Software developer convicted of creating 'kill switch' code after losing his job

BEACHWOOD, Ohio (TCN) -- A 55-year-old Texas man working for an Ohio company has been convicted for "writing and deploying malicious code" on the employer's network, causing server crashes, user login issues, and significant monetary losses.

According to a March 7 news release from the U.S. Department of Justice, a jury found Davis Lu guilty of causing intentional damage to protected computers. His sentencing has not yet been set, but he faces up to 10 years in prison.

Lu, a software developer, worked for the victim company headquartered in Beachwood, Ohio, from November 2007 to October 2019. The Department of Justice said Lu's responsibilities and system access were reduced after a 2018 corporate restructuring, so the defendant "began sabotaging his employer's systems."

By August 2019, he reportedly employed malicious code that caused system crashes and user login issues. Prosecutors said he built "infinite loops" that led to server crashes and hangs. He also deleted co-worker profile files and created a "'kill switch' that would lock out all users if his credentials in the company’s active directory were disabled."

The "kill switch" code, named "IsDLEnabledinAD," stands for "Is Davis Lu enabled in Active Directory." It was reportedly set to activate on his termination date on Sept. 9, 2019, impacting thousands of users across the world. The Department of Justice said the defendant named other code "Hakai," which means "destruction" in Japanese, as well as "HunShui," the Chinese word for "sleep" or "lethargy."

Lu reportedly deleted encrypted data on the day he was supposed to turn in his company laptop. Prosecutors said Lu had researched "methods to escalate privileges, hide processes, and rapidly delete files," which showed an "intent to obstruct efforts of his co-workers to resolve the system disruptions."

The company lost hundreds of thousands of dollars due to Lu's actions, according to the Department of Justice.

MORE: