Police: Laid-off IT worker hacked former employer

MISSOULA (AP) — A laid-off information technology administrator that a Missoula company attempted to hire back on a temporary basis after computer servers crashed was the person who hacked into the system that caused the problems to begin with, authorities said.

The Missoulian reports (http://bit.ly/u4er6e ) that Vladimir Ivanovich Shved was charged Friday in District Court with two felony counts of unlawful use of a computer. His bail was set at $5,000.

According to court records, the company's computer system had been damaged in such a way that only someone with backup files could repair the problem. When Shved's former employer contacted him about returning to work on a temporary basis, Shved "made a counter offer and demanded a three- to five-year consulting contract at $100 to $150 per hour in exchange for the work."

Authorities said Shved was one of six employees laid off Oct. 25 from Edulog, which provides software for school bus routing and scheduling. Problems also developed at a sister company, Logisys, which provides software for law enforcement, fire and emergency management services.

Company officials said computer systems crashed on Nov. 2 and workers trying to restore the system found backup servers had been erased.

The Missoula County Attorney's Office said that on the day the computer system crashed, Shved sent a text message to former colleague and Edulog employee Matthew Horvath that said: "Do you know what is going on over there? I have been called 100 times today."

Court documents say that when Horvath told Shved what was happening, Shved told Horvath to do a "normal restart" of the server.

Missoula County Deputy Prosecutor Jason Marks wrote in court documents that "had Horvath followed through on that advice, another server would have been erased."

Edulog employee Jason Barker made the connection between Shved and the crashed servers, authorities said, by finding computer log files on Shved's former work computer. Authorities said the evidence included a history of secure connections to the company's computer system both before and after Shved was laid off.

Edulog workers trying to repair the system "discovered several of the servers had been erased of data and were running based only on what was in current memory, which would be permanently erased as soon as a server was rebooted, disabling that server even further," according to court documents.

Company employee Ryan Reed told authorities that other company computers were found with malicious changes made on the day Shved was laid off and on the day the servers crashed.

"These changes substantially disabled the ability of Logisys/Edulog to have their computer systems in working order, and also took down many of their clients for approximately five days," authorities said in court documents.

Edulog said it has paid a company called Blackfoot Telecommunications Group more than $6,000 so far to fix the computer problems.