SINGAPORE: A “human oversight” enabled a former NCS employee to enter its computer test system even after he was fired, as his access was not immediately terminated, the infotech company told CNA on Wednesday (Jun 12).
Kandula Nagaraju, 39, was sentenced to two years and eight months’ jail on Monday for the offence of unauthorised access to computer material.
Upset about being fired, he accessed the company’s computer system multiple times using the administrator login credentials. He later ran a programmed script to delete 180 virtual servers.
In response to CNA’s queries, NCS said this was an “isolated incident” involving a former contract employee who had been part of a team managing the quality assurance (QA) computer system at NCS.
This QA system comprises a test environment where new programs and software are tested before they are launched.
“Due to a human oversight in administering the standalone test environment, the perpetrator’s access to the test environment wasn’t terminated immediately upon departure from the company,” said NCS.
“Once the unauthorised access was discovered, all access was immediately terminated, and a police report filed.”
POOR WORK PERFORMANCE
Kandula was part of a 20-member team managing the QA computer system at NCS between November 2021 and October 2022.
The system consisted of about 180 virtual servers, and no sensitive information was stored on them.
His contract with NCS was terminated in October 2022 due to poor work performance and his official last date of employment was Nov 16, 2022.
According to court documents, he felt “confused and upset” when he was fired as he felt he had performed well and “made good contributions” to NCS during his employment.
He returned to India where he used his laptop to gain unauthorised access to the system on six occasions between Jan 6 and Jan 17, 2023.
In February that year, Kandula returned to Singapore after finding a new job. He rented a room with a former NCS colleague and used his Wi-Fi network to access NCS’ system once on Feb 23, 2023.
During the unauthorised access in those two months, he wrote some computer scripts to test if they could be used on the system to delete the servers.
In March 2023, he accessed NCS’ QA system 13 times. On Mar 18 and 19, he ran a programmed script to delete 180 virtual servers in the system. His script was written such that it would delete the servers one at a time.
Kandula’s laptop was seized by the police in April and the script used to carry out the deletions was found on it.
Investigations revealed that he had searched on Google for scripts to delete virtual servers, which he then used to code the script.
At all times, he was aware after his employment with NCS ended that he was not authorised to access the system. As a result of his actions, NCS suffered a loss of S$917,832.
NCS said on Wednesday that it has stringent processes and controls in place, and that it will continue to monitor and enhance them.
“While this is a one-off incident, NCS has a zero-tolerance policy towards such wrongful conduct and expects all personnel to serve with integrity and honesty,” it added.
