Blue Lance InfoSec Blog

Former Army employee arrested while attempting to smuggle confidential documents to China

According to the FBI Minneapolis field office,

A former civilian employee at the U.S. Army Training and Doctrine Command at Fort Sill, Oklahoma, was taken into custody yesterday afternoon at the Minneapolis-St. Paul International Airport while attempting to board a flight to China. At the time of his attempted one-way flight to China, Liangtian Yang, age 26, also known as Alfred Yang, of Lawton, Oklahoma, allegedly had in his possession multiple media storage devices, one of which contained a restricted Army field manual. The manual was not authorized to be in his possession, nor was it authorized to be transferred to a personal computer disk.

Yang had his secret clearance revoked last month as a result of security violations.  The field manual was discovered by Customs officials during a secondary screening while awaiting his flight.  Yang faces a maximum penalty of one year in prison.

Full Press Release

Ex-General Motors employee charged in $40M theft of trade secrets

The FBI has released details of a federal indictment of a couple charged with conspiracy to possess trade secrets without authorization, unauthorized possession of trade secrets, and wire fraud.  Shannon Du and Yu Chin are charged with stealing thousands of GM documents regarding to the company's hybrid technology worth an estimated 40 million dollars. 

According to the press release,

According to the indictment, from December 2003 and continuing through May 2006, the defendants conspired to possess trade secret information of General Motors Company relating to hybrid vehicles, knowing that the information had been stolen, converted, or obtained without authorization. The indictment alleges that Du, while employed with GM, provided GM trade secret information relating to hybrid vehicles to her husband, Qin, for his benefit and for the benefit of a company, Millennium Technology International Inc. (MTI), that the defendants owned and operated. Approximately five days after Du was offered a severance agreement by GM in January 2005, she copied thousands of GM documents, including trade secret documents, to an external computer hard drive used for MTI business. A few months later, Qin moved forward on a new business venture to provide hybrid vehicle technology to Chery Automobile, a Chinese automotive manufacturer based in China and a competitor of GM. The indictment further alleges that in May 2006, the defendants possessed GM trade secret information without authorization on several computer and electronic devices located in their residence.

Full press release

VA launches criminal investigation into employee for downloading patient data

Nextgov reports that the inspector general at the Veterans Affairs Department has launched an investigation into a physician assistant, who allegedly downloaded patient data.

The assistant allegedly recorded two sets of patient data on to a personal laptop for research purposes. One set included three years' worth of patient data and another held 18 years of medical information, according to a source familiar with the incident and who asked not to identified.

There are conflicting reports on how the data was obtained:

Roger Baker, VA's chief information officer, commented on an item about the incident that was posted Monday evening on a Nextgov blog that the physician assistant's laptop was never connected to the VA network and any data she recorded on her laptop was "hand entered."

But the source told Nextgov the VA inspector general is investigating whether the assistant used two thumb drives to transfer the data to the laptop.

No word on how many patients were involved or whether or not they would be contacted.  Hopefully, the VA's IT department has an detailed user audit trail to work with to shed some light on this incident. 

Sources: Nextgov, Open Security Foundation (OSF)

KPMG Study Finds That Corporate Data Theft More Than Doubled Since 2006

A report released yesterday by KPMG and law firm Mishcon de Reya concludes that corporate data theft in the UK has more than doubled between 2006 and 2008. 

According to the press release:

"In the current uncertain times, the theft of business sensitive and confidential information by employees is a real threat to companies. With redundancies being made across all sectors in the UK along with rising job insecurity, more and more employees are using the confidential information they have obtained with their current employer in order to give them the edge in the increasingly difficult job market."

Key Findings

• In 93% of the cases, the theft was not discovered until after the employee had left the company.

• 70% of the time, the perpetrator was an employee who went to work for a competitor.

• In 75% of cases the stolen data customer or client-related information (relating to customer relationships, levels of trading, pricing information, profit margins and so on) or customer lists.

• 69% of cases involved males, or groups of males.

According to Hitesh Patel, partner in KPMG’s Forensic practice,

“These findings highlight the challenges of defining what data within your business should be considered proprietary and also when and why it may be construed as public information. Companies need to consider how vulnerable they are to this kind of misconduct by employees and ensure that they have everything in place to prevent or fight information theft.”

The report also suggests that measures be taken to not only prevent, but also respond to the theft of data to minimize losses, take legal action and recover the data quickly to prevent damage from its release.

The full report is available here.

Did a State Agency Respond to their Privacy Breach with a Second Breach?

In what has to be one of the strangest data loss cases ever, the Oklahoma Employment Security Commission fails on the handling of a recent data loss incident.

The News-Star in Shawnee, Oklahoma reported last month on a data loss incident at the Oklahoma Employment Security Commission, where an employee lost a flash drive contain containing the Social Security numbers and payroll information of more than 5,500 Shawnee-area workers while attending a work-related conference in Dallas.

According to one business owner, the state agency sent the breach notification via registered mail, but failed to include the owner's name.  Okay, an oversight to be sure but it's just a breach notification, right? 

Here's where it gets interesting...

Kurt Kalies, an audiologist and owner of Shawnee-based Hearing Health Care, Inc., said he become upset with the OESC when the state agency sent a certified letter to his business but failed to address it specifically to him.  “I just can’t believe they would send out that information to no recipient in particular,” Kalies said. “There was Social Security numbers and payroll information for every employee at the company. I don’t think that seems right to me.”

So, in response to the initial privacy breach and data loss, OESC responds by creating a secondary breach by sending the same lost information through the mail without explicitly identifying a contact to receive such information. 

In addition, the breach notification named the employee responsible for losing the flash drive; even after the agency had deemed the loss as accidental.

According to John Carpenter, the OESC spokesman, the investigation was brief:

“I called the guy and talked to him and I believe that he probably just misplaced the flash drive and that it wasn’t done intentionally,” he said. “I thought it was pretty strange that his name was in the letter considering they [the OESC] were saying it was an accident.”

The OESC's inept handling of this breach including the investigation and the response, illustrates the need to have a response plan in place prior to a breach as well as security policies and tools that safeguard sensitive data. 

Here's the original article.

What do you think?  Leave a comment below.

Federal Reserve Employee Arrested for Using Stolen Identities to Get Loans

Curtis Wiltshire, a former information analyst for the Federal Reserve Bank of New York, and his brother Kenneth Wiltshire were arrested last week on charges related to a series of fraudulent loans obtained with employee data stolen from FRB-NY.

The theft was discovered in February 2009 when an FRB-NY investigator examined a USB flash drive found attached to Curtis Wiltshire's computer.  The investigator found application data from two student loans in the names of two individuals whose identities had been stolen, and a fraudulent driver's license with the photo of an FRB-NY employee.  The loans were obtained in 2006, with values totaling approximately $73,000.

Kenneth Wiltshire was discovered separately through an investigation into fraudulent loans which led them to Wiltshire's rented mailbox, which was opened using a fraudulent driver's license using the photo of another FRB-NY employee.  Stolen data had been used to obtain a boat loan, along with a fake income tax return in the name of the FRB-NY employee.

Curtis Wiltshire was charged with bank fraud, fraud accociated with identification documents and aggravated identity theft.  His brother Kenneth is charged with mail fraud and identity theft.

View the press release.

Employees Steal More Than 100,000 Files From Starwood Hotels

Starwood Hotels & Resorts announced it has filed a lawsuit against Hilton Hotels Corporation and senior executives Ross Klein, Global Head of Hilton Luxury & Lifestyle Brands and Amar Lalvani, Global Head of Hilton Luxury & Lifestyle Brand Development, who are former Starwood employees.  Klein, former President of the Starwood Luxury Brands Group and Lalvani, former Senior Vice President of Starwood Luxury Brands were recruited to Hilton in June 2008.

The suit alleges Klein and Lalvani, aided by Hilton, stole more than 100,000 electronic files including strategic development plans, financial information, negotiation strategies, marketing and operational materials.  The materials were all related to the development of Starwood's W® luxury brand, which Starwood had spend the last 10 years and tens of millions of dollars to develop.

The theft was discovered almost by accident.  According to the press release,

In November 2008, Starwood initiated arbitration with Klein over the non-solicitation provisions in his employment contract and separation agreement, and put Hilton on notice to preserve relevant information. Three months later, and just days before Hilton announced the launch of its new lifestyle brand, Starwood received from Hilton eight large boxes of hard copy documents as well as computer hard drives, zip drives, and thumb drives containing more than 100,000 electronic files downloaded from Starwood computers, much of it highly proprietary. It was at this point that Starwood first became aware of the theft.

After delivering the materials, Hilton notified Starwood that Klein and other former employees had brought the materials they had developed or acquired during their employment at Starwood and had additional materials at home.

Kenneth Siegel, Starwood’s Chief Administrative Officer and General Counsel, said: “The wholesale looting of proprietary Starwood information, including a step-by-step playbook for creating a lifestyle luxury hotel brand, unfairly enabled Hilton to launch a new brand in only nine months instead of the usual three to five years.”

Hilton issued the following statement on Tuesday:

Hilton Hotels Corporation today acknowledged receipt of a federal grand jury subpoena from the United States Attorney’s Office for the Southern District of New York requesting documents relating to Hilton's employment of former employees of Starwood Hotels & Resorts Worldwide, Inc. and materials which Hilton returned to Starwood in February of 2009.

On April 16, Starwood filed a civil complaint alleging its former employees, Ross Klein and Amar Lalvani, and Hilton, unlawfully obtained and used Starwood information. Hilton has placed Mr. Klein, Mr. Lalvani and their luxury and lifestyle team on paid administrative leave pending Hilton’s review of the situation. At this time, further development of the Denizen Hotels brand has been temporarily suspended.

This is another example of the massive financial damage malicious insiders can cause when user activity is left unmonitored.  Had Starwood been monitoring file and user activity, they would have been able to notify the authorities prior to the loss of the data to Hilton.