We’ve all had frustration at work, especially when a job doesn’t go as planned. Maybe you’ve had a boss who doesn’t seem to understand your value or a company that’s made decisions that leave you feeling sidelined. While most of us just complain to coworkers or vent on social media, one Texas-based software developer took it to the extreme, crafting a “kill switch” that activated when he was fired.
When Lu sensed his job might be in jeopardy following a corporate reorganization, he methodically designed and planted malicious code throughout his employer’s network—code specifically engineered to trigger catastrophic system failures if and when the company terminated his employment.
This wasn’t a simple case of changing a password or deleting a few files on the way out. Lu created an elaborate “kill switch” that would automatically activate upon his dismissal, causing widespread disruption across the entire corporate network and affecting thousands of employees globally. It was digital sabotage executed with a level of premeditation that would ultimately lead to serious criminal charges and a conviction in federal court.
Who is Davis Lu?
Davis Lu, a 55-year-old software developer from Houston, worked at Eaton Corp., a global power management company. Lu was a valuable employee for over a decade, contributing to the company’s technical operations. However, in 2018, Eaton Corp. underwent a corporate realignment that drastically reduced Lu’s role and responsibilities. This restructuring cut his system access and sidelined him from key projects. It was clear to Lu that the company was preparing for his eventual departure.
According to the Department of Justice, “Following a 2018 corporate realignment that reduced his responsibilities and system access, Lu began sabotaging his employer’s systems. By Aug. 4, 2019, he introduced malicious code that caused system crashes and prevented user logins.” His frustration with the changes and his diminishing role likely fueled his decision to take matters into his own hands. Instead of quietly accepting the situation, Lu set the stage for a digital form of retaliation that would cost the company millions.
The Kill Switch: A Digital Time Bomb
Lu’s method of retaliation wasn’t just a grudge or a bad mood; it was a calculated move designed to cause maximum chaos. He created what’s commonly called a “kill switch” — a piece of malicious code that would go into action once a specific condition was met. In his case, the trigger was simple: if Lu were fired, the code would activate and cause serious problems within Eaton’s network.
He called his deadly creation “IsDLEnabledinAD” — a name that was as straightforward as it was sinister. The code checked whether his name was still listed as an active employee in the company’s internal directory. As long as Lu’s status read “yes,” the code remained dormant, posing no threat. However, when he was eventually terminated on September 9, 2019, and his status switched to “no,” the kill switch activated.
The Malicious Code: Sabotage on a Grand Scale
Lu didn’t stop at creating a simple trigger. He meticulously crafted several pieces of code designed to destroy the company’s systems. One such code created “infinite loops,” essentially overwhelming Eaton’s servers by generating endless threads, which led to system crashes and slowdowns. Other parts of his code deleted vital profile files, locking employees out of their accounts. His system-wide sabotage crippled the company’s ability to operate effectively.
The real kicker was the code that caused the network-wide lockout when Lu’s credentials were disabled. The code was as personal as it was malicious — it was Lu’s way of ensuring that no one could do their job if he couldn’t have the job. Employees across the globe found themselves locked out of their systems, their files vanished, and operations grumbled.
Lu also gave his codes cryptic names. “Hakai” — meaning “destruction” in Japanese — was one of the pieces he designed to bring chaos to Eaton’s network. Another piece, “HunShui,” meaning “sleep” or “lethargy” in Chinese, further emphasizes his intent to disable the company’s systems entirely.
September 9, 2019: The Day of Chaos
On the day Lu was let go, Eaton Corp. had no idea what was about to happen. As soon as his credentials were disabled, the kill switch went into full effect, and the company plunged into panic. Thousands of employees, unable to access their work systems or retrieve their files, faced a nightmare scenario.
It wasn’t just a matter of inconvenience — the company’s operations ground to a halt. Employees couldn’t do their jobs without the ability to log into systems or access critical files. The financial impact was immediate, and Eaton Corp. would later estimate losses in the hundreds of thousands of dollars due to Lu’s actions.
How Lu Was Caught
It didn’t take long for Eaton to begin investigating the incident. The company quickly realized that a random hacker could not handle the scale and sophistication of the attack. No, this was an insider job, and the trail led straight to Davis Lu.
Authorities soon uncovered that Lu had been preparing for this moment for over a year. His internet search history revealed that he had been researching hacking techniques and methods for hiding malicious code in the months following his firing. Lu even deleted encrypted data from his company laptop when he was instructed to turn it in.
FBI Special Agent in Charge Greg Nelsen weighed in on the severity of Lu’s actions, stating, “Sadly, Davis Lu used his education, experience, and skill to purposely harm and hinder not only his employer and their ability to safely conduct business, but also stifle thousands of users worldwide.” Lu’s methodical sabotage left a lasting impact on his employer and countless innocent employees and global operations.
Eaton’s IT team found that the code was unmistakably tied to Lu. Not only had he written it himself, but the pieces of code were marked with his references. It became clear that this wasn’t a crime of opportunity — it was premeditated.
The Legal Consequences: A 10-Year Sentence Looms
After the FBI traced the attack back to Lu, he was arrested and charged with intentionally damaging protected computers. Lu now faces serious legal consequences for his actions, including a potential sentence of up to 10 years in prison. According to a press release by the Office of Public Affairs of the Department of Justice, ‘’The jury convicted Lu of causing intentional damage to protected computers, for which he faces a maximum penalty of 10 years in prison. A sentencing date has not been set. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.’’ His trial and conviction highlight the severity of cybercrime and the punishments that can follow such extreme measures.
While his defense team argues that the financial damage was closer to $5,000, the company estimates that the actual losses were much higher, with the ripple effect impacting their operations globally. Regardless of the financial sum, the legal implications are clear: Lu’s calculated sabotage could cost him a decade behind bars.
Why Did He Do It? Understanding the Motive
At first glance, it might seem that Lu’s actions were those of an angry employee exacting revenge. And while that’s partly true, it’s worth considering what motivated him to go to such extremes. Was this just about a demotion, or was it a deep-seated feeling of being wronged by the company that led to his drastic retaliation?
In many cases, workplace frustration can build over time, especially when employees feel that their contributions are undervalued or that their career paths are blocked. Lu’s situation highlights the emotional toll corporate changes take on an individual, especially when those changes signal the end of a career. While most people would find healthier outlets for their frustration, Lu chose to take things to an unprecedented level.
Lessons Learned: The Dangers of Digital Retaliation
The tale of Davis Lu is cautionary for both employees and employers. It underscores the importance of securing networks and systems from potential internal threats for companies. After all, employees like Lu possess intimate knowledge of a company’s inner workings, which can be weaponized if disgruntled.
For employees, this story highlights the potential consequences of acting out destructively. While it may seem satisfying at the moment, the long-term repercussions — legal, financial, and personal — can be devastating. Lu’s actions destroyed his career and impacted thousands of innocent coworkers who had no role in the decisions that led to his firing.
A Reminder of the Cost of Digital Retaliation
For employers, the case underscores the importance of robust security practices, particularly around privileged access management and employee transitions. Companies should implement monitoring systems to detect unusual code changes, conduct regular security audits, and establish thorough offboarding procedures.
Organizations should also balance security measures with efforts to create positive workplace cultures where employees feel valued. Corporate reorganizations should be handled with transparency and empathy to prevent the deep resentment that can motivate malicious actions.
For employees, Lu’s case serves as a stark reminder of the serious legal consequences that can result from digital sabotage. The temporary satisfaction of striking back at a company perceived to have wronged you is far outweighed by the permanent impact of a federal conviction.
For the broader technical community, Lu’s case reinforces the need for strong ethical frameworks in professional practice. Technical knowledge comes with responsibility, and professional ethics demand that this knowledge be used to build and protect, not to damage and disrupt.
