Fraud Management & Cybercrime , Governance & Risk Management , Insider Threat
'Game of War: Fire Age' Insider Arrested
Fired Employee Charged With Bargaining Trade Secrets for Severance PayA former manager at a software company that makes the popular online multiplayer "Game of War: Fire Age" has been accused of stealing corporate secrets, then attempting to trade the information for a better severance package.
See Also: Free Cybersecurity Awareness Kit
The U.S. Department of Justice says that the FBI arrested Jing Zeng, 42, on Aug. 20 as he attempted to board a Beijing-bound flight departing from San Francisco International Airport. Zeng, who's a naturalized U.S. citizen, has been charged with trade secret theft, under 18 U.S. Code § 1832. If convicted, he faces a maximum sentence of 10 years in prison and a fine of up to $250,000, plus the potential of having to pay restitution.
The complaint against Zeng includes details from IT logs, including VPN access, as well as records of unauthorized access to a sensitive corporate analytics application, thus demonstrating the importance of recording accurate logs relating to all network activity.
The popular "Game of War: Fire Age" is known in part for its television advertisements, which feature American model Kate Upton. The "freemium" game - not related to the HBO series "Game of Thrones" - was reportedly the third highest-grossing Apple app in 2014, and one of the top 10 most downloaded apps via Apple's App Store as well as Google Play.
Zeng appeared in San Francisco federal court Aug. 25 for a bail hearing before Magistrate Judge Joseph C. Spero, after which he was released on a $100,000 bond and placed on electronic monitoring.
The case is just the latest example of prosecutors pursuing the theft of U.S. trade secrets (see U.S. Charges 6 Chinese with Insider Theft). In this instance, Zeng is accused of downloading more than 100 files containing propriety, non-public information from his employer - Machine Zone, based in Palo Alto, Calif. - after learning in June that he was going to lose his job.
Confidentiality Agreement
The case against Zeng centers in part on Tableau, an off-the-shelf data analytics and business intelligence application that is used by Machine Zone "to collect valuable data regarding customer use that is used to optimize the performance of its video game," according to the complaint against Zeng, unsealed Aug. 25, which includes an affidavit signed by FBI Special Agent Cynthia Ho. It notes that Machine Zone limits Tableau access to a small number of engineers, and further limits access on a per-report basis, because the information it contains provides the company with "valuable insight and a huge competitive advantage over other online game providers and competitors."
Zeng joined Machine Zone as the company's director of global infrastructure in 2014, and signed a "confidentiality and intellectual property agreement" stating that he would "not disclose to any 'unauthorized persons' or use for any 'unauthorized purposes' any confidential information" obtained from the company without written consent from a company officer, according to the affidavit. After joining the company, however, Zeng said he wanted to be part of its platform team, according to the affidavit. But company officials told Zeng that they wanted him to remain with the operations team - where he was overseeing the building of a new Las Vegas data center, due for completion in July - and said he could contribute to the platform team from there.
But according to the affidavit, after announcing that he would leave the company - and interview his replacement - Zeng continued to press forward with the platform idea, and on June 17 briefed Francois Orsini, CTO of platform, on his plan to create a new operations team inside the platform group. Executives, however, continued to reject that idea.
At the same time, Zeng was copying corporate data to external devices, according to the affidavit: "On June 19, 2015, the Machine Zone IT department captured log files relating to Zeng's computer for the period June 17, 2015, through June 19, 2015. The files show Zeng attached external storage devices to his laptop."
Zeng allegedly continued to communicate to executives that he planned to start at the new role he had created for himself, as of Aug. 1. But he ultimately appeared to back down, allegedly telling JC Chau, the vice president of technical operations, on July 7 that "I think I screwed myself," and asking for his old operations job back, which Chau declined to give him. In a subsequent human resources meeting on July 10, Zeng allegedly requested that he be allowed to work at the company until his one-year anniversary so that more of his stock options would vest. At that meeting, the company negotiated a new severance package with Zeng and told him to review the document with a lawyer before signing it, according to the affidavit.
Also on July 10, Zeng was using the corporate VPN to access the Tableau database and run more than 100 reports, according to the affidavit. "I have been informed by Machine Zone employees that Zeng had no business reason to do this as it was not part of his job responsibilities," Ho writes in the affidavit, adding that Zeng was allowed to leave on July 10 with his laptop, although his access to the corporate network was later disabled that day at 4 p.m., but not before the IT logs recorded that he had accessed the corporate network again.
On July 14, Zeng requested changes to the separation agreement, and Machine Zone requested that he return the laptop, according to the affidavit. When the IT department received the machine back and detected that the operating system had been reinstalled, it sent the laptop to an outside computer forensic consulting firm. The company allegedly also discovered on July 21 that Zeng had been running Tableau reports, which they correlated with data transfers made via Zeng's corporate VPN connection from July 8 to July 10.
According to the FBI, Zeng then traveled to China from July 17 to August 5.
After his return, Machine Zone reportedly requested a meeting with Zeng. His attorney - Michael Quillinan - said that Zeng would meet with the CEO, Gabriel Leydon, alone and without lawyers, in a café in Palo Alto, "to talk about the laptop concern only," according to the affidavit.
FBI Surveillance
At that point, Machine Zone contacted the FBI and relayed what had been happening, after which the bureau arranged to conduct an audio recording and surveillance of Zeng's Aug. 17 meeting with Leydon. According to the affidavit, Zeng told Leydon that he had copied corporate files to three external hard drives, and suggested one of the drives might be at his girlfriend's house in China, and another at his house in San Ramon, Calif.
Using the hard drives as leverage, Zeng - citing tax bills - said he wanted to renegotiate his severance package, which had been based on three months' salary, and requested a six or seven-month severance package, according to the affidavit. He also warned that he was due to depart for China on Aug. 20.
Quillinan could not be immediately reached for comment on the charge filed against Zeng.