Beginning in 2003, Sandia National Laboratories analyst Shawn Carpenter investigated intrusions affecting Sandia networks and identified patterns that also appeared in breaches at Lockheed Martin, Redstone Arsenal, and NASA. Carpenter concluded that the activity was connected to a sophisticated cyberespionage operation later code-named Titan Rain by the FBI and reported his findings to Army cyber-counterintelligence agents, who verified the report and involved the FBI. He then served for roughly six months as a confidential informant while continuing to work at Sandia.
Sandia management had instructed Carpenter to limit his attention to Sandia systems and drop the broader investigation. The company terminated him after discovering his communications with investigators. During litigation, counterintelligence chief Bruce Held acknowledged using the word “decapitate” during Carpenter’s termination hearing and apologized; Carpenter said the exchange included a threat of bloodshed. On February 13, 2007, a New Mexico jury found Sandia’s handling of the termination malicious, willful, reckless, wanton, fraudulent, or in bad faith, awarding nearly $4.7 million in compensatory and punitive damages. Sandia’s post-trial challenges failed, and it dropped its appeal in October 2007 while interest accrued on the judgment.
