Former It Employee Of Transcontinental Railroad Sentenced To Prison For Damaging Ex-Employer’s Computer Network

WASHINGTON – A former IT employee for the Canadian Pacific Railway was sentenced today to one year and one day in prison for causing intentional damage to critical portions of Canadian Pacific’s computer network.

Acting Assistant Attorney General John P. Cronan of the Department of Justice’s Criminal Division, U.S. Attorney Gregory G. Brooker of the District of Minnesota and Special Agent in Charge Richard T. Thornton of the FBI’s Minneapolis Field Office made the announcement. 

CHRISTOPHER VICTOR GRUPE, 46, was sentenced by U.S. District Judge Patrick J. Schiltz of the District of Minnesota. GRUPE was convicted of one count of intentional damage to a protected computer on Oct. 6, 2017, following a five-day jury trial in Minneapolis, Minnesota.

“The defendant in this case, a former IT professional, has been convicted of a felony, is going to prison, has lost his IT job and will likely never work in the IT industry again, and had to resign from the Army after losing his security clearance,” said Special Agent in Charge Thornton. “These are real consequences. The FBI, along with our law enforcement partners, will continue to aggressively pursue cases such as this to ensure that those with technical skills and trusted access to computer systems like Christopher Grupe who then betray that trust and commit computer crimes will be caught and punished.”

“Christopher Grupe chose to seek revenge on his employer by abusing company assets and insider knowledge that was entrusted to him to make the railroad safer, not more dangerous,” said Assistant U.S. Attorney Tim Rank. “Today’s sentence is an appropriate consequence for the defendant’s deliberate and malicious actions.”

As proven through evidence presented at the trial, from September 2013 until December 2015, GRUPE was employed as an IT professional by Canadian Pacific Railway (CPR), a transcontinental railroad company headquartered in Alberta, Canada, with U.S. headquarters in Minneapolis. On Dec. 15, 2015, following a 12-day suspension, GRUPE was notified by CPR management that he was going to be fired due to insubordination. However, at his request, GRUPE was instead allowed to resign, effective that same day. In his resignation letter, GRUPE indicated that he would return all company property, including his laptop, remote access device, and access badges, to the CPR office.

The evidence presented at the trial proved that on Dec. 17, 2015, before returning his laptop and remote access device, GRUPE used both to gain access to the CPR computer network’s core “switches” – high-powered computers through which critical data in the CPR network flowed. Once inside, GRUPE strategically deleted files, removed administrative-level accounts, and changed passwords on the remaining administrative-level accounts, thereby locking CPR out of these network switches. GRUPE then attempted to conceal his activity by wiping the laptop’s hard drive before returning it to CPR.

The evidence presented further showed that on Jan. 6, 2016, while trying to address a networking problem, the CPR network staff discovered that they were unable to access the main network switches. After CPR IT staff was able to regain access to the switches through a risky, but successful, rebooting procedure, they discovered evidence in logging data stored in the memory of the switches connecting the damage to GRUPE. CPR hired an outside computer security company to identify the source and scope of the intrusion as well as conduct an incident analysis, which also connected the damage to GRUPE.

This case is the result of an investigation conducted by the FBI, with assistance from the Digital Forensic Laboratory of the Criminal Division’s Computer Crime and Intellectual Property Section.

Assistant U.S. Attorney Timothy C. Rank of the District of Minnesota and Trial Attorney Aaron R. Cooper of the Criminal Division’s Computer Crime and Intellectual Property Section are prosecuting the case.

Defendant Information:

CHRISTOPHER VICTOR GRUPE, 46

Minneapolis, Minn.

Convicted:

• Intentional damage to a protected computer, 1 count

Sentenced:

• One year and one day in prison

###

Additional news available on our website.

Follow us on Twitter and Facebook.

United States Attorney’s Office, District of Minnesota: (612) 664-5600