O'Neil testified that he and other agents interviewed each man for one to two hours and considered them nothing more than fact witnesses. Both men, who reportedly were friends with Duronio, were systems administrators who worked to help recover the network after the attack.
In a report from @Stake, Inc., the computer forensics company UBS hired in the days after the attack, experts noted that they had examined the men's computers but didn't find criminal evidence, despite finding two short, but related, strings in the one computer. "The surrounding information did not lead us to believe it existed in the system," according to the report. "It was clear they were not direct entries Based on the evidence collected, @Stake believes it is unlikely CR and RR were directly involved in any malicious activity against UBS PaineWebber."
Adams has repeatedly argued against UBS using @Stake for forensic work because @Stake, now owned by Symantec Corp., employed well-known hackers.
Adams also grilled O'Neil about the fact that other computer code was found in Duronio's home but O'Neil was only specifically alerted about what ultimately turned out to be a portion of the malicious code that was on the printout found on a dresser in the master bedroom. ''Is it your testimony that prior to the search you were never shown a copy of the logic bomb or its components?" Adams said. "Yes," O'Neil responded.
Adams questioned how the agents, who had not yet seen the malicious code, could quickly identify the code on the dresser as potential evidence. "Because [an agent] found a piece of paper with some type of gibberish on it, that caused him, without knowing anything about Unix, to say, 'Get Agent O'Neil up here'?" Adams continued. "After all, the other agents found computer code in the house but they only alerted you to this one?"
O'Neil responded that this piece of paper did stand out. "It was the only paper with code on it on the dresser," he said. "There was nothing else like this."
On Tuesday, Adams had a similar string of questions surrounding a latent fingerprint found on the hardcopy of the code. When questioned, O'Neil said they had found an identifiable print on the paper but it didn't belong to Duronio or to either agent who handled it at the scene.
"The agent wasn't wearing gloves, but he still didn't leave fingerprints on it?" Adams asked. O'Neil said that he had handled it without gloves on, as well.