1 IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLORADO
2
Civil Action No. 95B2143
3
RELIGIOUS TECHNOLOGY CENTER,
4
Plaintiff,
5
vs.
6
F.A.C.T.NET, INC., et al.,
7
Defendants.
8
9
REPORTER'S TRANSCRIPT
10 MOTION FOR PRELIMINARY INJUNCTION
11
12
13 Proceedings before the HONORABLE JOHN L. KANE, JR.,
14 Judge, United States District Court for the District of
15 Colorado, commencing at 10:00 p.m., on the 8th day of
16 September, 1995, in Courtroom C401, United States Courthouse,
17 Denver, Colorado.
18
19
20
21
22
DEBORAH A. STAFFORD, Official Reporter
23 P.O. Box 3592
Denver, Colorado, 80294
24 (303) 5710530
25 Proceedings Reported by Mechanical Stenography
Transcription Produced via Computer
117
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16 MR. KELLEY: Your Honor, we have a witness, Professor
17 Cleek, from Wisconsin here today. He has difficulty getting
18 back here next week. We don't know what we can work out, but
19 I was hoping we could put him on right now and try to get him
20 done today.
21 MR. COOLEY: My expert witness is from Virginia, who
22 is our next witness. He has a real problem coming back on
23 Monday.
24 THE COURT: How much time are you going to take on
25 this examination on direct?
118
1 MS. HANLONLEH: 45 minutes.
2 THE COURT: 45 minutes on your expert. How much on
3 your expert on direct?
4 MR. COOLEY: About half threequarters of an hour,
5 half an hour on direct.
6 THE COURT: Why don't you step down, sir. We'll
7 finish your crossexamination later. You are going to be
8 around any way?
9 THE WITNESS: I will be here, sir.
10 THE COURT: After last Saturday, I don't want to do
11 anything to anybody from Wisconsin that hasn't already been
12 done to them. But I think maybe we had better take the
13 plaintiff's witness since we have the same problem. If we
14 can, we'll call your witness after that. I don't mind staying
15 a bit late if the rest of you don't.
16 MR. BLAKELY: Plaintiffs call Ron Tencati.
17 (Ron Tencati was sworn.)
18 THE COURTROOM DEPUTY: Please be seated. State your
19 name for the record. Please spell your last name.
20 THE WITNESS: Ronald Tencati, TENCATI.
21 DIRECT EXAMINATION
22 BY MR. BLAKELY:
23 Q Mr. Tencati, whom are you employed by?
24 A INET, Incorporated.
25 Q What's the business of INET?
119
1 A They are an information system security corporation. They
2 do computer network computer security.
3 Q What's your position and responsibilities with INET?
4 A I am the program manager in the network security division
5 in Falls Church, Virginia.
6 Q What does a program manager do?
7 A I direct the work of senior analysts relating to the
8 business of our company which is risk analysis and other
9 computer security matters and contracts.
10 Q Could you briefly summarize your educational background?
11 A Sure. I attended high school in Gardena, California. I
12 attended the University of Southern California from 1977 to
13 1983.
14 Q What areas did you study there?
15 A Entered the university in 1977 as an electrical
16 engineering major. In '78 I changed to computer science,
17 attended to 1983, where I left after having completed 112 or
18 128 units.
19 Q Could you also trace your employment history for the
20 court?
21 A I served as a FORTRAN programmer at a corporation called
22 Martin & Stern Corporation from approximately 1978 to 1984. I
23 then moved to the Jet Propulsion Laboratory where I held
24 various roles until 1989 as a computer system manager, network
25 security manager and eventually the manager of computer
120
1 network security for the laboratory.
2 I left the Jet Propulsion Laboratory in 1984 to take
3 a job at the Goddard Space Flight Center as security manager
4 for NASA. The company I work for is now Hughes STX
5 Corporation. It has changed its name a few times. After
6 having served in the role of the security manager for the
7 physics analysis network, I secured the position of security
8 manager for NASA Internet, where I helped establish security
9 policies and procedures and set operational security policies
10 in concert with NASA headquarters. My most recent position.
11 Q When you are talking about the security position you have
12 had, is that with respect to computers?
13 A Yes, NASA wide area network. Basically NASA's Internet
14 networking environment. My job was to be the security manager
15 of NASA's entire nationwide network, as well as it reached
16 into the international aerospace partnerships.
17 Following that responsibility, I became the project
18 manager for NASA Automated Systems Incident Response
19 Capability which was a computer security support function,
20 reporting to the head of computer security at NASA
21 headquarters. This was a position where training and
22 awareness was provided to all of the NASA centers to the
23 senior managers at NASA centers, again, security policy and
24 procedures they are developed at headquarters and this
25 function was an assisting function to help disseminate and
121
1 educate the other NASA centers in those roles.
2 I also participated in computer security enforcement
3 activities on behalf of NASA as it related to computer hacking
4 against the NASA computers.
5 Q After NASA did you go to INET?
6 A After NASA I left and went to INET, and I am in the role
7 I am in currently which is program manager.
8 Q How long have you been with INET?
9 A Since May of 1995.
10 Q Do you have any training or instruction in computer
11 forensic analysis?
12 A During the course of my employment and work with NASA,
13 since those systems were federallyowned systems, I had
14 occasion to interface with the Computer Crime Squad of the
15 FBI, the Inspector General's Office at NASA, and also the Air
16 Force Cryptologic Support Team in San Antonio, Texas, all of
17 which have provided instruction into computer forensic
18 analysis as it relates to gathering of evidence for
19 prosecution, since my job at the time was to assist in the
20 prosecution and support information relating to intrusions
21 into NASA systems.
22 Q Do you belong to any professional associations or
23 organizations which are relevant to the subject matter of this
24 lawsuit?
25 A The Forum of Incident Response and Security Teams. It's
122
1 an organization which I cofounded, and I am currently a
2 steering committee member in my second term. This is a
3 worldwide organization that brings together response teams.
4 Has a computer emergency response team in Pittsburgh. NASA
5 has had their own, which is the organization I was the manager
6 of, as well as other federal computer security organizations,
7 as a means of sharing computer security related information
8 and also includes the law enforcement component in the federal
9 government.
10 Q Has INET been retained to perform any service in
11 connection with this litigation?
12 A Yes, we have.
13 Q What are those services?
14 A To assist in the seizure of computer equipment and also to
15 perform an independent analysis of that computer equipment and
16 the data contained thereon.
17 Q What has INET done to fulfill or discharge these
18 responsibilities?
19 A We traveled here to Colorado, assisted in the seizure of
20 equipment pursuant to the Writ of Seizure. We have been
21 performing ongoing analysis of the computer systems based upon
22 key words that have been provided to us by the law firm of
23 Sheridan Ross & McIntosh and have been gathering information
24 based upon that analysis.
25 Q Did you participate in the seizure on August 22?
123
1 A Yes, I did.
2 Q In what capacity?
3 A My role there was to identify and take custody of any
4 computerrelated equipment as was specified in the Writ of
5 Seizure for that location which included all computer systems,
6 peripherals, disks, magnetic media that was capable of storing
7 information, to catalog that information. We kept an
8 inventory and to make sure that it was properly collected and
9 transported to the law offices.
10 Q Did anyone assist you in performing that function?
11 A In the area that I was at in the portion of the house
12 that I was at Mr. Robert Brunelli of Sheridan Ross was also
13 collecting evidence.
14 Q You were at?
15 A I was at the Penny residence.
16 Q Were there any counterparts to you Mr. Wollersheim's at
17 residence?
18 A Yes, Mr. Salfiti.
19 Q Would you spell
20 A SALFITI was essentially my counterpart at the
21 Wollersheim residence.
22 Q Did you provide any direction or instructions to
23 Mr. Salfiti as to his performing that role at the Wollersheim
24 apartment?
25 A Yes, I did. I provided him with a set of notes that I
124
1 wrote for him which was the procedure that he should follow at
2 the Wollersheim residence to assure that we had equivalent
3 processes going on in both locations and that information
4 would be properly logged.
5 Q Would you describe those procedures that were followed
6 during the seizure?
7 A Computer equipment was identified, and what I instructed
8 and what I did at the Penny residence was try to minimize the
9 number of people that were touching things. In the location
10 where I was at was Mr. Penny and myself in the main part of
11 the myself in the livingroom and the front bedroom area.
12 All evidence that was located it ranged from computer
13 systems, monitors, floppy disks, CD Roms, they all had a
14 slightly different procedure, but in general the items were
15 counted, put into Ziploc bags, the label of the Ziploc bag was
16 marked with an identification number of the contents of what
17 was being placed inside and quantity, the location where
18 that where that material was first being seized from, the
19 initials of the person who placed information and the material
20 into the bag. The bag was sealed, Ziploc bag, and then a
21 piece of duct tape was put over the top of the bag to ensure
22 that the bag would not inadvertently open and the contents
23 would therefore be lost. A log was kept which matched the
24 number that was put on the bag to the contents of the bag that
25 were put onto the log and the numbers matched.
125
1 The computer equipment itself every piece of
2 equipment was numbered and initialed on the back with a
3 permanent marker and that was also entered on to the log and
4 this process was repeated for various pieces of computer
5 equipment that were being seized and cataloged and also for
6 any magnetic media, be it CD Rom, floppy disk, or any and a
7 quarterinch disk.
8 Q To your knowledge, were the same procedures followed at
9 Mr. Wollersheim's apartment?
10 A Yes, they were.
11 Q And what happened when all that stuff was collected at
12 the at the two residences.
13 A As the bags were being identified and matched, they were
14 being put into an empty box for collection upon the boxes
15 being filled. At the Penny residence they were taken outside
16 to the little courtyard area outside of the front door where
17 Mr. Penny was seated with his counsel and the box was turned
18 over to them for their review. When they were completed with
19 their review, the items were put back into the box and boxes
20 were covered and my initials were placed across the seal of
21 tape, then I transported them into the van which was parked at
22 the front of the residence. I unlocked the van, placed
23 material inside of the van, locked the van and returned to the
24 house.
25 Q Were you the only one with the keys to the van?
126
1 A Yes, I was.
2 Q Did you give them to anybody else during the seizure?
3 A No, I didn't.
4 Q When you arrived at Mr. Penny's residence were the
5 computer systems on or off? What status were they at?
6 A When I entered Mr. Penny's residence, there were two
7 computer systems that I observed and they were both on.
8 Q How did you dismantle them, what procedures did you
9 follow?
10 A What I did was I first observed what was displayed on the
11 screens of the two computer systems and wrote down everything
12 that was listed on the scope. I also took photographs of both
13 computer systems. Then I proceeded to disconnect any modum
14 lines that were hooked up to those computer systems. I
15 believe in the case there was a white CPU and black CPU. I
16 believe in the case of the white CPU, it had one modum line
17 attached to it. That was disconnected. The power cords
18 were the systems were turned off, the power cords
19 disconnected, and then I tagged each cable that was connected
20 to the back of the CPUs, so we could reconstruct the
21 configuration back at the law firm. As the components were
22 separated into their individual pieces, they were each tagged
23 in the manner described and moved into the van.
24 Q You have indicated you took photographs. Were there any
25 other photographers or videographers present?
127
1 A At the location where I was at there were two additional
2 persons. One was taking still photographs and one was taking
3 videotape.
4 Q Once all the materials were placed in the van, what
5 happened next?
6 A I drove them from Mr. Penny's residence directly to the
7 law offices of Sheridan Ross & McIntosh, where I turned them
8 over to the representatives of the law firm.
9 Q Can you please describe for the court where the materials
10 were then placed within the law firm, under what conditions.
11 A We were provided a corner office in the law firm to store
12 the materials. We put at this time also the materials from
13 Mr. Wollersheim were also arriving at the law firm. It was
14 placed in the same office at the opposite end of the office to
15 keep the two seized materials separate. The offices had a
16 lock on it. The members of the law firm had the keys. And
17 initially that first day, they were the only people with the
18 keys. All of the material all of the evidence and CPUs
19 were stored in that office and the door was locked.
20 Q Did any personnel from INET participate in the
21 preparation or development of the procedures that were
22 followed?
23 A Yes.
24 Q Who were they?
25 A My supervisor, Mr. James Settle.
128
1 Q Anyone else?
2 A No.
3 Q Could you look at Plaintiff's Exhibit 65 and identify what
4 that is.
5 A This is my biographical information that's included in
6 contracts that INET bids out.
7 Q Is the information in that accurate?
8 A Yes, it is.
9 Q Would you look at Exhibit 66, please, and identify what
10 that is?
11 A This is the biographical information for Mr. Albert E.
12 Lane.
13 Q Is Mr. Lane an employee of INET?
14 A Yes, he is.
15 Q Did he participate somehow in these seizures?
16 A Yes, he did. He came to Colorado after the seizure to
17 assist in the analysis of the computer software.
18 Q Do you understand the information contained in Mr. Lane's
19 biographical sheet to be accurate?
20 A Yes.
21 Q Would you look at Exhibit 67, please, and identify what
22 that is?
23 A This is the biographical information for Mr. Pooran
24 Rajkumar. He also worked for my company in my division.
25 Q Did Mr. Rajkumar participate in these procedures?
129
1 A Yes, he did. He also flew out to Colorado during the
2 first week to assist in the analysis of the computer
3 equipment.
4 Q Is the information contained in Mr. Rajkumar's
5 biographical sketch accurate, as far as you know?
6 A Yes, it appears to be.
7 Q Lastly, Exhibit 68, would you identify that?
8 A This is the biographical information for Mr. James Settle.
9 He is the director of our computer network security division
10 at INET.
11 Q He is your boss?
12 A Yes.
13 Q Did Mr. Settle participate in these procedures?
14 A Yes, he did.
15 Q In what fashion?
16 A He came out at the end of last week to assist in the
17 process of analyzing and cataloging the information that was
18 being collected.
19 Q Is the information contained in Mr. Settle's biographical
20 sketch accurate, as far as you know?
21 A Yes.
22 Q Were there any nonINET computer analysts that were
23 retained to assist in the review of the computer equipment?
24 A Yes.
25 Q What did these nonINET analysts do?
130
1 A They were engaged mostly in searching the hard drives of
2 the CPUs that were seized at both Mr. Penny's and
3 Mr. Wollersheim's residences, and because of the volume of
4 information that was seized, and at the time we thought the
5 information I had was that there was a possible hearing that
6 was coming up, so we procured rental computer systems and put
7 copies of the hard drives by performing a backup operation on
8 the floppy disks from the seized machines and moved them down
9 onto some of the rental machines, so some of these nonINET
10 employees could continue assisting in these scanning of key
11 words on the copies of the hard drives, as well as some of the
12 other rental machines were dedicated for the scanning of the
13 floppy disks and other media that was seized during these
14 activities.
15 Q Why wasn't that done on the seized equipment?
16 A We didn't want to as part of my training the last thing
17 you want to do is modify or provide any opportunity where
18 information on a person's computer system or the system under
19 review might be modified. So we chose to analyze as much of
20 the data as possible on machines other than the machines that
21 were seized so as not to contaminate any of the data that
22 might be on the hard drive or destroy inadvertently any of the
23 data that belongs to the defendant.
24 Q Did you satisfy yourself as to the competency of these
25 nonINET computer analysts?
131
1 A Yes, I did. They were retained by the law firm. Upon
2 their arrival, I had a short discussion with each of them
3 about their general background. The skill set that was
4 required for what we were doing wasn't that technical. They
5 needed to be briefed on what the procedures were, and I
6 satisfied myself that they were sufficiently qualified to
7 perform the activities that we were going to be asking them to
8 do.
9 Q Were there any characteristics that these people generally
10 had that you can identify?
11 A We looked for background people who had since we had
12 seized personal computer systems, DOSbased personal computer
13 systems, we looked for individuals that had experience with
14 DOS, that knew what the general commands in DOS were and how
15 to operate a personal computer system with that type of
16 operating system. They also had a Windows environment on
17 them, so we looked for people with that kind of background.
18 And I found all of the persons that were hired to be
19 sufficient.
20 Q Who instructed these nonINET computer analysts as to
21 what their job functions would be?
22 A I did.
23 Q What instructions did you give them?
24 A I told them that, first, I described for them what the
25 nature of the work was and that we had a situation where we
132
1 were looking at computer systems which had been seized in a
2 legal action, and our job was to analyze the information, but
3 we had an added component which was that we wanted to make
4 sure that the plaintiffs were only allowed to see information
5 that matched criteria that was specified for us by the law
6 firm. So there were a number of other people that they would
7 see around them, but they were not to allow those people
8 anywhere near the key board or to touch any of the evidence.
9 That the only people authorized to perform those functions and
10 execute the direct searches would be these people that were
11 hired.
12 Q Were those procedures followed?
13 A Yes, they were.
14 Q As an aside, can you guess or estimate how much volume or
15 quantity of data was seized in a computer form or computer
16 electronic media storage form?
17 A My estimate of what we seized was approximately 25
18 gigabytes of information.
19 Q Translate that into pages of paper.
20 A Approximately, the equivalent of 600,000 printed pages.
21 Q Did your analyze these computer files, uncover any
22 encrypted data?
23 A We found primarily backup tapes, quarterinch backup tapes
24 that had been made, that upon attempting to restore them to
25 rental computer systems using tape drives, which we had
133
1 procured, the software reported that the backup save sets were
2 password protected.
3 Q Has anyone attempted to break those passwords?
4 A No, we informed the law firm that that was the case in
5 some of the issues, but we have taken no action to try to
6 break those codes.
7 Q Can you please generally explain procedures that were used
8 from to search and obtain the information or what let me
9 rephrase that.
10 Can you describe the particular assignment that you
11 were given and how you went about filling that assignment with
12 respect to looking for information in the computer files?
13 A My understanding was that members of the Church of
14 Scientology provided the law firm with key words. I was
15 provided a list of key words by the law firm. We initially
16 started with a program that Norton Utilities, one of the
17 programs in the suite of software allows for key word searches
18 of raw disk sectors. We initially started using this program
19 but due to the volume of data and the fact that it was taking
20 approximately three hours per key word and we had a lot of
21 data to go, we chose a different program which was able to
22 search for five key words at a time, and we ran these
23 programs. In the case of actual CPUs that were seized, we
24 made sure we ran these programs off the floppy drives, so as
25 not to load any software, because one of the other things we
134
1 are looking for any key word matches which maybe in the
2 deleted file sectors of these machines, and I didn't want to
3 overwrite any information on those hard drives. The
4 information, if it matched a key word, we had Scientologists
5 present. We were this program would display the key word
6 on the screen as well as about five lines prior to and five
7 lines following the line in the particular file that was being
8 searched. If that had the key word, we would then have the
9 Scientologists look at the information or fragment of the file
10 that was being displayed on the screen, and they would
11 identify for us whether or not that was what we called a hit.
12 If they felt that what was being displayed on the screen
13 contained potentially infringing material, they informed us of
14 that, and that file name was written down and was later copied
15 to a separate floppy. If they indicated that the fragment
16 that was being displayed was not of interest, did not contain
17 any potentially infringing material, the search was continued
18 until the next key word was matched by the program.
19 There was a special case, after the first day, we
20 were provided additional key words to add to our list,
21 including names of attorneys, which then raised the issue of
22 possibly attorneyclient privilege information being
23 displayed, and I needed to protect that from being viewed by
24 the Scientologists, so the procedure I instituted was that in
25 the group of key words, we were we had more than five key
135
1 words total, so we had to do multiple searches of five key
2 words at a time. It so happened we had five lawyers' names.
3 What I instructed was that the first group of key word
4 searches be those lawyers names, and I think matches that were
5 picked out by the software not be referred to the
6 Scientologists at all, that those files be copied to floppy
7 disks. The method was any file with a hit, we would take a
8 copy of that file and put it onto two separate floppy disks.
9 I would take possession of one of those and in the case of the
10 attorneyclient privilege, both copies went to Sheridan Ross &
11 McIntosh attorneys. In the case of a hit where the
12 Scientologists thought that there may be infringing material,
13 I still retained one copy of that. The second copy was then
14 given to the Scientologists in the evidence room. There was a
15 computer set up later when we had the full compliment of
16 rental machines, one of those had been set aside for the use
17 of the plaintiffs to review the information.
18 Q So as a file a copy of a single file was given was
19 put on a single floppy disk and given to a member of the
20 church to review?
21 A Right. In most cases when we were searching floppy disks
22 especially in the case of the hard drives and CD Roms, those
23 media contained more than one file. The key word hit may only
24 be in one file in a particular area or one file of many that's
25 located on a floppy disk. What we did, we took that entire
136
1 file that achieved the key word hit and copied it to a floppy
2 disk, so information every single file that achieved a hit
3 we generated two copies which were then in the case of the
4 possibly infringing material, one copy was given to the
5 Scientologists, so to clarify in detail that that was in fact
6 an infringement.
7 Q And the Scientologists review of that file was done in the
8 same room as you and the other computer analysts were working?
9 A That's right. There was one computer system that we had
10 reserved for use by members of the Church of Scientology,
11 where the rest of the computers in that room were reserved for
12 use either by INET or nonINET analysts. And at any time
13 that a at any time it was required that a
14 nonScientologist was present at all times. And any time that
15 wasn't the case, the room was cleared and locked and all of
16 the evidence was either returned to its original location or
17 locked in the room.
18 Q Approximately, how many hours a day were people working on
19 these files?
20 A For the first three days, we had an operation going 24
21 hours a day. For the past three weeks, it has been
22 approximately 17 hours a day.
23 Q For those other six hours or five hours, whatever, 24,
24 seven hours it has been a long day what happened to the
25 information during those other seven hours? What was done
137
1 with the computer equipment?
2 A At the end of a shift, the information if it was
3 information that was coming from an evidence bag, it was
4 returned to the evidence bag. The bag was resealed, the
5 person who had opened the bag had already put their initials
6 and the time and the date on the bag that they opened it.
7 They would return the evidence to the bag, reseal it, and sign
8 their name again. That would be returned to the original
9 evidence room. Any floppies that were given to the
10 Scientologists were left locked in the room where the analysis
11 was being done. And also in the printouts that may have been
12 made by the Scientologists from those individual floppies were
13 also left locked in that room. The key to that office was
14 then turned over to a representative of Sheridan Ross &
15 McIntosh who was staying up late, and the rooms were secured
16 in that manner.
17 Q Did the key word search work in every instance or were
18 there files where key word search didn't work?
19 A There were some files where the key word search didn't
20 work because of the nature of the files. For example, there
21 were some files that were compressed. They take multiple
22 you can have multiple files, and you would compress them into
23 one. Nature of that file is such that it's no longer really
24 possible to do a key word search. In addition, there were
25 some scanned in numerous scanned in images of files that
138
1 had been processed into the system via scanner. They were not
2 text. So pictures didn't work for those.
3 Q What was done to
4 A We observed on the defendants' computer systems there were
5 some programs that could be used to view these. So we
6 initiated procurement of those copies of those software, but
7 we ran special software to view in graphical format these
8 types of files. In that case, the procedure had to be
9 slightly modified because we were not dealing with a fragment
10 of a file, and there was no way to do a key word search. What
11 we did, we had members of Scientology viewing pictures of the
12 pages. This is as they came up on the screen. And if it was
13 not infringing, it was passed over. If it was, then we would
14 follow that same procedure I described.
15 Q Were computer viruses a concern when you were reviewing
16 the data?
17 A Yes, they were.
18 Q How was that handled, if at all?
19 A On the bags of evidence that contained copied floppy
20 disks, every analyst was instructed and also provided a copy
21 of a program called F Prop which is a virus scanning program.
22 We scanned every floppy disk. That was the first operation
23 that was done was to run a virus scan against these floppy
24 disks to make sure they didn't have a virus on them.
25 Q Why were you concerned about that?
139
1 A If we had taken a floppy disk with a virus and ran
2 processed it on one of the rental computers, we would have
3 infected that rental computer with the virus, and any
4 subsequent floppy we put into that drive would have been
5 infected with the virus.
6 Q Was there concern about the defendants' equipment about
7 the integrity
8 A Yes. So we ran it so as to not propagate that to the
9 floppies that were being scanned.
10 Q Has the integrity of the defendants' computer files been
11 maintained, in your opinion?
12 A Yes, it has.
13 Q Did any of the procedures that you followed or that were
14 followed in conducting the review of this equipment add or
15 subtract any files to the existing storage on either of the
16 defendants' computer equipment?
17 A Not to my knowledge, no.
18 Q Was there any special software needed to undertake the
19 searches and the procedures you have outlined?
20 A Yes.
21 Q What was that?
22 A We used Norton Utilities Disk Edit to search the hard
23 drives for filing key word hits which may be in deleted file
24 sectors. We also used Norton Utilities and Erace to examine
25 for the presence of deleted files. And the first program I
140
1 mentioned would find fragments of files on those deleted file
2 sectors. The second program I mentioned would find entire
3 files where the file header was still resident which could
4 then be possibly restored. We also use a program called
5 P Search which was a utility which would search for five key
6 words at a time. It's a piece of software from a company
7 called PatraSoft in California. For viewing the image files
8 that were scanned or the result of scannedin files, we used
9 programs called Scan Fix and Type Reader Professional, which
10 we procured copies.
11 Q Since this is a copyright infringment case, was all the
12 all software used properly purchased and licensed?
13 A Initially when we used the software, we used copies from
14 the defendants' machines. We also at the same time procured
15 multiple copies, one for each of the rental systems that we
16 were using and we are now fully in compliance with the
17 licenses for all the software we have been using.
18 Q Can I have you look at Exhibit 28 which is in the book in
19 front of you? Do you have that?
20 A I have it.
21 Q Did you participate in any way in the preparation of that
22 exhibit?
23 A Yes, I did.
24 Q Could you explain what your input was?
25 A On this chart, columns three and four are columns that
141
1 describe where the where the infringing works were found
2 and the date the computer file was saved. I provided
3 information for this chart based upon the logs that were being
4 taken by the or generated by the computer analysts as they
5 were going through the evidence in the hard drives and as
6 Scientologists were identifying possible infringed works.
7 These are the file names and creation dates of those files as
8 they appeared either on the hard drive or floppy disks or
9 other magnetic media.
10 Q Do you have an opinion as to the integrity of the search
11 procedures that were followed in this case by you and the
12 people working under you?
13 A Yes, I think they were fine.
14 Q Do you have an opinion as to reliability of the searching
15 that was done to find the files that are identified in
16 Exhibit 28?
17 A I think that the search procedure was very reliable. We
18 have run multiple programs in some cases against the same data
19 and we achieved the same file hits, so I have every reason to
20 believe that the procedures followed were accurate.
21 Q One last question two last questions. Have you ever
22 met Mr. Wollersheim before?
23 A Not until yesterday.
24 Q And did Mr. Wollersheim threaten you in any way yesterday?
25 A At the end of my deposition, Mr. Wollersheim informed me
142
1 that F.A.C.T.Net would probably be suing my company because of
2 our participation in this case.
3 MR. BLAKELY: No further questions, Your Honor.
4 CROSSEXAMINATION
5 BY MR. TYSVER:
6 Q Mr. Tencati, you mentioned that you had some software to
7 search for deleted documents that have been found in the
8 storage media that you were that you were searching.
9 Did you discover any deleted documents that might
10 have had a key word hit in them?
11 A I discovered fragments of documents that had key word hits
12 in the deleted sectors on one of the computer systems.
13 Q How many fragments did you find?
14 A Two separate file fragments.
15 Q From your analysis, were you able to determine where on
16 that hard drive in terms of the directory those file segments
17 were originally found?
18 A No, the nature of the disks when the file is deleted,
19 especially in this particular instance, was such that there
20 was no residual information about where that file resided. It
21 was on the E drive of Mr. Penny's machine.
22 Q Were you able to determine when those files were deleted?
23 A No, I was not.
24 Q In the course of your work in this action, have you ever
25 been asked to determine whether or not the documents that you
143
1 may have found in your search were the source of the documents
2 that were placed onto the Internet?
3 A No, I was not asked that.
4 Q Did you ever make ever make a sufficient determination?
5 A If they were the source?
6 Q Right.
7 A No.
8 Q You mentioned that your search involved searching for
9 particular key words; is that correct?
10 A Yes.
11 Q Were you given an understanding as to why you were using
12 this key word technique?
13 A My understanding was that these key words had particular
14 significance to the plaintiffs because the material that would
15 be matching some of these key words was proprietary to the
16 church, and since none of the analysts were members of the
17 church, we would not be able to identify what was coming up on
18 the screen.
19 Q Were you ever told that one of the functions of using the
20 key word search technique was to prevent the Scientologists
21 from reviewing all of the documents that were seized?
22 A The only instructions I was given was with respect to the
23 attorneys' names and any key word matches relating to those
24 specific key words, we should assume attorneyclient privilege
25 and not let any of the Scientologists see that material.
144
1 Q Were you given any instructions on any other materials
2 that may have been confidential to the defendants?
3 A Only that we should only allow the Scientologists to view
4 the files that matched these particular key words that we were
5 being given and no others.
6 Q When you found a file that had a key word in it, were the
7 Scientologists allowed to view all of those files?
8 A No, if we found a file that had a key word in it, they
9 were the program would put as I mentioned five lines
10 prior to the key word hit the line containing the key words
11 and five lines following that, so a total of 11 total of 11
12 lines. They were allowed to view that fragment, and then
13 based on that fragment, they would tell us whether or not that
14 appeared to be their material and they would identify for us
15 whether or not that was a potential infringement or whether
16 that was just a text document.
17 Q Did they see this file fragment from every file that had a
18 key word hit?
19 A Yes.
20 Q Was anybody other than the Scientologist viewing this file
21 fragment responsible for determining whether or not this file
22 had potentially infringing material, and therefore, was to be
23 subject for further review?
24 A When we got to the CDs which had these graphical
25 representations of pages, some of the analysts were instructed
145
1 as to the in some cases if I had the word "copyright," they
2 were then told that was something that they should bring
3 attention to. But in general, they were told all
4 Scientologists were all of the analysts were told to show
5 that material to Scientologists for their determination.
6 Q And when the Scientologists asked for a particular
7 document to review, were they given the entire document?
8 A If it was one that they had identified in the manner that
9 I described, they would be given a floppy coining that
10 document alone.
11 Q Did any attorney or computer consultant or employee of
12 your firm witness or watch over the Scientologists as they
13 reviewed that whole document?
14 A The analysts were present in the room, but no one
15 supervised the activities of Scientologists, no.
16 Q Would it be correct to say the key word list controlled
17 the documents that the Scientologists could review?
18 A That's correct.
19 Q Who provided you with this list of key words?
20 A The attorneys for Sheridan Ross & McIntosh.
21 Q Do you know who selected the key words?
22 A No, I don't.
23 Q Were you involved in the selection of the key words at
24 all?
25 A No, I was not.
146
1 Q Approximately, how many words were you allowed to search?
2 A I believe it was approximately 30, although, I would have
3 to see the list to have the exhibit number.
4 Q Did the did the number of words that you were told to
5 search ever change during the process, sir.
6 A Yes.
7 Q How many words were you originally told to search?
8 A Five.
9 Q When was the number of words increased to 30?
10 A I believe it was on the second day of the analysis. We
11 were provided with an additional list of words to add to the
12 initial list of five.
13 Q Were you ever told why the number of key words was
14 increased?
15 A No.
16 Q Do you know whether or not the increased number of key
17 words allowed the Scientologists to review more documents?
18 A I am sure they did because it would have resulted in
19 additional opportunities for a key word match on the documents
20 that were residing on the disks.
21 Q Do you have any idea about how many more documents, how
22 many times more?
23 A With the number of key words that were added, I would say
24 we probably got three to four times more than we had gotten
25 with just the five.
147
1 Q Is the analysis of the data that was seized complete at
2 this point?
3 A No, it's still ongoing with respect to the CD Roms and
4 cartridge tapes.
5 Q Are you planning on supervising the analysis of those
6 materials?
7 A I am not planning on directly supervising the remainder of
8 the analysis. It will be supervised however.
9 Q Will you be in town during the analysis of that material?
10 A Not next week, no.
11 MR. TYSVER: Your Honor, the defendants have some
12 concerns of the security procedures that may have been
13 employed during the procedure as well as to the analysis. But
14 I won't ask questions on those points right now because of
15 time constraints; however, the defendants want to reserve the
16 right to address those issues if and when the integrity of the
17 materials actually comes into issue at that point.
18 I have no further questions.
19 THE COURT: Any redirect?
20 MR. BLAKELY: Two questions, Your Honor.
21 REDIRECT EXAMINATION
22 BY MR. BLAKELY:
23 Q With respect to crossexamination when you indicated there
24 is still some searching to be done, but you may be the person
25 there to supervise it
148
1 A Yes.
2 Q Will there be an INET employee present for the
3 supervision?
4 A Yes, there will.
5 Q One other question you were asked, I may have
6 misunderstood it. Just so we are clear, as key words were
7 found Scientologists or certain members of the church were
8 allowed to review those 11 lines?
9 A Yes.
10 Q Those were for key words that were not attorney names?
11 A That's correct. The only displays that the Scientologists
12 were shown were the displays containing key word hits that
13 were not the attorney names.
14 Q Do you know on those two deleted file fragments that you
15 were talking about if there were any key word hits in those?
16 A Yes, there were.
17 Q Do you know if those made it onto Exhibit 28 or they were
18 found to have found infringing material in them?
19 A My understanding is I performed that particular search
20 and the key word this was early when they were using the
21 Norton Utility disk, the key word that was being used was O.T.
22 in capital letters with spaces on either side and it matched
23 it achieved a hit in both of the contiguous deleted sectors
24 on this E drive.
25 MR. BLAKELY: No further questions, Your Honor.
149
1 THE COURT: You can stand down. Thank you
2 Mr. Tencati. Now, can we switch over and get the other
3 expert? This is one witness we don't want to badger, right?