A 51-year-old man from New Jersey has received the longest prison sentence for attempting a crime to damage a computer system.
Yung-Hsun Lin (a.k.a Andy Lin), a systems administrator, was given 30 months in jail for planting code on a computer server in 2003 that was supposed to destroy a medical drug database. He also has to pay $81,200 in restitution to his former employer, Medco Health Solutions, ordered by the US District Judge Jose Linares.
The story goes along like this. Lin was employed at Medco because he was “proficient in the HP-Unix computer language designed to operate computer servers,” according to court documents seen by Ars Technica. In the fall of 2003, he learned that the company was to lay off some system admins and sent off e-mails to his colleagues that he wasn’t sure that he would survive.
A day later, he decided to plant a piece of code into the servers to delete almost everything once triggered. “Among other information, the Destructive Code was designed to delete the Drug Utilization Review Database], as well as databases identifying subscribers, plan coverage, prescription administration, and billing data,” read the court document. The code was written to be activated on April 23, 2004 – Lin’s birthday.
However, Lin had gotten a little bit ahead of himself, because several days later, Medco did lay off four system admins – none of them were him. A month after that, Lin attempted to edit the code so it wouldn’t deploy as scheduled. It turns out that Lin wasn’t as good in programming as he thought, because the code deployed right on schedule. It also turns out that he was really bad at programming, because the code failed to delete anything due to a bug, to Medco’s relief.
That’s not all; Lin figured out the bug and decided to make the code go off a year later. Fortunately, another Medco system admin found the code while looking into another system error in January 2005, and Lin was officially caught. He pleaded guilty to one count of transmitting computer code with the intent to cause damage in excess of $5,000 and he was sentenced this week.
The US Attorney General for New Jersey, Christopher Christie, has praised Medco for moving quickly and turning the case to the government.