Texas Developer Convicted After Kill Switch Sabotage Plot

A Texas software developer is facing up to a decade behind bars after being found guilty of causing intentional damage to protected computers at his former employer.

Davis Lu, 55, of Houston, was an employee at Ohio-headquartered power management firm Eaton between 2007 and 2019.

However, after his role was scaled down in 2018, he turned to sabotage in retribution. In August 2019 he deployed malware that caused crashes and blocked logins.

Lu created “kill switch” code dubbed “IsDLEnabledinAD” – an abbreviation of “is Davis Lu enabled in Active Directory” – which activated automatically upon his termination on September 9 2019, locking out thousands of global users.

Read more on insider threats: Man Charged with Remote Attack on Water Plant

He also created code designed to cause infinite loops, which led to server crashes, and delete profile files related to his colleagues.

Some of the code Lu wrote was dubbed “Hakai,” a Japanese word meaning “destruction,” and “HunShui,” a Chinese word meaning “sleep.”

Although Lu tried to hide his malfeasance by deleting encrypted data from his company laptop before handing it in, his internet search history apparently revealed lengthy research into how to escalate privileges, hide processes and rapidly delete files.

According to the Justice Department (DoJ), these searches revealed Lu’s intent to obstruct the efforts of his colleagues as they tried to remediate the disruptions he caused.

Lu’s employer apparently claimed it suffered hundreds of thousands of dollars in losses as a result of his actions.

This is far from the first time a disgruntled former IT worker has taken out his aggression on an employer.

In December 2020, a former Cisco engineer was sentenced to 24 months behind bars after causing millions of dollars in damages and losses for the firm. He’s said to have unlawfully accessed Cisco cloud infrastructure in September 2018, deploying code which deleted 456 virtual machines supporting the WebEx Teams application for clients.

In 2021, Delaware resident and former IT administrator, Levi Delgado, deleted employee user accounts and file servers at the medical center he previously worked at.

Over half of British businesses are concerned about malicious insider threats, according to a Cifas study from February 2024 that cited contributing factors such as the high cost of living and remote working, which may enable wrongdoing to go unnoticed.