A former Microsoft employee (Russian national Alex Kibkalo) admitted to investigators that he provided confidential company documents and information to a blogger in France. Kibkalo had previously worked in the Microsoft offices in Lebanon and Russia. An email from Kibkalo was found in the blogger’s Hotmail account. The blogger, who was not identified, admitted to posting information on Twitter and his websites and selling Windows Server activation keys on eBay. A Microsoft team named “Trustworthy Computing Investigations” tracked the blogger down. In various email exchanges, Kibkalo apparently was also bragging about breaking into Microsoft’s corporate college and university schools, on the Redmond campus, and copying a server.
Microsoft responded with the following statement to The Verge:
During an investigation of an employee we discovered evidence that the employee was providing stolen IP, including code relating to our activation process, to a third party. In order to protect our customers and the security and integrity of our products, we conducted an investigation over many months with law enforcement agencies in multiple countries. This included the issuance of a court order for the search of a home relating to evidence of the criminal acts involved. The investigation repeatedly identified clear evidence that the third party involved intended to sell Microsoft IP and had done so in the past.
As part of the investigation, we took the step of a limited review of this third party’s Microsoft operated accounts. While Microsoft’s terms of service make clear our permission for this type of review, this happens only in the most exceptional circumstances. We apply a rigorous process before reviewing such content. In this case, there was a thorough review by a legal team separate from the investigating team and strong evidence of a criminal act that met a standard comparable to that required to obtain a legal order to search other sites. In fact, as noted above, such a court order was issued in other aspects of the investigation.
Based on his LinkedIn account, Kibkalo had relocated to Russia and was working for another U.S.-based technology company with offices in Moscow and St. Petersburg. Kibkalo was charged with the federal crime of stealing trade secrets, including an interesting code for a program to protect against copyright infringement. The case was filed in the U.S. District Court for the Western District of Washington at Seattle: U.S. v. Kibkalo, Case No 2:14-mj-00114-MAT.