Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security Government The Courts News

2.5 Years in Jail for Planting 'Logic Bomb' 303

Posted by CmdrTaco from the well-that-seems-fairly-light dept.
cweditor writes "A former Medco Health systems administrator was sentenced to 30 months in federal prison and ordered to pay $81,200 in restitution for planting a logic bomb on a network that held customer health care information. The code was designed to delete almost all information on about 70 company servers. This may be longest federal prison sentence for trying to damage a corporate computer system, although Yung-Hsun Lin faced a maximum of 10 years." How long before the disgruntled sysadmin replaces the disgruntled postal worker in the zeitgeist?
This discussion has been archived. No new comments can be posted.

2.5 Years in Jail for Planting 'Logic Bomb' More

2.5 Years in Jail for Planting 'Logic Bomb'

Comments Filter:

  • Do they give Nobel prizes for (Score:5, Funny)

    by Trigun ( 685027 ) <<xc.hta.eripmelive> <ta> <live>> on Wednesday January 09, 2008 @09:58AM (#21967626)
    Attempted Physics? I think not!

  • Let me guess (Score:3, Funny)

    by Daimanta ( 1140543 ) on Wednesday January 09, 2008 @09:58AM (#21967632) Journal
    They replaced everyones desktops with a picture of Xeno's paradox?

  • meatspace (Score:3, Interesting)

    by qwertphobia ( 825473 ) on Wednesday January 09, 2008 @09:59AM (#21967644)

    How long before the disgruntled sysadmin replaces the disgruntled postal worker in the zeitgeist?
    Only when disgruntled sysadmins start damaging meatspace. Really, it's possible, but only then will people start waking up.

    • Re:meatspace (Score:5, Insightful)

      by ScentCone ( 795499 ) on Wednesday January 09, 2008 @10:20AM (#21967920)
      Only when disgruntled sysadmins start damaging meatspace.

      When someone blows away the contents of 70 servers, they ARE damaging meatspace. Real time, stress, cash, and possibly very serious side-effects to real meat can result (especially in health care operations and record keeping). We just need more people to be aware of how the things that they pay money for, and get or don't get with the fruits of their labor, are diminished by the acts of crooks and vandals of ALL sorts. Inside IT jackasses, retail store theft/shrinkage - all of that. People don't want to think about it, not least because it's a reminder that there really are just plain bad people out there, and that they cost us all a little (and sometimes not so little) piece of our lives. I don't know about you, but the only life I'm getting is in meatspace. Chip away at that - however indirectly - and you're messing with the only thing that matters. And there are thousands of people chipping away, every day. Disgruntled IT guys aren't any different than disgruntled anyone else, but they can cause damage in unique ways, given their reach and the subtlety of their line of work.

      • Re:meatspace (Score:5, Insightful)

        by CFTM ( 513264 ) on Wednesday January 09, 2008 @10:31AM (#21968058)
        Right but the question was "When will going sysadmin replace going postal" and the answer is never because they are fundamentally different entities. Yes, this is a total ass clown thing to do and yes it does lots of REAL damage. People do not end up dead with bullet holes in them; people may be dead because some health services group isn't able to pull their record and gives them medication that they are allergic to but that won't capture the imagination of the American public. Walking in to a public building and opening up with fire arms, has, unfortunately caught the imagination of our society.

        Apples and oranges...

        • Re:meatspace (Score:4, Interesting)

          by SharpFang ( 651121 ) on Wednesday January 09, 2008 @11:06AM (#21968496) Homepage Journal
          Actually, it may get much more spectacular than wrong medications served to patients.

          Flight control hacking
          Railway tracks control
          Time bombs in firmware of cars (in all cars of given model, after given date, once the speed is over 60mph, disable brakes and force power steering all the way to the left)
          huge chemical industry factory manufacturing systems
          municipal gas networks
          oil pipelines control
          Nuclear power plants
          halon dump release system firmware
          top secret strategical plans posted to usenet
          military devices control systems

            • Flight control hacking
            • Railway tracks control
            • Time bombs in firmware of cars (in all cars of given model, after given date, once the speed is over
            • 60mph, disable brakes and force power steering all the way to the left)
            • huge chemical industry factory manufacturing systems
            • municipal gas networks
            • oil pipelines control
            • Nuclear power plants
            • halon dump release system firmware
            • top secret strategical plans posted to usenet
            • military devices control systems

            Now that's what I'm talking about! Don't forget about

            • meatheadspace (Score:5, Insightful)

              by Gription ( 1006467 ) on Wednesday January 09, 2008 @12:49PM (#21970102)

              . . .

              The real panic for the public happens only when individuals fear for their lives.

              This is basically the exact reason that Homeland Security is the biggest terrorist organization in the US.

              (The news media is right up there though...)

        • Apples and oranges...
          Correction: Apples and cheetoes...

      • Re: (Score:2, Funny)

        by zehaeva ( 1136559 )
        All this talk of meat is making me thirsty [archive.org]
      • Comment removed based on user account deletion

    • Re:meatspace (Score:5, Funny)

      by daeg ( 828071 ) on Wednesday January 09, 2008 @10:22AM (#21967936)
      Fear and appease the mighty systems administrator, lest he make your CD tray eject at random and hit thy knee, causing grave distress and injury.

    • This is kind of like the difference between blue-collar and white-collar crime. If I physically break into your house and steal a thousand dollars of property, it's blue-collar. If I intentionally falsify tax documents and earnings statements in order to pump up my company's stock value, then cash out for millions of dollars while you and the other stockholders are left holding the bag, it's white-collar.

      Both are crimes. The first appears more "meatspace" than the second, but the consequences of the sec

  • Well.. (Score:5, Funny)

    by Killjoy_NL ( 719667 ) <slashdot@@@remco...palli...nl> on Wednesday January 09, 2008 @10:00AM (#21967652)
    How long before the disgruntled sysadmin replaces the disgruntled postal worker in the zeitgeist?

    Maybe then they'll fear us MWUAHAHAHAHAHHAA :D

  • Yeah (Score:2)

    by suso ( 153703 ) *
    How long before the disgruntled sysadmin replaces the disgruntled postal worker in the zeitgeist?

    Hmmm, let's just get through today and I'll get back to you.

  • Disgruntled sysadmins? (Score:4, Insightful)

    by morgan_greywolf ( 835522 ) on Wednesday January 09, 2008 @10:02AM (#21967680) Homepage Journal
    Ehm, I don't think the disgruntled sysadmin will ever really enter the zeitgeist. If a company has good IT policies and practices in place, the disgruntled sysadmin really isn't that big of a problem.

    In my mind, this means that you should always have more than one admin, never giving anybody absolute authority over ALL systems. With offsite backups and redundant systems, the damage any single admin could do would be minimal. Maybe costly in terms of downtime, but nothing that's going to grind your business to a halt. Just as in government, there needs to be checks and balances. Giving a single admin too much power is a very bad idea.

    What I want to know is: Why would a sysadmin do things like planting a logic bomb anyway? I mean, we're talking about your PROFESSIONAL REPUTATION here. This guy's never gonna work in IT again.

    • Re:Disgruntled sysadmins? (Score:4, Interesting)

      by hal9000(jr) ( 316943 ) on Wednesday January 09, 2008 @10:12AM (#21967804)
      Just as in government, there needs to be checks and balances. Giving a single admin too much power is a very bad idea.

      Your plan sounds good in theory, but unfortunately, it rarely works in practice. Distinct separation of duties and powers requires a great deal of discipline on the organization. It took an act of congress to force get public companies, and in particular, the executive board, to take responsibility over accounting practices.

      Besides, little ot todays software lets you seperate duties in a meaningful way or to require double authorization for critical actions.

      2 1/2 years is a light sentence compared to the damage this guy could do. Thankfully, most sysadmins are honest ethical people.

    • Re: (Score:3, Insightful)

      by Ruprecht the Monkeyb ( 680597 )
      For big business, that's fine. Most small businesses are lucky to have a single full-time IT person, and redundant systems just aren't going to happen. A week's downtime without customer records for billing, etc., while servers get rebuilt and data restored could kill them.

    • Re:Disgruntled sysadmins? (Score:5, Insightful)

      by nighty5 ( 615965 ) on Wednesday January 09, 2008 @10:17AM (#21967870)
      The problem is, the common threat for most organisations is that an employee only needs full access to only one or a couple of critical assets, not all systems.

      I've been in security for over 10 years and I tell you know, if you have an employee with enough access and dedication to bring down the company down to its knees, they will probably succeed.

      IT policies and practices won't save a company against criminal activity, the law handles that just fine.
      • I bet in most companies one baseball bat could bring most companies to their knees.

        Why resort to a "logic bomb" which they will know who did it to just being direct?

        Don't think so, many places I have been I could appear as a Heating and Cooling worker, electrician, or even trash disposal, and get unescorted access into the data center. All the security in the world doesn't do diddly when half of the IT department will let you in with "can you let me back in, my buddy can't hear me over the fans"

    • In my mind, this means that you should always have more than one admin, never giving anybody absolute authority over ALL systems. With offsite backups and redundant systems, the damage any single admin could do would be minimal. Maybe costly in terms of downtime, but nothing that's going to grind your business to a halt. Just as in government, there needs to be checks and balances. Giving a single admin too much power is a very bad idea.

      There's the way things should be done and the way things are done. For a company of this size, the story should be a non-issue, even if the sabotage was successful. "Pull the binder for disaster scenario 454 off the shelf, start at step 1." Maybe lose a day or two getting the restores in place, no problem. But what's the reality? Probably something more like "Gee, I think we might have the backup from two months ago. Yeah, we needed more tapes, more SAN's, whatever, but the board wouldn't approve our budge

      • Well, it goes deeper than just doing restores. Medco Health is a provider of prescription benefits management and a mail order pharmacy (see their website). It's likely that the result of a 2 or even 3 day outage of these systems would have affected their ability to deliver drugs to customers and the ability of brick-n-mortar pharmacies to process prescriptions. So, yes, while a recovery plan was most likely in place, you can't explain to the family of someone who died that they couldn't get their prescr

  • I don't get this... (Score:5, Insightful)

    by Corporate Troll ( 537873 ) on Wednesday January 09, 2008 @10:03AM (#21967686) Homepage Journal
    Why so destructive? I would be way more effective to place a "corrupter" on the network. Instead of destroying the data, let it gradually corrupt the data. Way more damage, and probably much harder to recover from with backups.

    • Re:I don't get this... (Score:5, Insightful)

      by FuzzyDaddy ( 584528 ) on Wednesday January 09, 2008 @10:36AM (#21968130) Journal
      You're missing the psychology of the situation. He wanted everyone in the company in a complete panic at once, so they would be really sorry they laid off poor old Andy Lin. It wasn't the damage, it was the psychological effect he was looking for.

      • Re: (Score:2, Insightful)

        by mcrbids ( 148650 )
        You're missing the psychology of the situation. He wanted everyone in the company in a complete panic at once, so they would be really sorry they laid off poor old Andy Lin. It wasn't the damage, it was the psychological effect he was looking for.

        Except that you are wrong. He didn't want them to be sorry they laid him off. He just wanted them in a complete panic. If you had read TFA, you'd know that:

        1) He wrote the script,

        2) It failed to "go off" on his birthday,

        3) He modified the script to "go off" on his

    • Re:I don't get this... (Score:4, Funny)

      by morgan_greywolf ( 835522 ) on Wednesday January 09, 2008 @11:12AM (#21968586) Homepage Journal
      Or replace or, in open source systems, edit the NIC driver(s). Have it change random bits in the packets. They'll probably spend WEEKS trying to track THAT down. :-D

    • Re:I don't get this... (Score:5, Insightful)

      by tnk1 ( 899206 ) on Wednesday January 09, 2008 @12:37PM (#21969902)

      Why so destructive? I would be way more effective to place a "corrupter" on the network. Instead of destroying the data, let it gradually corrupt the data. Way more damage, and probably much harder to recover from with backups.


      A number of reasons. A top reason is that a slow burn corruption doesn't make any impact. This guy is trying to make a statement, and you don't make a statement if no one finds out that someone fucked them over. He wants to show them that they "messed with the wrong guy". A slow burn sort of corruption is something a calculating, mercenary industrial saboteur would do. That pro's motivation is probably a payoff and he wants to stay in business, while this guy is just acting out his feelings of being unappreciated and underestimated.

      Secondly, if you do it the slow way, it takes time and he could have only had a short window before he expected his access to be revoked or a fix to be applied without actually doing much damage.

      Mostly though, for a slow insidious sort of attack, you have to be a cold, calculating sort of customer, and those sorts tend to realize that you will end up paying fines and in a federal "pound me in the ass" prison if they get caught. It generally takes someone who is a hothead who simmers for awhile and then explodes to actually execute these sorts of acts.

  • Re: (Score:4, Funny)

    by Anonymous Coward on Wednesday January 09, 2008 @10:03AM (#21967688)

    How long before the disgruntled sysadmin replaces the disgruntled postal worker in the zeitgeist?
    2.5 years, apparently.
  • In principle, this seems fair, but I worry that courts simply aren't up to distinguishing deliberate acts of sabotage from perfectly legitimate behavior. That is, I don't like courts having the power to impose stiff sentences for "computer crime" because I think courts and juries simply aren't up to determining reliably when a computer crime has been committed, and until they are, they shouldn't have that power.

    • Re:seems fair, but... (Score:5, Insightful)

      by demonlapin ( 527802 ) on Wednesday January 09, 2008 @10:19AM (#21967902) Homepage Journal
      I'm an anesthesiologist. It's virtually impossible for judges and the lay public to determine, really, whether I committed malpractice (absent blatantly criminal acts). In fact, most doctors would probably need a fair amount of exposition to determine whether or not I committed malpractice (as I would, in turn, if faced with a case from another specialty). And yet we are judged by twelve people who could not escape jury duty. Yes, I'd prefer if I were judged only by my colleagues, and so would you. But if that were the case, nobody would ever trust us. It's the price you pay for having a society.
      • Well now *I* don't trust you!

      • Re:seems fair, but... (Score:4, Informative)

        by MMC Monster ( 602931 ) on Wednesday January 09, 2008 @10:54AM (#21968370)
        IANAAIAAC (I am not an anesthesiologist, I am a cardiologist), and I agree.

        There are things that you really need a great deal of training to understand, that expert witnesses cannot really stress to a jury. When I get sued for malpractice, I would much rather have a jury of my peers and a physician-judge than 12 guys that were picked up off the street, with jury selection involving a prosecuting attorney that wants to get all the educated individuals eliminated from the jury pool.

        • Re: (Score:3, Informative)

          by rk ( 6314 )

          My guess is you're a very good cardiologist, because otherwise you'd know that malpractice is a civil matter and that a prosecuting attorney is not involved in your case at all (at least in the United States).

          Or, you're a really bad one, and your malpractice rose to the level of criminal negligence, which is when a prosecutor would get involved. :-P

          As an anecdotal counterpoint to your jury selection process: I was on a jury for a medical malpractice case against the surgeon (an appendectomy that went w

    • [...] I think courts and juries simply aren't up to determining reliably when a computer crime has been committed, and until they are, they shouldn't have that power.

      How is this any different from complex fiscal issues, medical malpractise cases, or claims arising from alleged building construction errors? Courts and jurors are no experts in any of these fields, that's why they (or rather, the plaintiff and defense) bring in expert witnesses.

      I suppose that you could fairly assert that the law itself i

  • a logic bomb? (Score:5, Funny)

    by theheadlessrabbit ( 1022587 ) on Wednesday January 09, 2008 @10:05AM (#21967722) Homepage Journal
    so would everyone in the blast radius of this 'logic bomb' be hit with a blast of reason and common sense?
    would those affected begin acting rationally?
    maybe the courts would wake up and start letting the common people win for a change.
    i think we need more of these logic bombs.

    live long and prosper, logic bomber...

    • Re: (Score:2, Funny)

      by Loibisch ( 964797 )
      No, they would start thinking in terms of 'AND', 'OR' and 'NOT'...what you are thinking about is a reason bomb, or even better a 'smart bomb' :)

    • Re:a logic bomb? (Score:5, Insightful)

      by sm62704 ( 957197 ) on Wednesday January 09, 2008 @10:18AM (#21967880) Journal
      live long and prosper, logic bomber...

      If it was financial data I might agree with you, but this guy destroyed medical records. How would you feel if all your medical records were destroyed? Especially if you were right in the middle of chemo, or radio, or treatment for AIDS?

      This guy's sentence was not only just, I think it should have been longer. I have a freind in Dwight Correctional Center [slashdot.org] (a maximum security women's prison in Illinois) for selling a couple of joints to an undercover cop. Are you telling me that destroying medical records is less harmful that marijuana?
      • That sound you just heard was the joke going over your head.
        • OH MY GOD! WHAT'S THAT HEADING OUR WAY? Is it a bird? Is it superman? Oh, thank goodness, it went right over our heads.

          It was...a JOKE! DUM DUM DUM!

    • Re: (Score:3, Funny)

      by Logic Bomb ( 122875 )
      Thank you for your kind words.

      I'm going to plead the 5th on this particular incident, though....

  • Isn't being disgruntled... (Score:5, Funny)

    by Billosaur ( 927319 ) * <wgrotherNO@SPAMoptonline.net> on Wednesday January 09, 2008 @10:06AM (#21967730) Journal

    ...part of a sysadmin's job description?

  • How long before the disgruntled sysadmin replaces the disgruntled postal worker in the zeitgeist?

    I, for one, would rather see dead servers than dead people. And, to put things in a different perspcctive, a friend's brother spent five years in a federal prison in the 1980s for loaning money to a dope dealer; the charge was "conspiracy to distribute cocaine".

    What does more damage, loaning monsy to a drug dealer or wiping hundreds of people's medical records? If it had been financial data I might be a bit more

    • Re:Going Sysadmin (Score:4, Informative)

      by isa-kuruption ( 317695 ) <kuruption@@@kuruption...net> on Wednesday January 09, 2008 @10:21AM (#21967924) Homepage
      Yes, but in this case, we are talking about dead people.

      The result of the bomb on the server infrastructure would have caused patients to not have their life-saving prescriptions delivered thus putting their health at risk. So, if it had gone off, it is possible there could have been deaths due to his actions.
      • Unlikely. People with life saving prescriptions usually make sure they're up to date a couple of weeks in advance (some of the stuff I take has horrid withdrawl symptoms and I mustn't go more than a day without it - I'm always at least a week in advance of it, since remember doctors/pharmacies don't work weekends and holidays so you're out of contact at least 2 days a week anyway). For those that 'forgot' there are emergency procedures, where a pharmacist can issue a drug without prescription given suffic

      • Re: (Score:2)

        by sm62704 ( 957197 )
        I'm not for commuting the guy's sentence, as I responded in another comment. But erasing medical records, while dastardly and dangerous, isn't quite a breathtakingly shocking as shooting a dozen people dead within a fifteen minute time span.

  • Dead man switch (Score:5, Insightful)

    by INeededALogin ( 771371 ) on Wednesday January 09, 2008 @10:09AM (#21967776) Journal
    We all have thought about planting a Dead Man Switch [wikipedia.org]. The difference between us and this guy is the same difference between saying you want to kill someone and actually doing it. This guy sucks and deserves prison and to be banned from the workplace. As a Unix Engineer who has survived and been part of layoffs in the past, this type of person is not fair to the rest of the team. If you aren't gonna be the best, don't put scripts in place to punish the people that are.

    The saving grace in this case was not the guy who found the script(he of course milked it for what it was worth), but the fact that this guy did things half-assed. His original script had a bug in it(not tested)... these are the same reasons that he probably lost his job to the better people on the team when the cuts came.

    Label me a troll if you want... but this guy was trash and is where he belongs.

    • the fact that this guy did things half-assed. His original script had a bug in it(not tested)...


      Not only that, the loser had the "D Day" set to his own birthday. I'm not condoning or defending this type of thing, but if you're going to do it, do it well and for crying out loud, don't leave a trail of friggin' bread crumbs leading right to you.
    • Honestly, getting off with 30 months and an $80k fine actually seems kind of light considering the hysteria that has surrounded this kind of thing in recent years. He's lucky he didn't end up being convicted under the draconian "terrorism" statutes that can now be applied to computer crimes. And while I have a certain perverse sympathy for revenge tactics, the fact is that these were medical insurance systems, and the loss of data wouldn't have just hurt the company, it would have hurt customers who depende

    • If you aren't gonna be the best, don't put scripts in place to punish the people that are.


      I don't want to take issue with the main gist of your post, with which I agree 100%. But I think it would be a mistake to assume that surviving a round of layoffs necessarily means that you're one of "the best." I've seen plenty of competent folks get laid off while incompetent ones stay on for one reason or another.

    • Re: (Score:3, Interesting)

      by mccrew ( 62494 )
      His original script had a bug in it(not tested)... these are the same reasons that he probably lost his job to the better people on the team when the cuts came.

      What is interesting, perhaps even mind boggling, is that it appears that he hadn't lost his job. When his birthday rolled around in 2004 and the logic bomb didn't fire due to the bug, he was able to apply a fix and reset it for his birthday in 2005! You'd think that he wouldn't want to be around when it went off.

  • Of course only if the gulty one is not a company.

  • wow, that's harsh (Score:5, Interesting)

    by jollyreaper ( 513215 ) on Wednesday January 09, 2008 @10:15AM (#21967840)
    I would like to give this admin credit for not just walking into the place with a high-powered assault rifle and shooting at random.

    I've heard some tales of the disgruntled from back in the day. The most common "I quit" sabotage was taking the reel-to-reel's from the library and dumping them in a sink with water. But the worst worst worst one I heard of, one that could even be an urban legend because of how evil it is, it was the revenge of an angry admin who wanted the company to pay dearly for the evils visited upon him. He sets up this program that doesn't run until several months after he leaves the company. Note, this is back in the days of tapes and computer operators who worked the night shift and moved the tapes from one drive to another, 1970-somethings. Anyway, what his program did was step through EVERY tape in the library. He shuffled it in a random order so nobody would become suspicious. The operator just follows the prompting on his terminal, never the wiser. By the time the sequence is complete, every tape has been erased. As the story goes, the company had no offsite backups and was ruined.

    Revenge fantasies are fun but seriously, a job is a job. If you go out in a blaze of glory at one, it will make finding the next one a lot more difficult, especially with a felony on your record. But I guess if he was thinking clearly we wouldn't be reading about this in the first place.

    • Re:wow, that's harsh (Score:5, Insightful)

      by greenfield ( 226319 ) <samg+slashdot@unhinged.org> on Wednesday January 09, 2008 @11:23AM (#21968768) Homepage

      I would like to give this admin credit for not just walking into the place with a high-powered assault rifle and shooting at random.
      I wouldn't. I think a minimum qualification for participating in our society is knowing that "walking into a place with a high-powered assault rifle and shooting at random" is wrong. What's next? Giving people credit for not spitting on people who annoy them?

      I have been angry at work. I took a more reasonable approach: I quit and found a different job.

  • Probably never (Score:2, Funny)

    by bickle ( 101226 )
    "How long before the disgruntled sysadmin replaces the disgruntled postal worker in the zeitgeist?"

    First, people would need to know they exist. Second, they'd need a vague, rudimentary knowledge of what a sysadmin does.

    So, probably never.
  • How long before the disgruntled sysadmin replaces the disgruntled postal worker in the zeitgeist?

    Exactly as long as it takes for someone at ABC to go postal and delete Barbara Walter's files.

  • life-threatening? (Score:4, Interesting)

    by sholden ( 12227 ) on Wednesday January 09, 2008 @10:37AM (#21968152) Homepage
    """
    Liebermann noted that if the bomb had taken down Medco's network, people using a Medco prescription card would not have been able to fill any new prescriptions. "That could be very serious, maybe even life-threatening, depending on the need for that medication," Liebermann said.
    """

    So what happens when they have a network failure for some other reason? Bad hardware, power outage, building fire, comet impact...
    • Redundant systems, geographically dispersed disaster recovery sites... solves that problem. Doesn't solve the system administrator problem, who most likely sysadmins both the primary and disaster recovery sites.

  • Malfunctioning DRM and other logic bombs (Score:5, Insightful)

    by dpbsmith ( 263124 ) on Wednesday January 09, 2008 @10:43AM (#21968220) Homepage
    Faulty DRM and "software activation" schemes are logic bombs, too.

    There is of course a a very important difference, in that they are not intended to do anything but enforce the bombers' legal rights. Or, at any rate, what the bombers credibly believe to be their legal rights.

    But when a malfunctioning Microsoft server trips the "kill" switch on legitimate copies of Vista, I think it's fair to call that a logic bomb of sorts.

    No, I don't think Bill Gates should do 2.5 years of jail time, but it is disappointing that Microsoft was not held accountable for this beyond a few weeks' of mildly embarrassing publicity.

  • What, sysadmins show up with with a flash drive instead of a firearm?

  • Sounds about right (Score:5, Insightful)

    by Sounder40 ( 243087 ) * on Wednesday January 09, 2008 @10:50AM (#21968326)
    The story's author and the prosecuting attorney point out that this involved risk to patients and not just a company's finances. However, I think it's simpler than that: If I worked at, say, a guitar shop, and I took a hammer to the guitars in the shop, that's destruction of the shop's assets. For Medco, their assets include the customer/patient data. Destruction of the assets is a crime. Whether it was done with a computer or a hammer is insignificant.

    On a separate subject entirely, that ComputerWorld web page is exactly what's gone wrong with the web: The content I wanted to see (the article) is spread out over three pages, and each page only contains approx. 10% of the content I want to see. The other 90% of the page contains shit, and probably blinky shit if I wasn't using Firefox and Adblock Plus. I don't know why web sites do that. Do they actually think they're adding value? Another one on the list of web sites to avoid...

    • >The content I wanted to see (the article) is spread out over three pages, and each page only contains approx. 10% of the content I want to see.

      So, They are only giving you 30% of the content total? You missed out on more than 2/3 of the article? Ouch.

      > Do they actually think they're adding value?

      If those extra ad-views are generating enough revenue to allow them to continue publishing the articles and pay the authors, then the answer would be yes, they think they are.

      At least they're nice enough to
  • He's not just trying to hurt the company he works for, he's trying to hurt the millions of people impacted by the data loss. How much time and money would clients of this company waste trying to rebuild it? How many people may suffer, or perhaps even die, because they can't fill their prescriptions? Seriously, if there's a chance anyone could've died from it, they should've brought extra charges up for that, too.
  • From TFA:

    Sentencing documents noted that in his role as systems administrator, Lin had access to Medco's network, which is made up of about 70 HP Unix servers, and that he was "proficient" in coding for them.


    Obviously not...

  • How long? (Score:3, Insightful)

    by KodaK ( 5477 ) <`sakodak' `at' `gmail.com'> on Wednesday January 09, 2008 @11:14AM (#21968628) Homepage
    "How long before the disgruntled sysadmin replaces the disgruntled postal worker in the zeitgeist?"

    Well, I think first a sysadmin has to, you know, kill someone. This incident does not even remotely compare with postal shootings. I'm all for hyperbole, but, fuck, it has to be within a couple of orders of magnitude.

  • How long before the disgruntled sysadmin replaces the disgruntled postal worker in the zeitgeist?


    Just wait until someone dies because an important piece of their medical history was missing at a critical time. I think that'll get the ball rolling.

    (And no, I'm not looking forward to that.)
  • What would've been really cool is if the guy who found the code exclaimed "SOMEONE SET US UP THE LOGIC BOMB?!?!?"

  • Professional / Trade (Score:3, Insightful)

    by DeanFox ( 729620 ) * <spam DOT myname AT gmail DOT com> on Wednesday January 09, 2008 @11:38AM (#21968986)

    Label me a troll if you want... but this guy was trash and is where he belongs.
    You're not a troll. I think maybe he should have got the 10 years. I wouldn't expect a doctor loosing his hospital privileges to start killing patients in revenge. There are some things, disgruntled or not, that you just don't do.

    I say that and yet I feel for the guy. I've been disrespected by suits and have gone to sleep fantasizing about wiping a system. It felt good. But in the morning, I got up and went to work to get a job done.

    Many in IT are bitter for good reason. Most of the IT in my area was layed off 9/12/2001 and a week later offered their jobs back at half what they were making. A few of my friends have trained their Indian offshore replacements. I see jobs advertised that want 5-7 years expert experience in 12 different programming languages, 10 different platforms and a four year degree with a starting salary less than a manager at McDonnalds would make.

    What do you do... We're a new profession with growing pangs. It took a centry for doctors to fight off the mid-wife. Eventually, the world will come to accept that computers are important enough that they want the best people and will treat the Admin with the importance that work entails. It's starting. Google does it. Others do too. We'll get there.

    -[d]-
  • I don't care what kind of logical permissions scheme you have in place. any disgruntled (ob: Ever seen a gruntled sysadmin?) sysadmin can do massive damage even without the rights to do so. Physical Access is key.

    in many data centers a small fire is enough to cause massive damage... smoke particles in hard drives, and (potentially) wet electronics

    a "nicely" modified piece of cat5 can in some cases fry a switch

    EPO button can be a pain to recover from

    remove a drive

    flash the bios with a bad bios-image

    the opt
  • SOX and HIPPA notwithstanding, providers do a horrible job of collecting and storing their own subscribers information. Everytime I go to a provider I have to fill out the same damn forms over and over. So - either they lose it or, they simply store everything and never look at it or check it. Even the AMA says more than a hundred thousand people a year die from bad records, incomplete information, negligence and inattention.

    BTW I'm a Medco customer and what they think is an equivalent lower cost subscripti
  • As simple as a re-org? That's great news. Everyone who reads /. knows that from a management perspective, a re-org can solve any problem and only takes 90 days. After 90 days, all those problems are fixed and it is often time for another re-org to solve the next set of entirely different problems.

    This may be frustrating for the patient, who will be totally unable to accomplish anything for the 30 days leading up to and the 30 days following the re-org; but hell, its not like they were going to run a mara
  • As the the line between cyberspace and 'meatspace' becomes thinner and thinner malicious behavior in cyberspace will have more and more serious consequences in real people's lives (not just financially).

    Seeing as how I'm currently on a commuter train headed into Seattle, imagine if the entire railway (tracks/trains) were automated by a central command center (which they aren't as each train has a human operator). A disgruntled employee who works at the command center leaves a program that causes damage to
  • I have been so angry at jobs I have left that I have been tempted to do bad things to the network/data/servers/etc.

    Whenever leaving such a job, I have always taken the high road. I did the worst thing possible, I left them without telling them the REAL reason for leaving. This way they can hire more sysadmins who will also leave. Those companies will never get their stuff together!

    BRWAHAHAHAHA!!!

  • Nice work if you can get it (Score:5, Interesting)

    by MillionthMonkey ( 240664 ) on Wednesday January 09, 2008 @12:19PM (#21969642)
    I once worked for a guy who had to maintain some code that a consultant had written several months before. (Ironically this was at a place that handled medical records.) He stumbled across a logic bomb in the consultant's code that hadn't gone off yet. I forget the details but he said it was some sort of obfuscated routine that used a number of inputs, including the timestamp, to produce its outputs, and the timestamp was a legitimate input needed by the routine for real reasons. It was being manipulated with some goofy number in some way to cause an overflow on a certain date, which was still several months away.

    So he figures, oh, it's a logic bomb, and not being terribly intrigued by it enough to study it, he just kicked up the number to push the deadline back by a century and left it at that.

    Three or four days after the bomb was set to go off, they got a phone call from the guy asking if they had any work for him.

Slashdot Top Deals

E = MC ** 2 +- 3db

Close