Former coder sentenced for insider sabotage with kill switch in Ohio

A former software developer has been sentenced to four years in prison for sabotaging his former employer’s network in Ohio, deploying custom malware including an automatic “kill switch” that locked thousands of users out when his credentials were disabled. Davis Lu, 55, a Chinese national living in Houston, worked for an Ohio-based company from 2007 until his termination in 2019. After a 2018 realignment reduced his responsibilities, Lu is accused of embedding disruptive code into the Windows production environment, triggering outages and hundreds of thousands of dollars in losses.

The case centers on Lu’s actions beginning in 2019, after the company reorganized and demoted him. Investigators say Lu introduced an infinite loop in Java that exhausted server resources, causing production systems to crash or hang. He also created a kill switch tied to his own Active Directory status, designed to lock out all users if his account was disabled. The kill switch, coded as IsDLEnabledinAD, activated automatically when Lu was placed on leave and asked to surrender his laptop, cutting access for thousands of employees globally. In the aftermath, investigators found Lu had deleted...