Department of Justice

U.S. Attorney’s Office

District of Minnesota

---

FOR IMMEDIATE RELEASE

Tuesday, October 10, 2017

Former Employee Of Transcontinental Railroad Company Found Guilty Of Damaging Ex-Employer’s Computer Network

Acting United States Attorney Gregory G. Brooker of the District of Minnesota and Acting Assistant Attorney General Kenneth A. Blanco of the Justice Department’s Criminal Division today announced the conviction of a former employee of Canadian Pacific Railway for causing intentional damage to Canadian Pacific’s computer network. CHRISTOPHER VICTOR GRUPE, 46, was charged on April 11, 2017, with one count of intentional damage to a protected computer and on October 6, 2017, following a five-day trial, was found guilty by a federal jury in Minneapolis, Minn. A sentencing date has not been set.

“IT professionals with both substantial technical skills and trusted high-level access to the computer systems on which they work can cause significant and potentially catastrophic damage to businesses and critical infrastructure, and so when they use their skills and access to commit crimes there should be real consequences,” said Assistant U.S. Attorney Tim Rank. “This guilty verdict, which was the result of a thorough investigation by the FBI, demonstrates that there will be. I am grateful to the jury for their time and service.”

As proven at trial, from September 2013 until December 2015, GRUPE was employed as an IT professional by Canadian Pacific Railway (CPR), a transcontinental railroad company headquartered in Alberta, Canada, with US headquarters in Minneapolis, Minnesota. On December 15, 2015, following a twelve-day suspension, GRUPE was notified by CPR management that he was going to be fired due to insubordination. However, at his request, GRUPE was instead allowed to resign, effective that same day. In his resignation letter, GRUPE indicated that he would return all company property, including his laptop, remote access device, and access badges, to the CPR office.

However, on December 17, 2015, before returning his laptop and remote access device, GRUPE used both to gain access to the CPR computer network’s core “switches” – high-powered computers through which critical data in the CPR network flowed. Once inside, GRUPE strategically deleted files, removed administrative-level accounts, and changed passwords on the remaining administrative-level accounts, thereby locking CPR out of these network switches. GRUPE then attempted to conceal his activity by wiping the laptop’s hard drive before returning it to CPR.

On January 6, 2016, while trying to address a networking problem, the CPR network staff discovered that they were unable to access the main network switches. After CPR IT staff was able to regain access to the switches through a risky, but successful, rebooting procedure, they discovered evidence in logging data stored in the memory of the switches connecting the damage to GRUPE. CPR hired an outside computer security company to identify the source and scope of the intrusion as well as conduct an incident analysis, which also connected the damage to GRUPE. In total, CPR experienced a financial loss of approximately $30,000 as a result of GRUPE’S conduct.

This case is the result of an investigation conducted by the Federal Bureau of Investigation, with assistance from the Digital Forensic Laboratory of the Criminal Division’s Computer Crime and Intellectual Property Section.

Assistant United States Attorney Timothy C. Rank of the District of Minnesota and Trial Attorney Aaron R. Cooper of the Criminal Division’s Computer Crime and Intellectual Property Section are prosecuting the case.

Defendant Information:

CHRISTOPHER VICTOR GRUPE, 46

Minneapolis, Minn.

Convicted:

• Intentional damage to a protected computer, 1 count
   

###