Revenge of the Coder: Ex-Employee Jailed for Digital Sabotage and a Malicious “Kill Switch”
A former employee has been convicted of deliberately orchestrating digital sabotage against his own company. The U.S. Department of Justice announced that 55-year-old Davis Lu, a Chinese national residing in Houston, was sentenced to four years in prison followed by three years of supervised release. He was found guilty of willfully causing damage to protected computers, resulting in months of service disruptions and financial losses amounting to hundreds of thousands of dollars.
According to court records, Lu worked as a programmer at an Ohio-based company from 2007 to 2019. Following an internal reorganization, his responsibilities and system access were reduced—a turning point that set the stage for retaliation. In August 2019, he surreptitiously embedded malicious code into the company’s source files. The code triggered server failures and user lockouts by spawning endless Java threads in perpetual loops, overwhelming resources until services collapsed.
He also deleted colleagues’ profiles and planted a so-called “kill switch,” designed to activate automatically if his own Active Directory account was disabled. He cynically named this mechanism IsDLEnabledinAD—an abbreviation of “Is Davis Lu enabled in Active Directory.” On September 9, 2019, when he was placed on administrative leave and ordered to surrender his company laptop, the kill switch executed, paralyzing access for thousands of employees worldwide.
Some of the components he added carried symbolic names: Hakai—the Japanese word for “destruction,” and HunShui—the Chinese word for “sleep” or “sluggishness.” On the day he returned his equipment, Lu also deleted encrypted volumes, attempted to erase Linux directories, and sabotaged two additional projects. Internet search history confirmed that he had studied privilege escalation techniques, process concealment, and file deletion—efforts clearly intended to complicate recovery and maximize the impact of his attack.
Lu’s actions not only destabilized vital services but also inflicted significant economic harm. FBI officials stressed that the case underscores the critical need to detect insider threats before they escalate into catastrophe. The Department of Justice characterized Lu’s conduct as a profound betrayal of trust and a stark example of how technical expertise, when misused, can be transformed into an instrument of destruction.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
