Forensic Files - Season 8, Episode 39 - Hack Attack - Full Episode | Forensic Files

NARRATOR: A mysterious computer crash pushes a thriving manufacturing company to the brink of collapse, jeopardizing
the jobs of dozens of employees. There is no apparent cause. No obvious clues. Forensic investigators had to find out whether the disaster
was caused by a computer defect, human error, or sabotage. Today, there are over 700 million computers at work
in the world, any one of those holds millions of records vital to people, governments, and industry.
With millions of pieces of information in one small box can make that information vulnerable.
Omega Engineering manufactured high tech measurement devices for the United States Navy, NASA, and clients
around the world. A state of the art computer system at their New Jersey Plant, enabled Omega to quickly customize their products
to suit their customers' needs. The business was growing, and revenues were up. Then came July 31st 1996.
-It was a bad day in Omega on July 31st of '96. One of the workers got in about 8:00, 8:30 in the morning,
went to his or her workstation like they always did, and they clicked on the system.
They booted up the computer, and instead of coming on though, it said fixing. And the worker didn't know what was going on,
but fixing sounded pretty positive, so he let it run. And within seconds, the machine was down.
NARRATOR: But it wasn't that one machine that was in trouble. The manufacturing equipment in Omega
got its instructions from the computer server, the brains of a sophisticated system that could
store over 1,000 different programs. -Those 1,000 program built 25,000 different products,
and they could customize those products into 500,000 different pieces. So you talking about everything that the company can make.
NARRATOR: But now, in the span of just a few seconds, Omega's vital computer system had crashed.
The plant's manager tried to get the server up and running again, with no luck. Typically crucial files are periodically
copied from a server onto a backup tape. Omega thought they could restore the missing
programs from their backup. -And the backup tape was kept in a filing cabinet in the human resources office.
NARRATOR: But the tape wasn't there. With no computer programs to drive the manufacturing
process, plant operators had only one option, to complete the jobs that had already
been started before the crash. -Just to keep the machines running, to keep producing,
to keep people working, they just kept producing until they ran out of raw materials.
V. GRADY O'MALLEY (ASSISTANT U.S. ATTORNEY): But they ultimately created such a vast inventory
of those specific items, that they couldn't justify continuing it anymore. So they had to shut the plant down.
-One big problem that Omega had was that they hadn't hired a new network administrator.
NARRATOR: The former network administrator, a long time employee named Tim Lloyd, was now
working for another company. -He was the one who actually built the network in the Omega's health plant.
He was the genesis of their whole network. He knew it inside and out. He built it, and he was friends with these people.
-He was the designer for all the computer programming. He was the overseer of their network.
He maintained it. He secured it. He nurtured it. NARRATOR: The plant manager, Jim Ferguson,
called Lloyd to see if he could help solve the serious problem with Omega's computer system.
JIM FERGUSON (ON PHONE): Did you come across any-- you mentioned that you might want to look in the basement
for some old tapes, some backup tapes. TIM LLOYD (ON PHONE): Still looking. JIM FERGUSON (ON PHONE): OK.
Was there one tape or two tapes of backups? TIM LLOYD (ON PHONE): There was one tape
that was in the filing cabinet or-- NARRATOR: Omega was teetering on the brink of collapse,
with hundreds of jobs at stake, and no clues about what had caused the catastrophic shutdown of the computers.
Omega Engineering faced a crisis so immense, it could force the company out of business.
Two weeks earlier, the computer system that contained the plans for all their products had inexplicably crashed.
Time was running out. If Omega couldn't get its computer system back up, layoffs would be inevitable.
-What they lost was the ability to manufacture. And when you're a manufacturing company,
you're dead in the water. NARRATOR: Omega hired Kroll Ontrack, a Minnesota-based company that resurrects data
from crashed computers all over the world. -Any kind of media that actually store data onto, any time they
lose access to this, or for some reason becomes unreadable, we get involved to help restore the data.
NARRATOR: Bob Hackett, a computer forensic expert, began by examining the hard drive on Omega's server.
It's the heart of a computer, where information is magnetically encoded on a disc that's spinning
at 10,000 revolutions per minute. -Physically the hardware, which could be a hard drive or any components used to power
or drive the hardware could have failed, but everything seemed to be operational.
NARRATOR: The drive was physically undamaged. But retrieving the data would mean
examining the electronic contents. Contents that might reveal important evidence.
But Omega management now wondered if the crash might have been sabotage. So to safeguard the hard drive, they
turned it over to the Secret Service. Experts in Computer Fraud, the Secret Service
knew hunting for the loss programs might alter records on the drive. Even just turning on the computer
alters or overwrites some of the information. -From a forensics standpoint, you don't want write to that hard drive.
NARRATOR: The Secret Service made an exact digital replica of Omega's hard drive, a clone, that enabled Ontrack to examine
all the data stored in the original. What Ontrack investigators discovered was startling.
All that remained was fragmented computer code, mostly unintelligible even to computer experts.
This indicated the programs has not been simply deleted. Deleting a computer file erases only the name of the file.
The data actually remains in the computer's memory until it is replaced by something else.
So it's often possible to recover the information. But in this case investigators discovered
that Omega's programs had not only been deleted, they had also been purged. -If we take the analogy of a piece of paper on a desk,
if I was to take that, crumple it up, and throw it in the wastebasket, that would be
equivalent to a deletion on a computer system. I could still go, grab that piece out of the garbage
can unfold it, and look at it. A purge would take that same piece of paper, run it through a shredder, take what came out
through the shredder, throw it up in the air. NARRATOR: Omega's data could never be recovered.
The focus now shifted to a forensic investigation into how and why the data was purged.
Greg Olson, an expert in the operating system used by Omega, examined the drive for signs of a virus.
A virus corrupts data by inserting it's own code into whatever program is being run.
-There are no viruses that would cause this particularly damage. NARRATOR: User error was another possibility,
an accidental deletion. -Very common, we find that a data loss has happened because a computer system administrator has
come in and reinstalled an operating system, or made a mistake by reformatting a hard drive.
And I was able to rule that out effectively by looking at the system. That clearly that that did not happen.
NARRATOR: Because the deletion was to surgical to be accidental. Only the key manufacturing programs had been destroyed.
If it was intentional, it could mean it was an inside job. -They would have to know where the specific programs are
being kept. It's not going to be some kid home alone after school who just randomly breaks into Omega's system,
and knows where those specific files are. You need someone who's on the inside, someone who knows where
the keys to the castle are hidden, and they know how to hurt the company. NARRATOR: The Secret Service first
looked at Tim Lloyd, the man who had designed Omega's computer system. He had recently left Omega for a job at another company.
Supervisors had given him a positive reference. V. GRADY O'MALLEY (ASSISTANT U.S. ATTORNEY):
They said he was a good worker. They said that he was excellent technically. They didn't want to prevent him from getting another job.
NARRATOR: Lloyd had left Omega three weeks before the computer crash. So he didn't have access to the building
to purge the manufacturing programs on the day of the crash. -They were kind of in a quandary as
to who else besides him could have done it. They thought maybe he hacked in from the outside.
But they said they had disconnected any contact from an outside modem, so they knew
that couldn't have been done. NARRATOR: Only supervisors had access to Omega's computer
system at a level necessary to cause this much damage. But there was a problem. -Just about everybody had supervisory rights.
And there were even some accounts that were set up with a name like 12345. It's a really strange name with absolutely no password.
So there was no security on this. NARRATOR: Which meant that the perpetrator could have been anyone.
Six months after the massive computer crash, Omega was struggling to stay afloat.
How had its proprietary software been completely deleted? Kroll Ontracks' Greg Olsen, an expert in the Novell operating
system that controlled the server, sifted the electronic flotsam of the company's hard drive.
-The problem is, is when you do a delete and a purge, the entire road map to know where
this data is is completely gone. So it's literally a needle in the haystack, and impossible to piece this information together.
All you're seeing is a collection of letters and numbers that don't really mean anything.
NARRATOR: Olson relied on sophisticated software to help him search for any suspicious commands.
-What I'm looking for is bits of code that I know in the computer world cause deletion.
In this particular case, what I was zeroing in on was any type of a delete, or even any type of a purge.
Where I really hit gold was when I started taking hits on the search for purge. NARRATOR: Eventually, Olson found a purge command
tied to five other lines of code. -That one seven 39 six, all six lines of this calendar essentially that caused it.
12345 NARRATOR: It was a dangerously efficient bit of programming. -We called it a time bomb, and the actual fuse
was six lines of code. And what it was is really a set of steps that the computer would go through, some checks.
NARRATOR: The first line simply checked the date and compared it to July 30th 1996,
the day before the server crashed. -This fuse can be attached to anybody that's logging in.
So when you come in, what the fuse does is it checks the date. And if it's after the date in the fuse,
it would actually light the time bomb to actually do the deletion. NARRATOR: The second line of code accessed the server.
The third line was a logon command for the mysterious user, 12345, a kind of computer ghost.
The unsuspecting user and 12345 were logged in on the same machine. But 12345 provided the supervisory status
needed to perform deletions. The next line accessed the manufacturing programs. The fifth line launched a program labeled, FIX.EXE.
When Olson looked at the code for this program, he found a troubling clue. The code had been generated from a commonly available deletion
program, but it had been reconfigured to fool anyone using the system. -It did modify the intents of deletion,
but the message that appears on the screen that would normally say, deleting this file, deleting this file,
actually said, fixing this file, fixing this file. NARRATOR: The code was also rewritten to ignore safeguards,
automatically answering yes to the question, are you sure you want to delete these files?
The last line of code was the purge command, making the material unrecoverable. -It would happen relatively fast.
You could go get a cup of coffee, read the front page of the paper, and come back,
and it's all done. It's all gone. NARRATOR: And all the user had to do was turn on the computer.
But Olson and Hackett found other purge commands as well. -That one has a test directory.
NARRATOR: Three similar sets of code dated for February, April, and May. But they only deleted a useless test folder,
which would have gone undetected by the company. -What I deduced from that is essentially somebody
was doing some testing of the application, this particular time bomb to make sure that it would work
before it was truly implemented, and ready to go. NARRATOR: It appeared the tests were done
while Omega's former computer manager, Tim Lloyd, was still at the company. The Secret Service ran a background check
and learned that Lloyd had been disciplined for run-ins with coworkers shortly before leaving the company.
-There was conflict that broke out between other employees, between management, between supervisors.
-He would bottleneck projects just because he was in charge of the projects. That he hadn't tested projects before they
went into production. And so there were a lot of problems. One person even testified that he had elbowed
a female coworker in the workplace. NARRATOR: On August 21s, Secret Service agents
searched Lloyd's home and garage, looking for evidence to tie him to the malicious code.
They found circuit boards, computers, more than 500 disks, several hard drives, and data tapes.
What immediately stuck out was the tape labeled backup with the dates May 14th 1996 and July 1st 1996.
Authorities suspected it was the missing backup tape from omega, but it was blank.
-The dates that we found on some of the tapes had a format date of early August.
-We learned that the backup tape had been reformatted or essentially erased a matter of days
before the search warrant was executed. The next thing we had to do was try to establish additional evidence that would support our theory
that Lloyd was the guy. So what we did was, for example, we went to his time cards.
NARRATOR: Lloyd's time card showed that he worked late on days in February, April and May.
Each time, just prior to the test runs of the time bomb. Then Hackett and Olson found a copy of the time bomb
on one of Lloyd's hard drives. -So the same lines of code that Ontrack had pieced together
from the downed server, they found those lines intact in Tim's home. NARRATOR: A relatively new statute made computer sabotage
a federal offense, if it affected a computer used in interstate commerce and caused more than $5,000
worth of damage. Tim Lloyd was indicted by a grand jury. His case would be the first test of the new law.
Prosecutors in New Jersey say the computer crash devastated omega engineering, leading to $10 million of lost business,
$2 million of reprogramming cost, and 80 employee layoffs. -Probably would have done less damage to the company,
if he had done it with a real bomb. -Doesn't matter really what happens to the building
if your data is gone. -It is a white collar crime that's a very serious crime. It's a non-violent crime, but you know what?
You don't know what the implications are of people losing their jobs. You know maybe there was violence that occurred
as a result of some of these folks losing their jobs, maybe domestic violence. Timothy Lloyd's four week trial began in April 1998.
It would be one of the first criminal cases to explore the arcane world of computer code.
-How would an attorney who hadn't before this had a lot of technical expertise, go into a really high tech field
and explain it to a jury? You're not going to show them fingerprints. You're not going to show them a smoking gun or a bag of coke.
NARRATOR: At trial, prosecutors argued that Lloyd had fallen out of favor with his supervisors,
and grown resentful when he was reassigned. Investigators had been able to prove that Lloyd
developed the time bomb code at home. Then worked late so that he could install and test
the code in secret. He planned on quitting. And was in the process of interviewing
with another company, when he was fired. In fact, he told the recruiter at his new company
that everybody's job at Omega is in jeopardy. He made the remark on July 31st, the same day
the computer crashed. -How would he know that? On the date that that time bomb, nobody even at Omega knew that.
They thought they had a computer problem. That's all they knew. But everybody's job?
I think that was a remarkable find, and something that the jurors were able to pick up on.
NARRATOR: But the most compelling evidence was the bits of code the computer experts found.
-And to have this maliciously damaged and delete and purge all the data from this point
without really having any idea that this was actually happening, and to do it in such a short, quick fashion
was very clever. -And he was gone. Being fired actually helped him. And he probably sat back there and said,
now they'll never connect me to this. But we were able to find a hard drive in this house that had that command on it.
Had we not found that, then he would have gotten away with it. Once you find it at his house, how do you explain that away?
NARRATOR: The jury found Lloyd guilty. Various appeals kept him free for almost four years.
But in 2002, he began serving a prison term of 3 and 1/2 years, and ordered to pay $2 million in restitution.
Lloyd claims he is innocent, and it's someone at omega accidentally deleted the programs.
He says he could have proved that at trial, but his attorney advised him not to take the stand.
-He's the consummate egotist. I think he is absolutely livid that he was discovered.
I think that he was fully intent on getting away with it. In fact, I think consistent with his personality,
he was actually prepared, perhaps, to ride to the rescue. I think that there was a point in time when he was actually
prepared to say, I found it, and I'd ride to the rescue. But when Ferguson says, we're bringing
in the Secret Service-- FERGUSON (ON PHONE): We're at a very, very serious phase.
We're actually bringing in the federal authorities at this point. TIM LLOYD (ON PHONE): I don't blame you.
FERGUSON (ON PHONE): They've taken a real genuine interest in coming in here. Matter of fact, they may be in tomorrow.
-I think that changed his mind. NARRATOR: Omega Engineering never fully recovered, but is still in business.
Kroll Ontrack track was given an award by the Secret Service for the unique role they played in a case
that paved new legal ground. -It was interesting, simply because it was one of the first cases of this type that we had seen.
-Omega made a lot of technical mistakes, but their biggest mistakes were caused by human factors.
It was because they trusted Tim. It was because they had real affection for Tim,
and they thought that he was family. And you let family get away with a lot more
than you would anybody else. You give them a lot more rope to hang themselves with.

A computer crash pushed a manufacturing company to the brink of collapse. Investigators must determine if the crash was the result of a sabotage.

Forensic Files is the longest-running true crime series in television history. Evidence and interviews with experts help solve real crimes, disease outbreaks and accidents around the world.

#truecrime #forensicfiles #fullepisodes Click here to watch full episodes from Forensic Files - Season 8: https://www.youtube.com/watch?v=3gAB0hcY3Z0&list=PLC4mqmKvz1IbdnLKfCt8--pOV0xEpMIP5 Forensic Files is the longest-running true crime series in television history. Evidence and interviews with experts help solve real crimes, disease outbreaks and accidents around the world.

Brief Summary

A computer crash at Omega Engineering leads to an investigation revealing sabotage by former employee Tim Lloyd.

Key points

A Mysterious Computer Crash. A thriving manufacturing company faces collapse due to an unexplained computer crash.
The Time Bomb Code. Investigators discover a malicious code designed to delete vital data.
Tim Lloyd's Indictment. Tim Lloyd is indicted for causing $10 million in damages through computer sabotage.
The Jury's Verdict. Tim Lloyd is found guilty, leading to a prison sentence and restitution.
Omega's Ongoing Struggles. Despite the crash, Omega Engineering remains in business but never fully recovers.

Episode highlights

Episode quotes

It was a bad day in Omega on July 31st of '96.

NARRATOR reflects on the day of the crash

1:42WatchDec 16, 2021

Tension

75/ 100High tension

More from Forensic Files

Solve the Crime

Read a real case one clue at a time, then see how your call held up against the investigators.