Blue Lance InfoSec Blog

Bristol-Myers-Squibb Employee Charged for Stealing More Than 1300 Documents

The FBI has charged a former Bristol-Myers-Squibb employee with stealing trade secret and proprietary information.  Shalin Jhaveri faces up to 10 years in prison and a $250,000 fine if convicted.

Jhaveri, who was employed by Bristol-Myers-Squibb from November 2007 until his termination on February 2, 2010, allegedly downloaded more than 1300 documents containing confidential and proprietary information with the intent of starting a bio-pharmaceutical business in India.

Jhaveri is currently being held without bail pending a detention hearing.

Source:  Federal Bureau of Investigation

More information from Reuters

Two Former Employees Charged With Computer Intrusion Using Old Credentials

The U.S. Attorney's Office in Indianapolis filed computer intrusion charges on Wednesday against two former employees of Indiana-based Stens Corporation.

Scott R. Burgess and Walter D. Puckett allegedly accessed Stens Corporation computer systems on approximately 12 different occasions from several locations while working for a business competitor.

According to The Register,

"Although the men left their jobs in 2004 and early 2005, they were able to use the outdated passwords successfully as late as September of 2006. On at least two occasions, administrators at Stens grew suspicious and terminated old passwords. The men simply tried different login credentials - and succeeded several times."

It's unclear from the information available what was being accessed and with what accounts, but I suspect someone will have to answer for the lax security policies employed at Stens.  Access to information assets two years after separation, and the ability to guess passwords indicates that if a security policy exists, it's only in document form with no real enforcement.

It's not the first case of an organization failing to disable or remove accounts of employees who have left the fold, and it certainly won't be the last.  How thorough is your organization in enforcing its security policies?

Sources:

FBI Indianapolis Office
The Register

Ex-Ford Employee Charged with Stealing Trade Secrets

From the Detroit Field Office of the FBI:

A federal indictment was unsealed late yesterday in Detroit charging Xiang Dong Yu, aka Mike Yu, 47, of Beijing, China, with theft of trade secrets, attempted theft of trade secrets and unauthorized access to a protected computer, announced Terrence Berg, U.S. Attorney for the Eastern District of Michigan. Yu was arrested on Oct. 14, 2009 at the Chicago O’Hare International Airport upon entering the United States from China. Berg was joined in the announcement by Andrew G. Arena, Special Agent in Charge of the FBI.

According to the indictment, Yu was a Product Engineer for the Ford Motor Company from 1997 to 2007 and had access to Ford trade secrets, including Ford design documents. In December 2006, Yu accepted a job at the China branch of a U.S. company. The indictment alleges that on the eve of his departure from Ford and before he told Ford of his new job, Yu copied some 4,000 Ford documents onto an external hard drive, including sensitive Ford design documents. Included in those documents were system design specifications for the Engine/Transmission Mounting Subsystem, Electrical Distribution system, Electric Power Supply, Electrical Subsystem and Generic Body Module, among others. Ford has spent millions of dollars and decades on research, development and testing to develop and continuously improve the design specifications set forth in these documents. The indictment also alleges that Yu took Ford design documents to China in July 2005 in conjunction with his efforts to obtain employment with a Chinese automotive company. Lastly, the indictment alleges that Yu used stolen Ford documents in an effort to secure employment with a Chinese automotive company in 2008.

U.S. Attorney Terrence Berg said, “Protecting the competitive edge technology of our companies through vigorous enforcement of our federal trade secret laws is a top priority of this office. Both employees and employers should be aware that stealing proprietary trade secrets to gain an economic advantage is a serious federal offense that will be prosecuted aggressively.”

Special Agent Arena stated, “Michigan, as well as the rest of the United States, is significantly impacted by the auto industry. Theft of trade secrets is a threat to national security and investigating allegations involving theft of trade secrets is a priority for the FBI. The FBI will continue to aggressively pursue these cases.”

Yu remains in federal custody in Chicago where he is scheduled to have a detention hearing on Tuesday, Oct. 20, 2009 at 1:00 p.m. CST.

Each of the theft and attempted theft of trade secrets counts carries a maximum penalty of 10 years in prison and a $250,000 fine. The count charging unauthorized access to a protected computer carries a maximum penalty of five years in prison and a $250,000 fine.

An indictment is only a charge and is not evidence of guilt. A defendant is entitled to a fair trial in which it will be the government’s burden to prove guilt beyond a reasonable doubt.

The indictment is a result of an investigation conducted by the FBI. This case is being prosecuted by Assistant U.S. Attorney Cathleen Corken.

Insider Inmate Hacks Prison Computers

Francis G. Janosko, a former inmate of Plymouth County Correctional Facility, pled guilty in federal court today to charges of intentionally damaging the prison’s computer network during his incarceration. 

From 2006 to 2007, Janosko and other inmates had access to a restricted computer supplied to allow the inmates to research legal matters.  Janosko hacked the computer network to send e-mail; provide inmates access to a report that listed the names, dates of birth, Social Security numbers, home addresses and telephone numbers, and past employment history of over 1,100 current and former Plymouth County Correctional Facility personnel and applicants; and access (without success) to an important prison management computer program.

Sentencing is scheduled for December 15, 2009. Under the terms of the plea agreement, both parties will recommend a sentence of incarceration for 18 months, to be followed by 3 years of supervised release, and restitution to Plymouth County in an amount yet to be determined. Janosko had been free following his release from the Plymouth County Correctional Facility, but has been incarcerated since he was arrested again in November 2008.

Former United Way Employee Indicted for Deleting Donor Files

Former United Way of Miami-Dade (UWMD) computer specialist Luis Robert Altamarino was indicted Tuesday for a network attack which included deleting files from United Way's servers including donor contact information.  In addition, Altamarino also allegedly disabled the UWMD voicemail system, preventing access to the system by callers and employees.

Altamarino was employed by UWMD from July to December 2007, but still apparently had access to the network a year after his employment had been terminated. 

More information is available from the press release.

Philips Lumileds Ex-Employee Sentenced for Stealing Trade Secrets

Robert Scott West was sentenced last week to 10 months home confinement, ordered to pay $100,000 in restitution to Philips Lumileds Lighting Company, and $5,000 in fines.

West, 21, of Morgan Hill, CA, pled guilty in federal court in San Jose on March 9^th to one count of Possession of Stolen Trade Secrets in violation of 18 U.S.C. § 1832( a )( 3 ).

In February 2008, several months after resigning from his position as a senior product manager at Philips Lumileds to work for a competitor, West was found in possession of the architecture and product specifications for Philips Lumileds’ next generation of Luxeon Rebel surface mountable power LEDs.  According to the plea agreement, West had downloaded and copied the information before resigning from Philips. He intended to use the information to benefit himself and harm Philips.

Before pleading guilty, West met with representatives from Philips Lumileds and the government, and agreed to assist in accounting for all the copies of the confidential and proprietary information that he had made.

Philips Lumileds Lighting Company is a San Jose, CA company that designs and manufactures light emitting diodes, which may be used for computer displays, liquid crystal display televisions and general lighting. One of the company’s primary products was the Luxeon Rebel line of LED’s.

The maximum statutory penalty for each count of possession of stolen trade secrets in violation of U.S.C. § 1832( a )( 3 ) is 10 years imprisonment, 3 years of supervised release, and a fine of $250,000

Hanley Chew is the Assistant U.S. Attorney who prosecuted the case with the assistance of Lauri Gomez. The prosecution is the result of an investigation by the Federal Bureau of Investigations. The investigation was overseen by the Computer Hacking and Intellectual Property Unit of the U.S. Attorney’s Office. Philips Lumileds cooperated with the investigation.

View the full press release

Terminated Employee Disrupts Texas Power Company Operations

Wired.com reported on May 29th that a former employee of Energy Future Holdings, a Dallas-based energy corporation that operates the Comanche Peak nuclear power plant, allegedly logged on to the corporate network after his termination and emailed, modified, and deleted files containing proprietary information, resulting in an estimated $26,000 loss for the company.

According to the article,

“No charges have apparently been filed, but the FBI is treating the case as a suspected violation of federal computer crime laws, including a rarely-used statute prohibiting breaking into a computer and creating ‘a threat to public health or safety.’

“But the damage noted in the affidavit appears to be purely financial. One of the files that was tampered with, ‘Hourly Capacity Supplied — 2009 upload.xls,’ is described as an ‘input file to determine the power generation required by the RFH system components.’ The net result of the tampering was that ‘the EFH management system was rendered inoperable, resulting in EFH being unable to accurately forecast the parameters necessary to operate the business on March 4, 2009.’”

The ex-employee, Dong Chul Shin, had access to more than just the file system:

While at EFH, Smith notes, “Shin was responsible for programming the models which controlled the management of EFH power generation facilities, including Comanche Peak.”

Hopefully, the FBI investigation will provide enough evidence to result in a charge against the individual responsible, but the underlying issue here is why employees continue to have access to critical assets after their termination. 

This is a common theme in recent insider theft and sabotage cases that should serve as a warning to all organizations to review their termination policies.  The termination of one or more employees requires a coordinated effort between departments to ensure the removal of physical and electronic access to organizational assets.  It makes no sense to terminate an employee, escort him/her from the building only to leave VPN access and login credentials intact. 

At best, it's a costly oversight but nonetheless, it is a process failure and requires an internal review of termination procedures at EFH. 

And while they're at it, they can consider themselves lucky this wasn't worse.

Read the entire article here.

Texas Lottery Employee Arrested After Stealing Personal Data

The Austin American-Statesman reported last week that 39-year-old Joseph Anthony Mueggenborg of Austin was arrested in connection with the 2007 theft of the personal details of more than 27,000 lottery winners, employees and retailers.

According to the paper,

According to a search warrant filed in September, an assortment of Lottery Commission files was discovered on Mueggenborg's state computer while he worked in the fiscal management division of the Texas comptroller's office.

They included "names, social security numbers, race/sex, home addresses, home telephone numbers, hire date, job titles" and other information on 619 lottery employees; names, addresses and amounts won and paid on 27,075 "mid-level Texas Lottery prizewinners"; and the names and Social Security numbers of 534 lottery retailers.

Read the entire article

KPMG Study Finds That Corporate Data Theft More Than Doubled Since 2006

A report released yesterday by KPMG and law firm Mishcon de Reya concludes that corporate data theft in the UK has more than doubled between 2006 and 2008. 

According to the press release:

"In the current uncertain times, the theft of business sensitive and confidential information by employees is a real threat to companies. With redundancies being made across all sectors in the UK along with rising job insecurity, more and more employees are using the confidential information they have obtained with their current employer in order to give them the edge in the increasingly difficult job market."

Key Findings

• In 93% of the cases, the theft was not discovered until after the employee had left the company.

• 70% of the time, the perpetrator was an employee who went to work for a competitor.

• In 75% of cases the stolen data customer or client-related information (relating to customer relationships, levels of trading, pricing information, profit margins and so on) or customer lists.

• 69% of cases involved males, or groups of males.

According to Hitesh Patel, partner in KPMG’s Forensic practice,

“These findings highlight the challenges of defining what data within your business should be considered proprietary and also when and why it may be construed as public information. Companies need to consider how vulnerable they are to this kind of misconduct by employees and ensure that they have everything in place to prevent or fight information theft.”

The report also suggests that measures be taken to not only prevent, but also respond to the theft of data to minimize losses, take legal action and recover the data quickly to prevent damage from its release.

The full report is available here.

Federal Reserve Employee Arrested for Using Stolen Identities to Get Loans

Curtis Wiltshire, a former information analyst for the Federal Reserve Bank of New York, and his brother Kenneth Wiltshire were arrested last week on charges related to a series of fraudulent loans obtained with employee data stolen from FRB-NY.

The theft was discovered in February 2009 when an FRB-NY investigator examined a USB flash drive found attached to Curtis Wiltshire's computer.  The investigator found application data from two student loans in the names of two individuals whose identities had been stolen, and a fraudulent driver's license with the photo of an FRB-NY employee.  The loans were obtained in 2006, with values totaling approximately $73,000.

Kenneth Wiltshire was discovered separately through an investigation into fraudulent loans which led them to Wiltshire's rented mailbox, which was opened using a fraudulent driver's license using the photo of another FRB-NY employee.  Stolen data had been used to obtain a boat loan, along with a fake income tax return in the name of the FRB-NY employee.

Curtis Wiltshire was charged with bank fraud, fraud accociated with identification documents and aggravated identity theft.  His brother Kenneth is charged with mail fraud and identity theft.

View the press release.