Litigation , Standards, Regulations & Compliance

IBM and AT&T lacked basic security controls and hid nation-state hacking breaches from the government, a former IBM threat intelligence official alleged in a newly unsealed lawsuit.

See Also: OnDemand | Protect and Govern Sensitive Data

Former IBM Vice President of Threat Intelligence William Barlow claimed the companies did not keep logs for AT&T-managed VPN connections into IBM cloud services and that the telecom giant did not implement network segmentation to stop foreign hackers from roaming freely into the IBM cloud. The lack of detection and recovery made executives choose to bury warnings and evidence of active exploitation, he said.

The allegations come from a False Claims Act lawsuit filed under seal in 2020 that became public this week after the federal government declined to join as a co-plaintiff. The case is pending in Manhattan federal court. "The IBM core network is routinely hacked by foreign state actors and others," according to the lawsuit.

Barlow said during his tenure at IBM as head of threat intel from 2017 to 2019, his concerns about poor security practices were repeatedly dismissed by the senior executives, who told him to "tone down" and redact information from his reports so the company wouldn't lose public trust and face dismal market performance.

In an emailed statement, an IBM spokesperson said "this complaint was filed six years ago, and the US Department of Justice declined to intervene. IBM is confident that our actions followed the letter of the law." AT&T did not respond to a request for comment.

The lawsuit alleged that IBM received warnings in 2017 from U.S. and allied intelligence agencies that Chinese nation-state activity known as APT 10 penetrate the IBM cloud. An internal report cited in the lawsuit found that IBM identified more than 56,000 signs of potential APT 10 activity from 2013 through 2016, but that the "these indicators could not be investigated further" due to lack of logs.

In all, "the data breaches are so large and the core networks so poorly designed that neither IBM nor AT&T knows exactly what data was breached, who breached the data, where the data was breached, when the data was breached or whether any data was exfiltrated," the lawsuit asserted.

IBM received in 2018 another warning from the U.K. National Cyber Security Center of possible compromises in the company's data systems linked to APT 10, the lawsuit recounted. Two APT 10 hackers, part of China's hack-for-hire network of companies that break into foreign governments under contract, came under U.S. federal indictment in 2018 for intellectual property theft and stealing the records of more than 100,000 U.S. Navy personnel.

The internal IBM report cited by the lawsuit said nonexistent network monitoring from outsourcing to AT&T and slow implementation of endpoint detection and response "have resulted in a 'loss of control' where we can neither detect the movement of the adversary nor stop their activities in a comprehensive and timely manner." The same report also found that an earlier investigation into potential APT 10 activity came up short due to it probing just 1% of relevant systems.