## Facts

- Randal Lee Schwartz worked as an independent contractor performing programming and systems work on Intel’s Supercomputer Systems Division (SSD) computers, which held secret and valuable information protected by user passwords stored in encrypted form.
- After a dispute, Intel disabled Schwartz’s access credentials, but one password for an SSD computer (Brillig) was inadvertently left active.
- Using that remaining access, Schwartz ran a “gate” program that enabled access to Intel computers from outside Intel’s network, contrary to company security policy.
- Schwartz ran a password-guessing program on Brillig, obtained at least one user password, copied the SSD password file to another Intel computer, and continued cracking passwords from the copied file, learning additional user passwords.
- Intel discovered the activity, contacted law enforcement, and Schwartz was charged with three counts of computer crime under ORS 164.377 based on knowingly accessing Intel’s computer system for the purpose of committing theft of the password file and passwords.
- A jury convicted Schwartz on all counts, and the trial court imposed restitution to Intel for security-related losses.

## Issues

1. Whether evidence was sufficient that Schwartz accessed a computer system “for the purpose of committing theft” under ORS 164.377 when he copied and cracked passwords that remained on Intel’s computers.
2. Whether confidential passwords and an encrypted password file constitute “property” (or a protected property interest) capable of being stolen when the alleged harm is loss of exclusive control rather than physical dispossession.
3. Whether the restitution award was supported by legally cognizable economic damages and adequate proof of causation and amount.

## Decision

- The Court of Appeals affirmed the convictions, holding the trial court correctly denied Schwartz’s motion for judgment of acquittal.
- The court concluded a rational jury could find Schwartz knowingly accessed Intel’s system with the purpose of committing theft by taking confidential password information and depriving Intel of the exclusivity that gave the information value.
- The court held that unauthorized copying and cracking of the password file could constitute theft because Intel’s loss of exclusive control over the confidential password information was a cognizable deprivation.
- The court reversed and remanded the restitution order for reconsideration because the record did not adequately support the amount awarded or its connection to compensable economic damages caused by the offenses.

## Legal Principles

- Under ORS 164.377, the “purpose of committing theft” element may be satisfied where the intended object is intangible computer-related information, including confidential passwords and password files.
- “Property” for theft analysis may include intangible interests; an owner’s exclusive control over confidential security information can be a protected property interest.
- Theft in the computer-information context does not necessarily require physical removal or that the owner be unable to continue using the information; compromising exclusivity and functional security value can constitute a sufficient deprivation.
- Restitution requires proof of compensable economic damages and a demonstrated causal link between the criminal conduct and the claimed loss; insufficient evidentiary support warrants reversal and remand of the restitution award.

## Conclusion

The court upheld computer-crime convictions where the defendant copied and cracked a confidential password file, reasoning that the resulting loss of Intel’s exclusive control over password information could constitute theft even without physical dispossession, but it reversed and remanded restitution because the record did not adequately establish recoverable economic damages and causation.


State v. Schwartz, 173 Or. App. 301, 21 P.3d 1128 (Or. Ct. App. 2001)