your first name? 9 A Yes. It's a well-known program in Intel 10 for drawing foils in a short period of time. 11 MR. TINTERA: I have this pointing 12 the wrong way, don't I? 13 THE COURT: Yeah, they'll be able to 14 see it. 15 MR. TINTERA: Yeah, in a couple 16 days, they will be. 17 BY MR. TINTERA: 18 Q If you are familiar with using one of 19 those machines, could you -- 20 A I'm reasonably familiar with it. 21 Q Could you explain -- 22 A I only have a few. 23 Q Could you show and demonstrate to the 24 jury how Intel has their fire wall set up? 25 MR. SUSSMAN: Your Honor, I object 36 1 to this. This is not new matter. This is not 2 rebuttal. This is stuff that -- evidence that the 3 State presented in direct and -- and this isn't 4 proper rebuttal at this point. 5 THE COURT: I think given the 6 testimony of Mr. Johnson-Laird, it is proper 7 rebuttal evidence. I obviously haven't seen it 8 yet, either, Mr. Sussman, so based on what I 9 believe it is, I think it's appropriate. You may 10 renew that motion as we go along here if you wish, 11 after I've seen one or two of these. 12 BY MR. TINTERA: 13 Q Now, could you please show the jury what 14 the Intel fire wall looked like before the addition 15 of the gate program? 16 A Sure. 17 Q Is that part of Rich Draw to do it that 18 way? 19 A It could be. Rich Draw is very flexible. 20 THE COURT: I'm going to raise this 21 now. Did Mr. Johnson-Laird testify about how 22 Intel's fire wall looked before the gate program? 23 MR. TINTERA: This follows up with 24 our next one as to how the gate program changed it 25 and I asked him about in particular Telnet and 37 1 e-mail, or at that point to ask him the differences 2 between the two, and this helps to explain the 3 difference between telnetting and e-mail, which I 4 tried to do with Mr. Johnson-Laird. So yes, I went 5 into it. 6 THE COURT: And in some fashion it 7 rebuts what he said, you believe. 8 MR. TINTERA: I think it explains. 9 Doesn't say that he was wrong, I think it explains 10 it from an -- Intel's perspective. 11 THE COURT: Well, if it's just in 12 explanation, some further explanation, it's not 13 rebuttal. Rebuttal means rebuttal, Mr. Tintera. 14 MR. TINTERA: Well, Judge, we were 15 not appraised of what Mr. Johnson-Laird until very 16 much into the trial was going to talk about and we 17 were not in a position until after we saw his 18 demonstration to show the jury how the fire wall 19 works in regard to e-mail, which he talked about, 20 and telnetting, which he talked about, and we're 21 rebutting what I've attempted to -- I attempted to 22 elicit information about the various addresses. 23 THE COURT: I'd like to get this 24 going with the jury. Here is how I'm going to rule 25 on this. I'm going to go with the flow, so to 38 1 speak. This is technical in nature, but I do have 2 the discretion and reserve the ability to permit 3 the defense yet to put on something additional as 4 long as we don't get too far afield. And then I 5 guess since you have the burden, Mr. Tintera, you 6 finally could present something very brief at the 7 end, but this is a point that needs further 8 explanation and you think it's important by way of 9 rebuttal, if it is, we may go through a couple more 10 presentations before we get it all out to the jury, 11 so we all need to understand that. 12 Mr. Sussman, you have 13 Mr. Johnson-Laird here and I will consider the 14 possibility of permitting him to testify again if 15 we go through it in this fashion, as long as we all 16 understand that. 17 MR. SUSSMAN: I do appreciate that. 18 I just want to clarify that I think Mr. Tintera had 19 notice that Mr. Johnson-Laird was going to be 20 testifying long before the trial started and well 21 before he testified had information about the 22 essence -- essence of the basic presentation that 23 was made. So I think this is extraneous and 24 particularly since it's dealing with -- 25 specifically with Brillig, which was not discussed 39 1 by Mr. Johnson-Laird in his testimony in specific 2 terms. 3 THE COURT: You have made an 4 objection. It's on the record. I'm exercising my 5 discretion to permit it. These matters are 6 technical in nature. I think it's helpful to the 7 jury whether it's completely rebuttal or if it's 8 ever determined not to be, to some extent 9 permitting the State to reopen, I'd like not to do 10 that, but I have to hear it before I know whether 11 it's appropriate rebuttal. And having heard it and 12 the jury having heard it, the only way of taking 13 any corrective action is to permit the defense to 14 recall their expert, who I know is in court also. 15 MR. SUSSMAN: The Court could take 16 an offer of proof before. 17 THE COURT: I could, but then we 18 wouldn't finish today. This is the ninth day on an 19 eight-day case and I think to do it is to hear it 20 once. So proceed. 21 BY MR. TINTERA: 22 Q Could you show the jury the fire wall 23 existing at the Intel Corporation before the 24 addition of the gate program or door program that 25 we heard? 40 1 A This is a simplistic diagram. The 2 Internet sits out here and -- 3 Q I don't have a red pointer for you, but 4 there is a pointer there. 5 A You have the Internet out here. You have 6 a fire wall which in our case is a Cisco, and 7 Mr. Laird Johnson talked about. 8 For purposes of this discussion, 9 we'll use Brillig. Brillig is sitting inside 10 Intel's network and inside the fire wall. We have 11 e-mail going both ways. The FTP which is initiated 12 from Intel to the Internet and that's -- I think is 13 fairly important. We have Telnet initiated from 14 the Intel side going out to the Internet. That's 15 pretty much that slide. 16 Q Could you show how the fire wall was 17 changed with the addition of the gate program? 18 A Sure. 19 MR. SUSSMAN: Question in aid of 20 objection. 21 THE COURT: You may. 22 23 24 25 41 1 EXAMINATION IN AID OF OBJECTION 2 BY MR. SUSSMAN: 3 Q Mr. Cower, at the time that the events in 4 question occurred, did you -- have you looked at 5 the -- I guess the router configurations as far as 6 the connection, the actual connection between 7 Brillig and the Internet for Telnetting and e-mail? 8 A The actual router, the router connections 9 I don't believe were specific to Brillig. They are 10 subject to the subnet that sits inside SSD. 11 THE COURT: And Brillig was a part 12 of that? 13 THE WITNESS: Yes. I had looked at 14 them at the time. I don't remember. 15 BY MR. SUSSMAN: 16 Q Did you check to see whether Brillig 17 accepted the typical support No. 25 for e-mail? 18 A Yes, I believe it did. I didn't check 19 that specifically. Most of our systems run -- send 20 FTP mail to the same -- 21 Q Did you check to see whether Brillig did? 22 A Specifically, no. 23 Q Do you know personally whether Brillig 24 was set up that -- 25 A This is a generalization of how systems 42 1 at Intel talk to e-mail. 2 MR. SUSSMAN: Your Honor, I object. 3 THE COURT: Sustained. The diagram 4 is showing specifically how Brillig works and -- 5 BY MR. TINTERA: 6 Q Would you erase Brillig off there? 7 A Sure. 8 Q Just -- 9 A It doesn't go away very well. 10 Q Just move it off the screen. 11 THE COURT: Ask your question, 12 Mr. Tintera. 13 BY MR. TINTERA: 14 Q What's the change between the function of 15 the fire wall with the addition of the gate 16 program? 17 A This. I'll do this in red. 18 THE COURT: Well, the Telnet goes 19 both ways to what now? We're not -- 20 BY MR. TINTERA: 21 Q If Brillig isn't in there, the Telnetting 22 is going both ways to what? 23 A To Intel systems. 24 THE COURT: And you don't know 25 whether or not Brillig was wired that way or not? 43 1 THE WITNESS: No, I don't. 2 BY MR. TINTERA: 3 Q So what danger does that pose for Intel? 4 A I'll show that here. I have another 5 slide. Telnet was really the thing we were most 6 concerned about. 7 Q Don't go showing any names of any 8 computers on that. There you go. 9 A What happens is, I got o-r-a, is that 10 accurate? 11 Q This is a demonstration. My question is 12 what danger does this pose to the Intel -- 13 A The danger is if someone is sitting out 14 here with a sniffer, for example, at o-r-a, 15 O'Reilly, I'm waiting -- 16 MR. SUSSMAN: Your Honor, I will 17 object. This is repeating testimony that was -- 18 that came out both in direct and cross-examination. 19 THE COURT: I think it came out on 20 cross-examination of defense witnesses. I'm not 21 sure this came out on direct during the State's 22 case. I don't recall that. If it came out on 23 cross, it's all right, it's still proper area of 24 rebuttal. Go ahead. 25 44 1 BY MR. TINTERA: 2 Q So what does this -- what's the danger to 3 Intel Corporation? 4 A I heard mention that there was a person 5 coming through the gate program would be presented 6 with a magic screen or clear screen or blank screen 7 or you would have to type in some magic word or 8 some incantation of numbers, IP address with a port 9 number. 10 If there is a sniffer running out 11 here, you can type in a thousand words, it makes no 12 difference, and that person running the sniffer is 13 going to have all those packets going in. 14 THE COURT: Does a sniffer then 15 operate sort of like a crack program in that it 16 then -- 17 THE WITNESS: Sniffer sits on -- 18 probably easier example, sniffer sits on -- they 19 are netted, a -- network machines are typically 20 connected and sniffs or listens for packets going 21 through certain addresses coming from addresses and 22 going, looks at source and destination addresses 23 and gathers those packets up and saves them for 24 later analysis. It's a very useful tool. 25 THE COURT: The question I had then 45 1 is, is its operation sort of like then running a 2 crack program? Once it saves the packets up, does 3 it try different combinations? 4 THE WITNESS: No. Usually in the 5 case of sniffers I've dealt with, network general 6 sniffers, it's a device that sits there and listens 7 and gathers packets. 8 BY MR. TINTERA: 9 Q What type of information from the packet 10 would that program obtain? 11 A Well, they'd have everything. 12 Q "Everything" being what? 13 A They would have the user name, the 14 password, the machine you're going to, the 15 destination. 16 Q Port number? 17 A Sure. 18 Q Everything to use that Telnet? 19 A Yes. 20 Q Or to Telnet through the fire wall? 21 A Oh, yeah. If they had that information 22 they could come through the fire wall, yes. 23 Q Now, is the gate program, is it only 24 activate by an individual or does it remain active 25 waiting for a contact? 46 1 A I believe the gate program sat and 2 listened. 3 Q What type of exposure does that give the 4 Intel Corporation? 5 A It's a risk that we weren't willing to 6 accept at that time and haven't been willing to 7 accept that risk even today, incoming Telnet. 8 Q Mr. Johnson-Laird talks about passwords 9 being the weakest link in security. 10 A Oh, yeah, I have his file. Can I use 11 this file? He had a ***foil that started out that 12 passwords were the weakest links in security and 13 that's not what we have found. 14 Q From your experience, is that accurate? 15 A No. People are the weakest link in 16 security. 17 Q Why do you say that? 18 A We found that at Intel Corporation 80 19 percent -- roughly 80 percent of security -- 20 MR. SUSSMAN: Your Honor, I object. 21 I object to the question and object to the answer. 22 The question is calling for this witness to comment 23 on the credibility of another witness' testimony. 24 MR. TINTERA: Well, this was an 25 expert. 47 1 THE COURT: This is opinion 2 evidence. I consider it as opinion evidence and 3 the State can offer Mr. Cower -- the opinions 4 through Mr. Cower. 5 THE WITNESS: We found that 80 6 percent of the security incidents at Intel involve 7 people. We have a information security road show 8 that we present where this is laid out pretty 9 clear. 10 BY MR. TINTERA: 11 Q And what about testing security? 12 A Mr. Johnson-Laird said, "You have to test 13 your own before a cracker tests it for you. I 14 guess if that's the case, then you can read this 15 and people wishing to report a problem with the 16 security of a system need not exploit it to report 17 it. By way of analogy, one does not set fire to a 18 neighborhood shopping center to bring attention to 19 the ***then try to justify in in ****(reading from 20 the exhibit.) 21 And that's an excerpt from the paper 22 by Eugene ***Spafford at Purdue University and 23 Dr. Spafford is a recognized security expert. By 24 way of ***TPHAL job bring TABGTS attention to. 25 MR. TINTERA: That's all I have. 48 1 Thank you. 2 THE COURT: Do you have further 3 questions of the witness? 4 MR. TINTERA: I do. ****( way back 5 there the Judge made comments they ether? That 6 must be why we all fall asleep in the afternoon, 7 we're sniffing ether, words to that effect.) He -- 8 those are the only questions I have. 9 THE COURT: Mr. Sussman. 10 MR. SUSSMAN: Thank you, Your Honor. 11 12 CROSS-EXAMINATION 13 BY MR. SUSSMAN: 14 Q Mr. Cower, you've been working at Intel 15 for over five years now? 16 A Just under five years. Five years in a 17 week or so. 18 Q And you're a network security specialist? 19 A Yes. 20 Q Now, you had no special training to be a 21 network security specialist, did you, just your 22 experience working on computers? 23 A Yes. 24 Q And you've been asked by -- throughout 25 this investigation, you've been kind of the key 49 1 person that Intel has assigned to the investigation 2 of the events involving Mr. Schwartz, haven't you? 3 A No, I wouldn't say that. 4 Q Well, you've been one of the principle 5 people involved in investigating this incident, 6 haven't you? 7 A Actually, no. 8 Q You helped in the preparation of the 9 search warrant? 10 A Minimally. 11 Q You went along with the police to help 12 them identify things during the course of the 13 search? 14 A I was really there to assist the police 15 as a secondary -- that was secondary to what I was 16 doing there. I was there to make sure that the 17 search warrant got served. And when the search 18 warrant was served, we knew that Mr. Schwartz would 19 be busy, and when he was busy, we could turn off 20 the access. That's what I was doing. 21 Q And you were there to provide technical 22 support to the police in conducting the search? 23 A After -- my primary responsibility was to 24 make a phone call. 25 Q And you were also there to help them with 50 1 the questioning of Mr. Schwartz to answer technical 2 questions? 3 A They asked me to, yes. I didn't know 4 that I was going to do that when I went there. 5 Q And after that incident occurred, you've 6 been working very closely with the District 7 Attorney's Office during the preparation of this 8 case, haven't you? 9 A I would say no. I've only been here when 10 I've been subpoenaed, when I've been told to come. 11 Q You've had meetings with Mr. Tintera to 12 go over documents with him by computer? 13 A By computer? What do you mean? 14 Q Have you been -- 15 A You mean have we linked our computers up? 16 Q Yes. 17 A I don't think we have. I don't think it 18 ever worked. 19 Q You tried to do that? 20 A I think it was tried. Yeah, I think we 21 tried once, but it didn't work. 22 Q So you have been in touch with the 23 District Attorney's Office to talk about documents 24 that were provided? 25 A By phone primarily, yes. 51 1 Q You provided them technical assistance in 2 the preparation of the case? 3 A Some, yes. 4 Q And during the course of the trial, 5 you've been asked by Intel to be here and assist 6 the district attorney with their technical concerns 7 or questions in the prosecution of this case, 8 haven't you? 9 A Yes. 10 Q And you're working on salary for Intel 11 while you're doing this? 12 A Yes. 13 Q And you're here at the direction of the 14 corporation, aren't you? 15 A Oh, yes. I wouldn't be here if they 16 didn't tell me to be here. 17 Q In fact, you're here to represent Intel's 18 interests in that regard, aren't you? 19 A I'm here because they asked me to come 20 and help the district attorney. 21 Q Now, before you came back to make this 22 presentation, did you talk to Mr. Tintera about the 23 matters that you were going to be presenting to the 24 jury? 25 A I think -- yeah, I think we did. 52 1 Q You went over the information that you 2 wanted to present? 3 A Yes. 4 Q Talked about the questions that he would 5 ask? 6 A No. Actually, that was never discussed. 7 Q But basically the information and what he 8 wanted you to cover? 9 A Yes. No, he didn't ask us to cover 10 everything. He saw the results of what we were 11 going to do. That's all. 12 Q Now, your opinion on the security of the 13 Internet and fire walls, this is the first time 14 you've been asked to present an opinion on that, in 15 any proceeding? 16 A Yeah. 17 Q And the only time you've been asked to do 18 it now is on behalf of Intel; is that right? 19 A I don't understand the question. 20 Q I'll withdraw that question. 21 In the first part of your testimony 22 when you were referring -- are you familiar -- I'll 23 come back to that. 24 In your earlier testimony about the 25 exhibits showing the host files, the files -- 53 1 A I can't see that from here. 2 Q We're talking about State's Exhibit 29, 3 30 and 31. 4 A Oh, these. 5 Q Yeah. You testified about the codes 6 alongside those showing who could read them and who 7 could execute on the files? 8 A "Read" is what I'm most concerned with. 9 Q Okay. And that meant then that anybody 10 in Mr. Schwartz's -- the group that Mr. Schwartz 11 was working in that had access to those computers 12 could read anything in his files? 13 A Yes. It looks like he had most of his 14 stuff set up there. 15 Q And the people who were in his group, the 16 Systems Administrators and the Network 17 Administrators who made up that group could read 18 whatever he was doing on the Crack file; is that 19 right? 20 A Yes, that's what it meant. 21 Q And they could go into that and see 22 exactly what files he was running the Crack program 23 on? 24 A Actually, let me look. 25 Q You said that each of the people in that 54 1 group -- 2 MR. TINTERA: Well, Judge, would 3 you -- 4 THE COURT: Let him answer the first 5 question. 6 THE WITNESS: Yes. That's right. 7 BY MR. SUSSMAN: 8 Q Now, those settings, the "read, write" 9 settings there, are those -- those settings to 10 allow anybody to read those? Were those 11 specifically set to allow anyone to read them or 12 were those kind of default settings that sort of 13 came out of the package that way? 14 A I don't know. 15 Q That was -- the people who had access to 16 that file was a group made up of Mr. Morrissey and 17 a few other people like Mr. Wilcox who were Systems 18 Administrators or Network Administrators? 19 A That's what I've heard. I haven't looked 20 at the password file for that system or those 21 systems, so I don't know. 22 Q You were asked some questions about this 23 sniffer program kind of sitting out there looking 24 for data packets of information. 25 A I think you added "program." 55 1 Q I'm sorry. I maybe misspoke myself. 2 We'll just refer to it as the sniffer then. 3 A Uh-huh. 4 Q A person with the sniffer, does that have 5 to actually watch the conversation on the lines 6 somewhere along the lines where communication is 7 occurring in order to repeat it? 8 A Yes. In general, yeah. 9 Q Can one of those sniffers kind of sit out 10 there and attach to or kind of sit on a modem, too? 11 A I've never used one on a modem. 12 Q But can they? 13 A I don't know. I've not done that. I 14 think I would use something else for that 15 application. 16 Q You had testified a little while ago 17 about the concerns about the outside access of the 18 fire walls there. Would it be accurate to say that 19 since November of 1993, in the latter couple years, 20 you've actually limited -- tightened down on what 21 kind of access is coming in the fire wall? 22 A It's really gone both ways. In some 23 sense it has been tightened down and in others, 24 it's been loosened up. 25 Q Before November of 1993, there were 56 1 people accessing Intel through the fire wall, 2 weren't there? 3 A There were some, yes. 4 Q You had SSD field engineers -- 5 A Yes. 6 Q -- who had access to the Internet through 7 the fire wall? 8 A Yes. 9 Q And that -- 10 A That has since been shut down, I'm quite 11 sure. 12 Q But those people were doing that during 13 the time, too, that Mr. Schwartz was working at 14 SSD? 15 A I don't know if they were doing it at the 16 time he was working at SSD. 17 Q Your goal in dealing with this fire wall, 18 isn't it, would it be accurate to say, is to try to 19 limit access from the Internet to Intel machines? 20 A Yes, that's really the goal. 21 Q And you want to limit it -- particularly 22 limit it to the machines that have the sensitive 23 product information? 24 A No, that's not true. We want to limit it 25 to authorized access only. 57 1 Q But your goal in limiting the access was 2 to either make sure that the connections to the 3 Intel machines was done securely or to limit it 4 severely? 5 A Machines that don't contain private 6 information is really what we're limiting it to. 7 Q You actually looked at -- did you 8 actually examine the program script of each of the 9 door and the gate programs that Mr. Schwartz wrote 10 to allow access? 11 A I've taken a very cursory look at those. 12 I'm not a Pearl programmer, so it wouldn't really 13 make any sense for me to examine it. I can't read 14 the code. 15 Q You're aware, though, that Mr. Schwartz 16 wrote into that -- built in a feature that recorded 17 each effort to log in each connection to the 18 machines through that -- 19 A That's what I've been told, yes. There 20 are logs. 21 Q That allowed him to monitor the record of 22 who logged in, of where the log-ins came each time 23 somebody logged into the machines through that gate 24 or door program, didn't it? 25 A That would have allowed that, yes. 58 1 Q That would have allowed him also to 2 monitor any suspicious connection or any 3 connections that weren't his, wouldn't it? 4 A Yes. 5 Q Now, you had testified a little while ago 6 that in your opinion passwords were not the weakest 7 link. Are you familiar with a book entitled Fire=20 8 Walls and Internet Security, Repelling the Wily=20 9 ***Act, by William ***she is we can and? 10 A What does "familiar" mean? 11 Q Have you seen their book? 12 A I ever seen it? 13 Q Do you recognize it as -- 14 A That's a new book. 15 Q One that's reliable, kind of an authority 16 on this subject? 17 A It's a new book. 18 Q Well, here, this one, would you agree 19 with them then when -- at the beginning of Chapter 20 9 where it talks about stealing passwords and says, 21 "The easiest way into a computer is usually the 22 front door, which is to say the log-in command." 23 Do you agree with that? 24 A That's one way, yes. 25 Q And on nearly all systems a successful 59 1 log-in is based on supplying the correct password 2 within a reasonable number of tries? 3 A Yes, that's true. 4 Q Now, would you also agree with the 5 authors when they say that "System bugs are the 6 exciting way to crack a system but not most common 7 attack. That is, to most, mundane"? 8 A Yes. My point is by the people, who set 9 the passwords -- 10 Q So people setting up bad passwords? 11 A Is a security problem, yes. 12 Q That's a real problem, yeah? 13 A Yeah, it is. Yes. 14 Q Now, I've got this book here, Mastered=20 15 Complexities of Network Security, Internet Fire=20 16 Walls and Network Security. And this is by -- I'll 17 spell it, K-a-r-a-n-j-i-t-c-y and Chris ***Hair. 18 Have you ever seen this book? 19 A No, I haven't. 20 Q Are you familiar with either of the 21 authors, did you ever hear of them? 22 A You'd have to bring it up and maybe I 23 know them. I couldn't get it when you spelled it. 24 Q I didn't want to risk butchering that 25 author's name. 60 1 A No. 2 Q Well, would you agree or disagree with 3 this comment about a password file: "The first 4 line of defense against unauthorized access to the 5 system is the /ETC/ password file. Unfortunately, 6 it's also the weakest link." 7 A It's a weak link. 8 Q Is often the weakest link? 9 A Yes, I would agree with that. 10 MR. SUSSMAN: I think that covers 11 it. 12 THE COURT: Redirect? 13 14 REDIRECT EXAMINATION 15 BY MR. TINTERA: 16 Q Mr. Cower, could you explain if an e-mail 17 contains the same information as a Telnet for a 18 sniffer? 19 A No, it doesn't. E-mail would have a user 20 name and the machine that the e-mail is destined. 21 The Telnet contain the user name, password and the 22 machine IP address. In both cases it's really the 23 IP address. 24 Q Why is it Intel has not opened up its 25 fire wall to telnetting? 61 1 A That's a risk that we haven't found a way 2 to solve yet. We just can't accept that risk. 3 MR. TINTERA: Thank you. I don't 4 have any other questions. 5 MR. SUSSMAN: Just one. 6 RECROSS-EXAMINATION 7 BY MR. SUSSMAN: 8 Q Couldn't that -- you're talking about the 9 ***risk of telnetting, couldn't a sniffer see 10 outgoing telnets from Intel that are allowed out? 11 A Yeah. 12 Q So couldn't then the sniffer also see the 13 people from Intel who are sending Telnets out to 14 some machines outside of Intel and be able to see 15 the same information? 16 A No. The information wouldn't be the 17 same. 18 Q Wouldn't be able to see the passwords or 19 the IPDs? 20 A They see the machine they are connecting 21 to on the outside, which by policy is not supposed 22 to be the same password as they use internally. 23 Q Also see the IP address from where it's 24 originated, wouldn't they? 25 A Sure. Yeah. So what? I don't think 62 1 they're getting anything valuable there. 2 Q Even though it's not supposed to be the 3 same password, it could be the same password, 4 couldn't it? 5 A Oh, yes. 6 Q Because you have 80 percent of those 7 problems from people and people who often use the 8 same passwords when they shouldn't? 9 A Yes. 10 MR. SUSSMAN: Thank you. Nothing 11 further. 12 13 FURTHER REDIRECT EXAMINATION 14 BY MR. TINTERA: 15 Q Then why do you allow outgoing network if 16 it's the same as in-going? 17 A It's perceived to be a business need. We 18 think we need outgoing telnetting to solve the 19 business problem. 20 Q What does the outgoing have that the 21 incoming would not telnetting? 22 A The outgoing Telnet, assuming everything 23 is done right, should not contain a user name and 24 password at Intel. 25 MR. TINTERA: Thank you. That's all 63 1 I have. 2 MR. SUSSMAN: Nothing further. 3 THE COURT: Thank you. You may step 4 down. 5 Call your next witness. 6 MR. TINTERA: Jim Lilley. 7 8 JAMES LILLEY 9 called as a rebuttal witness on behalf of the 10 State, having been first duly sworn under oath, was 11 examined and testified as follows: 12 13 THE CLERK: State your full name and 14 spell it for the record, please. 15 THE WITNESS: James W. Lilley. 16 L-i-l-l-e-y. 17 18 DIRECT EXAMINATION 19 BY MR. TINTERA: 20 Q Mr. Lilley, if I could bring you back to 21 November 1st of 1993, do you recall your 22 conversation with the defendant, Randal Schwartz? 23 A Yes, I do. 24 Q Now, before you spoke with him, did you 25 have any information, specific information about 64 1 his activities at Tektronix or Tandem? 2 A No, I did not. 3 Q Did Mr. Schwartz share with you his 4 remembrances of his activities at Tektronix and 5 Tandem? 6 A Yes, he did. 7 Q And this was during the interview you 8 talked about at the beginning of trial as to what 9 he was saying? 10 A Yes, that's correct. 11 Q Could you tell us what he told you about 12 his activities at Tektronix? 13 A When we were talking with him about what 14 had been alleged at Intel and then we got into 15 other areas, in part which involved Tektronix, 16 Mr. Schwartz told me that he had worked at 17 Tektronix between the years of 1978 and 1983 and 18 that at one point, and he had to estimate that he 19 believed it was about 1981, he had actually been 20 suspended from Tektronix for engaging in similar 21 activities to what we were alleging and accusing 22 him of at the time of the interview. 23 Q Did he explain what those activities 24 were? 25 A I don't recall specifically any specific 65 1 activities. I don't remember him saying that he 2 had done exactly the same thing. 3 What he had done was -- what he said 4 to us was -- when we were explaining to him why we 5 were there and what we were alleging as far as 6 accessing the computer systems when he didn't have 7 authority to do that, and in fact overcoming 8 safeguards and barriers in order to do that, it was 9 in response to that conversation or as part of that 10 conversation that he said that, in fact, he had 11 been suspended from Tektronix for doing a similar 12 thing back in, he believed, about 1981. 13 Q What did he tell you about the Tandem 14 Corporation? 15 A He also told me during the same 16 conversation that he had worked at Tandem between 17 the years of 1986 and 1987 and that on April Fools 18 day as a joke, he couldn't remember which year it 19 was, but it was one of those two years, he also had 20 illegally cracked passwords and accessed files in 21 the Tandem systems. 22 He went on to say that as a result 23 of that activity, that he was -- and I use his 24 words in quotation marks here -- he said to me that 25 he was "technically terminated," to use his words, 66 1 for about two hours. 2 Q And he was reinstated for what reason? 3 A He then went on to say that he was 4 immediately reinstated by a supervisor who had 5 taken the point of view that what Mr. Schwartz had 6 done was, in fact, part of his job description and 7 part of what he was authorized to do while employed 8 at Tandem, which he said was testing the security 9 systems within the computer systems for Tandem. 10 Mr. Schwartz did also mention at 11 that point in time, he had been writing a book 12 about securities, about security systems for 13 computer systems, and that in part what he did on 14 this April Fools joke was in part research for that 15 book. 16 MR. TINTERA: Thank you. That's all 17 I have. 18 19 20 21 22 23 24 25 67 1 CROSS-EXAMINATION 2 BY MR. SUSSMAN: 3 Q Detective Lilley, when you testified that 4 Mr. Schwartz told -- in his discussions about what 5 happened at Tektronix told you that he had -- that 6 he was suspended for two weeks, are you certain 7 that he said he was suspended for two weeks? 8 A I don't believe I said two weeks. I 9 just -- my report reflects that he was suspended at 10 Tektronix for similar activities, but not for two 11 weeks. 12 Q Are you certain that he told you that he 13 was actually suspended? 14 A Yes, I am certain of that. 15 Q Could he have said that he might have 16 been suspended? 17 A No. 18 Q It's kind of curious because we ***I have 19 a heard that he was never suspended. Now, there 20 would be no reason for Mr. Schwartz to tell you he 21 was suspended when, in fact, he was not, would 22 there? 23 A I have no idea. To be honest with you, 24 that -- those sort of statements are statements 25 that I would pay particular attention to during the 68 1 course of an interview. And if that goes in my 2 report, then there is no doubt in my mind that 3 that's what Mr. Schwartz told me at that time. 4 Q So he may have told you something that 5 wasn't accurate? 6 MR. TINTERA: Objection. 7 THE COURT: Sustained. 8 MR. SUSSMAN: Nothing further. 9 THE COURT: Anything further? 10 MR. TINTERA: No. 11 THE COURT: Thank you. You may step 12 down. 13 Call your next witness. 14 MR. TINTERA: I have no other 15 rebuttal evidence, Judge. 16 THE COURT: Mr. Sussman, anything 17 else? 18 MR. SUSSMAN: May I have a moment? 19 THE COURT: Want to talk with 20 Mr. Johnson-Laird? 21 MR. SUSSMAN: Yes. 22 THE COURT: You may. 23 MR. TINTERA: May this witness be 24 excused? 25 THE COURT: He may be, yes. 69 1 (Discussion off the record 2 between Mr. Sussman and 3 Mr. Johnson-Laird.) 4 MR. SUSSMAN: Your Honor, I would 5 like to call Mr. Johnson-Laird. 6 THE COURT: Call your witness. 7 8 ANDREW JOHNSON-LAIRD 9 called as a surrebuttal witness on behalf of the 10 Defendant, having been first duly sworn under oath, 11 was examined and testified as follows: 12 13 THE CLERK: State your full name and 14 spell it for the record, please. 15 THE WITNESS: My name is Andrew 16 Johnson-Laird. J-o-h-n-s-o-n - L-a-i-r-d. 17 18 DIRECT EXAMINATION 19 BY MR. SUSSMAN: 20 Q Mr. Johnson-Laird, are you familiar with 21 the book Fire Walls and Internet Security,=20 22 Repelling Wily Hackers, by William ***SHEZ which 23 can -- ***(ck the title - different before) 24 A Yes. 25 Q -- that I referred to in questioning 70 1 Mr. Cower? 2 A Yes. 3 Q And in your opinion is this book 4 recognized among people in your field as an 5 authoritative -- 6 A Both the books and the authors. 7 Q What about this book, Internet Fire Walls 8 and Network Security by Dr. Karanjitcy and Chris 9 ***Hair? 10 A That's a recent book and the authors are 11 names that I hadn't scene before other than I think 12 I saw Dr. Karanjitcy's in a citation. I have every 13 reason to believe it's factually accurate. 14 Q It's based on your review of the book? 15 A Yes. 16 Q One other question about sniffers. 17 Would it be -- (Pause) 18 MR. SUSSMAN: I have nothing 19 further. 20 THE COURT: Mr. Tintera. 21 MR. TINTERA: Nice seeing you again. 22 THE WITNESS: Hello, Mr. Tintera. 23 MR. TINTERA: No questions. 24 THE COURT: Thank you. You may step 25 down. 71 1 Any further surrebuttal? 2 MR. SUSSMAN: I'd like to recall 3 Randal Schwartz. 4 THE COURT: Step forward, sir. 5 6 RANDAL SCHWARTZ 7 the defendant herein, called as a surrebuttal 8 witness on his own behalf, having been first duly 9 sworn under oath, was examined and testified as 10 follows: 11 12 THE CLERK: State your full name for 13 the record, please. 14 THE WITNESS: Randal Schwartz. 15 16 DIRECT EXAMINATION 17 BY MR. SUSSMAN: 18 Q Mr. Schwartz, while you were working at 19 Tektronix, were you ever suspended for any activity 20 involving breaking into -- breaking through the 21 company security? 22 A No, I was not. 23 Q Was there such an incident? 24 A There was an incident involving 25 passwords, yes. 72 1 Q In which you showed problems in the 2 security of the passwords? 3 A Not problems in the security of the 4 passwords. Problems in the way the system was 5 being operated. 6 Q And in that, after that incident, were 7 you then suspended or terminated in any way? 8 A No, not tall. 9 MR. TINTERA: Your Honor, can we 10 approach the bench? 11 THE COURT: You may. 12 (Discussion at the bench 13 between Court and counsel.) 14 THE COURT: ***KHAER question came 15 up I think we're done, but I want to hear argument 16 outside your presence. I'll have you excused to 17 the jury room. Have you wait there for a few 18 minutes. Unless we have you brought in, unless 19 that happens, we're all done with the evidence. 20 Tomorrow morning, we'll start at 21 9:30. I have a 9:00 o'clock matter. At that time, 22 you'll begin hearing argument of counsel and 23 instructions from me, and then you can begin your 24 deliberations. 25 It's very important now because you 73 1 have heard all the evidence, and it's possible that 2 we would bring you in for another minute or so, but 3 I think you've heard all the evidence, don't talk 4 about the case, don't read any news articles or 5 read up on the subject, keep a clear mind and come 6 back tomorrow morning and we'll try to start right 7 at 9:30. 8 Okay. Remove the jury. 9 I want to have you wait just for a 10 minute before we finally excuse you. 11 (Whereupon, the following 12 proceedings were held in 13 open court, out of the 14 presence of the jury:) 15 THE COURT: I have before me a 16 plaque that's been marked Defendant's Exhibit 179 17 and appears to be a Tektronix -- some sort of 18 recognition award dated July 22nd, 1982. 19 Mr. Tintera's objection is it's never been provided 20 to him in discovery and beyond that he doesn't 21 think it's relevant to anything that we're doing 22 here on surrebuttal. 23 Mr. Sussman, this is what you were 24 about to question your client about. What's the 25 relevance? 74 1 MR. SUSSMAN: The relevance that the 2 question was raised about the fact of whether 3 Mr. Schwartz was -- an incident was arose, 4 disciplined and suspended from Tektronix. We would 5 offer this to show through testimony not only was 6 he not suspended or disciplined, but also to show 7 that his work there was outstanding and that he was 8 awarded by Tektronix, to rebut the inference that's 9 created by the State's evidence. 10 THE COURT: Mr. Tintera. 11 MR. TINTERA: Judge, I don't see the 12 relevance. First, they didn't provide it to me. 13 Apparently they had it when they came in this 14 afternoon. They did not talk to me about it or 15 show it to me or anything else. Only time I saw it 16 is when Mr. Sussman was parading it in front of the 17 jury. I don't see how it's relevant to any issues 18 in surrebuttal. 19 THE COURT: Well, I think it's, if 20 relevant, only slightly so. Doesn't go to the 21 direct issue. 22 I'm trying to wind this case down. 23 We're on the last issue now of what happened at 24 Tektronix and it had to do with whether or not he 25 ever was suspended or terminated, sanctioned for 75 1 some sort of activity involving passwords or 2 password files. This doesn't really go directly to 3 that and I'm sustaining the objection and assuming 4 the Exhibit 179 is going to be offered, I won't 5 receive it. 6 Anything else? 7 MR. SUSSMAN: No, Your Honor. 8 THE COURT: Dawns on me I didn't let 9 your client lay a foundation. Do you want to ask 10 him questions before I do that? I assume he'll say 11 this was awarded to him and all those sorts of 12 things. 13 MR. SUSSMAN: Yes, Your Honor. Just 14 for the offer of proof. 15 16 OFFER OF PROOF 17 BY MR. SUSSMAN: 18 Q Mr. Schwartz, have you seen Exhibit 179, 19 what has been marked for identification as 20 Defendant's Exhibit 179? 21 A Yes, I brought it from home. 22 Q What is that? 23 A It's the plaque that I was awarded 24 sometime in 1982. It was a division level award 25 given to people that had contributed, I was told 76 1 above and beyond the call of duty, I guess, and I 2 was one of the few people to receive that in that 3 year in the division. 4 Q And this was at Tektronix? 5 A Yes, it was at Tektronix. 6 MR. SUSSMAN: That's it. 7 THE COURT: Anything else? 8 MR. SUSSMAN: No, Your Honor. 9 THE COURT: The fact that he 10 received an award isn't necessarily inconsistent 11 with him being a bright, young person, although it 12 may provide some meritorious service also might run 13 a crack program and being sanctioned for it. They 14 are not exclusive. I've ruled on it and I'm not 15 changing my ruling. 16 Anything else? 17 MR. SUSSMAN: No, Your Honor. 18 THE COURT: You may step down. And 19 that does conclude the evidence then. 20 You may release the jury. 21 MR. TINTERA: I would like to 22 offer -- I have marked State's Exhibit 32. I need 23 to cut -- 24 THE COURT: Wait until Lynda comes 25 back in so she can keep track of that. I wanted to 77 1 go briefly over instructions before you leave. 2 MR. SUSSMAN: As far as the exhibits 3 go, in light of the objections that were raised or 4 questions that were raised about Mr. Cower's 5 understanding of the Brillig computer, and that's 6 not necessarily and accurate representation, I 7 would, if the State is offering -- 8 MR. TINTERA: I'm going to cut that 9 part out. I can't find a pair of scissors and I 10 don't -- 11 MR. SUSSMAN: I would object to the 12 exhibits showing the fire wall and the connections 13 with Brillig as they were prepared and originally 14 shown the copies as given to me as not being 15 accurate. 16 MR. TINTERA: I'd like to delete the 17 Brillig part, and when I get a pair of scissors, 18 I'm just going to cut that out. I see this as 19 being no different than Johnson-Laird's, which the 20 Court admitted as demonstrative evidence. You have 21 a pair of scissors, I can -- 22 THE COURT: Do you wish to use the 23 judicial scissors? 24 MR. TINTERA: I do. I think they 25 are better than everyone else's. 78 1 THE COURT: The ones they gave me 2 are the ones with the rounded edge like you get in 3 grade school. 4 MR. SUSSMAN: Your Honor, again, as 5 far as the -- make sure the motion is clear, 6 additionally, as I recall the testimony, there were 7 some -- Mr. Cower in cross-examination also 8 indicated that at some point prior to 1993, there 9 was some inbound telnetting that was permitted. 10 THE COURT: He did. 11 MR. SUSSMAN: And so to the 12 extent -- 13 THE COURT: As I recall -- as I 14 recall, something about SSD engineers. 15 MR. SUSSMAN: That's correct. So to 16 that extent also, I don't have this one marked, but 17 at least part of the exhibits then are not accurate 18 in the sense they try to reflect inbound telnetting 19 was not permitted. 20 THE COURT: Well, that session has 21 been explained to the jury. The exhibits will be 22 received. 23 (Whereupon, State's Exhibit 24 No. 32 was received in 25 evidence.) 79 1 THE COURT: What numbers are they? 2 MR. TINTERA: That's the mysterious 3 missing link of -- 4 THE CLERK: 32. 5 MR. TINTERA: They are all stapled 6 together as 32. 7 MR. SUSSMAN: May I take a look at 8 what has been cut out before they are offered? 9 THE CLERK: Was 179 offered? 10 MR. SUSSMAN: Your Honor, could we, 11 perhaps, to make the record a little easier so we 12 don't have to have this plaque sitting in the 13 record for the purposes of the appeal, could we 14 perhaps stipulate we would offer Defendant's 15 Exhibit 179 in the record, it was a plaque which 16 designated -- specifically said, "Design Automation 17 Division recognition award July 22nd, 1982 18 presented to Randal Schwartz for occupying 19 achievement during the physical year 200 ***WW," 20 under the signature of Vice President General 21 Manager of Design Automation Division, and that if 22 allowed, the plaque showing that award would have 23 been presented. 24 THE COURT: Mr. Tintera, is that 25 okay with you? 80 1 Thank you, Mr. Tintera. He 2 sometimes -- I can tell by the look on his face. 3 MR. SUSSMAN: Thank you. Lynda, 4 that's all. 5 THE COURT: I believe you did 6 correctly recite what the plaque says and we don't 7 need to keep it. Does raise the issue about how 8 Tektronix counts their physical year. They have 9 200 physical years? I thought they started 10 sometime in the forties or fifties. The physical 11 year must be about three months each. 12 THE DEFENDANT: Do you want an 13 explanation? 14 THE COURT: No. After the trial. 15 Does that conclude the evidence 16 then? 17 MR. TINTERA: I thought I had 18 offered, but I had apparently had not, I would 19 offer State's Exhibits 23, 26, 27 and 28. I 20 thought I had done that. 21 THE COURT: It's possible. I did 22 check my notes and I did see the notation, but -- 23 that's the reason I wanted you to check with the 24 clerk. 25 MR. SUSSMAN: I have no objection. 81 1 THE COURT: 23, 26, 27 and 28 are 2 received. 3 (Whereupon, State's Exhibit 4 Nos. 23, 26, 27 and 28 were 5 received in evidence.) 6 THE COURT: Mr. Sussman, have you 7 likewise checked the list that Lynda has kept? 8 MR. SUSSMAN: Yes. 9 THE COURT: You're satisfied that 10 everything you wanted to offer has been offered and 11 I've either received or rejected? 12 MR. SUSSMAN: Yes, Your Honor. 13 THE COURT: That concludes the 14 evidence. 15 MR. TINTERA: I didn't look at the 16 list, Judge. I have 23 as being offered and 17 received. 18 THE COURT: I just did that. 19 THE CLERK: I just haven't marked it 20 "received" yet. 21 MR. TINTERA: I don't have the 22 updated list, then. 23 THE COURT: 23, 26, 27 and 28 are 24 received. Is this consistent with your 25 recollection? 82 1 MR. TINTERA: No, consistent with my 2 records. My recollection is much weaker than my 3 records. 4 THE COURT: That does conclude the 5 evidentiary part of the trial. We will recess 6 until tomorrow morning at 9:30. I'd like to have 7 counsel here before that and like to see counsel 8 for a few minutes regarding instructions. 9 Thank you. 10 (Evening recess.) 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25