Guilty! Network manager destroyed his own network

By Sharon Gaudin
Network World, 05/09/00

Despite observers' concerns that wading through technical details - such as programming code - might derail the jury charged with deciding the first federal prosecution of computer sabotage, jurors yesterday said that the technology was actually the key to their decision.

The jury found Tim Lloyd, 37, of Wilmington, Delaware, guilty in Newark District Court of setting a software time bomb that crippled his former employer's manufacturing capabilities and cost the firm more than $12 million in damages. He was acquitted on a second charge of interstate transportation of stolen goods. Both charges were connected with a 1996 crime that cost Omega Engineering, a Stamford, Conn. high-tech measurement and instrumentation manufacturer, more than $10 million, derailed its corporate growth strategy and eventually led to the layoff of 80 workers.

Lloyd, who faces as much as five years in federal prison, is slated for sentencing on July 31, four years to the day after Omega's file server crashed, destroying the programs that ran the company's manufacturing machines.

His lawyer, Edward Crisonino of Westmont, N.J., said the issue is not over and he will be filing an appeal after the sentencing.

"The technology was the reason the government was able to prove its case," one juror said. "It would have been more difficult to prove the case if not for the programming... The technology was not confusing. Several members of the jury write code. They understand technology."

Assistant U.S. Attorney V. Grady O'Malley, who prosecuted the case, said the level of a jury's technical savvy would have to be factored into any computer crime case.

"It tells you that technology is creeping into the courtroom," O'Malley said after the verdict came in. "Clearly, this was a test run."

Industry analysts have noted throughout the trial that the jury would have to grapple with what is a relatively new phenomena for the court system - technology, even lines of code, as evidence.

"They don't have a smoking gun. They don't have 10 pounds of drugs to look at and touch," said Richard Power, editorial director of the San Francisco Computer Security Institute. "This is a whole new arena. This is going to be a good way look at the use of tech, data and code, as evidence."

Ken VanWyk, corporate vice president and chief technology officer of Alexandria, Va., ParaProtect, a computer security portal, said this case could very well set a precedent for how computer security crimes are handled.

"You're looking at a lot of damage here," VanWyk said. "The company has been greatly damaged. How easy is it to track down digital evidence? How easy is it to find the culprit following a digital trail? How easy is it to make a jury understand the technology? These are all questions that will be answered."

The government's case centered around the assertion that before Lloyd was fired from Omega, he left a six-line string of code on the plant's centralized file server. The code was a time bomb designed to go off the first time anyone logged onto the server, which was running Novell's NetWare V3.12 operating system, after July 30, 1996. On the morning of July 31 every manufacturing program, along with the code generators, was destroyed since the time bomb not only deleted them but then purged them, as well.

The government said Lloyd was planning on leaving Omega months before he was fired and had been planning the server crash to happen after he left - no matter how he went out the door.

Lloyd, the only employee at the company responsible for maintaining, securing and backing up the server, also made off with the only back-up tapes.

O'Malley argued for nine days that this is a case of a trusted, long-term employee who built the company's network and then began plotting to destroy it when he started losing his standing and respect at Omega. The system crashed and eradicated all of the programs that ran the company's manufacturing machines three weeks after Lloyd was fired.

In the time it takes to boot up a server, the manufacturing company was no longer able to manufacture.

"I have never seen this massive a deletion in my 10 years of experience," said Greg A. Olson, expert witness for the prosecution and director of Minnesota OnTrack's World Wide Data Recovery Services. "This was intentional."

Executives from Omega, testifying during the trial, said the company spent $2 million on reprogramming alone. They also calculated that the company lost about $10 million in other expenses and missed sales.

"We will never recover," said Jim Ferguson, plant manager of Omega South, the company's Bridgeport facility, during his testimony in the trial.

Crisonino, Lloyd's attorney, maintains that Lloyd is the victim of a large-scale frame up. He said Omega executives are trying to divert attention from the fact that the company left its network, and the programs that fueled its manufacturing, unsupervised, unprotected and unmaintained.

Crisonino, in his closing last week, told the jury he doesn't know what happened to the file server but that it could have been a myriad of problems from a simple accidental crash to a hacker planting a virus.

Lloyd, who was with Omega for 11 years until he was fired on July 10, 1996, was the computer system manager in Omega's Bridgeport, N.J. manufacturing plant, which was responsible for building the company's products, along with handling product customization work. Omega, at the time, built 25,000 products, with that number jumping to 500,000 including customizations. The programs on the centralized file server housed the programs and code generators for all of them.