Blue Lance InfoSec Blog

Former Valspar Chemist Sentenced to 15 Months for Stealing up to $20 Million in Trade Secrets

David Yen Lee, a former technical director for Valspar, was sentenced this week to 15 months in prison for stealing an estimated $20 million in trade secrets after accepting a position with a competitor.  Lee pleaded guilty in September to charges that he used his credentials on Valspar's secure network to access and download data including chemical formulas, sales and cost data, product research and marketing data.

According to the Chicago Office of the FBI:

Lee admitted that between September 2008 and February 2009, he had negotiated employment with Nippon Paint, located in Shanghai, China. On Feb. 27, 2009, Lee accepted employment with Nippon as vice president of technology and administrator of research and development beginning on April 1, 2009, in Shanghai. Lee was scheduled to fly from Chicago to Shanghai on March 27, 2009. He did not inform Valspar that he had accepted a job at Nippon until he resigned on March 16, 2009.

At Valspar, Lee’s duties included scouting new paint technologies, coordinating with other paint laboratories, coordinating staffing and projects with Huarun Limited, a Valspar subsidiary located in China, and overseeing Valspar’s technical service group, which conducted experiments for paint coloring.

Between November 2008 and March 2009, Lee downloaded technical documents and materials belonging to Valspar, including the paint formula batch tickets. He further copied certain downloaded files to external thumb drives to store the data, knowing that he intended to use the confidential information belong to Valspar for his own benefit. The total value of the trade secret information Lee took was estimated at between $7 million and $20 million. There was no evidence that he actually disclosed any of the stolen trade secrets.

In addition, Lee has been ordered to pay $30,975 in restitution to cover the expenses of Valspar's internal investigation.

 

Read the press release

Former IT employee gets 18 month prison sentence for computer intrusion

According to a press release from the FBI's Tampa office, Patricia Marie Fowler, a former IT technician, received 18 months in prison and ordered to pay $17,243.01 in restitution.  Fowler, was employed at the Suncoast Community Health Centers (SCHC) in Ruskin, Florida, was found guilty in September of computer intrusions resulting in over $5,000 in damages to SCHC.

According to trial testimony, Fowler had been fired by SCHC on March 13, 2009, for insubordination and failing to follow the orders of her supervisors. On March 17, SCHC employees discovered that a computer intrusion had occurred and that damage had been done to the SCHC computer system. From March 17, 2009 through April 1, 2009 numerous unauthorized intrusions were made into the SCHC computer system which resulted in the deletion and movement of files from the computers of SCHC executives, changing of administrative account names and passwords, removing access to infrastructure systems, changing pay and accrued leave rates on the employee payroll system, and the compromise and lockout of the firewall used to secure the SCHC network.

In addition, Fowler will be placed on supervised release for 3 years after serving her sentence.

Read the full press release

Former employee pleads guilty to computer intrusion, deletion of files

The El Paso branch of the FBI last week announced the guilty plea of Ismael Alvarez, a former employee of Gray Wireline to charges of computer fraud for illegally accessing a company database and deleting several files.

...Alvarez admitted that on September 1, 2010, he illegally gained access to the computer system of Gray Wireline, Inc., and deleted approximately 68 files, including analysis reports on oil and natural gas wells in Odessa, Levelland, Denver City, and Andrews, Texas. As a result, Gray Wireline estimates that it had to spend approximately $16,000 to correct and remedy the damage caused by Alvarez.

Alvarez faces up to 10 years in federal prison.

Read the full press release

Ex-Ford employee pleads guilty to theft of trade secrets

According to the FBI's Detroit Office, Xiang Dong Yu, the former Ford employee charged with stealing trade secrets and fleeing to China, pleaded guilty yesterday to in federal court to two counts of theft of trade secrets.  Last October, Yu was arrested and indicted at Chicago O'Hare Airport, after arriving on a flight from China.

According to the plea agreement in this case, Yu was a product engineer for the Ford Motor Company from 1997 to 2007 and had access to Ford trade secrets, including Ford design documents. In December 2006, Yu accepted a job at the China branch of a U.S. company. On the eve of his departure from Ford and before he told Ford of his new job, Yu copied some 4,000 Ford documents onto an external hard drive, including sensitive Ford design documents. Included in those documents were system design specifications for the engine/transmission mounting subsystem, electrical distribution system, electric power supply, electrical subsystem and generic body module, among others. Ford spent millions of dollars and decades on research, development, and testing to develop and continuously improve the design specifications set forth in these documents. The majority of the design documents copied by the defendant did not relate to his work at Ford. On December 20, 2006, the defendant traveled to the location of his new employer in Shenzhen, China, taking the Ford trade secrets with him. On January 2, 2007, Yu e-mailed his Ford supervisor from China and informed him that he was leaving Ford’s employ.

As part of the plea agreement, Yu faces up to 78 months in prison and fines from 50-100 million dollars.  Yu is scheduled for sentencing on February 23, 2001.

Read the entire FBI press release

Former Army employee arrested while attempting to smuggle confidential documents to China

According to the FBI Minneapolis field office,

A former civilian employee at the U.S. Army Training and Doctrine Command at Fort Sill, Oklahoma, was taken into custody yesterday afternoon at the Minneapolis-St. Paul International Airport while attempting to board a flight to China. At the time of his attempted one-way flight to China, Liangtian Yang, age 26, also known as Alfred Yang, of Lawton, Oklahoma, allegedly had in his possession multiple media storage devices, one of which contained a restricted Army field manual. The manual was not authorized to be in his possession, nor was it authorized to be transferred to a personal computer disk.

Yang had his secret clearance revoked last month as a result of security violations.  The field manual was discovered by Customs officials during a secondary screening while awaiting his flight.  Yang faces a maximum penalty of one year in prison.

Full Press Release

Former Societe Generale employee charged with stealing trading source code

On Monday, the New York Field Division of the FBI announced the arrest of Samarth Agrawal, charged with theft of trade secrets for allegedly stealing proprietary computer code used in the high-frequency trading system of Societe Generale, his former employer.

Agrawal began working at Societe Generale in March 2007 as a quantitative analyst.  Shortly after being promoted to a trader position in April 2009, he obtained access to the code. 

In April 2009, AGRAWAL was promoted to the position of trader within the Company's High-Frequency Trading Group. On Friday, June 12, 2009, AGRAWAL obtained access to a unit of the Code ("Unit A") relating to the type of trading activity in which he was involved. However, AGRAWAL also was able to obtain access to a unit of the Code ("Unit B") with which he was not otherwise involved, and did not have permission to review.

After copying portions of the code into Microsoft Word documents, Agrawal printed hundreds of pages over a period from August to September 2009.  On at least one occasion, surveillance cameras captured Agrawal placing the documents into a backpack.

Likewise, on August 31, 2009, September 2, 2009, and September 11, 2009, AGRAWAL similarly printed out multiple portions of Unit B Code, also from Microsoft Word documents, which did not relate to the trading activity in which he was involved.

On November 12, 2009, his last day in the office, AGRAWAL deleted a folder on his personal network drive that contained the Code in its original format as well as the Code that had been gathered together in Microsoft Word documents. Starting on the next day, AGRAWAL took four sick days and was absent from the Company's New York offices. Subsequently, on November 17, 2009, AGRAWAL submitted a letter of resignation to his supervisor at the Company.

After AGRAWAL submitted his resignation, one of his supervisors spoke to him in an effort to convince him to stay at the Company. Among other things, the supervisor reminded AGRAWAL of his promotion to trader and told him that if he stayed his 2010 bonus would be "many multiples" of his 2009 bonus, which had been $130,000. AGRAWAL, in declining the offer, told the supervisor, among other things, that he eventually wished to return to his native country of India to set up his own high-frequency trading firm. AGRAWAL was later contacted by an FBI agent, who was acting in an undercover capacity, and advised the agent that he had been interviewing with "most of the big names" among New York financial firms.

Read the Press Release

Former NSA executive charged for theft and disclosure of classified information

The U.S. Department of Justice announced a 10-count indictment charging Thomas Drake, a former National Security Agency senior executive with willfully retaining classified information, obstruction of justice and making false statements.

Drake, who was employed at the NSA from 2001 to 2008, allegedly served as the confidential source of newspaper reporter for a series of articles published between February 2006 and November 2007.  During this time, Drake allegedly researched stories for the reporter, providing both classified and unclassified documents from the NSA's classified network, and reviewed and helped edit drafts of the reporter's articles.

According to the press release:

The indictment also alleges that Drake took a series of steps to facilitate the provision of this information to the reporter, including:

• exchanging hundreds of e-mails with and meeting with the reporter;
• researching stories for the reporter to write in the future by e-mailing unwitting NSA employees and accessing classified and unclassified documents on classified NSA networks;
• copying and pasting classified and unclassified information from NSA documents into untitled word processing documents which, when printed, had the classification markings removed;
• printing both classified and unclassified documents, bringing them to his home, and retaining them there without authority;
• scanning and emailing electronic copies of classified and unclassified documents to the reporter from his home computer; and
• reviewing, commenting on, and editing drafts of the reporter’s articles.

Drake is charged with five counts of willfully retaining documents that relate to the national defense, obstruction of justice, and four counts of making false statements to the FBI.  He faces a maximum penalty of 90 years in prison and $2.5 million in fines.

Read the full press release

Bank of America employee pleads guilty planting malware on 100 ATMs

According to Wired, Rodney Reed Caverly, a former Bank of America employee pleaded guilty last week to charges stemming from stealing $304,000 using malware he installed on 100 ATM machines over a period of seven months.

Caverly had been employed at Bank of America since 2007, where he worked as an application programmer. He faces up to five years in prison and a maximum fine of $250,000.

Read the Wired article

Employee indicted for attempting to corrupt TSA database

The FBI announced this week the indictment of Douglas James Duchak, former employee at the  TSA's Colorado Springs Operations Center (CSOC) on charges of attempting to intentionally damage a protected computer.  Duchak allegedly attempted to damage the TSA CSOC database which receives its screening data from the government's Terrorist Screening Database and the U.S. Marshal's Service Warrant Information Network. 

According to the indictment, Duchak was employed as a data analyst at the TSA CSOC from at least August 2004 through October 23, 2009, where he handled data updates from the federal government's Terrorist Screening Database and the United States Marshal's Service Warrant Information Network. Duchak received notice on October 15, 2009 that his employment at CSOC would be terminated on October 30, 2009.  

On October 22, 2009, Duchak allegedly attempted to install malicious code in an effort to damage the CSOC database.

Count one of the indictment alleges that on October 22, 2009, Duchak attempted intentionally to cause damage without authorization to a protected computer, namely, he knowingly transmitted code into the CSOC server containing data from the U.S. Marshal’s Service Warrant Information Network, and thereby intentionally attempted to cause damage to the CSOC computer and database.

Count two of the indictment alleges that on October 23, 2009, Duchak attempted intentionally to cause damage without authorization to a protected computer, namely, he knowingly transmitted code into the CSOC server that contained the Terrorist Screening Database, and thereby attempted intentionally to cause damage to the CSOC computer and database.

The indictment alleges that the defendant attempted intentionally to cause damage without authorization to the CSOC computers, which caused loss aggregating at least $5,000 or more during a one-year period and if completed would have caused damage affecting a computer used by the United States government in furtherance of national security.

Duchak faces up to 10 years in federal prison and $250,000 in fines.

Source:  Denver Branch of the FBI

West Memphis Police Officer Terminated, Under Investigation for Accessing Employee Personal Info

WMC-TV in West Memphis reports that an FBI investigation is underway of a West Memphis police officer suspected of accessing the personal information of other officers.  The suspect, an unnamed detective in the police department, has been terminated.

From the report:

According to Paudert, files containing the names and social security numbers of police department employees were stored on the computer network, making the employees vulnerable to identity theft.

"It's very disturbing to us that someone, first of all, would do that, and secondly, what it would do to the employees that work here," Paudert said.

To date, it is unclear how the detective was able to access the files via a hack or a lapse in network security, and whether or not any other files were affected.  West Memphis Police Department employees have been notified and asked to monitor their credit reports for irregularities.