6 ms·
Developer sentenced to prison for activating “kill switch” to avenge his firing
- windowshopping 1y agoWell this seems pretty cut and dry.
- deleted 1y ago[deleted]
- JumpCrisscross 1y ago“A disgruntled developer has been sentenced to four years in prison after building a ‘kill switch’ that locked all users out of a US firm's network the moment that his name was deleted from the company directory following his termination.” Morality aside, that’s kind of hilarious.
- b_e_n_t_o_n 1y agoFour years feels like a long time for this...
- JumpCrisscross 1y agoIt was premeditated. It caused actual damage. He doesn’t appear to have done anything to stop it once is started. He gets points for style. But this is novel behaviour that has to be discouraged.
- happyopossum 1y ago> actual damage Damage is a funny word here. Yes - money was lost, but no building were destroyed, nor people physically harmed. “Actual damage” makes it sound like a lot more than lost time and a few extra contracts paid out.
- cmcaleer 1y agoMonetary damages are damages, I don't think this is particularly complicated. If I made it so you couldn't get several weeks of your wages for hours that you worked you would be rightly furious with me and feel like a victim.
- jkaplowitz 1y agoDamages in the sense that warrants compensation and likely additional punitive damages as deterrence, agreed. But monetary damages don’t seem sufficient to justify jail time in a society that likes to claim it doesn’t have debtor’s prisons. Yes, yes, criminal law and civil law are two different things and statutes can allow or require imprisonment in a criminal sentence. But we are discussing what is morally appropriate punishment for this misdeed, not what current law allows.
- rank0 1y agoThat’s an insane take. Financial damage isn’t a problem for you? What if someone targeted you personally or your business?
- praptak 1y agoI don't buy this equivalence of financial damage to a person with financial damage to a business. If I had a business its finances would be separate from my personal finance using limited liability, so even if someone destroyed 100% of its value, it would only be no return on investment for me - sad and bad but totally not equivalent to losing all my personal money.
- b_e_n_t_o_n 1y agoYeah I know, it just feels long for what is almost a victimless crime. I'm aware the company lost money and therefore the shareholders etc etc. I feel like 2 years would have made sense to me.
- School-Cotton 1y agoHow is this a victimless crime or even almost a victimless crime? I’m confused by your post — you say it’s “almost a victimless crime” and then immediately describe who was victimized and why. So what do you mean? Just that it didn’t involve physical violence?
- eviks 1y agoIt means that those are lesser categories of victims
- paulddraper 1y agoLength of sentence aside, your notion of victimless crime is wild. Mugging is “almost a victimless crime” by that standard. And this was significantly more victim-ful than that.
- gpvos 1y agoA company losing money is way less bad than a mugging.
- deleted 1y ago[deleted]
- deleted 1y ago[deleted]
- zonkerdonker 1y ago"Chinese national" feels like a pretty critical detail to this sentencing time.
- devjab 1y agoI'm not sure what is meant by supervised release but there is also three years of that after the initial four. He apparently also gets a permanent record as a felon, so I imagine it'll be hard for him to find new work. Without that, can he even have health insurance? He als can't vote in elections right? Sounds like his life is frankly going to be ruined. From a Danish perspective I think that this is rather cruel.
- jrockway 1y agoIt varies by state. In many states, felons can register to vote immediately after release (even while on parole) and aren't disqualified from programs like Medicaid. So it's not a death sentence despite what the system intends.
- Tostino 1y agoFlorida passed a ballot measure allowing felons to vote a few years back. Our legislature just ignored it and instituted other requirements and hoops for them to jump through that made like 90+% of them ineligible to vote still.
- zx8080 1y agoIt's just a punishment for being too foolish: if he scheduled it to switch some time after he's fired, that would be more funny to investigators and he would get less years. /s
- chaosbolt 1y agoIt is, there are rapists that get less prison than this.
- andrewflnr 1y agoWell, there are always two directions you can go to fix a double standard.
- MemesAndBooze 1y agohttps://en.m.wikipedia.org/wiki/Eaton_Corporation https://en.m.wikipedia.org/wiki/Eaton_Corporation
- balamatom 1y agoThis is like the archetype incarnate. >Ranked #4 in "100 Best Corporate Citizens" of Corporate Responsibility Magazine in 2013, also ranking in Top 50 for Six Consecutive Years. Fucking bozos!
- ReptileMan 1y agoThe article is pretty light on what exactly the charges were. Anyway he should have been slapped with a lot more monetary and probably less prison time.
- black_13 1y ago[dead]
- AtlasBarfed 1y agoShould have named it cryptolockDefender() and argued it was to protect against someone disabling his account to lock out the administrator.
- waltbosz 1y agoThe article says he named programs after himself but also that he tried to evade detection. How crazy would it be if he were framed.
- maxbond 1y agoReminds me of the Siemens contractor David Tinley, who programmed an Excel spreadsheet to deliberately break periodically so that they had to hire him to "fix" it. But then it happened while he was on vacation, and he was forced to explain to Siemens employees how to "fix" the spreadsheet. Tinley plead guilty and got 6 months. https://www.zdnet.com/article/siemens-contractor-pleads-guilty-to-planting-logic-bomb-in-company-spreadsheets/ https://www.zdnet.com/article/siemens-contractor-pleads-guil...
- encom 1y agoWho answers their work phone while on vacation? I don't even have mine turned on outside of working hours. What a rookie.
- maxbond 1y agoAnswering your phone is one thing, but not adding a critical date to your calendar!?
- pflenker 1y agoHe was a freelance contractor. Being available basically all the time is part of the job.
- esperent 1y agoI worked as a freelance contractor for years. Being available is not part of the job, in fact not having to be available at specific times, aside from occasional planned meetings, is one of the major perks of the job. If I was expected to be available all the time, you can be damned sure I would have expected to be paid by the hour for that.
- jajko 1y agoMost of us don't have work phones, that's stuff from early 2000s at best. Lugging around another brick just for work, no thank you. That being said, answering anything work related outside of work, unless they are your truly close friends is lame and considered a character weakness, to be abused. And don't expect any extra bonus points for that. Having a good private (aka actual) life you are willing to defend ain't a sign of weakness, in contrary.
- deleted 1y ago[deleted]
- pm90 1y agoThe bigger issue that nobody seems to have addressed is how a single developer could have a machine that only he had access to that could run this code with admin privileges over their ActiveDirectory. Eaton should immediately explain what kinds of safeguards it has instituted to prevent this from happening again. If I were the CEO I would be thanking this person to have revealed this kind of access control vulnerability.
- paulddraper 1y agoWhy do you think he had admin access to Active Directory? Regardless, it should be pretty obvious that if an attacker gains RCE, they can do a lot.
- gpvos 1y agoHe could prevent logins of other people. That means a rather high level of access.
- eurleif 1y agoYes, and this is especially concerning because Eaton makes IoT devices. Imagine the damage a disgruntled employee could do by deploying malicious code to devices on millions of consumers' networks. A company of this size, with this large of a blast radius, should be highly diligent about internal threats.
- thrown-0825 1y agoyou would be amazed how often this happens i regularly see orgs with orphan machines running that no one understands or wants to touch
- tamimio 1y agoWaaaay overexaggerated sentence! But I believe this wasn't about the “damage” that happened but about sending a message asserting the power dynamics between the employees and employers, as in, if you dare to do something similar or rebellious you will have your life and future ruined forever, establishing a precedent that reinforces the power hierarchy between employees and employers. The underlying message suggests that any similar acts of defiance will result in severe and harsh consequences. By the way, modern dynamics have shifted a lot of things for granted. I know personally a few developers who worked back in the 80s/90s and up to this date the companies still pay them portions of their profits because these developers are the owners of that code and have ownership rights in the code they developed, meanwhile these days under “industry standards”, the code that you spent your time/life/etc. is totally owned by the company and you, the creator, do not, the original creator retaining no ownership rights whatsoever. Hilarious! slavery? Code monkey? Whatever you want to name it but definitely it isn't a good thing. It’s a substantial shift in the balance of intellectual property rights between developers and their employers.
- layla5alive 1y agoIndeed, and to add to the irony, yours is the most downvoted comment. Developers think owning their work product is a bad idea?
- tamimio 1y agoDomestication. A lot of people are afraid to go against the status quo, or to be different from their colleagues, or demand things that aren't usually demanded. It shouldn't be hard for a programmer who is hired to demand that he owns the code he writes. Keep in mind too that a lot of company/startup founders are on HN and having this idea spreading around threatens their profits. Instead of having people paid peanuts to write code the company will own, then replace said people with a week's notice to bring another cheaper person, having programmers owning that code will end their exploitation model. As for the up/down votes, I have them disabled so I don't know nor do I care about them. I actually should write that part in my signature.
- DougN7 1y ago
- analognoise 1y ago4 years for that is absurd. We have an outright criminal at the top, healthcare CEOs can kill you with Excel by the tens of thousands, but a company loses some money and the rules suddenly apply? What an absolute joke.
- rrgok 1y agoI was thinking the same. I guess money can buy everything: morality, spirituality and even justice.
- dns_snek 1y ago> and even justice. Punishment, not justice!
- layla5alive 1y agoIndeed. This seems like the only thread so far on this discussion where commenters have a sense of human-centered morality. And it's far fewer posts than the others. It really feels like corporations, greed, money and power have won..
- jjav 1y agoRules apply only if you're not rich enough to buy some special rules just for you. It's not how it was supposed to be.
- thrown-0825 1y agopretty dumb way to go about implementing this, dont skip code review kids
- RickJWagner 1y agoHe gets an A for naming his methods sensibly. But Fs in morality and long game planning.
- OutOfHere 1y agoJust as a thought exercise, the better kill switch is a dead man switch that is disarmed every month or two until its next run, also one that acts as malicious ransomware that deletes everything including itself and all logs. Obviously don't do this, because you don't want to be more morally bankrupt than your employer, or your whole argument of righteousness falls apart. The morally righteous never would, because they already know that employment in the US is voluntary for both sides. Also, over time, one would absolutely forget to disarm it.
- amy214 1y agothe best kill switch is to write a slop codebase only you understand. no intentional evil little mechanisms, no intentional breaking, just the slop, slop written in good faith. now that is legal
- OutOfHere 1y agoTo be fair, LLM can cut through unclear codebases like a hot knife through butter. The LLM may make some mistakes, but it gets the general idea. There is one exception. It is when the code has no type definitions and obfuscated variable names, or worse yet, has incorrect type definitions and misleading variable names, but such code is not maintainable at all anyway, even for oneself. In summary, even for the author to understand a codebase over a long period, it has to be well organized because human memory doesn't recall all the little details.