Defense Hammers At Investigator In UBS Computer Sabotage Trial

Newark, N.J. - The defense in the UBS PaineWebber computer sabotage trial here continued its assault on the investigating agent on the stand Wednesday, calling into question not only the evidence the feds collected, but the methods they used to collect it, and the information and people they did not investigate.

Special Agent Gregory O'Neil of the U.S. Secret Service was hammered by defense attorney Chris Adams for the second day in a row, in questioning that several times became heated and contentious. Counsel repeatedly asked O'Neil about the circumstances surrounding agents finding a hard copy of malicious code in the defendant's bedroom, why mirror images of the defendant's computers were made at Secret Service offices instead of in the man's home, and about two other systems administrators who were questioned but never part of the criminal investigation.

Roger Duronio, 63, of Bogota, N.J., is facing four charges in connection with allegedly writing and planting malicious code on the Unix-based network at UBS PaineWebber, where he had been working as a systems administrator for three years. The attack effectively took down about 2,000 of the company's servers, some of which were brought back up in a day, but others remained down for two to three weeks. UBS has reported that the cleanup alone cost the company $3.1 million. The company has not revealed the price of lost business.

Duronio, in his third week of trial, is facing four federal charges in U.S. District Court here. If convicted, he's looking at a maximum sentence of 30 years, fines of up to $1 million and restitution for what UBS spent on recovery.

During his first two days on the stand, O'Neil, who was the lead case agent in the investigation, testified that during the execution of a search warrant on the Duronio home a few weeks after the March 4, 2002 security incident, Secret Service agents found parts of the malicious code on two of his home computers, as well as printed out in a hard copy that was found on his bedroom dresser.

On O'Neil's third day as a witness and his second in front of defense cross-examination, Adams on Wednesday badgered the agent about the way Duronio's computers were handled during the search, why mirror images of their hard drives weren't made in the man's home and why federal agents immediately called attention to the printout of the malicious code found in the bedroom when other programming code was found elsewhere in the house.

"It wasn't until after the analysis in your offices that you found the computer code?" asked Adams, referring to the trigger mechanism of the code that was found on the hard drives. "That's right," O'Neil responded.

Adams added, "You didn't find the document in the computer in the state [the computer originally] was in, did you?" Answering a similar question from the prosecution, O'Neil said, "I did nothing to alter the hard drives. No attempt to alter the records was made."

O'Neil explained agents took the computers back to the Secret Service field office before making the images because they had six hard drives from the house to handle, they wanted to get out of the Duronios' home before it was too late at night and they didn't know how long it would take. Part of Adams's barrage of questions for O'Neil focused on Charles Richards and William (Rob) Robertson, two other systems administrators who were put on leave in the month following the attack and then ultimately let go from their jobs at UBS. The attorney asked the agent why the Secret Service didn't seize the two men's work computers or weave them into the official investigation, especially when a small string of the code was found in the swap space of one of Richards' two computers. Swap space is where data is stored for programs running in memory.

O'Neil testified that he and other agents interviewed each man for one to two hours and considered them nothing more than fact witnesses. Both men, who reportedly were friends with Duronio, were systems administrators who worked to help recover the network after the attack.

In a report from @Stake, Inc., the computer forensics company UBS hired in the days after the attack, experts noted that they had examined the men's computers but didn't find criminal evidence, despite finding two short, but related, strings in the one computer. "The surrounding information did not lead us to believe it existed in the system," according to the report. "It was clear they were not direct entries Based on the evidence collected, @Stake believes it is unlikely CR and RR were directly involved in any malicious activity against UBS PaineWebber."

Adams has repeatedly argued against UBS using @Stake for forensic work because @Stake, now owned by Symantec Corp., employed well-known hackers.

Adams also grilled O'Neil about the fact that other computer code was found in Duronio's home but O'Neil was only specifically alerted about what ultimately turned out to be a portion of the malicious code that was on the printout found on a dresser in the master bedroom. ''Is it your testimony that prior to the search you were never shown a copy of the logic bomb or its components?" Adams said. "Yes," O'Neil responded.

Adams questioned how the agents, who had not yet seen the malicious code, could quickly identify the code on the dresser as potential evidence. "Because [an agent] found a piece of paper with some type of gibberish on it, that caused him, without knowing anything about Unix, to say, 'Get Agent O'Neil up here'?" Adams continued. "After all, the other agents found computer code in the house but they only alerted you to this one?"

O'Neil responded that this piece of paper did stand out. "It was the only paper with code on it on the dresser," he said. "There was nothing else like this."

On Tuesday, Adams had a similar string of questions surrounding a latent fingerprint found on the hardcopy of the code. When questioned, O'Neil said they had found an identifiable print on the paper but it didn't belong to Duronio or to either agent who handled it at the scene.

"The agent wasn't wearing gloves, but he still didn't leave fingerprints on it?" Adams asked. O'Neil said that he had handled it without gloves on, as well.