Fired software developer gets 4 years in prison for sabotaging company’s systems

A former software developer at a global power management company, Eaton Corporation, was sentenced Thursday to four years in federal prison and three years of supervised release for sabotaging his employer’s systems.

David Lu, 55, a Chinese national, was convicted in March of causing intentional damage to protected computers, according to the US Justice Department.

He initially worked as a software developer for Eaton Corp from November 2007 to October 2019. In 2018, his access to internal systems and work responsibilities were reduced, after which Lu started sabotaging his employer’s systems.

The conversation on this topic is live. Join in the discussion.

He developed “infinite loops” that would result in constant system crashes, deleted colleague profile files, and implemented a kill switch, meaning that all users would be locked out of the system if his credentials were ever disabled.

Lu named the kill switch “IsDLEnabledinAD”, abbreviating “Is Davis Lu enabled in Active Directory”, and it was automatically implemented when Eaton Corp laid him off on September 9th.

On the day when he was meant to return his laptop, Lu deleted encrypted data. His search history, however, revealed that he was looking up ways to escalate privileges, hide processes, and rapidly delete files, suggesting that he was exploring how to prevent his co-workers from restoring access.

According to the Justice Department, Lu’s employer suffered hundreds of thousands of dollars in losses as a result of his actions..

“The defendant breached his employer’s trust by using his access and technical knowledge to sabotage company networks, wreaking havoc and causing hundreds of thousands of dollars in losses for a U.S. company,” said Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division.

The charge carries a maximum sentence of 10 years in prison — Lu’s attorney, Peter Zeidenberg, asked for less than two years, while the prosecutors requested over five years.