You’re Only As Good As Your Password

Warren Leggett had just spent the long July 4 weekend golfing with his

brother-in-law near Portland, Ore. Early the following Monday morning, his

relaxing holiday ended abruptly. The chief information officer of Niku Corp. (NIKU

), a small Silicon Valley software company, found himself plunged into a

shocking case of alleged corporate espionage–one that raises troubling

questions about the security of company information in the Internet Age.

It all started when Leggett’s brother-in-law, Jay Berlin, a mid-level tech

manager at Nike Corp. (NKE ), agreed to view a demonstration on July 8 of Niku’s

software, which helps companies collaborate on big projects over the Web. The

morning of the meeting at Nike’s suburban Beaverton offices, Berlin checked

his voicemail–which included a message from a salesperson at Niku archrival

Business Engine Software Corp. That’s odd, he told Leggett. He didn’t even

know the firm, and he wouldn’t be the one to buy such software anyway. How did

they know to call him?

Niku’s Leggett and Dibachi have filed a lawsuit against Business Engine

Struck by the coincidence, Leggett says, he dug into Niku’s Web access logs

the next morning and discovered that someone using Internet addresses owned by

Business Engine had used Niku passwords to sneak into Niku’s network more than

6,000 times, downloading some 1,000 documents–including one that Leggett wrote

about the planned demo for Berlin. The allegations are outlined in a lawsuit

filed on Aug. 12 in U.S. District Court in San Francisco. "We never, ever

assumed something like this could be going on," says Niku Chief Executive

Farzad Dibachi. In a written statement, Business Engine said it’s cooperating

with an FBI investigation and does not yet know all the facts around the case.

The alleged high-tech pillaging highlights a vexing problem in today’s

networked corporations: gaping holes in computer security. Passwords, which can

be easily guessed or tricked out of employees, are becoming the Achilles heel of

computer security. On Aug. 14, for example, an associate dean at Princeton

University was removed from his post after admitting he used easily guessed

passwords to access a student admissions site set up by Yale University. Indeed,

an April survey of 500 corporations by the Computer Security Institute found

that 80% of them had been broken into, resulting in combined losses of $455

million. And there are no easy solutions. "For all intents, when they are

using that password, they are inside that network," says Dorothy Denning, a

computer science professor at Georgetown University.

Now the feds are involved. On Aug. 8, at least 2 dozen FBI agents raided

Business Engine’s offices. FBI officials won’t comment. Five days later, a

federal judge issued a temporary restraining order against Business Engine and

ordered it to ask its business partners and customers to return any proprietary

Niku information it may have given them. In an Aug. 20 statement, Business

Engine said it asked Niku to work with an "independent third-party

mediator" to help resolve the case. Niku execs said that, as of press time,

they had not received that request.

The Niku lawsuit doesn’t specify damages. Company officials claim that

using that stolen information, Business Engine was able to become a last-second

competitor on several major deals, including a project at Lloyds of London,

according to court documents.

The loss of big deals couldn’t have come at a worse time for Niku, which is

struggling with the tech downturn. The still-unprofitable Redwood City (Calif.)

company has reduced its staff from 1,100 a year ago to 300 today. In the quarter

ended in July, its sales fell 38%, to $10.5 million, from the year before.

The stolen Niku files, the company contends in the lawsuit, were the crown

jewels of the software company, including upcoming features, lists of potential

customers, pricing, and customizations for clients. The downloaded items also

included one file mentioning that Leggett planned to show Niku’s software to a

project manager from Nike. That file, the only place an invader could have

learned of the Nike meeting, didn’t mention they were related.

That was strange enough, but Leggett says he kept digging and found more. He

was stunned to find that someone outside the company used 15 internal passwords

over and over again. The invasions had occurred since last October. "It was

sheer coincidence," says Dibachi. "Otherwise, who knows how long this

would have gone on?"

Even now, officials aren’t quite sure how the passwords fell into the wrong

hands. It could be weeks or months before Niku and the FBI figure that out. But

for the rest of industry, Niku’s experience is a warning call: The nearly $3.6

billion being spent worldwide on computer security clearly isn’t enough.

By Jim Kerstetter in San Mateo, Calif in BusinessWeek. Copyright 2002 by The McGraw-Hill Companies, Inc