Behind the bailiff, Steve Gunther lumbered into the courtroom with a slow, side-to-side gait. He did not look like a typical skinny computer geek. His stocky physique, tight business suit, and sour facial expression made him resemble an aging, second-string linebacker who had spent most of the games on the bench.
After the clerk administered the oath and had him place his name on the record, Nielsen sought to qualify him as an expert witness in the field of cybersecurity.
Despite my questions that challenged his credentials and proved he had worked for Benton Dynamics only briefly, Judge Arnetti overruled my objection. The court recognized Gunther as an expert witness for the plaintiff. Nielsen slowly and methodically elicited opinions from Gunther about the theft of confidential files from Benton Dynamics.
Begrudgingly, I admired my opponent’s skill as a litigator. If I were not on the other side of this case, I might have enjoyed watching this hearing as a spectator and picking up a few pointers. Nielsen’s direct examination of Steve Gunther showed patient attention to detail. With carefully crafted questions, Nielsen built a bridge that crossed the gap between doubt and certainty regarding Marisa’s role in the theft.
By further exploring Gunther’s education and background, Nielsen laid a solid foundation for the witness’s knowledge of cybersecurity. On top of that foundation, he supported his case with questions about technical procedures that identified the breach. Nielsen politely asked follow-ups to guide his witness away from computer jargon. Judge Arnetti seemed to understand the testimony and did not interrupt for clarification.
With the foundation and supports in place, Nielsen connected the facts that Marisa had the passwords, only Marisa had the KEL drive, and the theft of confidential data occurred at her workstation where a biometric pad granted access only to her. Each of these facts, like the beams and cables of a bridge, held up his theory of the case.
Judge Arnetti simply needed to walk across that bridge and reach the destination that Nielsen intended. Only Marisa could have stolen the missing files.
But that could not be true. Other employees at Benton Dynamics would have had a record of Marisa’s passwords. Somehow someone must have bypassed her biometric pad, but I doubted I could prove it.
“Your witness,” said Nielsen.
For whatever reason, Marisa was reluctant to testify, and I could not blame her. If she declined to take the stand, the entire case depended on my questions to Steve Gunther. Somehow, I had to shake him.
In a stolid tone, Judge Arnetti said, “Mr. Seagraves, cross-examination.”
25
At that moment, the ornate wooden walls of the courtroom seemed to recede and disappear. The tables, railings, and judge’s bench faded from view. Judge Arnetti and everyone else at the hearing might as well have been in the Mojave Desert. Only the witness, Steve Gunther, sat before me.
Placing my hands atop the podium, I asked, “Mr. Gunther, your position with Benton Dynamics is Chief of Cybersecurity, correct?”
“Yes,” he replied with thinly concealed annoyance.
“But you’ve only been at that job for what … two or three weeks?”
“That’s right.”
“Did you work for Benton Dynamics before taking this job and were promoted?”
“No,” he replied, avoiding eye-contact with me.
“You were at another company?”
“Yeah.”
Short answers. No elaboration. Nielsen’s team of lawyers must have coached him well for cross-examination, where I was free to ask leading questions. Still, there had to be some way to get him to start talking.
I asked, “All the alleged thefts of the research files occurred before you arrived, correct?”
“Correct.”
“So everything you learned about the missing data was secondhand … not something you observed at the time?”
Gunther’s chin and squinting eyes turned abruptly toward me. “No, not secondhand. My team forensically examined the central processing units. That’s why they brought me on. My area of expertise. The digital history told me what happened.”
“When did you start your review of the computers at Benton Dynamics?”
“Day one on the job. In light of the gravity of the situation, we didn’t waste any time.”
“When did the first theft of data occur, according to your examination?”
Gunther shifted in his chair. “The first unauthorized download was on July 27.”
“Of this year?”
“That’s right.”
I tried to shake off the drowsiness that still clouded my mind. It had to have been more than just the aftereffects of India Pale Ales. “And none of those first files were downloaded from Marisa Dupree’s computer, correct?”
“Uh-huh.”
“Because the clerks are recording, could you testify out loud, Mr. Gunther?”
“Yeah, sure,” he replied. “Not hers.”
“Whose computer?”
“Richard Kostas’s.”
“Anyone else’s?”
“What do you mean?” he asked.
I exhaled slowly and continued. “Were any other computers at Benton Dynamics used for this first unauthorized download?”
“No, just his at first … and then four other times on his. The last one, however, was from Marisa Dupree’s workstation.”
“And as part of your investigation, did you look at security videos, you know, to identify who sat at the computers during these alleged thefts?”
Gunther gave me a condescending smirk. “No, I didn’t. There’re no closed-circuit cameras in the research lab.”
“Why not?”
“Video recordings are a security risk. Another possible source of a leak.”
I fidgeted with my pen and tapped it quietly on a legal pad. “So if there is no video, you can’t be sure who used Richard Kostas’s computer to steal files?”
“No, that’s wrong. It was Kostas. His password.”
“And he loaded files onto a special flash drive, a KEL drive?”
“Yeah,” Gunther replied. “A portable drive assigned only to him. Also password-protected. And there’s a biometric pad to read his handprint before he could access files. Two-step authentication.”
“Because Richard Kostas used his own passwords and his own disk drive, and because his handprint was required to get in the system, then you’ve concluded that Marisa Dupree didn’t download files the first five times, right?”
“I suppose so.
