Fannie Mae Unix Engineer Gets 41 Months for Planting Logic Bomb

I don't think a stronger sentence would have deterred him. I doubt he sat down and thought "If I get caught, I'll only get 3 1/2 years, which isn't too bad. Now, if I would get 10 years, that's another story..." I doubt he even knew the specific penalties for doing this. It seems to me he assumed he'd never get caught.

I think others reading this article will be deterred by the thought of losing 3 1/2 years of their life, and having their life after prison ruined in many ways. For example, try to explain a 3 1/2 year gap in your employment history during a job interview. And for the ones who aren't, I don't think a 10 year sentence would somehow deter them.

I don't think this guy is likely to commit another such crime after his release. I doubt he figures that 3 1/2 years in jail and putting his life back together isn't that big a deal and planting another logic bomb feels so good that it's worth it to do it again.

The only other motivation for punishing a crime is vengeance, an emotional feeling of hurting someone who tried to hurt us. That seems a poor motivation for taking away even more of someone's life.

He did something malicious that could have caused a lot of problems. He needs to be punished. But the punishment seems way out of proportion to what's needed to reduce crime.

Looking at the actual indictment, I think he was charged with just violating Section 1030 (a)(5)(A)(i) of the U.S. Code. I don't think the other two sections mentioned are separate charges.

http://www.law.cornell.edu/uscode/html/uscode18/usc_sec_18_0...

If you've never read section 1030, it's surprisingly clumsy and vague to us non-lawyers. Two important things for most cases are that generally any computer that is (or even 'can be') connected to the internet is considered to be 'protected' as it may potentially be involved in interstate commerce. The second this is that for this section to apply, there must be at least $5000 in damages involved.

Then you can go look up sentencing guidelines. It's important to realize that these 'guidelines' are a lot more than just suggestions for federal judges. They can go outside of these guidelines but rarely do. http://www.sentencing.us has a great calculator. That quickly tells us to use section 2B1.1(a)(2) of the guidelines.

http://www.ussc.gov/Guidelines/2010_guidelines/Manual_HTML/2...

If you go look at those guidelines, there's a chart in (b)(1) that shows how much his base offense level would be increased depending on the damages. From the descriptions I've read, I would think the damage amount would be less than $120,000 (lost time, hours it took to clean up) so that's a +8 level increase.

Then there are a number of special modifiers that can increase the 'level' of the sentence guideline. It looks like (b)(14)(B) might apply due to the financial institution aspect, so that would be a +4, except if I read the awkward combination of (C) and (D) correctly, this automatically pushes him to a level 24.

So then you need to look at the sentencing table: http://www.ussc.gov/Guidelines/2010_guidelines/Manual_HTML/5...

The table takes his criminal history into account, which was likely none. Then we need to look at his level, which we still don't know.

If he caused under $120,000 in damages, his level should be a base of 6 plus 8 for the dollar amount. He could reduce this by 1 or 2 levels by accepting responsibility or other things. But if he was at a level 14, his sentence guideline should be 15-21 months. I would think that the damage amount could be even lower than that, especially if it had to be proved in trial. This is why I made my original statement that I thought it sounded quite high.

So they must have applied the (b)(14)(B) part to push him to level 24 for a range of 51-63. In which case his sentence of 41 months is then too low. So if he "accepted responsibility" he could reduce his 24 to a 22, getting him right at the 41-51 month range. Judges would almost always apply the lowest end of the range to a first time offender.

I think his 41 months can be split into two phases so he could spend half of it in an actual prison and then the rest on 'supervised release' - either monitored home detention or in a halfway house. He might even be able to spend the entire time on 'supervised release'. I couldn't find it but section 1030 offenses used to have a clause about mandatory 6 months 'imprisonment'.

Due to his offense level, he could have gotten 5 years probation, but 3 is typical. He will be required to make restitution to the victim for the damage amount. There's also a fine table that shows him with a $7,500 to $75,000 fine range. He'll have to make his best effort to pay those.

So that's the mechanics of federal sentencing.

This is something I wish they covered in every school program. It's amazing to realize that one angry act by a programmer or IT person could result in very severe consequences. So few people in our field realize how stiff the penalties can be, so this law isn't much of a deterrent.

[quote] If the malicious script had gone undiscovered, it would have disabled monitoring alerts and all log-ins, deleted the root passwords to the approximately 4,000 Fannie Mae servers, then erased all data and backup data on those servers by overwriting with zeros.

"Finally, this script would power off all servers, disabling the ability to remotely turn on a server," said the government's complaint. "Subsequently, the only way to turn the servers back on was physically getting to a data center." [/quote]

  > During this time Makwana had root access to all of the main
  > systems, credentials which the company failed to revoke until
  > the evening of the day of his layoff.

  > His intention was nothing short of replacing the entire financial
  > data, including the backups, from all of the company's production
  > servers, with zeroes.

  > the admin appended malicious code to a legitimate script, leaving
  > a page-worth of blank lines between the two in order to avoid
  > detection.

  > Had this malicious script executed, engineers expect it would
  > have caused millions of dollars of damage and reduced if not
  > shutdown operations at Fannie Mae for at least one week.

This quote above, and the entire article boggles the mind. I've worked with big and small organizations that protected root on <10 machines like it was the key to preventing aging.