So ends — at least until appeals — Shawn Carpenter's quest for justice. Carpenter, whose story was first written about in TIME magazine in August 2005, was a network security analyst working at Sandia National Laboratories in Albuquerque when he discovered that the lab's network was coming under a methodical series of attacks emanating from Chinese IP addresses. When the Navy veteran found out that dozens of Army bases and defense contractors around the country had been suffering identical Trojan horse attacks on their secure networks, he went to his bosses to present the evidence he had collected and ask for permission to "backhack" the attackers to find out their point of origin.
What followed was an object lesson in bureaucratic torpor. Wary of the gray legal area involved in tracking Internet attacks back to foreign servers, Sandia supervisors told Carpenter that it wasn't in the lab's interest to follow or stop the attackers. They ordered him to stop and not to share information on the attacks, even after the FBI had requested permission to have him work the case under their supervision.
The attacks — code named Titan Rain — are still hitting secure government networks here and abroad. And the country can thank in large measure the type of fecklessness that Sandia's managers showed in handling Carpenter's case. Sandia actually has a huge security apparatus designed to ensure that the nuclear lab's secrets stay safe. But when Carpenter said he would continue trying to solve the case on his own time as a matter of conscience, Sandia trained that security apparatus on him. They investigated him, harangued him, stripped him of his security clearance and ultimately fired him.
A Sandia spokesman declined on Tuesday to respond to specific allegations, but said that Sandia is "disappointed by the verdict" and might appeal. He also repeated earlier Sandia assertions that Carpenter had stepped beyond clear boundaries.
I myself was skeptical of Carpenter's story when I first met him. And, after months of investigating his claims about his firing and the attacks that he tracked down, I still think he can be amazingly pigheaded, ignoring his own best interests and exasperating those around him when he thinks he's right.
But the thing is, he was right. And he fought a good fight. Not only against the hackers from China (until the FBI itself got cold feet and told him to stop), but also against the government bureaucracy that wronged him. Carpenter sued for wrongful termination. In response, the nuclear lab spent untold amounts of taxpayer money (that's right: his money, my money, and your money) on a legal strategy that appeared to be designed to run up Carpenter's bills long enough to force him to drop the case. They made him fly back from his new home in Washington, D.C., to New Mexico for settlement talks that Carpenter says wouldn't even have paid his lawyers' fees. They buried him and his lawyers in discovery documents. But Carpenter, who since had his security clearance restored and is a contractor with another federal agency, never wavered. In that quintessentially American way, he still wanted his day in court. Along the way, he became a minor cult hero among networks geeks and stubborn patriots.
It's still unclear whether this verdict will do anything to actually chasten Sandia into changing its management culture. But for all those in favor of government accountability, and for anyone who likes to see a David occasionally win against Goliath, Shawn Carpenter's victory in court is worth cheering.