Q&A: Reverse hacker describes ordeal

Computerworld - A New Mexico jury recently awarded Shawn Carpenter $4.3 million in a wrongful termination lawsuit against his former employer Sandia National Laboratories.

The former network intrusion detection analyst was fired in January 2005 after he shared information relating to an internal network compromise with the FBI and the U.S. Army. Sandia alleged that Carpenter had inappropriately shared confidential information he had gathered in his role as a security analyst for the laboratory.

Carpenter said he had done so only for national security reasons. He said his independent investigations of a May 2004 breach had unearthed evidence showing that the intruders who had broken into Sandia's networks belonged to a Chinese hacking group called Titan Rain that also had attacked other sensitive networks and stolen U.S. military and other classified documents.

Security analyst Shawn Carpenter

Carpenter until last Friday worked with the U.S. Department of State's Cyber Threat Analysis Division. He is currently a principal research analyst at NetWitness Corp., a start-up headed by Amit Yoran, former director of the National Cyber Security Division of the Department of Homeland Security. In this interview conducted via e-mail, Carpenter talks about the case.

What's your reaction to the verdict? It is almost a guarantee that Sandia will appeal and drag it out for years. They don't have any incentive to resolve the case, as the taxpayers are footing the bill. Besides the cadre of attorneys they already have on staff, they hired a local firm, Bannerman & Williams, to assist them in the litigation.

We've indicated our willingness to negotiate over the course of the suit, but they expressed no desire to talk. The one offer they made at a settlement conference ordered by the court was so pathetic that it wouldn't have even covered a few months of my legal expenses. All along, I wanted my day -- OK, week and a half -- in court, and to have the opportunity to tell a jury my side of the story.

Since Sandia is an "at will" employer -- and they regularly remind you of this if you press issues -- people fear for their jobs. Of the several hundred colleagues I worked with during my career there, a grand total of two still talk to me -- even after the verdict. My friends in computer security that are still working there think their phones are tapped by Sandia counterintelligence, and are terrified to even call me from home. We clearly demonstrated for the jury that it is an environment of fear, created expressly to keep the employees in line.

What prompted you to conduct that independent investigation into the Sandia intrusion in the first place? As a network intrusion detection analyst, I regularly used similar "back-hacking" techniques in the past to recover stolen Sandia password files and retrieve evidence to assist in system and network compromise investigations.