James Wilson was a proud military soldier who had been married for just under a year to his sweetheart, Linda. They had plans of expanding their family, but for the time being were happy with their short-hair terrier, Scrappy. James was pleased with his military career; he learned electronics and communications in the Army and enjoyed his assignment as a signal-corps technician. After his active-duty assignment ended, he continued his career in the Army Reserves and used his G.I. Bill to obtain several computer certifications. James was a fit, active young man who still donned his military-style haircut. He wanted to make sure his wife received every enjoyment and luxury life could offer, and promised Linda's father that he would strive to provide her with the finer things in life.
Linda was the daughter of a plastic surgeon and grew up in an upper-class, conservative, suburban neighborhood. Her parents did not allow her to wander very far from home or partake of any questionable or risky activities. She went to the best schools and had been brought up to be a refined member of upper-class society. Linda's father, Richard, did not think anyone was good enough for his sweet Lin, who he believed was destined to become a world-class surgeon. She graduated magna cum laude in premed from Stanford University and was accepted to Johns Hopkins University's prestigious medical school. But her future took a dramatic turn when she was introduced to James through a mutual friend. When they met, Linda was immediately drawn to his bad-boy persona, which her parents raised her to avoid. James had an arrogance that appealed to Linda, and she looked at him as both a challenge and a charity project. James told her of his future plans and insisted that he only needed the right opportunity and support to succeed. What began as an innocent flirtation turned into dating, and eventually James invited her to visit him at his Army base. While there, Linda had three of the most memorable weeks of fun and excitement that she had experienced in her sheltered life.
James came from a blue-collar family. His father was a veteran of the Vietnam War and worked in a manufacturing plant 12 hours a day; his mother did not finish high school after giving birth to his oldest sister; she was a career housewife. James grew up motivated to succeed by reflecting back on the hard times that he and his family went through, and made a promise to his mother that one day he would buy her a house with a backyard. When he graduated from high school, he wanted to leave his hometown and expand his horizons, and he saw the Army as the answer. It would give him the opportunity to travel the world, be trained in a new career and receive money to go to college. And to top things off, he could follow in his father's footsteps and serve his country. James's family was very proud of him. Nevertheless, his accomplishments did not meet the standards of Linda's father — Richard expected his daughter to marry a doctor or lawyer and enjoy the same financial comfort in which he raised her. When Richard found out about Linda's relationship with James, he became angry and expressed his disdain of their relationship to both of them. The doctor was concerned that Linda would not finish college, which would ruin her career prospects. James, attempting to understand Richard's concerns, promised him that he would do everything in his power to make sure that Linda finished medical school and lived the life that Richard envisioned for her. Her father just replied, "Sure. We'll see, son."
Despite Richard's objections, Linda's mother was able to convince him to attend the wedding and give away his daughter. Shortly after they were married, James decided to leave the Army and pursue a career in the computer industry. Linda enrolled in medical school. When James spoke of his wife and their future, he passionately expressed that nothing in the world would prevent him from providing her and their future children with whatever they desired. James used his Army benefits to purchase a new home in the suburbs, which he referred to as their "temporary" home. It was a modestly built single-story home with approximately 2,800 square feet. Linda's father considered it meager, but it was James and Linda's starting point. James set up his own computer lab at home, where he conducted research into the industry and new trends on the Internet. He was most proud of the home-wide computer network he constructed. He had a cable line installed in his office to support a self-contained server that he used to host his Web site. He connected the desktop and laptop computers in the house to a single system, which he could monitor remotely. He constantly devised hypothetical network problems and came up with different solutions to sharpen his problem-solving skills. One of his favorite pastimes was hacking into his own network from different Internet connections — friends, family members, even the local library — and then devising stronger protections against such hacks. After working various odd jobs with temporary agencies, James found an opening for the position of his dreams at a mom-and-pop network-servicing company that was undergoing growth and had the potential for future advancement.
James believed that his education and training made him one of the top candidates for the company's newest network engineer position. James knew the interview was going well when Eric Mathis, who co-owned the company with his wife, reviewed James's resume, and then brought his wife, Rita, into the interview with them. James's practical experience in the military, along with his industry certifications, proved to be influential in his hiring. Eric and Rita were especially impressed when James explained how he installed his own server network and practiced with the various scenarios he created. He seemed to have a unique grasp of Internet-based threats to network security, which the Mathises considered a valuable asset to the company. The couple was excited about bringing James on board; they thought they had found the right person with the ideal desire and dedication. A week later, James was hired and began his new career. He told Linda, "Baby, our worries are over. You just focus on finishing school; I have found the golden egg."
During his first week at work, James was given an organizational chart of the company's administration. There were already potential management slots being created due to the enormous growth of the company. James's ambitions began to soar and he set his sights on upward progression — more responsibility and more money. He was strongly motivated to help his mother buy that house he promised her and to prove to Linda's father that he was worthy of her. James worked overtime on a regular basis, not only to keep up with his workload, but to get a better understanding of how the company functioned. He had his eyes on the prize and he wanted his bosses to know that he was a dedicated employee.
Mathis Network Technologies was founded to manage and maintain network servers for small- to medium-size companies that did not have internal IT departments. Mathis Network gave their clients a reliable backup system in case of a disaster and was more cost effective for their customer base than it would be to purchase expensive equipment and hire on-staff personnel. The company began as a daydream Eric had while working as a technician at a computer-manufacturing company. He learned electronics on the job from a technician who took him in as an apprentice. Since that experience, Eric also tried to help young people who were hard working and wanted to make something out of their lives. Eric enrolled in business courses and undertook entrepreneur training provided by a community program.
After developing a sound business plan and obtaining a commercial loan, Eric and Rita started Mathis Network Technologies in a small office in a strip mall. Eric would drive out to businesses in his little Chevy S-10 pickup truck and work on their computers and network problems while Rita managed the office. As the company grew and attracted more clients, they moved into their own 8,600-square-foot building with four floors. They eventually employed more than 500 people, working in shifts around the clock. Eric and Rita were considering taking the company public, so they asked James to help redesign the Web site to increase visibility and expand market share, a step recommended by their bank. The bank also suggested that they hire more management with advanced education.
The Mathises had a big decision to make — to get the loan to expand the corporation, they needed to hire a few MBA-type managers. But they already had dedicated network engineers with a zeal for the business who anticipated moving up. Despite their loyalty to the current staff, Eric and Rita knew what they had to do for the company to move forward. Eric interviewed several highly qualified managers with MBAs but he was having trouble finding someone who also had a knack for the industry; those who did, frankly, wanted more money than Eric was willing to pay. Finally, a candidate with a bachelor's degree in computer science and an MBA applied for the position — Eric and Rita hired her almost on the spot. A few weeks later Eric took Marcy around the office and introduced her to the staff as the new operations manager.
I was going through my morning rituals — coffee, e-mail, voice mail — when the lieutenant brought me a new case file and said, "I believe you're going to like this one." As a police investigator I usually received relatively standard — cookie-cutter, even — fraud cases, but on the humid spring day when I read the report filed by Eric Mathis, I was forced to switch up my routine and take heed of the peculiar circumstances. I reviewed the initial report. This was an opportunity to wear my Dr. Holmes hat and get into some real investigative work, especially for an Internet fraud; these crimes were still relatively new at the time and I looked forward to expanding my skills. Eric Mathis stated in his report, "A former employee is trying to put me out of business. He has sabotaged my company's network and shut down my operations, which affects several of my clients."
I drove over to the Mathis Network Technologies' office and met with Eric and Rita Mathis to get a more detailed overview of the incident. Eric began by describing James as a brilliant employee, but said he also suspected James had serious personal issues. As I gathered more details, Rita suggested that pressure from his wife may have been a problem for James. She said that Linda didn't work and was used to having the finer things in life. And from water-cooler talk around the office, Rita had surmised that James needed a promotion not only to build a bigger house for Linda, but also to show his father-in-law that he could be a good provider. Eric then mentioned James's upbringing and said that James had to work hard for everything in his life. Eric said that was one of the reasons he hired James — his determination — was exactly what Mathis Network Technologies needed. Eric told me that he knew James was disappointed to be passed over for the operations manager position, but Eric "explained to him that it was a business decision. I told James he could go back to school and then I would be glad to bring him up. But I believe he wanted instant gratification. Four to six years of college was not in his plans."
A year after they hired Marcy as operations manager, James's focus and priorities seemed to change. He showed up late to work, left early, called in sick on a regular basis and became outright disrespectful to his superiors. The final straw came when a customer complained about James to Eric, stating that records had been altered without his authorization and that James was his account representative. When Eric questioned James about the incident, James became irate and combative. Eric said he had no choice but to call the police to escort him from the premises: That was the end of James's tenure with Mathis Network Technologies. The day after James was fired, Eric and Rita began to get calls from clients complaining that their networks had been terminated and that they were losing money by the minute.
The Mathises looked into the compromised accounts and discovered that someone had used the Internet to hack into Mathis Network Technologies' system and then shut down their customers' networks. I learned that an outside Internet protocol (IP) address had been used to access the Mathis server on the night James was fired. I contacted the domain name service (DNS) that Mathis Network Technologies used and obtained the IP address that was used to access the company's server; it was serviced by One-Stop Cable Company. My next step was to request grand jury subpoenas to obtain the physical address where the IP address originated. After the subpoenas were granted, One-Stop turned over its records. It was no surprise that the IP address came from James Wilson's home in the northwest suburbs of town.
I decided to drive by the Wilson residence to ascertain the activity and routines of Linda and James. Then I was able to obtain a search warrant for the premises from the district judge, and I was trying to get the lay of the land before executing it. Based on significant amounts of circumstantial evidence, I chose a foggy summer morning to execute the search warrant.
With the assistance of several other officers, I entered the Wilson residence with the search warrant to find James and Linda inside. It appeared that James was preparing to leave for the weekend for Army Reserve duty. We gathered digital evidence including CDs, DVDs, thumb drives, cameras, cell phones, laptops, and desktop and server computers. Our forensic experts packed it all and took it to our computer forensics lab for examination.
Later I called James into my office to give him an opportunity to give his perspective of the events. I read him his Miranda rights and proceeded with the interview. James began to rant about Eric and said he did not receive the respect he deserved at work. "I should have been promoted to a supervisory position long ago, but I was overlooked for someone who had less experience but who had graduated from a well-known school with a master's degree. I was the only employee who worked overtime when Eric needed me to; everyone else always made up excuses."
I asked James how he felt when Marcy was hired and he practically screamed, "I felt betrayed! I needed that raise; that job was mine! Eric knew that I needed more money to buy a new house. But the final straw came when I told Eric and Rita I couldn't work one weekend that they scheduled me because I had Army Reserve duty. They called the commander of my reserve unit and asked him if I really had a drill that weekend. Then they started telling him my personal business and work habits."
I asked James how he knew what the Mathises told his commander, and he admitted to fixing the network to notify him whenever Eric or Rita called the base. He said once he received a notification, he tapped into the phone line and listened to their conversation. I was stunned by this admission and asked him, "You mean that you hacked into a government network and listened to other people's conversations? Does your commander know you did this?" And suddenly James wasn't so forthcoming. He said he didn't want to talk about it anymore and wanted to consult with a lawyer.
I pieced together my digital and Internet evidence and the facts I gathered from my various interviews, and determined that James became disgruntled when Marcy was hired and decided to take revenge on the Mathises. He started by tapping their phones and listening in on private conversations, but he took it to a new level after he was fired. He returned home, box of desk miscellany in hand, and used the Internet to remotely launch an attack on his previous employer's network. Once he gained access to Mathis Network Technologies' systems, he began shutting down Mathis's largest clients, one at a time. James knew which clients to target first, and he knew exactly how to compromise the networks. After all, he helped set them up. I compiled a report of my findings and presented it to the district attorney. After reviewing my evidence he was pleased to have such a well-packaged case. "Looks like you did your homework, Bruce. This guy is going to take a long ride."
A warrant was issued, and James was arrested at home early one morning. He was tried in court for breach of computer security, a second-degree felony. During the trial, evidence showed that James's actions caused a monetary loss of more than $100,000 for Mathis Network Technologies. The district attorney also proved that James's actions were intentional and malicious. James was sentenced to 10 years in prison and received a $10,000 fine. The district attorney also forwarded a copy of my report and a transcript of my interview with James to the department of defense for investigation because he tapped into phone calls made by military personnel. He faces possible additional federal charges of unlawful access to stored communications. In the meantime, he has been dishonorably discharged from the Army Reserves.
Bruce L. Owdley, CFE, is a police investigator for the Houston Police Department's Financial Crimes Unit. He enjoys working on computer crimes and has become the de facto computer-crimes investigator in his unit. Bruce has a bachelor's degree in computer science, with a minor in business, and is currently pursuing a master's degree in strategic leadership. Bruce is a Certified Fraud Examiner and a Certified Fraud Specialist.