1000 Friends of Oregon v. Wasco Co., 399 Or 344, 703 P2d 207 (1985) 40

Andresen v. Maryland, 427 US 463, 480 (1976) 33

Barber v. Gladden, 327 F2d 101 (9th Cir.), cert den 377 US 971 (1964) 49

Connally v. Georgia, 429 US 245 (1977) 36

Galley v. Babb, 50 Or App 617, 624 P2d 616, rev. den. 291 Or 117 (1981) 46, 50

Giaccio v. Pennsylvania, 382 US 399 (1966) 46

Grayned v. City of Rockford, 408 US 104 (1972) 46

Johnson v. United States, 333 US 10, 68 SCt 367, 92 LEd2d 153 (1948) 36

Lo-Ji Sales, Inc. v. New York, 442 US 319, 326 n.5 (1970) 33

Payton v. New York, 445 US 573, 100 SCt 1371, 63 LEd2d 639 (1980) 26

Portland General Elec. Co. v. Bureau of Labor and Industries, 317 Or 606, 610-11, 859 P2d 1143 (1993) 43

Raymond v. Feldmann, 124 OrApp 543, 548-49, 863 P2d 1269 (1993) 54, 55

Samuel v. Frohnmayer, 95 OrApp 561, 770 P2d 914, rev'd on other grounds, 308 Or 362, 779 P2d 1028 (1989) 54

Sizemore v. Swift, 79 OrApp 352, 358, 719 P2d 500 (1986) 54

Stanford v. Texas, 379 US 476, 485 (1965) 34

State ex rel Juv. Dept. v. Rogers, 314 Or 114, 836 P2d 127 (1992) 37

State v. Anspach, 298 Or 375, 692 P2d 602 (1984) 23, 25, 28, 32

State v. Atkinson, 98 OrApp 48, 777 P2d 1010 (1989) 59

State v. Barkley, 315 Or 420, 435, 846 P2d 390 (1993) 57

State v. Bates, 304 Or 519, 527-28, 747 P2d 991 (1987) 13

State v. Blackburn/Barber, 266 Or 28, 34, 511 P2d 381 (1973) 29, 31, 33

State v. Blair, 287 Or 519, 524, 601 P2d 766 (1979) 43

State v. Buffington, 87 OrApp 559 743 P2d 738 (1987) 28

State v. Bullock, 135 OrApp 303, 899 P2d 709 (1995) 55, 56

State v. Carillo, 125 OrApp 52, 56, 865 P2d 379 (1993) 56

State v. Carlile, 290 or 161, 165, 619 P2d 1280 (1980) 25

State v. Carter, 316 Or 6, 13, 848 P2d 599 (1993) 21, 23-26, 32

State v. Cooper, 78 OrApp 237, 239-40, 715 P2d 504 (1986) 48, 49

State v. Corpus-Ruiz, 127 Or App 66, 874 P2d 90 (1994) 27

State v. Crotsley, 308 Or 272, 278, 779 P2d 600 (1989) 59

State v. Davis, 295 Or 227, 666 P2d 802 (1983) 37

State v. Dillon, 292 Or 172, 181, 637 P2d 602 (1981) 53, 55

State v. Dimeo, 304 Or 469, 478 n. 4, 747 P2d 353 (1987) 13

State v. Evans, 119 Or App 44, 47, 849 P2d 539 (1993) 26, 27

State v. Gates, 31 OrApp 353, 356, 570 P2d 670 (1977) 38

State v. Gloster, 145 OrApp 555, 558, 932 P2d 68 (1997) 24

State v. Goodman, 152 Or App 83, ___ P2d ___ (1998) 26

State v. Graves, 299 Or 189, 700 P2d 244 (1985) 39, 41, 46

State v. Green, 245 Or 319, 422 P2d 272 (1966) 48

State v. Harp, 299 Or 1, 697 P2d 548 (1985) 19, 21

State v. Hart, 299 Or 128, 139, 699 P2d 1113 (1985) 53

State v. Heath, 75 OrApp 425, 706 P2d 598 (1985) 57

State v. Heneghan, 108 OrApp 637, 816 P2d 1175 (1991) rev. den 59

State v. Henry, 302 Or 510, 516, 732 P2d 9 (1987) 33

State v. Hodges, 254 Or 21, 27, 457 P2d 491 (1969) 40

State v. Ingram, 313 Or 139, 145, 831 P2d 674 (1992) 29-31, 33, 37

State v. Jim/White, 13 OrApp 201, 508 P2d 462 (1973) 49

State v. Jones, 103 Or App 316, 797 P2d 385 (1990) 33

State v. Keeney, 323 Or 309, 918 P2d 419 (1996) 20

State v. Kincaid, 78 OrApp 23, 714 P2d 624 (1986) 49

State v. Kurtz, 46 OrApp 617, 624, 612 P2d 749 (1980) 38

State v. Lefthandbull, 306 Or 330, 758 P2d 343 (1988) 53, 57

State v. Lindsly, 106 OrApp 459, 808 P2d 727 (1991) 55

State v. Lyons, 124 OrApp 598, 863 P2d 1303, 1312 (1993) 58

State v. Mahoney, 115 OrApp 440, 838 P2d 100 (1992) 54, 55

State v. Matsen/Wilson, 287 Or 581, 601 P2d 784 (1979) 26

State v. Maxfield, 133 Or App 371, 891 P2d 1342 (1995) 23

State v. Miller, 116 Or App 174, 179 (1992), aff'd as modified 119 Or App 102 (1993) 20, 22

State v. Modrell-Lydall, 128 Or App 372, 876 P2d 315 (1994) 20

State v. Moeller, 105 OrApp 434, 806 P2d 130 (1991) rev. dismissed, 312 Or. 76, 815 P2d 701 (1991) 38, 40, 50

State v. Nunn, 110 OrApp 96, 821 P2d 431 (1991) rev. den. 313 Or 211 (1992) 59

State v. O'Brien, 96 OrApp 498, 774 P2d 1109, rev. den. 308 Or 466, 781 P2d 1214 (1989) 54

State v. Olson, 287 Or 157, 598 P2d 670 (1979) 26

State v. Peller, 287 Or 255, 598 P2d 684 (1979) 26

State v. Ray, 302 Or 595, 733 P2d 28 (1987) 43

State v. Reed, 116 OrApp 58, 840 P2d 723 (1992) 38

State v. Reid, 319 Or 65, 872 P2d 416 (1994) 29, 30

State v. Ritter, 71 OrApp 282, 288, 692 P2d 158 (1984) 13

State v. Robertson, 293 Or 402, 408, 649 P2d 569 (1982) 50

State v. Rodriguez, 317 Or 27, 854 P2d 399 (1993) 37

State v. Sanders, 280 Or 685, 572 P2d 1307 (1977) 49

State v. Sanderson, 33 OrApp 173, 575 P2d 1027 (1977) 42

State v. Spencer, 289 Or 225, 611 P2d 1147 (1980) 43

State v. Stockton, 120 Or App 111, 852 P2d 227 (1993) 27

State v. Sumerlin, 139 OrApp 579, 584, 913 P2d 340 (1996) 59

State v. Tidyman, 54 OrApp 640, 643-44, 635 P2d 1355 (1981), rev den 292 Or 722, 644 P2d 1131 (1982) 24, 42

State v. Valentine, 264 Or 54, 504 P2d 84 (1972) 36

State v. Waldo, 93 OrApp 613, 763 P2d 417 (1988) 38

State v. Wallock/Hara, 110 OrApp 109, 821 P2d 435 (1991), rev. den. 313 Or 75 (1992) 59

State v. Wise, 305 Or 78, 749 P2d 1179 (1988) 13

State v. Yancey, 32 OrApp 477, 574 P2d 358 (1977) 49

State v. Zuniga-Ocegueada, 111 OrApp 54, 824 P2d 427 rev. den. 313 Or 211 (1992) 59

Union Pacific R. Co. v. Bean, 167 Or 534, 119 P2d 575 (1942) 41

United States v. Perez, 67 F3d 1371 (9th Cir 1995) 28

Voss v. Bergsgaard, 774 F2d 402, 405 (10th Cir. 1985) 34

Wong Sun v. United States, 371 US 471 (1963) 37

Oregon Constitution, Article I §9 29, 37

Oregon Constitution, Article 1 §8 33, 34

Oregon Constitution, Article I § 20 48

Oregon Constitution, Article I, §11 48

United States Constitution, Fourth Amendment 29, 36, 37

United States Constitution, First Amendment 33, 34

United States Constitution, Fourteenth Amendment 49

ORS 131.505 59

ORS 133.015 48

ORS 133.535 32, 33

ORS 133.565 29, 30

ORS 133.683 37

ORS 133.693 12, 20, 22

ORS 135.630 38, 48

ORS 136.445 52

ORS 137.103 53, 54, 56, 57

ORS 137.106 53

ORS 138.040 1

ORS 138.222 1

ORS 161.025 40

ORS 161.062 59

ORS 161.067 58, 59

ORS 161.565 53

ORS 164.015 51

ORS 164.377 1, 12, 14, 24, 40, 41, 43, 44, 49, 51, 52, 60

ORS 174.010 40

ORS 133.575 12, 34, 36

OAR Chapter 253, Division 4, Appendix 4 38

Black's Law Dictionary, 5th Edition 41, 44

The Merriam-Webster Dictionary 41

Affidavit for Search Warrant, 11/3/93 App 1-5

Opinion Letter, 8/1/94 App 6-7

Findings and Order from Omnibus Hearing, 6/22/95 App 8

Excerpt from Transcript 7/19/95, pp. 52, l. 13 - 53, l. 24,

Court Colloquey App 9-10

Excerpt from Transcript 7/18/95, 7/18/95, pp. 99, l. 10 - 100, l. 22,

Herb Mayer Cross Examination App 11-12

Excerpt from Transcript 7/1/94, pp. 13, l. 21 - 15, l. 13,

Court Colloquey App 13-15

This is a criminal appeal in which the defendant seeks reversal of his conviction for three counts of computer crime. The defendant was charged by indictment.

The indictment is set forth as follows:

INDICTMENT - Secret

ORS 164.377 - Counts 1 thru 3

Count 2

Count 3

Dated: March 2, 1994.

Jurisdiction of the Court of Appeals is invoked pursuant to ORS 138.040 and ORS 138.222(4)(a) & (7).

/ / /

The defendant was convicted by a jury on all three Counts and sentenced to 5 years probation on Count 1 (reduced to a misdemeanor) with special conditions including restitution, 18 months probation on each Counts 2 and 3 (felonies) with special conditions including restitution, all sentences to run concurrently. None of the counts was merged with any other count for the purpose of the imposition of sentence.

Notice of Appeal was timely filed on February 1, 1996.

Was there probable cause to support the search of defendant's home?

May police officers executing a search warrant invite non-law enforcement personnel along at their discretion?

Is the computer crime statute unconstitutionally vague either on its face or as applied?

Does the copying of a password file from one Intel computer to another Intel computer, using Intel's network, and the execution of a password-guessing program on the password file also using an Intel computer, constitute theft of that password file?

Does the copying of a password file from one Intel computer to another Intel computer, using Intel's network, and the execution of a password-guessing program on the password file also using an Intel computer, constitute a separate theft of the individual user's passwords?

Did the trial court err by refusing to merge Counts 2 and 3 for sentencing purposes?

Did the trial court err by ordering restitution when the state failed to prove that defendant's activities were the actual cause of the restitution amounts claimed or that the amounts claimed as restitution were actually incurred or easily measurable? Could restitution be imposed for those amounts claimed which were not recoverable as pecuniary damages?

Summary of Argument

The warrant which authorized the search of defendant's home was based on an affidavit which was speculative in its entirety and rife with inaccuracy. Shorn of inaccuracy, the affidavit was lacking in facts from which it could be inferred that any of the legitimate objects of search and seizure would probably be discovered in the places sought to be searched. Moreover, the warrant directed the seizures of items which seizures were not even justified by the speculation.

The statutory basis for the charges against defendant is unconstitutionally vague in that the terms "alter" and "authorization" are not defined and the term "alter" is not distinguished from the term "access." The statute criminalizes socially tolerable, and even completely innocuous, conduct. Finally, the statute lends itself to ex post facto application.

Neither copying a password file from one Intel computer to another Intel computer, using Intel's network, nor running a password guessing program on any password or all the passwords (also using Intel's computer), constituted theft. Nothing was taken from its original place. There was no evidence of intent to deprive the owner or rightful possessor of any value inherent in the password file or in the individual passwords.

The state did not offer adequate evidence that defendant's activities were the actual cause of the restitution amounts claimed by Intel or that the amounts claimed as restitution by Intel were actually incurred or easily measurable. Restitution could not be imposed for those amounts claimed which were not recoverable as pecuniary damages.

Statement of Facts

On October 28, 1993, an Intel system administrator named Mark Morrissey discovered a password-cracking program running on one of the Intel computers administered by him.

App 1; 6/14/95 Tr. 178. He also found a file called "password.ssd" in the computer where the password-cracking program was stored. The file name indicated to him that the file contained a password file from the Intel Supercomputer Division. App 1; 7/14/95 Tr. 169. It was, in fact, a copy of the SSD password file. 7/14/95 Tr. 86 ll. 14-18.

Passwords are groups of computer characters, usually letters, digits and printable punctuation which, when used in conjunction with the applicable "username," permit access to the information stored on a computer or group of computers. 7/13/95 Tr. 178, 181. They are "encrypted (7/13/95 Tr. 179)," using a mathematical formula known as an "algorithm," and kept in a file on the computer. Anyone with access to the computer can see the password file. 7/18/95 Tr. 95 ll. 19-24. To gain access to the computer and its files, a user must "login" with a username and the unencrypted counterpart to that specific user's password. 7/18/95 Tr. 7 ll.11-13. The computer, using the "algorithm," encrypts the password which is offered, and then compares it to the password listed for that user in the password file. If it matches, the user is given access to the computer and/or the system.

The password cracking program is freely available on the internet, 6/14/95 Tr. 188, and is used by system administrators to insure the effectiveness of password files. 7/13/95 Tr. 127; 7/14/95 Tr. 91; 212 ll. 17-19; 7/19/95 Tr. 63 ll. 5-18. It uses the algorithm to encrypt words and their derivations from a dictionary or dictionaries available to it. 6/14/95 Tr. 188; 7/14/95 Tr. 178. Then it compares the encrypted word to the encrypted passwords in the password file. 7/13/95 Tr. 179; 7/20/95 Tr. 140; Tr. 142 ll. 10-16. If it comes up with a match, the password is "cracked" and the system administrator notifies the user to change his or her password. 7/13/95 Tr. 105. Intruders, if they are able to gain access to the system, may also use such a program to "crack" one or more passwords and then use the cracked password(s) to gain access to the information to which that user has access. 7/13/95 Tr. 137.

Network security is a major concern for companies such as Intel (7/14/95 Tr. 98), because the engineers and scientists work on the network, and their work is considered a company secret. 7/13/95 Tr. 102-103. It is part of the job of a systems administrator to see to it that the systems which he/she administers are secure against such intrusions. 7/13/95 Tr. 102 ll. 15-22.

Morrissey knew that only a limited number of people at Intel are allowed to run password cracking programs on password files, and he knew that access to SSD files is limited, due to the fact that they contain data on state-of-the-art computer products which are very valuable and at least some of which are under export restrictions by the U.S. government. Morrissey suspected a violation of Intel security policy, and he notified Intel Security of his findings. App 1; 7/14/95 Tr. 169.

The password cracking program was running under the username and password assigned to Randal Schwartz (6/14/95 Tr. 187; 7/14/95 Tr. 168), who was an independent

contractor at Intel with system administrator duties involving the operation of Intel's email systems. 7/13/95 Tr. 106-107; 7/21/95 Tr. 151 ll. 3-6.

After discussing the matter with Rich Cower, an Intel Network Security Specialist (9/9/94 Tr. 98 l. 17; 6/14/95 Tr. 192), Morrissey talked to John Kent, a systems administrator for the SSD Division, who said that Schwartz was not permitted to "conduct this activity," and that under SSD policy such "activity" is a firing offense. App 1. Morrissey told Kent that he had noticed a record of several instances of Schwartz connecting with a computer called "Brillig" in the SSD cluster (7/13/95 Tr. 179; 7/14/95 Tr. 36-37), and Kent expressed surprise (7/14/95 Tr. 170), as he thought that all of Schwartz's "accounts" on SSD machines had been removed when his SSD contract expired the previous spring. This turned out not to have been accurate. 7/13/95 Tr. 181, 186; 7/14/95 Tr. 36-37. It also turned out that Kent was not the system administrator responsible for Brillig. 7/14/95 Tr. 106.

Morrissey advised Kent to look for a file called "gate" on "Brillig," because he was aware that Schwartz had used such a program in the past to gain access to Intel systems over the internet when he was off site. Kent did find such a program on "Brillig." 7/14/95 Tr. 75 (See Count 1). Morrissey rechecked files "owned" by Schwartz, who was a system administrator in his own right (7/13/95 Tr. 94 ll. 12-22; 7/14/95 Tr. 165 ll. 6-8), and discovered that many passwords for SSD employees had been "compromised." App 2; 6/13/95 Tr. 148. / / /

He talked to Wilcox and Kirkwood, who confirmed that running the crack program on the SSD password file was beyond the scope of Schwartz's contracts and done without permission. App 2.

Kent told Morrissey that the "compromised" passwords included those of Ed Masi, a VP of Intel Corporation, the President of the SSD Division and one of the supercomputer architects for SSD. App 2. Masi's password was "PRE$IDEN." 7/14/95 Tr. 14-15. Kent said that sensitive information was "likely" kept in files accessible under some of these passwords. App 2. Morrissey arranged to maintain the backup tapes for the computers he was administering so that "daily snapshots" of Schwartz's activities would be available. 7/13/95 Tr. 68; 7/14/95 Tr. 180. The examination of those backup tapes revealed no trace of any SSD passwords, files from SSD or data from any individual's SSD files. 7/14/95 Tr. 216 l. 20 to 217 l. 14.

Intel staff met on Friday, 11/29/93, to discuss the situation, and because Schwartz was out of town it was decided to do nothing until Monday. 6/13/95 Tr. 80-81; 7/14/95 Tr. 136 When a suggestion was made that it might be advantageous to simply ask Schwartz what was going on when he returned, the idea was vetoed by someone in authority who said that the decision to seek to prosecute Schwartz had already been made. 7/14/95 Tr. 225-226; 7/18/95 Tr. 148.

On the morning of Monday, 11/1/93, Cower, Morrissey, Kent, Intel security specialist Clyde Stites, in-house counsel Richard Pierce and paralegal Janice Baldwin met with Detectives Lilley and Lazenby of the Washington County Sheriff's office and DDA Thomas Tintera.

9/20/94 Tr. 77-78. An affidavit in support of a warrant to search Schwartz's home was prepared. Omnibus Hearing Exh. 2; App 1-5.

That affidavit stated, among other things, that Morrissey told Det. Lilley that Schwartz uses an Apple portable computer to do his work at Intel, and attaches it to the Intel network when he is there. Morrissey "expressed concern" that passwords had been transferred to that computer. Morrissey also said that Schwartz was identified, through his user identification and password, as the person running the password-cracking program, (6/15/95 Tr. 63 ll. 17-22), and that Schwartz was security conscious enough to use a password that would be difficult for anyone else to obtain and use. App 1. Morrissey also said that Schwartz was sophisticated enough to cover his tracks if that was what he intended (6/15/95 Tr. 63 ll. 8-13; 7-14-95 Tr. 204) and that Schwartz was running the password cracking program in the open under his own user identification and password. 6/15/95 Tr. 63 l. 17 - Tr. 64 l. 6.

Det. Lilley swore that Cower volunteered that if Schwartz desired to avoid detection, he "would" transfer the files to his portable computer, and that this would be a "convenient" way to move them from Intel to his home or office without detection (App 2). By contrast, Cower denied that he volunteered this information and denied that he said anything to Det. Lilley about Schwartz taking anything home. 6/13/95 Tr. 89. According to that affidavit, Morrissey said that Schwartz often works out of his office or home (App 2). Morrissey, under oath, adamantly denied that he had said that. 6/14/95 Tr. 199 l. 13 to 200 l. 2.

Det. Lilley was told that Schwartz's activities were monitored all day on Monday, 11/1/93, that he had not logged onto the computer running the password cracking program, and that he had not logged onto that computer since that program began running on 10/21/93. 7/13/95 Tr. 68, 69. That was omitted from the affidavit.

According to Det. Lilley, Cower said that information can be stored on any computer that has: 1) floppy disc drives; 2) any kind of tape drive; 3) any kind of hard drive; 4) tapes and/or floppy discs. It can also be stored on: 5) printouts; 6) "computer related documentation;" 7) written information related to Intel Corp; 8) a personal digital assistant; 9) any "computer related contents" in personal and/or business vehicles. App 2-3.

Also according to Det. Lilley, Morrissey said that Dirk Brandewie, the system administrator responsible for "Mink" (7/18/95 Tr. 6; See Count 1), had told him that in March, 1993, Schwartz had bypassed Intel security systems ("blocks") which prevent outside access to Intel computers. Brandewie reportedly said that he told Schwartz to replace "the blocks," but in July of the same year had found that "the blocks" were back off. Schwartz had explained that he desired to gain access to Intel systems from the outside. App 3. When Morrissey testified about this, however, it turned out that he had personally examined the outside access program and that the outside access program had not been quite the open door that it had appeared to be from the affidavit. 7/14/95 Tr. 191-2; Tr. 195-6. Brandewie confirmed that. 7/18/95 Tr. 12 ll. 2-9. Brandewie did indicate, however, that telnetting in from the internet, as opposed to telnetting out, was not permitted. 7/18/95 Tr. 9 l. 5 to Tr. 10 l. 13. According to Schwartz, the policy was that inbound telnet was "dangerous." 7/21/95 Tr. 81 ll. 1-2.

Det. Lilley swore that Morrissey said that the program used by Schwartz was "RUBY.ORA.COM," which belongs to the publisher of books written by Schwartz. According to the affidavit, Morrissey did not know how, or from what location, Schwartz was gaining access to "RUBY.ORA.COM." App-3. In fact, "RUBY.ORA.COM" is not a program, Morrissey did not say that it was (6/14/95 Tr. 216), and, consequently, the affiant either misunderstood or misrepresented what he heard.

Det. Lilley included the location of Schwartz' office and home, and a detailed description of his vehicle. Among the long list of items he requested permission to seize were all computers, discs and tapes, because, he alleged, it is not possible to know which of those (if any) contain "material sought by this affidavit" without examining them. See App-4 to 5. That was based on the assertion that Det. Lazenby "knows" that persons "involved in these activities" try to conceal the contents of the disks and tapes "Schwartz used" by mislabeling or not labeling their contents, and that an expert is needed to examine computer evidence in an environment where information will not be destroyed. App-4.

The affidavit also requested permission to search for, and seize "all telephones equipped with recording devices, automatic dialers or any other special equipment the examination of which can reveal information concerning the prior use of the equipment" and "any 'blue boxes' or 'black boxes' that being devices specifically constructed for the purposes of using telephone services while avoiding detection or payment for the services provided." App-4 to 5.

On 11/1/93, the search warrant was executed at Schwartz's residence. In addition to some uniform officers, the detectives in charge of the case invited Cower, Pierce, and Stites along to help execute the warrant (9/20/94 Tr. 80-81) without authorization from the magistrate who issued the warrant, despite the fact that Cower, Pierce and Stites were involved in the preparation of the affidavit and the magistrate's permission could have been sought.

Schwartz's two laptop computers and two hard drives were seized and examined by one of the two Washington County Deputy Sheriffs trained in computer evidence analysis. 7/19/95 Tr. 96-97. The data stored on Schwartz's computers was examined using technology which makes a "mirror copy" of the data in those devices. 7/19/95 Tr. 98 ll. 5-12. This mirror copy preserves not only whole, active files but also bits and pieces of files that have been erased but not overwritten. 7/19/95 Tr. 98 ll. 13-17.

Then the data in the mirror image was searched using a program that looks for keywords. 7/19/95 Tr. 98-99. After that, the data was searched for anything of evidentiary value. 7/19/95 Tr. 99 ll. 18-22. This process was completed four times, one for each device. 7/19/95 Tr. 99 ll. 23-25. Nothing of an incriminating nature was found on either of the hard drives or on either of Schwartz's laptop computers. 6/15/95 Tr. 286 ll. 15-16; 7/14/95 Tr. 228 l. 1 to 230 l. 13; 7/19/95 Tr. 103 ll. 21-25.

During the execution of the warrant, Det. Lilley interviewed Schwartz for two hours. 6/15/95 Tr. 50 ll. 6-9. Lilley's understanding of computers was very limited. 7/13/95 Tr. 61, ll. 6-11. He did not understand much about what Schwartz had to say. 7/13/95 Tr. 45 ll. 6-9. Small portions of the conversation were recorded in his notes and included in his police report. 6/15/95 Tr. 42-50. According to Det. Lilley, his report was "the summary of the essence of what was said." 7/13/95 Tr. 76 ll. 16-17.

/ / /

Seeking suppression of his statements, defendant filed both a Motion to Suppress and a Supplementary Motion to Suppress (Motion to Controvert). Both Motions were denied. 7/13/95 Tr. 40-53.

Defendant demurred to the indictment on the grounds that: 1) The terms "alter" and "without authority" in ORS 164.377(3) are unconstitutionally vague; 2) that the statute underlying Count 1 was not sufficiently definite and certain in that it did not distinguish between a culpable mental state and an element; and 3) that the computer crime statute was unconstitutionally overbroad in several particulars. That demurrer was denied.

Schwartz was convicted on all counts by the jury and sentenced on all counts, over the objection that Counts 2 and 3 should merge. The court ordered $68,471.45 in restitution to Intel as a condition of probation, over the objection that the state had not sufficiently proved the losses that Intel had claimed or demonstrated that they were suffered as a result of Schwartz's conduct.

The trial court erred when it denied defendant's Motions to Suppress as follows:

In a motion to controvert, the moving party is required to prove the affiant's lack of good faith, accuracy or truthfulness by a preponderance of the evidence. ORS 133.693(3). The Court of Appeals reviews a trial court's findings for supporting evidence in the record. State v. Ritter, 71 OrApp 282, 288, 692 P2d 158 (1984).

The defense requested "Specific Findings of Fact and Conclusions of Law," both in the caption and the body of the Supplementary Motion to Suppress. The trial court simply found that "[A]ny omissions or inaccuracies" were not material. It did not find that there were no such omissions or inaccuracies. In fact, the trial court noted on the record that there were both inaccuracies in, and omissions from, the affidavit. 6/15/95 Tr. 285-6. Simply dismissing them as "immaterial" is not sufficient. The trial court was required, at a minimum, to provide this Court with a list the assertions in the search warrant affidavit that it deemed to be inaccurate. State v. Wise, 305 Or 78, 749 P2d 1179 (1988); State v. Bates, 304 Or 519, 527-28, 747 P2d 991 (1987); State v. Dimeo, 304 Or 469, 478 n. 4, 747 P2d 353 (1987).

1. " * * * Mr. Rich Cower * * * told me that based upon his security experience in computer hacking (unauthorized access to computer information), in order to avoid detection in the workplace, Mr. Schwartz would transfer the information to his Apple portable computer in order to work with the information in the privacy of his own home." App 2

.

The truth, according to Cower, was that Cower had called the FBI and a computer crime investigator told him not to let Schwartz out of the building with his laptop, "because if he has any confidential information, it would be on the laptop." 6/13/95 Tr. 86, ll. 20-22. What Cower was told by the FBI indicated nothing, then, about Schwartz's home. The information Cower related to Det. Lilley was what he had learned from the FBI. 6/13/95 Tr. 89, ll. 11-19.

According to Det. Lilley, "the Intel people" brought that subject up, and Det. Lilley admitted that Cower did not relate any facts indicating that Schwartz was running the programs in question in a way calculated to "avoid detection in the workplace." 6/13/95 Tr. 153. In fact, Det. Lilley admitted that he was told that Schwartz was running the program under his own name and that the files upon which the program were running, the SSD password files, were stored under Schwartz's own name and user identification. 6/13/95 Tr. 143; Morrissey confirmed that. 6/14/95 Tr. 187. Morrissey also told Det. Lilley that Schwartz is sufficiently knowledgeable that he could avoid systems security checks and also cover any traces of his activities if he chose to do so. 6/14/95 Tr. 200-201. Det. Lilley omitted that information from the affidavit, and apparently created the reference to Schwartz's home out of whole cloth.

2. "That on 11/1/93 I spoke with Mark Morrissey, Senior Engineer (15 year computer knowledge), an employee of Intel Corporation, who advised me that he had found evidence of violations of ORS 164.377 (Computer Crime) at Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, Washington County, Oregon." App 1.

Det. Lilley admitted that the "evidence of violations of ORS 164.377 (Computer Crime)" words were supplied "later," and had not been said by Morrissey. 6/13/95 Tr. 125. Morrissey confirmed that he had not said that. 6/14/95 Tr. 195.

3. "That Mr. Morrissey told me that he expressed concern to Mr. Kent that password information had been transferred to Mr. Schwartz's Apple portable computer." App 2.

Det. Lilley testified that the "concern was more for the potential rather than any actual transfer of information." 6/13/95 Tr. 151, ll. 24-25. Det. Lilley had been given no information to indicate that anything of an improper nature had been transferred to Schwartz's laptop computer. 6/13/95 Tr. 152. Morrissey testified that when Det. Lilley asked if it was possible that Schwartz could have transferred information to his laptop, Morrissey responded that it was "possible." 6/14/95 Tr. 209 l. 19.

Morrissey also testified that he told Det. Lilley that Schwartz had transferred information to his laptop before and that to do so was, indeed, the reason for bringing the laptop to Intel. 7/14/95 Tr. 209-210. He said that he did not know what information had been copied to Schwartz's laptop, that he would assume that Schwartz had done so in his capacity as a contractor for Intel, and that Det. Lilley did not ask what kind of information Schwartz might have copied to his laptop. 6/14/95 Tr. 211 ll. 4-6. According to Morrissey, Det. Lilley was expressly interested in whether it was possible that Schwartz had copied information from Intel computers onto his laptop. 6/14/95 Tr. 210 ll. 15-17. This was reiterated by Morrissey on cross-examination - that Det. Lilley had asked him if it was possible that Schwartz had copied information from Intel's computers onto his laptop. 6/14/95 Tr. 231. However, that is not what the paragraph in the affidavit said, and it is not what the magistrate was led to believe. The magistrate was led to believe that the subject was raised by Morrissey and that there was some unspoken reason for his "concern."

4. "That further Mr. Morrissey told me that Mr. Schwartz has told him that he (Mr. Schwartz) often works out of his home and office." App 2.

Morrissey denied this most material allegation in its entirety. Not only did Schwartz not tell Morrissey where it was, off-site, that he worked, but Morrissey did not tell Det. Lilley that Schwartz had said anything about working "out of his home and office." Morrissey did not claim any knowledge about where Schwartz works when off the Intel campus. 6/14/95 Tr. 199 l. 13 to 200 l. 2.

Det. Lilley was less than definitive on this issue. The most he could say was that he "believed" that he recalled that "someone" from Intel told him that Schwartz worked on Intel business from home. 6/13/95 Tr. 135. This entire sentence should have been stricken from the affidavit. It and the statement about "avoiding detection in the workplace," which was attributed to Cower but which Cower repudiated and Det. Lilley at least partially recanted, were the only references in the affidavit which even mentioned Schwartz's home.

/ / /

/ / /

5. "That Mr. Morrissey told me that the reason he believed that Mr. Schwartz himself was running the [password cracking] program was because Schwartz is security conscious enough to use a secure password that would be extremely difficult for any other person to obtain and utilize." App 1.

What Det. Lilley did not say, in this connection, is that Morrissey also told him that Schwartz is sufficiently knowledgeable to not only avoid systems security checks but to cover any traces of his activities if he chose to do so. 6/14/95 Tr. 200-201. Had that information been included in the affidavit, it would have directly contradicted the inference that Det. Lilley was creating that Schwartz had been involved in some kind of surreptitious activities.

1. Det. Lilley was told that all of Schwartz's files on "Brillig" had been checked and that no stolen or illegal files had been found. He omitted this from the affidavit. 6/13/95 Tr. 141-2. Its omission was material and significant, given the fact that Det. Lilley included the following: "That Mr. Morrissey told me that he then rechecked files owned by Randal Schwartz using Mr. Morrissey's computer system and discovered that many passwords for SSD employees had been compromised."

Det. Lilley was also told that Schwartz had an authorized, working password on "Brillig," a computer in the SSD cluster, which he also omitted from the affidavit. This is significant because it is standard practice to remove a user's password from the password file on a machine when his authorized access is terminated. 6/14/95 Tr. 197-198. Schwartz's password on Brillig was legitimate. 7/13/95 Tr. 181-182.

/ / /

/ / /

2. Morrissey told Det. Lilley that there was no indication that Schwartz had removed the password cracking program or elicited any passwords from the output (i.e., from Morrissey's systems). 6/14/95 Tr. 206, 207. That information was omitted from the affidavit.

Det. Lilley omitted the following known, relevant facts from the affidavit:

The omission of this information left the magistrate with a completely false impression of what was actually happening.

This paragraph actually embodies a rich mixture of inaccuracies and false impressions conveyed through the use of material omissions. RUBY.ORA.COM is a computer, not a program, and Morrissey did not tell Det. Lilley that RUBY.ORA.COM was a program. He told Det. Lilley that it was a computer. 6/14/95 Tr. 216. Schwartz had an email address at this computer, which is owned by his book publisher. 6/14/95 Tr. 216, ll. 21-26; 7/19/95 Tr. 60 ll. 5-7; Tr. 60 l. 23- Tr. 61 l. 3. He used his perfectly legitimate access to that computer to read his email at Intel. 7/13/95 Tr. 69 l. 24-Tr. 70 l. 7; 7/14/95 Tr. 182; 7/18/95 Tr. 140 ll. 8-13.

When the gate program was first discovered running on Mink, Schwartz told Brandewie exactly that. 7/18/95 Tr. 34 ll. 20-22. Schwartz travelled out of town during hist tenure at Intel (7/13/95 Tr. 117), and it was within his contract terms to do so. 7/13/95 Tr. 117. The problem with the gate program was that Morrissey and Brandewie did not believe that the access gained by means of that program was narrow enough. See 6/14/95 Tr. 221-223; 7/14/95 Tr. 182. The affiant's inaccuracies in and omissions from this paragraph created an impression which was entirely at odds with the truth. It was written to suggest that Schwartz gained illicit access to a program owned by his publisher that he was using to access Intel machines for nefarious purposes.

No one told Det. Lilley that Schwartz had used any disks or tapes. He admitted that he did not know whether he was told that Schwartz used disks or tapes. 6/13/95 Tr. 151. Morrissey certainly did not tell him that. 6/14/95 Tr. 225. Det. Lazenby testified that he had no information indicating that Schwartz used disks or tapes. 6/13/95 Tr. 64-65.

Moreover, Det. Lazenby had no experience in the investigation of computer crimes. 9/20/94 Tr. 131 ll. 3-5. His experience consisted of four or five drug cases and a homicide case where computers were seized. 6/13/95 Tr. 70. He was not trained to examine data. 6/13/95 Tr. 70. Det. Lazenby's training consisted of a two week course in the investigation of computer crimes. 6/13/95 Tr. 63. He was basically taught how to seize computers and tag all the parts. 6/13/95 Tr. 69. Det. Lilley was aware of Det. Lazenby's "training and experience." 6/14/95 Tr. 159. When he referred to "these activities," Det. Lazenby was referring to cases where "somebody goes into a computer and takes stuff that's not theirs." 6/13/95 Tr. 65. No one had any information, at the time that Det. Lilley filed this affidavit, indicating that Schwartz had "taken" anything. 6/13/95 Tr. 92-93, 104. In fact, he had not. 6/15/95 Tr. 286.

The inclusion of this paragraph, with these two misstatements, was materially misleading and was a significant factor in the issuance of a warrant that authorized the seizure of such things as keyboards and monitors (App 4), upon which no data can be stored.

State v. Harp, 299 Or 1, 697 P2d 548 (1985) requires that once inaccuracies appear in the affidavit, the Judge hearing the motion to suppress must begin to perform surgery. His job "is a procedure of subtraction, not addition." 299 Or at page 9. Also, once a substantial basis for questioning the good faith, accuracy or truthfulness of the affiant has been shown, there is no occasion for according the decision of the magistrate the deference that it ordinarily deserves. 299 Or at page 10.

After the untrue and inaccurate information is excised from the affidavit, the affidavit must be reevaluated for probable cause in light of the controverting information. State v. Miller, 116 Or App 174, 179 (1992), aff'd as modified 119 Or App 102 (1993) (requiring that officer's subjective belief that something subject to seizure is in the place to be searched be objectively reasonable and holding that officer's good faith will not save warrant if excision of untrue or inaccurate statements nullifies probable cause); State v. Keeney, 323 Or 309, 918 P2d 419 (1996).

That is not what happened here. First, even though the trial court acknowledged that the affiant misreported, to the magistrate, the information he had received, the trial court "denied" the Motion to Controvert. 6/15/95 Tr. 286 ll. 7-8. Nothing was excised from the affidavit. Apparently, that denial was based on the trial court's view that the inaccuracies and omissions proved did not constitute a "substantial basis" for questioning the good faith, truthfulness or accuracy of the affiant. 6/15/95 Tr. 286 ll. 3-7. The cases do not support that view.

In State v. Modrell-Lydall, 128 Or App 372, 876 P2d 315 (1994), the Court of Appeals ruled that a statement from someone who claimed to be one of the CRI's to the effect that some of the information contained in the affidavit was "wrong." The error was that the affiant had asserted the personal knowledge of the informant, whereas the informant had told the affiant that she knew the information by hearsay. The mere assertion of this inaccuracy established a "substantial basis" under ORS 133.693 for questioning the good faith, truthfulness and accuracy of the affiant.

The trial court here noted that the affiant knew things at the time of the submission of the application for the search warrant that were "relevant," but that the affiant did not see as "all that relevant" at the time. 6/15/95 Tr. 285. This remark suggests that the trial court believed that "relevant" was not equivalent to "material."

Omissions which affect the probable cause are significant when evaluating search warrant affidavits. The omitted information may not be included for purposes of analyzing what is left of that pattern after the inaccurate or untrue allegations are removed. State v. Harp, supra, 299 Or at 9. However, what was omitted from the affidavit may significantly alter or limit the inferences which may be drawn from the remaining, accurate information. State v. Carter, 316 Or 6, 13, 848 P2d 599 (1993), citing State v. Harp, supra.

An example of this is the affiant's assertion that Schwartz would take information home on his laptop computer in order "to avoid detection in the workplace." Ignoring for argument's sake the fact that Cower did not say anything of the kind, the affiant learned that Schwartz was running the password cracking program on the SSD password file on a machine readily accessible by others, that he was running it using his own user identification (6/13/95 Tr. 137, 143) and that he was running it using his own password. 6/13/95 Tr. 138. The affiant admitted that he "may" have been told that Schwartz was sophisticated enough to cover his own tracks if he desired to do so. 6/13/95 Tr. 137.

The affiant completely altered the tenor of this information by omitting those facts. The affiant replaced that information with the following:

Considered in light of the whole of what the affiant was told, the statement about "avoiding detection in the workplace" was deceptive to say the least, and the statement about why Morrissey believed Schwartz was running the program was an outright fabrication. As such, this entire passage was grossly misleading when presented to the magistrate.

Another example of information tailoring was the statement that Morrissey said that he had expressed "concern" to Kent that password information had been transferred to Schwartz's laptop computer. App 2. Lilley testified that the concern was more for the "potential" transfer of information than the actual transfer (6/13/95 Tr. 151). He omitted that fact from the affidavit. In addition, he omitted the facts that: 1) He had been given no reason to believe that Schwartz had improperly transferred password information to the laptop (6/13/95 Tr. 152); 2) Morrissey had told him that transferring information to the laptop was, indeed, the reason for bringing the laptop on site (7/14/95 Tr. 209-210); 3) Morrissey told the affiant that he would assume that, if Schwartz had done so, he had done so in his capacity as a contractor for Intel (6/14/95 Tr. 210 l. 23); and 5) the whole subject came up in response to the affiant's question about whether it would have been possible for Schwartz to transfer password information to the laptop, not, as implied by the statement's context in the affidavit, as part of an earlier conversation between Morrissey and Kent.

These omissions, together with the careful, abridged way the included information was presented, created a completely false impression of the information that the affiant had been given, and permitted, if not compelled, the drawing of false and unwarranted inferences. ORS 133.693 "requires a court to suppress evidence if it finds that an officer acted in other than good faith in making an affidavit, as for example, by purposefully excluding material information that would go against a finding of probable cause for a search or seizure." State v. Miller, supra, 116 Or App at 178.

/ / /

/ / /

The trial court's decision that the omissions and inaccuracies in the affidavit were not material is not supported by the evidence in the record. The only two references to the place sought to be searched - the home of Schwartz - were recanted or debunked.

In an unbroken line of cases beginning with State v. Anspach, 298 Or 375, 692 P2d 602 (1984), the Oregon Supreme Court and the Oregon Court of Appeals have required that a search warrant affidavit state sufficient facts to permit a reasonable person to infer that seizable items are in the place to be searched. A suspicion that the evidence may be there is not enough. State v. Anspach, supra, 298 Or at 381; State v. Carter, supra, 316 Or at 12.

The first reference in the affidavit to Schwartz's home was attributed to Cower. However, neither Cower nor the affiant confirmed that Cower had made any reference to Schwartz's home. The context in which the statement appeared in the affidavit was utterly contradicted by overwhelming evidence. The affiant put a spin on this that was completely unsupported by what he had learned.

The second reference to Schwartz's home, to the effect that Schwartz often works at his home, allegedly came from Morrissey. It was that reference upon which the prosecutor relied to distinguish the instant case from State v. Maxfield, 133 Or App 371, 891 P2d 1342 (1995). 6/13/95 Tr. 19. During arguments on the Motion to Suppress, the trial judge specifically called that reference to the attention of both counsel, in answer to defense counsel's assertion that the affidavit contained no facts indicating that any evidence would be found in Schwartz's home. 6/13/95 Tr. 18.

As noted above, Morrissey clearly and without reservation disavowed the statement attributed to him by the affiant, testifying that Schwartz had never discussed, with him, where Schwartz worked when he was not present at Intel. 6/14/95 Tr. 199. He said that all he told the affiant was that Schwartz had said that Schwartz did work off site. 6/14/95 Tr. 199 ll. 22-23. Det. Lilley could only recall that he "believed" someone from Intel had told him that Schwartz worked at home. 6/13/95 Tr. 135.

Had the statement in the affidavit merely been attributed to "someone at Intel," it would have constituted an anonymous tip which adds nothing to the probable cause. State v. Carter, supra 316 Or at 11. But it was attributed to Morrissey, who did not say it. The trial court made it clear in his questions during the argument on the Motion to Suppress that he believed that Morrissey's information should be credited. 6/13/95 Tr. 21. For the trial court to hold, then, that these references to Schwartz's home were not "material" to the probable cause is simply unfathomable. It was Schwartz's home that was the principal target of the search warrant.

An affidavit supporting a search warrant must set forth some factual nexus between the objects of the search and the place to be searched. State v. Gloster, 145 OrApp 555, 558, 932 P2d 68 (1997) citing State v. Tidyman, 54 OrApp 640, 643-44, 635 P2d 1355 (1981), rev den 292 Or 722, 644 P2d 1131 (1982). In this case there was no true factual nexus between the objects sought and the place to be searched, and the affiant sought to cure that fatal flaw by making some up. He recognized that references in the affidavit to Schwartz's home would be very significant. The Motion to Controvert should have been granted and these references to the home of Schwartz should have been stricken.

Likewise, the trial court should have stricken the sentence indicating that Morrissey said he had discovered evidence of violations of ORS 164.377 (Computer Crime), the report that Morrissey said he had expressed "concern" about the transfer of password information to Schwartz's laptop, the whole paragraph about Schwartz using a machine called RUBY.ORA.COM to bypass Intel security systems to access Intel computers from outside, the references to "persons involved in these activities" and "the disks and tapes Mr. Schwartz used" in the paragraph outlining Det. Lazenby's contribution, and the sentence indicating that Morrissey "believed" that Schwartz was running the password cracking program. In fact, he knew it; it was obvious, and the way the sentence is crafted permits an unwarranted inference to be drawn.

All these inaccuracies, together with the material omissions noted, combined to give a false picture to the magistrate.

In reviewing an affidavit to determine whether it alleges particular facts that would lead a "reasonable person to believe that seizable things will be found," State v. Anspach, supra, 298 Or at 381, mere suspicions, conjectures or conclusions, entertained without the presence of particular facts to support them, do not establish probable cause to search and cannot support a search warrant. State v. Carter, supra, 316 Or at 12.

Most of the information in the affidavit comes from named informants, who are entitled to a presumption of veracity. State v. Carlile, 290 or 161, 165, 619 P2d 1280 (1980). Yet, leaving aside for a moment the substantial controversion outlined above, the only basis in this affidavit for thinking that any of Intel's information left the Intel campus with Schwartz was Cower's alleged statement, later denied, about how it would be done if it had been done and Morrissey's "concern" (expressed to Kent, apparently, and not the affiant) that password information had been transferred to Schwartz's computer. The affidavit did not contain any facts to indicate that password information actually had been transferred, only that Morrissey told Kent that he was concerned that it had.

Morrissey's expression of "concern" constitutes no more than conjecture under these circumstances. There are no facts upon which the magistrate could infer that Schwartz had transferred password information from Intel computers to his laptop. And, while Cower's beliefs about how hackers transfer information and can store data were instructive, they did not establish that there was a probability that this particular computer user had done so.

Extraneous knowledge and conclusions, even those attributed to trained and experienced police officers, are insufficient to support such a finding. In State v. Evans, 119 Or App 44, 47, 849 P2d 539 (1993), the Court said: "[S]tanding alone, the officer's intuition or professed knowledge of the common practices of people who grow, distribute and sell marijuana is not an additional fact supporting probable cause that this particular residence contained any particular evidence." This rule was reaffirmed in State v. Goodman, 152 Or App 83, ___ P2d ___ (1998).

In State v. Carter, supra, 316 Or at 13, the Supreme Court stated:

The failure of the affidavit to establish more than a mere possibility that Schwartz had transferred information to a portable computer is particularly important because the applicant for this warrant sought to search Schwartz's home. The home is the place where, traditionally, there is the highest legitimate expectation of privacy. Payton v. New York, 445 US 573, 100 SCt 1371, 63 LEd2d 639 (1980). If the conclusions, speculations and conjectures of software engineers (Morrissey) and Network Security Specialists (Cower) are insufficient to support a probability that Schwartz had transferred password information to his laptop computer, they can hardly support the entry, seizure and search of his home for that computer. The affidavit at issue here is lacking in specific articulable facts to support an inference that any criminal activity occurred at or near the Schwartz's home, office or vehicle. Evidence concerning those events reported by the various Intel employees, who are the sole sources of information contained in the affidavit, is inferentially available, if anywhere, solely in the electronic memories of the machines at Intel. That is clear from a common sense, non-technical reading of the four corners of the affidavit.

Where there is an insufficient factual nexus between suspected criminal activity and the suspect's home, there is no probable cause to search that home. State v. Stockton, 120 Or App 111, 852 P2d 227 (1993); State v. Evans, supra.

In State v. Corpus-Ruiz, 127 Or App 66, 874 P2d 90 (1994), the affiant had noted three events connecting the place to be searched with drug activity: A known drug offender under surveillance (Michael) had been seen entering the defendant's house; another subject was seen leaving the defendant's house under the influence of heroin some six months previous to the warrant; and Michael's car had been seen parked in front of the defendant's house. The person leaving the defendant's house under the influence supported the inference that he had obtained the heroin there, but the Court of Appeals held that a single, remote incident did not support the inference that any heroin would still be there. 127 Or App at 669-670. In so holding, the Court stated:

In the present case, at least three inferential leaps were required to arrive at even a suspicion that there was any connection between what happened at Intel and any of the contents of the Schwartz residence. The first, that Schwartz was doing anything inimical to Intel's interest, is unsupported by specific facts, particularly given the circumstances surrounding what actually happened. Any basis for the second, that he took anything belonging to Intel that he was not authorized to take, is totally speculative. The third, that he took that something home, is pure conjecture. Speculation and conjecture do not equal probable cause. State v. Buffington, 87 OrApp 559 743 P2d 738 (1987); United States v. Perez, 67 F3d 1371 (9th Cir 1995) (fact that defendant had used automobile to transport stolen coins to mall for sale 4 days earlier and was using it to return to collect money from sale day of search did not give authorities probable cause to search automobile).

The extent to which this application was based on the speculation and conjecture of the affiant is illustrated by the inclusion of "'blue boxes' or 'black boxes'" in the list of things to be seized. App 4. According to the affidavit, neither Morrissey nor any other source of information mentioned "blue boxes or black boxes" to the affiant. There is no mention of such devices in the affidavit until the affiant asks permission to search for and seize any he may find.

According to the Oregon Supreme Court:

/ / /

The doctrine of "overbreadth," which was developed to protect the "particularity" requirement, is thus distinguished from the doctrine of "indefiniteness," which prohibits warrants that are so ambiguous that it is up to the investigating officer to determine the place to be searched. Ibid. at page 35; State v. Ingram, 313 Or 139, 145, 831 P2d 674 (1992). To pass statutory and constitutional muster, search warrants must be both definite and particular. ORS 133.565(2); Constitution of the State of Oregon, Article I §9; Constitution of the United States, Fourth Amendment; State v. Ingram, supra.

In State v. Reid, 319 Or 65, 872 P2d 416 (1994), the Supreme Court reaffirmed the distinction between the requirements of particularity and definiteness in a search warrant. The warrant in question had authorized the search of "persons present" at a certain residence in Eugene. The defendant was searched, pursuant to that provision, when he approached the front door during the execution of the warrant. In passing on the validity of the warrant, the Court stated:

Here, as in the Reid case, the warrant is much broader than the information in the affidavit can be read to support. The difference is that, in this case, there is no probable cause with which to begin. The fact that Intel personnel suggested that Schwartz might have been using some of his computer equipment for criminal purposes does not create probable cause to seize every piece of computer or electronic equipment in his house. Such a seizure violates the particularity requirements of Oregon statutes and the state and federal constitutions, for it authorizes the seizure and search of a wealth of non-seizable items which may also be contained in that house.

Even if one assumes that there is probable cause to examine the contents of the electronic memory in Schwartz's Apple laptop computer, this warrant is vastly overbroad. It authorizes the seizure of:

/ / /

This paragraph permits seizure of all computers; yet, all computers are not the instrumentality of any crime which might conceivably have been committed. At most, the affidavit can be read to support a search for computer records stored on the Apple laptop computer. The seizure of all computers and computer-related items is not justified.

Furthermore, if Schwartz's laptop computer was, based on the facts available to the affiant, the probable instrumentality of a crime, the seizure of that laptop would be the extent of the intrusion permitted by law. Schwartz's activities were monitored carefully after Thursday, 10/28/93. 7-18-95 Tr. 150 l. 21 - Tr. 151 l. 1. A search and seizure warrant for the laptop could have been executed at Intel at any time on 11/1/93, the last day that Schwartz worked at Intel. Cower testified that Intel's main concern was the laptop. 7/18/95 Tr. 132, 148. If that was true, there was no legal reason for contriving to search Schwartz's home.

Additionally, as pointed out above, data cannot be stored on "floppy disk drives, monitor or monitors, * * * cables, expansion cards, plotters, printers, phone modems, computer mice, image scanners . . ." The affidavit states no facts indicating otherwise, yet the affiant seeks seizure of all such items.

Finally, this paragraph is not drawn narrowly and with enough specificity to eliminate the searcher's discretion and opportunity to intrude into the vast amounts of other material stored in any computer(s) that may be discovered. See State v. Ingram, supra, 313 Or at 145- 46; State v. Blackburn/Barber, supra, 266 Or at 34. And, that portion of the warrant designating ". . .and all other related equipment. . ." runs afoul of the holding in State v. Ingram, supra, that a search warrant for a certain premises and "all vehicles associated * * * with the occupants of said premises" was "ambiguous and potentially so broad, officers executing it could invade privacy interests not intended by the magistrate to be invaded and could conduct searches not supported by probable cause." 313 Or at 146.

The warrant authorizes the seizure of:

There was no indication anywhere in the affidavit that Schwartz possessed "telephones equipped with recording devices, automatic dialers or any other special equipment . . ." or "blue boxes" or "black boxes." There is no factual basis to support probable cause to believe either that Schwartz possessed these items, or that seizure of such items would produce evidence of a crime.

The warrant authorizes the seizure of:

This is an astonishingly broad request, justified apparently only by the "need" for a subsequent examination to determine if the information seized even relates to any criminal offense.

Nothing may be seized unless there is probable cause supported by specific articulable facts to believe that it is:

This paragraph illustrates the dangers inherent in general warrants. "[T]he problem [posed by the general warrant] is not that of intrusion per se, but of a general exploratory rummaging in a person's belongings . . ." Andresen v. Maryland, 427 US 463, 480 (1976) (brackets in original) (emphasis added); State v. Blackburn/Barber, supra. This portion of the warrant is not drawn sufficiently narrow, or with enough specificity, to eliminate the searcher's discretion and opportunity to intrude into the vast amounts of other material stored in the computer(s). State v. Ingram, supra, 313 Or at 146; State v. Blackburn/Barber, supra.

Indeed, the warrant authorized the seizure of printouts of any and all information stored in the computer so law enforcement officers could examine it in the future to determine its evidentiary significance. The police cannot seize something because they think it might possibly contain evidence. It must probably be evidence when seized or searched for. ORS 133.535; State v. Jones, 103 Or App 316, 797 P2d 385 (1990).

In addition, there is nothing in the affidavit to support the implication that the possession, by Schwartz, of information relating "to the computers of the Intel Corporation and any of its business units or subsidiaries" was even criminal. In fact, Schwartz was fully authorized to possess such information. This fact was known to the affiant. 7/14/95 Tr. 209-210.

There are "special restraints upon searches for and seizures of material arguably protected by the First Amendment." Lo-Ji Sales, Inc. v. New York, 442 US 319, 326 n.5 (1970). Where the object of a search and seizure includes materials which may be protected by Article 1, §8 and the First Amendment, both the particularity and probable cause requirements must be "accorded the most scrupulous exactitude." Ibid. 442 US at 325-26; Stanford v. Texas, 379 US 476, 485 (1965); Voss v. Bergsgaard, 774 F2d 402, 405 (10th Cir. 1985).

The application to search all of Schwartz's computer files and records, and to seize printed or written matter for which there was no probable cause not only violated his right to privacy, but it was an infringement on Schwartz's rights under Article I § 8 of the Constitution of the State of Oregon and under the First Amendment to the Constitution of the United States. The affiant was aware that Schwartz used his computer to access his email (electronic mail) and is a published author. App 3; 6/14/95 Tr. 216. The likelihood that seizure of all Schwartz's computers, equipment and records would impede his ability to communicate by email and cause a restraint of publication due to the potential seizure of any written material was palpable.

Thus, this warrant was constitutionally defective because it allowed a search which vastly exceeded the information relied on to support the search both as to place(s) to be searched or as to objective(s) of search.

ORS 133.575 provides, in pertinent part:

Cower, Stites and Pierce were invited to accompany the police on the execution of the search warrant. Permission of the magistrate was not sought to justify that.

A number of explanations, some not completely consistent with the facts or with each other, were advanced to justify this action. The District Attorney told the court that "the reason the Intel people were brought was safety in extracting the computer equipment so that the information would not be lost or destroyed. That's exactly why the Intel people were there. They were there as consultants to be able to take the computer equipment safely from Schwartz's home without destroying the information or the subject of the search, and I think that we are within the parameters of this statute." 6/13/95 Tr. 28. Det. Lilley, on the other hand, said that the Intel people were invited along to assist him in understanding Schwartz's answers to his questions, to help identify items of evidentiary value, to assist in maintaining the integrity of that evidence and to safeguard against damage to the computers so that the police would not get sued. 9/20/94 Tr. 80-81.

Those two stories are at stark odds with that told by Cower. He said that Pierce went along to fire Schwartz and that Stites went along to collect the badges that Intel had issued to Schwartz. 9/20/94 Tr. 101. Each was only in the room with Schwartz for a very brief period of time. 9/20/94 Tr. 105 ll. 6-8.

Cower was asked to look at a Macintosh computer that was downloading files, and he told them that "it looked okay to [him]." 9/20/94 Tr. 102 lines 18-19. Other than that, all Cower did was participate in the interrogation of Schwartz for an aggregate time of about one hour. 9/20/94 Tr. 103. In fact, no one from Intel was needed to help safeguard the information on the computers. That was the subject of Det. Lazenby's training. 6/13/95 Tr. 69.

According to Pierce, he accompanied the officers, first and primarily, in order to represent Intel Corporation, to "fire" Schwartz and to terminate his access to any Intel buildings. 9/20/94 Tr. 136 ll. 11-18. Second, Pierce was there to identify, on behalf of Intel Corporation, the "assets" that might be located on diskettes or running on a computer screen somewhere. 9/20/94 Tr. 136 l. 19 -137 l. 1. Pierce explained that by "assets" he meant "trade secrets, password files or anything that would indicate that he had obtained other assets by using intelligence password files. 9/20/94 Tr. 137 ll. 18-21. So neither Pierce, Stites nor Cower were confused about whose bidding they were present to do or what their purpose was, and it was not to provide for safety of any kind or to help preserve evidence. They went along with the police for the purpose of representing Intel Corporation. The execution of this search warrant was a joint, Washington County-Intel Corporation mission.

The trial court simply found that 133.575 had not been violated. That was patently in error. A violation of ORS 133.575(1) alone would probably not warrant suppression of any incriminating evidence found by the police. Noncompliance with a provision similar to ORS 133.575(2) in a former, similar statute did not result in suppression. State v. Valentine, 264 Or 54, 504 P2d 84 (1972).

However, this flouting of the statute was not done in a vacuum. Instead, it was part and parcel of a series of events that included overt misrepresentations of information by the affiant relating directly to the nexus between the suspected crime(s) and the place to be searched, careful tailoring of information for purposes of conveying false impressions to the magistrate and the deliberate omission of facts which carried implications contrary to those false impressions.

Under the Fourth Amendment to the Constitution of the United States, citizens are entitled to have the probable cause determination made by a "neutral and detached magistrate." Connally v. Georgia, 429 US 245 (1977). It was a violation of Schwartz's Fourth Amendment rights when Lilley decided for himself what relevant evidence the magistrate needed to know, and what relevant evidence he did not need to know, in order to secure the search warrant. This illustrates the dangers recognized by the U.S. Supreme Court in Johnson v. United States, 333 US 10, 68 SCt 367, 92 LEd2d 153 (1948):

Where, as here, the affiant provides the magistrate with only that information which supports the issuance of the warrant, and withholds all of the information which weighs against issuance of the warrant, the affiant effectively decides whether a warrant will be issued.

The search and seizure which occurred pursuant to the warrant were unlawful and the state must be precluded from using any evidence obtained by exploiting that search and/or that seizure, including Det. Lilley's rendition of the statements made by Schwartz during the execution of the warrant. ORS 133.683; State ex rel Juv. Dept. v. Rogers, 314 Or 114, 836 P2d 127 (1992), State v. Ingram, supra, 313 Or at 237; Wong Sun v. United States, 371 US 471 (1963).

The search warrant process does not exist for the benefit of any private interests; its purpose is to protect the rights of the citizens of Oregon against unreasonable search or seizure. Or. Const. Article I §9; State v. Davis, 295 Or 227, 666 P2d 802 (1983). Suppression is the remedy that vindicates those rights. State v. Rodriguez, 317 Or 27, 854 P2d 399 (1993).

The trial court erred when, during the hearing on defendant's Demurrer, it denied the defendant the opportunity to offer evidence as follows:

/ / /

The prosecutor relied on State v. Waldo, 93 OrApp 613, 763 P2d 417 (1988) and State v. Reed, 116 Or App 58, 840 P2d 723 (1992) for the proposition that "the case law supports the proposition that facts are not to be considered at the trial court level in regard to a demurrer." 7/1/94 Tr. 13. Those cases are inapposite to this case. Both Waldo, and Reed, involved attempts by the defense to raise what were, in effect, defenses on the facts by way of demurrer by asking the court to analyze extrinsic facts in evaluating the sufficiency of the indictment . The demurrer in this case alleged that the statute which established the elements of those offenses as charged against the defendant was constitutionally flawed, not that the allegations were insufficient to state the offenses charged. ORS 135.630(5) provides the statutory basis for that demurrer.

In State v. Moeller, 105 OrApp 434, 806 P2d 130 (1991) rev. dismissed, 312 Or. 76, 815 P2d 701 (1991), the defense offered the testimony of prosecutors from various counties around the state on their interpretation of the "scheme or network" language from the former OAR chapter 253, Division 4, appendix 4, in order to demonstrate that the challenged provision was unconstitutionally vague. The trial court was not required to "analyze" that extrinsic evidence. It was offered to illuminate the breadth of the statutory terms.

/ / /

The same was true here. The defense challenged the statutory terms "alter" and "without authorization" as being unconstitutionally vague. The evidence was offered on the term "alter," which is not defined in the statute. Defense counsel, in what turned out to be an offer of proof, explained that the testimony of the expert computer systems engineer would show industry standards and how the statute's provisions would affect routine practices. App- 9. It would also provide a basis for determining whether the statute impermissibly proscribed permissible or protected conduct. 7/1/94 Tr. 13-15.

In State v. Graves, 299 Or 189, 700 P2d 244 (1985), as in the case at bar, the statutory term was not defined by statute and was susceptible of any number of possible meanings. Those possible meanings, in the context of the use of computers, were the subject of the proffer of evidence. It was error to refuse to permit it and, as will be illustrated in the following Assignment of Error, the error was prejudicial and substantial, leading the court into even more serious error.

The trial court erred when it denied defendant's Demurrer as follows:

A criminal law is impermissibly vague if it is written so that it does not adequately distinguish between what conduct is permitted and what conduct is not. State v. Moeller, supra. In State v. Hodges, 254 Or 21, 27, 457 P2d 491 (1969), the Supreme Court said:

The court here held that "alter" and "access" are two key words in the statute. The statutory term "alter" is not defined. It is the term in question here, since defendant was not charged with improper "access." As was noted by the court, the term "alter" must mean something different that the term "access," unless the legislature has performed a superfluous or meaningless act. The courts are generally not permitted to conclude that the legislature has done a superfluous or meaningless act. ORS 174.010; 1000 Friends of Oregon v. Wasco Co., 399 Or 344, 703 P2d 207 (1985); Union Pacific R. Co. v. Bean, 167 Or 534, 119 P2d 575 (1942).

The court held that the term "alter" in ORS 164.377 carried its usual and customary meaning. The problem is that the usual and customary meaning is the equivalent of " to change" or "to make different." The Merriam-Webster Dictionary. "Alteration" is defined as "a change of a thing from one form or state to another, making a thing different from what it was without destroying its identity." Black's Law Dictionary, 5th Edition, page 40.

If the word "alter" simply means "change," it is difficult to distinguish that normal, well- recognized meaning from at least some of the meanings given by the legislature to the word "access." Typing even one letter or number on the keyboard of an operational computer uses its resources, regardless of whether it is running a word-processing program, a graphics program, a spreadsheet or a CAD program. Storing data "changes" the computer. Virtually anything you do to a computer alters it. 7/14/95 Tr. 128-129, Tr. 140 ll. 23-25.

The data in a computer cannot be changed without communicating with it, instructing it, adding to or retrieving from its data and/or without using its resources. That is the same as "accessing" the computer according to the statutory definition of the term "access." While the court held that the term "alter" meant something different from the term "access," the court did not say what that difference was. In fact, as assigned as error above, the court prohibited the defense from proving that one must "alter" a computer to "access" it, and one must "access" a computer to "alter" it. An overabundance of possible interpretations and meanings which may be given to statutory terms is one of the hallmarks of an unconstitutionally vague statute. State v. Graves, supra.

Second, if the "usual and customary meaning" construction is adopted, it is so all- encompassing that its effect is to criminalize both socially tolerable and socially intolerable conduct. For instance, an employee installing and playing of computer games on the company hard disk over the lunch hour without the express permission of the employer is clearly within the meaning of the statute given that construction.

During his argument on the demurrer, the prosecutor in this case admitted that the statute would reach utterly innocuous behavior:

While it may, in some circumstances, be inappropriate, changing the color on a computer screen is most emphatically not a permissible focus of the criminal law. In State v. Sanderson, 33 OrApp 173, 575 P2d 1027 (1977), the Court of Appeals held that a statute which prohibited "Engag[ing] in a course of conduct that alarms or seriously annoys another person and which serves no legitimate purpose" was unconstitutionally vague because it provided no basis to distinguish between socially tolerable conduct, e.g., consistently appearing late for social appointments, and the antisocial conduct intended to be prohibited, such as the making of obscene telephone calls. 33 OrApp at 176-177.

This "well-recognized meaning" construction of the word "alter" illuminates another problem with the statute: There is no requirement that anyone be harmed. This is underscored by the statutory language itself; "damage" to "any computer, computer system, computer network, or any computer software, program, documentation or data" is punishable independent of any alteration. Alteration and damage, separately delineated in the statute, are alternate ways of committing computer crime. See State v. Tidyman, 54 OrApp 640, 650, 635 P2d 1355 (1981).

One of the consistent features of unconstitutionally vague criminal laws is that there is no requirement that harm occur. State v. Blair, 287 Or 519, 524, 601 P2d 766 (1979) (nullifying a statute which proscribed "harassment" by means of telephone calls to named persons in a manner both intended and "likely to cause annoyance and alarm").

This flaw is compounded when the definition of "computer" is considered:

This definition must be considered in any attempt to interpret or construe the computer crime statute itself.

Portland General Elec. Co. v. Bureau of Labor and Industries, 317 Or 606, 610-11, 859 P2d 1143 (1993).

The definition of "computer" is part of the same statute. Most phone systems easily qualify under this definition, even without the "is not limited to" language. Indeed, most modern thermostats also qualify, and many employers, rightfully and with good reason, forbid changing the setting. But may fiddling with the office thermostat without the employer's permission be made a crime? More absurdly, since the statute also forbids unauthorized "access" to "computers", an employer could deny employees authorization to look at the thermostat and, under the statute, to do so would become a crime.

The term "authorization" is also, as previously noted, undefined. To authorize, of course, generally means "to give a right or authority to act" or "to permit a thing to be done in the future." Black's Law Dictionary, 5th Edition, page 69. "Authority" is seen as "permission." Ibid, page 68. Black's lists a number of kinds of "authority," including apparent authority, authority by estoppel, authority coupled with an interest, general authority, implied authority, incidental authority, inherent authority, limited authority, special authority and naked authority. The problem with ORS 164.377 is that contains no standards for the determination, on any objective basis, of what sort of "authorization" is required, nor does it identify the source from which the authorization must originate. This omission distinguishes ORS 164.377(3) from virtually every other section of the Oregon Revised Statutes where the term "authorization" is used to mean "permission." Appendix A to defendant's demurrer in the trial court contains a list of the statutes involving the term "authorization" and the respective, designated source(s) and/or kinds of the authorization(s) required.

So the hapless engineer or programmer is left to guess, at his peril, whose permission he must seek if he is to "change" the data in the memory of a computer, and, in addition, what sort of permission it must be if he is to be safe from criminal prosecution. If he guesses wrong, prosecution may still ensue, but may not. This case provides an excellent, concrete example of why this term in this particular statute, without modifiers, fits the vagueness criteria to a "T." Schwartz answered directly to Robert Wilcox. 7/13/95 Tr. 94 ll. 4-5, Tr. 101 l. 20 - Tr. 102 l. 1. Schwartz was hired to monitor computer networks with UNIX workstations. 7/13/95 Tr. 94 ll. 16-17. This requires an expert, and Schwartz's direct supervisor, Wilcox, was not an expert in that area. 7/13/95 Tr. 94 ll. 20-22. But Schwartz is. 7/13/95 Tr. 95 ll. 19-21; Tr. 123 l. 22- Tr. 124 l. 1.

The inevitable consequence was that none of the changes (read alterations) wrought by Schwartz in the ordinary course of his employment were "authorized" by anyone. He was hired by his supervisor for his expertise; expertise which the supervisor did not possess. Wilcox relied on Schwartz's expertise. 7/13/95 Tr. 124. In fact, Wilcox made it clear that it is the systems administrators themselves who know what is to be done and not to be done. 7/13/95 Tr. 102 ll. 2-14.

Schwartz's jobs were to administer the UNIX computer systems, to put them on the Intel network and see to it that they ran harmoniously with the rest of that network, to install network monitoring software and to "automate the administration of the network." 7/13/95 Tr. 95-97. This activity, by definition, involves altering the network. 7/13/95 Tr. 97-102. Yet no supervisor "authorized" what changes he made on a day-to-day, minute-to-minute basis. Nor did any supervisor have the authority to do so. Intel manages its independent contractors only as to results, not as to the means used to achieve them. 7/13/95 Tr. 120; Defendant's Ex. 106. In fact, the lack of control over the activities of independent contractors in the high tech industry is industry-wide. Patrick Reilly, co-founder of Isoqwan Technology which develops software for leading edge wireless communications systems, hired Schwartz as an independent contractor. 7/18/95 Tr. 111-12, 115. As an independent contractor, Reilly did not attempt to exercise control over what Schwartz did. He would "[g]ive him a broad task and tell him 'make it work' and not really be concerned about how he did it." 7/18/95 Tr. 119-120.

The way the statute reads, any alteration of a computer must be authorized. It is not tenable under either the Constitution of the State of Oregon or the Constitution of the United States that an element of a crime be so ad hoc. State v. Graves, supra; Giaccio v. Pennsylvania, 382 US 399 (1966). It is another touchstone of unconstitutional vagueness. Grayned v. City of Rockford, 408 US 104 (1972). Not knowing from whence the requisite authorization must come, it is impossible to determine what kind of authorization it must be. Will apparent authority constitute a defense? Is implied authority enough? The statute contains no clue.

In Galley v. Babb, 50 Or App 617, 624 P2d 616, rev. den. 291 Or 117 (1981), an ordinance banning drug paraphernalia was struck down as unconstitutionally vague. The court said:

Second, the potential for criminal prosecutions based on after-the-fact, ad hoc decisions by middle level corporate managers, among others, makes this term particularly susceptible to ex post facto application due to the lack of definition and standards. This potential is one of the main signals of fatal vagueness. State v. Graves, supra.

Another example of the vagueness of the term "without authorization" as applied in this case occurred in connection with the "alteration" of the computer named Mink by installation of the "gate" program which, according to the search warrant affidavit, bypassed Intel security systems. Dirk Brandewie, Schwartz's supervisor at the time, testified that what he actually told Schwartz about this program when he first discovered it was that it was not "secure enough." 7/18/95 Tr. 36 ll. 9-12. That does not mean it is not "authorized;" that means it is not secure enough. That was in March, 1993. 7/18/95 Tr. 8.

Later, after Schwartz had experimented with the program some more, Brandewie told him that he would require a waiver from Intel security to allow it to run on Mink, and Schwartz told Brandewie that if Schwartz could not use the program in its current form it was not useful to him and to close the account on Mink. 7/18/95 Tr. 14-15. No disciplinary action was taken against him for either incident. 7/18/95 Tr. 47 ll. 5-7. On 3-2-94, the Washington County Grand Jury decided that, somewhere along the line, Schwartz had committed Computer Crime, at least partly on account of those events. Indictment, Count 1.

Brandewie admitted that his computer system's security arrangements was based on Intel policy as he understood it. 7/18/95 Tr. 42 ll. 19-24. Thus, when he was talking to Schwartz about security policy, what he said had only to do with his computers. He had no idea whether policy manuals had been distributed to other employees, much less independent contractors. 7/18/95 Tr. 43. Cower expressed doubt that security manuals had been distributed to independent contractors. 7/18/95 Tr. 173 ll. 11-17.

In fact, Schwartz had been directed to create a working port reflector when he worked as a system administrator at IWARP. 7/19/95 Tr. 123-124. The practice then was that machines that were accessible by internet did not have sensitive, proprietary information. 7/19/95 Tr. 125 ll. 6-15. The two-way access was critical to getting the job done. 7/19/95 Tr. 126 ll. 3-8. Schwartz helped see to security. 7/19/95 Tr. 126 ll. 12-13; Tr. 127 ll. 17-20. Inbound telnetting from the internet was still permitted on some Intel machines, despite this company-wide "policy," at the time of the trial. 7/19/95 Tr. 130 ll. 6-9.

Yet another example of the nebulous and subjective nature of "authorization" in this context is that it was generally against company policy, i.e., "unauthorized," for independent contractors to be system administrators. 7/18/95 Tr. 64 l. 23 to Tr. 65 l. 5. That policy was, up to and including the time of the trial, routinely ignored. 7/18/95 Tr. 65 ll. 6-11. Schwartz worked as a system administrator there for years. 7/18/95 Tr. 65 ll. 12-15. The Information Technology Manager at SSD saw that as a fundamental violation of company policy. 7/18/95 Tr. 65 ll. 22-24. Thus, from his point of view, Schwartz's employment by Intel was "without authorization." Yet Intel routinely paid the bills he sent, and routinely accepted the fruits of his labor.

So what was "authorized" and what was not was a matter of time, place and expediency. Criminal liability, or the lack of it, cannot be based on such flexibilities, because to do so violates basic due process principles, as well as Article I § 20 of the Constitution of the State of Oregon.

Defendant also demurred to Count 1 of the indictment on the ground that it was not definite and certain. ORS 135.630(6).

The specificity requirement for indictments is found both in statute, ORS 133.015(7), and the state and federal constitutions. State v. Cooper, 78 OrApp 237, 239-40, 715 P2d 504 (1986). Article I, §11 of the Oregon Constitution provides that an accused has the right to demand the nature and cause of the accusation against him. See, State v. Green, 245 Or 319, 422 P2d 272 (1966); State v. Cooper, Supra, State v. Jim/White, 13 OrApp 201, 508 P2d 462 (1973). The due process clause of the Fourteenth Amendment requires that an indictment describe an offense with sufficient precision and certainty to enable a presumptively innocent person to prepare for trial. Barber v. Gladden, 327 F2d 101 (9th Cir.), cert den 377 US 971 (1964), State v. Cooper, 78 OrApp at 239-40.

The availability of discovery may not save an unspecific accusatory instrument from a challenge on specificity grounds. State v. Sanders, 280 Or 685, 572 P2d 1307 (1977). A complaint which does not set out the specific facts that the State intended to rely upon to prove a statutory violation can fail to be definite and certain and to state an offense, even if plead in the terms of the statute. State v. Cooper, 78 OrApp at 240-41.

For the reasons discussed above, the terms "alter" and "without authorization" in ORS 164.377(3) are unconstitutionally vague. As a result of their vagueness, the allegation in Count 1, that defendant ". . .did unlawfully, knowingly and without authorization alter a computer and computer network. . .", lacked the requisite specificity to provide defendant with the degree of notice of the criminal conduct the State intended to prove, which was necessary in order to enable him to prepare his defense for trial. Barber v. Gladden, supra; State v. Kincaid, 78 OrApp 23, 714 P2d 624 (1986). Moreover, these terms, as used in ORS 164.377(3), cannot be saved by a judicial interpretation because the statute has no foundations upon which to base a narrowing construction as in State v. Yancey, 32 OrApp 477, 574 P2d 358 (1977) (scienter requirement held to modify each other element which saved statute from being held unconstitutionally vague) .

The only conceivable construction that could save the statute is to read the word "alter" to mean: "To permanently erase data from the memory of the computer, computer system or computer network." Any other construction either 1) runs afoul of the definition of the statutory term "access" (which includes to store data in the memory or retrieve it, but does not include to erase it) or 2) leaves the reader so far out at sea that he has no idea what behavior violates the statute and what behavior does not. The first option is not available because it requires the court to declare either the term "alter" or the term "access" redundant. The second option renders the statute is unconstitutionally vague.

The difficulty with the "erasure" construction is that if the legislature had erasure in mind, the statute could easily have included that term. It did not, and the courts are strictly limited in what they may do by way of limiting construction. In short, courts may not legislate. State v. Robertson, 293 Or 402, 408, 649 P2d 569 (1982); State v. Moeller, supra. Nor are they required to engage in tortured analysis or to amend a legislative enactment by inserting definitions and limitations or deleting terms enacted. Galley v. Babb, supra, 50 OrApp 628.

Indeed, because the common usage of both terms is so broad, there is nothing in Oregon law to provide guidance for an interpretation of the terms and this court would be required to fashion a definition, which would be tantamount to legislating. This is clearly not permissible.

The trial court erred when it denied defendant's Motion for Judgment of Acquittal as follows:

* * * *

At the end of the state's case, the defendant moved for judgment of acquittal as follows:

The trial court should have granted the defendant's Motion for Judgment of Acquittal on Counts 2 and 3, which charged violations of ORS 164.377(2)(c), because nothing was taken, appropriated, obtained or withheld from Intel Corporation when Schwartz copied the password file from one Intel computer to another Intel computer. The evidence that both the SSD password file and its contents, i.e., the individual users' passwords, were still there and were actively doing their job after the copying occurred was not refuted or even challenged. 7/14/95 Tr. 131; 7/19/95 Tr. 69-70.

The state's express theory was that the acts of copying the file and running the password cracking program on the copy was an act of theft. 7/19/95 Tr. 11. The trial court agreed when it viewed defendant's acts as a high tech equivalent of an employee taking a television set and hiding it in a dumpster in order to steal it at a later time. App-13-15. Indeed, the prosecution argued that very proposition to the jury.

There is a critical difference in this case. When the store employee hides the television set, it is no longer on the shelf. No one can go over, turn it on and watch it. It is not available. But the password file was still at SSD and still working. All the individual passwords were still contained in that file, and the various users could log onto the system using them. The prosecutor anticipated this point and, when he was arguing to the jury, the best answer he had was that "the point" was that Schwartz had violated his position of trust and compromised the security of the Intel Corporation. 7/25 Tr. 26-27. However, that is not "the point." Schwartz was not charged with compromising the security of the Intel Corporation. He was charged with theft, and to commit theft one must take something from the owner or rightful possessor. The unassailable fact is that nothing was taken. Intel Corporation had everything after the SSD password file was copied that it had before the SSD password file was copied.

ORS 164.377(2)(c) does not apply to the acts which are alleged in Counts 2 and 3 of the indictment in this case. The facts established at trial, did not support a guilty verdict on those counts precisely because the acts admittedly done by Schwartz do not violate the section of the computer crime statute that was the basis of his conviction. In short, the evidence did not support the verdict. ORS 136.445. The trial court should have granted defendant's Motion for Judgment of Acquittal on Counts 2 and 3.

The trial court erred when it ordered restitution as follows:

* * * *

ORS 137.106 allows a court to order restitution when a person's criminal activities have resulted in pecuniary damages. There must be a causal relationship between the crime and the damages. State v. Dillon, 292 Or 172, 181, 637 P2d 602 (1981). The state has the burden to prove that the amounts requested for restitution are justified because they were losses actually caused by the activities of the defendant. State v. Lefthandbull, 306 Or 330, 758 P2d 343 (1988).

Restitution is not the equivalent of an award of damages in a civil case. There are no general or punitive damages, and a defendant cannot be ordered to pay more than he is able to pay. State v. Hart, 299 Or 128, 139, 699 P2d 1113 (1985); State v. Dillon, supra, 292 Or at 179-180. This basic rule was lost on the state. At the beginning of the restitution hearing, the state argued that the purpose of the hearing was "putting Intel in a monetarily whole state after the damage that Schwartz has inflicted on the company." 1/8/96 Tr. 3 ll. 2-5.

I. Attorneys Fees

Intel sought the services of outside counsel on several aspects of this case. 9/11/95 Tr. 5 ll. 1-13. The state relied on the case of State v. Mahoney, 115 OrApp 440, 838 P2d 100 (1992) for the proposition that the fees which Intel paid outside counsel were recoverable as restitution. 1/8/96 Tr. 3 ll. 11-12.

There is an apparent conflict in Oregon law over whether attorney's fees can be recovered under the restitution statute. State v. O'Brien, 96 OrApp 498, 774 P2d 1109, rev. den. 308 Or 466, 781 P2d 1214 (1989), which held that they are not recoverable, was cited with approval in Raymond v. Feldmann, 124 OrApp 543, 548-49, 863 P2d 1269 (1993):

The fact that Raymond post-dates State v. Mahoney, supra, by one year suggests that the Court of Appeals has sub silentio adopted the dissent of Judge Joseph in Mahoney, 115 OrApp at 444.

Second, even if some attorneys fees were assessable as restitution, it would be necessary to show that the fees were reasonable and necessary expenses caused by defendant's conduct. State v. Dillon, supra. Here, the state did not show this connection and the trial court ruled that defense counsel's attempt to inquire into that area was irrelevant. 1/8/96 Tr. 43.

Restitution for attorneys fees was assessed in the amount of $8,779.45. 1/8/96 Tr. 82. The trial court excluded only the amount billed for research into the question of contact with members of the jury after the trial, 1/8/96 Tr. 79, leaving it to this court to "back out some of the numbers" if the total bill was not assessable as restitution. 1/8/96 Tr. 80.

Intel sought restitution in excess of $70,000.00. The amount actually assessed, including the disputed attorneys fees, was $68,471.45. 1/8/96 Tr. 82 l. 15. That amount included salaries and expenses for employees which the state did not show were actually incurred due to Schwartz's actions. The criminal activity must have "caused" the expense, and causation is met by applying a "but for" standard. State v. Bullock, 135 OrApp 303, 899 P2d 709 (1995).

When employees are "diverted" from their normal duties their salaries are assessable as restitution. State v. Lindsly, 106 OrApp 459, 808 P2d 727 (1991). Thus when Intel sought restitution for the salary of its security specialist, Clyde Stites, the state conceded that Stites' salary was not recoverable as restitution, because his activities on the case were encompassed in his job description. 1/8/96 Tr. 79 ll.17-22. That was clearly correct.

Yet the state secured restitution for Rich Cower's salary during the investigation. Exh. 1 to the Restitution Hearing. Cower's job also was in security. 6/14/95 Tr. 188 l. 19; Tr. 192 ll. 2-3; App-2 (Cower described in affidavit as "Network Security Specialist). His "opinion" on security issues was presented by the state as that of an "expert" during the state's rebuttal. 7/24/95 Tr. 49. If Stites' base salary for the time he was involved in the Schwartz affair was not assessable as restitution, then neither was Cower's. The trial court erroneously included that salary in the restitution amount assessed against Schwartz. 1/8/96 Tr. 80.

One of the expenses listed was related to the construction of case notebooks for trial. 1/8/96 Tr. 22. Another was for hardware and software purchased by Morrissey and then delivered to the Washington County Sheriff's office. 1/8/96 Tr. 39. The state offered no explanation of how Schwartz's conduct caused the necessity for those outlays.

Those expenses were not proper subjects for restitution in any event. The state is charged with prosecuting the case, not Intel. There is no authority for awarding a victim of a crime restitution for what essentially are expenses incurred to assisting the state in litigating the criminal case. The state offered no theory of civil liability to support a recovery of these expenses as "pecuniary damage" as defined by ORS 137.103(2). State v. Carillo, 125 OrApp 52, 56, 865 P2d 379 (1993).

The restitution amount imposed by the court included the full cost to Intel for each employee as well as the expenses of those Intel employees involved in any part of the investigation and/or rectification of the activities of Randal Schwartz. 1/8/96 Tr. 25; Tr. 28. These "burdened" costs included taxes, benefits, and in some instances executive bonuses and stock participation. 1/8/96 Tr. 6. 14 ll. 5-6; ll. 8-17.

The state offered no evidence to show a causal connection between the activities which led to Schwartz's conviction and Intel's duty to pay taxes or employee benefits. State v. Bullock, supra. The trial court made no distinction between the "burdened" costs and those expenses directly related to the investigation, such as Cower's travel expenses, which clearly are assessable as restitution.

Intel had the details about hours spent and actions actually taken by all employees in connection with this matter. 1/8/96 Tr. 29. According to the schedule submitted by Intel (State's Ex. 2 on Restitution), hourly rates ranged from just over $20 to $41. Yet according to State's Ex. 1 on Restitution, Cower's hourly rate computes at approximately $195 and Carlene Ellis, who was not mentioned in any police report or other official document, was billed at approximately $250 per hour. There was no indication of what she did in relation to the case. These discrepancies were pointed out to the trial court. 1/8/96 Tr. 69. The state offered no evidence to support the claims for these salaries, and failed to meet its burden to prove that the restitution claimed was actually caused by the activities of the defendant. State v. Lefthandbull, supra.

If the victim of a crime suffers inconvenience, but no financial loss attributable to the crime, then there are no pecuniary damages and no restitution can be ordered. State v. Heath, 75 OrApp 425, 706 P2d 598 (1985). ORS 137.103(2) specifically restricts recovery to special damages and, therefore, applies only to expenses actually incurred and to those expenses which are easily measurable. State v. Barkley, 315 Or 420, 435, 846 P2d 390 (1993).

Should Mr. Schwartz's conviction be affirmed, some of the expenses suffered by Intel are assessable against him as restitution. However, many of the costs and expenses claimed by Intel were either not proved to have been traceable to Schwartz's conduct or there was no evidence explaining how those costs were actually incurred correcting the results of that conduct.

The trial court erred by denying the defense Motion to merge Counts 2 and 3 as follows:

The defendant, before the time of sentencing, filed a Memorandum of Law Supporting Merger of Counts 2 and 3. Tr. Ct. File. The prosecutor argued in part, and the trial court found, that Counts 2 and 3 involved "separate timeframes." 9/11/95 Tr. 22 ll. 2-3. The "timeframe" in Count 2 is from 8-1-93 to and including 11-1-93. The "timeframe" in Count 3 is from 10/21/93 to and including 10-25-93. Thus, the so-called "separate timeframe" in Count 3 is wholly encompassed and contained within the "timeframe" in Count 2.

Additionally, there is no difference between the "Intel SSD's password file" (Count 2), and the "Intel SSD individual user's (sic) passwords" (Count 3). The "password file" is simply a grouping of data which is the sum of the individual users' passwords. 7/20/95 Tr. 108 ll. 21-22.

ORS 161.062 provides, in pertinent part:

* * * *

There is no merger, even if the offenses are part of the same episode or transaction, if proof of one includes proof of an element that is not necessary to prove in the other. State v. Atkinson, 98 OrApp 48, 777 P2d 1010 (1989); State v. Zuniga-Ocegueada, 111 OrApp 54, 824 P2d 427 rev. den. 313 Or 211 (1992). For purposes of merger under ORS 161.062 and ORS 161.067, elements of proof are controlled by statute, not the facts of the individual case; the issue is one of statutory comparison. State v. Heneghan, 108 OrApp 637, 816 P2d 1175 (1991) rev. den; State v. Sumerlin, 139 OrApp 579, 584, 913 P2d 340 (1996); State v. Nunn, 110 OrApp 96, 821 P2d 431 (1991) rev. den. 313 Or 211 (1992); State v. Wallock/Hara, 110 OrApp 109, 821 P2d 435 (1991), rev. den. 313 Or 75 (1992).

The test for whether separate convictions should be entered is: "(1) Did defendant engage in acts that are 'the same conduct or criminal episode,' (2) did defendant's acts violate two or more 'statutory provisions,' and (3) does each statutory 'provision' require 'proof of an element that the others do not.' " State v. Crotsley, 308 Or 272, 278, 779 P2d 600 (1989).

Here, there is no difference in the statutory elements because both counts are charged under the same section of the same statute. Under the Crotsley test, it is of no consequence that one count charges intent to commit theft of a password and the other charges intent to commit theft of a password file, because the question is statutory, not factual. No statutory element is present in Count 2 that is not present in Count 3, and vice versa.

The only remaining question is whether copying the SSD password file and running the "Crack" program on the SSD password file was part of the same criminal episode. ORS 131.505(4) defines "criminal episode" as "continuous and uninterrupted conduct that establishes at least one offense and is so joined in time, place and circumstances that such conduct is directed to the accomplishment of a single criminal objective."

Schwartz denied that his objective was criminal. He testified that he was testing a new version of the password cracking program for use in his ongoing duties as a systems administrator. 7/21/95 Tr. 150-151. Still, Schwartz was convicted of having copied the SSD password file and then running "Crack" on the passwords in that file. He copied it in the first place, admittedly, to run "Crack" on it to see how many of the passwords were guessable. 7/21/95 Tr. 154. Both acts were clearly part of a single criminal episode. 7/21/95 Tr. 150-162. The convictions should have been merged.

For the reasons stated above, appellant respectfully submits that this Court should order the evidence secured through the execution of the search warrant suppressed, declare the terms "alter" and "authorization" in ORS 164.377 unconstitutionally vague, reverse the trial court's denial of defendant's Motion for Judgment of Acquittal of Counts 2 and 3 or, in the alternative, order them merged and reverse the trial court's restitution order.

Marc Sussman, OSB#77368

Attorney for Defendant-Appellant

I certify that on July 24, 1998, I served two certified copies of the forgoing APPELLANT'S OPENING BRIEF by mailing them to: Mr. Michael D. Reynolds, Solicitor General, Appellate Division, Department of Justice, 1162 Court Street NE, Salem, Oregon 97310

Dated this 24th day of July, 1998.

Marc Sussman, OSB #77368

Attorney for Defendant-Appellant