on one hand simple and on another hand complex computer intrusion case involved six counts three of computer intrusion three were dismissed on t testimony was presented at all mr landon was convicted largely on the basis of circumstantial evidence government's theory was that he was the only one who had the knowledge and passwords to have completed the intrusions and the defense theory was that a former employee of his c from hatfield who worked for one of the companies which suffered an intrusion had a list of all his passwords and had the knowledge to conduct the intrusion and make it appear that mr landon had done it instead  the investigation reached something of a dead end neither mr lanham nor mr hatfield's computers were ever examined by the f b i to see if one of them had conducted the intrusions they were would have been preserved or examined on which evidence of the source of the intrusions would have been present well the machines were either not preserved or examined at all or were simply  restarted and put back into use so the logging information would have been destroyed the issue here as to do with ineffective assistance of counsel it does sufficiency that is correct and i guess two somewhat up my position is that defense counsel didn't listen closely enough to his client about the sources of the bug the sorts of details regarding the devices and what it would have taken to do the intrusions and because he didn't listen closely enough he missed the opportunity to be present to present evidence which could have raised a reasonable doubt that may have an expert that was retained he did have an expert who was retained to remotely was in california i believe and he examined the f b i report and examined one of the machines in question to see if he could find anything there and he didn't he wasn't asked to search for example with the slack space on the computer to see whether there were evident evidence on that device which the f b i had not identified or located when you say one of the computers does that mean  computers or moment mr hatfield's no neither the only computers that were examined belonged here if memory serves were devices that belonged to air source one which was the site through which the intrusion was done at total mortgage dean eggs dean is the expert correct us he examined the computer at air source examined a clone of the air source one computer he didn't look at the slack  space and so you're saying the clone would not have picked up the well the clone might have but he simply didn't look at it we had an expert take a look at that and he didn't find the intruder's ip address on that device but he found some intrusions by the administrator which was unusual and was not brought up at court and suggested somebody had done that to remove the a security breach he found the op that the same time  remote access was enabled on the air source one computer so that a number of different people could access the device but basically these are other potential evidence that might have been favorable to the defense that might have been found through greater efforts is that a fair summary of that evidence you're talking about yes it is if he found from mr kelly phone for example  before the intrusions which were the subject of the case somebody kelly is your expert now on hey b s is that it's correct he found that there was an attempted intrusion two weeks before and that the intruder at that time used both the clam account k lanham being short for my client's name as well as the administrators account that was not brought up at trial nor discovered by the f b i apparently ok but so then the the ineffective assistance of counsel standard here has got to got to be not just that this is less than some other better lawyer might have done but it has to be enough to fall below  standard of reasonable representation so what would you point to because what you said at the first blush is additionally sophisticated but some things were in fact done so what would you point to to give us a the question becomes one of whether there was whether the further efforts would have resulted in one juror finding a reasonable doubt are you saying that mr dean expert no i'm saying that defense counsel didn't do enough and he didn't listen to his client closely enough that if you review that i don't have time to detail it all but one reviews the testimony that was taken at that several portions of the evidence rehearing both by mr landover and mr wise mr wise conceded there were a number of things that his client raised with him when he simply didn't do it and he said by that because of the passage of time by the last hearing he could not recall precisely what his process was back at the time of trial the counsel the citation you have to remove him is quotes language about all it would have taken is one juror to have struck a different balance between competing stories but it's not clear at least to me and in reading this that that they're relying there on  on any decision that was made or as to prejudice if already a deficient  exercise has been undertaken because if the standard was broad as you state it then anything that would not have been wholly superfluous would be ineffective assistance well i don't think i'm arguing for that broad standard and what i'd like to return to is the simple point that when you read the transcript of what mr lanham said he discussed with his lawyer and most of what mr wise mr wise just simply wasn't able to explain why he did it hadn't taken the additional investigative steps his client suggested for example mr lanham said that a trainee of his who was working with him around the time of the intrusions philip to ground might be a potential alibi witness and grant the grand was never interviewed until after the trial of the case and we asked him to look and see if he could had any way of to finding out determining if he was working with lanham of the time of the intrusions and it turned out he had time sheets which suggested they were both looking at the same computer at the time of two of the intrusions or one of them was discovered for weeks after the trial is over that's correct are several council never asked never contacted the grand after the trial lanham asked him is there any way you can information wise told him i'll contact him not you why didn't contact him and then after the trial to grant phone time sheets which would have tended to establish an alibi or at least that was not  lanham the first intrusion on march first lasted twenty minutes the grand was said he was working being trained by lanham and they were both staring at the same computer screen he sort of popped up a separate remote access screen i would have noticed that and i didn't see any such thing in those several hours for is this what the timing was correct me if i'm wrong as i understood it even when lanham contacted to grand degree and didn't say oh i've got time sheets to write down them several weeks after that contact is that correct that's correct he went it well looking for something else he came across some other financial records he came across them which he didn't find he didn't find the first search of that even if at least on its face even if ys had made the same kind of contact there's no no indication or assurance that he would have randomly found them i don't know  i see i've got don't have much time left i would like to touch just very quickly on restitution restitution was ordered for devices at total mortgage which were either unnecessary or never purchased and i note that the trial court did not while it examined the restitution issue on remained did not address my objections precisely there was seven thousand dollars spent to reload  the system and our position on that will was that was unnecessary that was not an expense that was related to the intrusion because the viruses that they were reloading the system to eliminate preexisted and were recurring for several years prior to the intrusion that's basically two separate amounts that you're challenging one for the new computers and one for the reload value right i think yes exactly we can we can look at that if you want to save your rebuttal time thank you very much that afternoon may please court my name is graham teal and i represent the government here today if i may i'd just like to respond to a couple of items that were brought up that was brought up during mr minix presentation  starting with restitution in reverse order here there was discussion of this cisco router the acquisition i think of the warranty which had not which total mortgage did not have prior to the intrusion in order for them to have the router worked on after the intrusion they had to buy the warranty it was cisco's policy that they would not come in and work with a router that did not have that warranty so lanham had actually installed this router initially after the intrusion occurred and in order to have it fixed they had to acquire that warranty those facts were brought up at court  i agree with those decisions but they they do exist and are those cases where the issue was raised on direct appeal and then raised again on hey b s i don't know the answer to that there was  some testimony regarding some argument regarding reloading the system because of preexisting viruses the f b i agent in this case was pretty unusual he was an expert himself he had a masters degree in computer science and testified that yes there were preexisting viruses however the damages that were incurred after the fire wall was disabled were the viruses that cause the costs regarding the proof trial we also heard mr minnick address the issue of his expert when i first read mr minix brief it had been some time before since i had thought about the trial and he's  he's an articulate author and i read that brief and said we're in trouble i can't believe we didn't go through a whole these things and when i reviewed in fact the record they had all been gone into all the damages that were brought up had source the passwords well that testimony was introduced to kirk lanham change those passwords three weeks prior to the intrusion he was the network administrator for air source supplies system  said there was r d p or remote access created on the air source system that was testimony to that effect as well kirk lam were created the remote access for him and paul staples a rather  naive user if you will and owner of the source the system let's see if the panel had any other questions i'd be glad to answer them but i would submit to the panel that all of the damages that have been complained about all the lack of testimony about these damage of was in fact introduce that goes to the money part but as far as the ineffective assistance where his complaint is i take it that mr kelly his current expert was able to come up with with arguments at least potentially evidence but at least arguments that would have been helpful that mr dean did as i said the password so that mr kelly talked about being changed there was testimony about that prior during the trial what had happened is that the logging on air source suppl system had been disabled that ended the tracing backwards to find out who had who had initially intruded and the fact that the logging was disabled as to when and how that happened are you saying that was known and introduced at trial the fact that it was disabled was introduced to trial there was no evidence introduced as i recall as to when it was disabled  if they found the answers to that since the trial no they have not it ends of any it ends any inquiry beyond that so they're sourced systems computers were accessed remotely and because the systems logging was disabled we can't determine what happened prior to that or the next link if you will the circumstantial issue  evidence a trial was compelling however sat down at a computer screen for a day and could tell us during that entire time mr lamb did not commit a ten minute and an eight minute intrusion which in effect could sir very easily done so i don't think that that testimony was very damaging to the government's case even if it had been introduced secondly i don't think there was any prejudice at the trial because as a panelist pointed out this information was not obtainable during the trial that would be my response to mr much time expired between th that the defendant lie and i'm told his lawyer about this witness who could have been going back through all the records your honor it's my understanding that mr graham was asked at or about the time of the trial to find these records and was on the able to do so and it was only and it wasn't until the twenty two fifty five proceeding that this information became available or shortly before the twenty two fifty five proceeding what several months or so yes that's my understand where would we find that time line that is are there affidavits or or depositions or i don't think it's in the record ok we will see what you leisure yes mr de grande and mr landon both testified about this at the one of the last evidentiary hearing is one of the later evidence or earrings and testimonies in the record as the twenty to fifty five yes  day and specially with that my notes indicate that the first intrusion was twenty minutes and twenty minutes sort of three hours i think i could argue to a jury would have been very notable but was on the computer that he was training to grant to use to grandstanding over a shoulder or seated next to him watching the same screen as lanham instructed to him what commands had to be given to make the computer the device function the logging disabled at the air source one machine or two machines in question one served as the route for the intruder there was another device called a linux server which serves as a firewall in it's stored would have stored all incoming traffic and the f b i simply didn't grab that machine and by the time of the twenty two fifty five that machine had been turned on and off and would no longer had the data it was one of cali's conclusions but it so the machine would never have been turned off and on before trial either or know what it would have been but but at the time that the f b i went out to the investigation if they had realized didn't grab the machine they would have had the interest but that's a that's a government failure which could be attacked i suppose yes but it's not affirmatively that they didn't take some opportunity to get it no we just didn't understand finally with regard to restitution i think it's still alive in the procedural history of this case it's complex the district judge promised me a restitution hearing at sentencing he issued the judgment several hours later in error it included the restitution amount we wound up appealing in the middle of the twenty two fifty five to this court on an unrelated issue you were remanded it back to him when he got the case restitution hearing on the merits in his opinion nine to twenty two fifty five and he granted a certificate of appeal ability on everything i raised so i think the issues right despite the procedural curiosity cited couple cases in my brief for the proposition that a difference between an oral pronouncement of sentence and the judgment of sentence case in the case of that where there's a variance the oral pronouncement controls and judge cohen said he intended to hold wit unusual procedural posture he's saying from that that he didn't make an oral pronouncement of the restitution amount that is correct he said he was reserving it for a hearing but that hearing didn't happen until we did the twenty zero you're  saying that effectively the restitution part of the twenty to fifty five was kind of a known pro tunc of the direct sentencing yes because the same issues were involved it would have been seemed somewhat foolish to shift gears and heard all the testimony about losses now we're going to reprint the testimony in the restitution hearing i mean and i don't think there never occurred to me that there would be a problem he addressed it and he said he was going to address what he had rested a grant of his certificate of appeal ability on it so another way of looking at it would be that the restitution hearing that did happen as part of the twenty to fifty five you could say that procedur