Contractor admits planting logic bombs in his software

[ChrisSD]

In 2011 Tinley had refused to hand over the password to unlock the spreadsheet for editing when asked, claiming he was protecting his work product.

> For years, the spreadsheet would glitch, Tinley would be hired to come in, would "fix" it, invoice Siemens, and head out again. But that all changed in May 2016 when Tinley was out of state, and Siemens called again about the spreadsheet. The company had an urgent order it had to put through, it told Tinley, and it wasn't working properly again. Pushed, Tinley relented and handed over the password.

https://www.theregister.co.uk/2019/06/25/siemens_logic_bomb/

[auggierose]

Must have been a brain freeze moment to hand over that password.

[mgleason_3]

Wow, does 6-months in jail seem a little severe? How does one even get someone prosecuted for this crime?

We hired a licensed plumber on 2 occasions - to install a sink and later a shower.

We just had a different plumber out because the sink was plugged up. He pointed out that the prior plumber had installed the sanitary-t upside down basically guarantying it would eventually become clogged.

We also had him look at the shower because we couldn’t figure out how to get the screen out to clear the hair. Turns out the grate was also installed upside-down and the screws holding the screen in are in-accessible. So, there is no way to get it out without demoing the shower.

Should this plumber be sentenced to 6-months in jail?

[conistonwater]

I understand it depends on whether the FBI can show malice, planning and intent, and the size of the damage ($42k in the Siemens case). So in your plumber case it's probably impossible unless it's like a pattern of fraud rather than just one mistreated client. If a plumber actually tried to make a fraudulent business model out of such behaviour, then I could totally believe they might get jail time. Furthermore, if you sue the plumber yourself, that's a civil case and so jail time is not possible at all (the Siemens case was handled by the FBI).

I personally do not think that 6 months' jail for stealing $42k from somebody is so severe, to be honest, it's a lot of money.

[jlarocco]

If he's purposely making mistakes to get work in the future then I don't think 6-months in jail is that bad. It's just plain fraud isn't it? Not to mention an expensive inconvenience for all of his customers who have to deal with his shoddy work.

On the other hand, it's entirely possible the plumber made an honest mistake.

[narag]

You're assuming the guy did that just to you. If he does the same in every installation, I'd say that six months is not enough.

[ufmace]

It seems the specifically designed logic to fail at a certain date is the reason. If stuff breaks because of a screwup, or at least something that people can be convinced is a routine screwup, that's one thing. Actually creating a new module to make something fail is something else.

It's like if the plumber designed, built, and installed a device specifically to make your plumbing leak or clog or something at a specific point in the future, instead of just installing a normal and expected device incorrectly.

The law does tend to take intentions into account for crimes and punishment. Killing somebody by a freak accident is different from making a plan in advance to kill somebody and executing it.

This does make it feel rather odd that it's legal to DRM things though.

[ropiwqefjnpoa]

No he shouldn't. We need to stop sending people to jail for all but the most heinous of crimes. He should be ordered to pay you back twice for what it cost to install and repair.

[yrro]

Just sued for the cost of putting the job right.

[drc500free]

Unlike code, law considers intent.

[slowmovintarget]

6 months for fraud doesn't seem unreasonable.

[bjornsing]

That age-old saying comes to mind: “Never attribute to malice what can be sufficiently explained by incompetence.”

[everybodyknows]

How about adding your judgement, based on the specific evidence, of the likely cause? One of:

1. Ignorance/Incompetence -- wasn't paying attention?

2. Gross negligence -- doing it wrong was somehow quicker and cheaper.

3. Fraud -- calculated to fail.

p.s. Dealing with similar case of malfeasance myself just now (electrical). Looks to be about #1 20%, #2 80%.

[ppseafield]

Did the previous plumber install a timer on a pipe, ensuring it would leak every 6 weeks?

[jessant]

Any amount of jail time for non-violent crimes seems excessive.

[rustybolt]

Shows the importance of code reviews.

I wonder why this is illegal but it's legal for hardware to deny service or even break stuff when they detect you're using something they don't like (I'm referring to printers, but I also remember a case where a microcontroller would try to brick something when it detected a counterfeit cable).

[javagram]

Apparently it was a password protected spreadsheet.

Which seems like incredible incompetence of the company to accept code in that format in the first place and to not have demanded the password when the first issue arose.

[navaati]

On the one hand, yes, that's crazy. On the other hand, an argument can be made that company accept proprietary software in binary form all the time, and this is no different !

Still a good laugh from the sidelines...

[zelon88]

If you dump the XML and remove the <sheetProtection password=/> line you don't even need to ask for the password.

[de_watcher]

You must be crazy to use proprietary closed source software. Oh, wait...

[Rexxar]

I'm sure there is a lot of password protected spreadsheets in finance industry.

[choeger]

Yep. If it was me I would hold the supervisors responsible.

[hurricanetc]

I read the DOJ link and it just states “intentional damage to a protected computer.”

If he had accidentally written sloppy code that happened to break periodically would that have been illegal? I don’t fully understand what law he broke and how such a law would not also apply to the seemingly infinite cases of built in obsolescence.

[EGreg]

I once wanted to put a logic bomb for a client that was a startup and for months (years?) prioritize paying others. I had accumulated $30K in debt for them as they told me the sky is falling numerous times and that they’d pay me as soon as the next money came in. They just had raised hundreds of thousands but paid their own salaries and large empty office instead.

I knew I’d have the upper hand if the site suddenly stopped working. But I was afraid of some kind of “hacking laws” being “exceeding access” or whatever (probably stupid given what was realistic) and never did it. My only acceptable option was to do a DMCA takedown at AWS because they had never signed a copyright assignment.

Anyway long story short I never got paid. Been too nice / scared. And the startup went out of business. Many of its investors were pissed. The usual.

[Rainymood]

Malicious compliance by the contractor. Hilarious incompetence by Siemens.

[pc86]

How is this malicious compliance? He wrote code to intentionally stop working at certain times in order to defraud Siemens by getting them to pay for what is essentially the same work over and over again.

[hamilyon2]

It is somewhat like drm, but nobody goes to jail when books stop opening and old games break

[bilekas]

I would be curious how they came to realise what was happening.

Also, how were the contractors changes not reviewed?

If the same engineers work keeps throwing unknown problems down the line, the LAST thing I am doing is contacting them again.

[zozbot234]

Can you even "review" changes to spreadsheet code? I know that Office apps have some support for change management, but is it even up to this task?

[leowoo91]

How about the maintenance services who act lazy reporting client issues to the main vendor? That's one of the undetected patterns I believe.

[MertsA]

>Tinley added code to the complex spreadsheets that "had no functional value, other than to randomly crash the program,"

I could say the same about some of the... less talented developers I've worked with in the past. Hanlon's razor might not apply in this case, but that's a scary thought given how the US justice system seems so inept at handling cyber crime.

[ghostpepper]

Off topic but is does anyone else feel that the phrase “logic bomb” is too meaningless for the frequency with which it shows up in reporting these days?

It makes it sound more sophisticated than it is. What’s wrong with calling it malware? Or even better, simply criminal behaviour that happens to involve a computer.

[PeterisP]

Logic bomb is a term for a very specific subtype of malware, and it is quite informative and useful to use this term - it gives a proper impression about what this particular malware does and doesn't do.

It immediately suggests that it has a delayed action that creates a disruption after some time (and not right away); that it is hidden (as opposed to e.g. ransomware), that it's intentionally deployed there (as opposed to someone accidentally getting infected), that it's most likely not spreading itself automatically like a virus and that the damage isn't controlled in realtime like in a botnet, etc.

Simply saying 'malware' would not tell us this information, so it would be vague and inaccurate instead of using the appropriate terminology.

[jrockway]

We really like PR in this field. We call making a copy of a file "piracy", as in piracy on the high seas. We call adding a password to an Excel spreadsheet a "bomb", as in a device designed for leveling entire cities and brutally murdering everyone nearby. We call adding restrictions to books and films "digital rights", kind of like the "bill of rights" that protects our country's core values.

The prosecutors and industries that coined these terms are very clever. For the petty crimes that they describe, they can turn the outrage up to eleven by comparing the most minor transgression to murder. In the case of DRM, the industry managed to convince people to buy new TVs, monitors, video cards, and cables... to protect their rights? Their right to be turned upside down and have the coins and bills shaken out of their pants, I guess.

[duxup]

I guess it depends on your definition but something designed to go off (negatively) after a predetermined time and dork up the logic of a program seems apt.

[markstos]

Weapons don't have be sophisticated to be used as weapons. Even physical bombs don't have be sophisticated to be bombs.

"It wasn't an armed robbery, it was just unsophisticated criminal behavior that happened to involve a gun."

[thrower123]

Hmm, is this a common turn of phrase in reporting these days? I can't recall that expression being used outside of some rather old science fiction.

[ggggtez]

>$42k

Doesn't seem like he was a very good scam artist... That's not a lot of money to risk jail over.

[LegitGandalf]

Dilbert covered this back in 95

https://dilbert.com/strip/1995-11-13

[BuildTheRobots]

> The parties in the case stipulated a total loss amount of $42,262.50

That's an oddly specific loss amount, especially the 50c

[drderidder]

All I can say is he must be a really good programmer if he needed to deliberately install logic bombs to make his software malfunction after a period of time. I've got my hands full just making things work properly in the first place!

[dmix]

Yeah, really, this is the first programmer I've ever heard of who had lacked bugs to be fixed. There's always new stuff to work on.

Maybe he was only used for some older niche stuff that was going out of style and he was trying to cling to the past.

[giancarlostoro]

That or he's hired by people who don't peer review at all, as in he's the only developer.

[duxup]

Or just the usual periodic business logic changes.

[pts_]

That's because he's a boomer who probably knows asm. There were no wannabes in this field back in the day.

[pmiller2]

Why does the title not contain "to ensure he gets new work"? The original title was 2 characters too long for HN, but could have been edited to contain that information. For example: "Contractor admits planting logic bombs in software to ensure he’d get new work"

[jonplackett]

I wonder how they figured it out?