This week's testimony by two Harvard computer workers before the federal grand jury investigating the "Cornell virus" is key to an indictment because, unlike in other criminal cases, prosecutors of computer crime must rely on circumstantial evidence to show guilt, experts on computer law said this week.

In addition, these experts said that the relevant legal codes in the virus investigation are an untested agglomeration of brand-new statutes and old legislation recently given high-tech applications. They said that even if the prosecution could prove one person knowingly created the virus, it may not be able to show that making the rogue program--which jammed thousands of terminals across the country--violated federal law.

The "Cornell virus" infected the Arpanet network, which links 60,000 computer systems nationwide including those of the defense Department and research institutions, on November 2. Experts estimate that clean-up costs related to the program--which did not destroy any computer information--reached $2 million for down-time spent weeding the program out of the stalled systems.

From the start, the man believed responsible for the unprecedentedly successful--and costly--rogue program is Robert T. Morris, Jr., '83-'85, a Dunster House alumnus and Cornell graduate student. Morris, who is affectionately known as "RTM" by his friends at Aiken Computation Laboratories, immediately drew Harvard into the virus vortex by calling Aiken's Andrew H. Sudduth '83-'85 and computer science graduate student Paul Graham the night the renegade program began to spread.

Sudduth and Graham testified Wednesday before the Syracuse, N.Y. grand jury, answering questions about Morris and their late-night talk with him on Virus Night, November 2.

The examination consisted "more of a general fact-finding type of thing," rather than targeted questions, Sudduth said.

Graham could not be reached for comment yesterday.

Asked whether Morris mentioned the word "virus" in their conversations, Sudduth said, "I can't recall exactly whether he did or not."

Technically, though, Morris' creation was not a virus, but a `worm,' a less dangerous program that reproduces itself and slows down the host system, but does not hurt the data.

This kind of general testimony is vital to establishing whether Morris was capable of creating the virus and intended for it to cause the damage, experts said.

Morris' intent and the wording of federal laws form the basis for a "two-pronged" question surrounding computer crime.

"It's a two-pronged test [for federal prosecutors]," said Florida state attorney John A. Frusciante, "[They must prove] what the man did, and what does that violate." Frusciante, who has prosecuted several Florida computer crime cases, is the chair of the American Bar Association's computer crime committee under its science and technology section.

Morris' legal fate depends on the interpretation of a handful of newly enacted or applied federal laws, Frusciante said. These laws--especially the Computer Fraud and Abuse Act of 1984, a statute prohibiting unauthorized access to stored computer records and a longstanding wire fraud act--represents the federal government's frontline against a new technological crimes.

But Morris' lawyer and federal authorities have acknowledged that it may not be clear whether--even if Morris created the virus--he violated any of these laws.

"If it appears that he's done what he's done--he's put the virus into the machine--the question is does that constitute the violation of a criminal offense?" Frusciante said. "If it does, how are we going to prove that?"