Date: Sat, 20 Feb 93 16:38:00 EDT
From: d.mccauley1@GENIE.GEIS.COM
Subject: File 5--"Time Bomb" Detonated In Pennsylvania

                 Time Bomb Detonated In Pennsylvania
                          by Dennis McCauley
                           copyright, 1993

        A Pennsylvania meat packing company has filed a civil action
in Bucks County Court against its former systems consultant, charging
that the consultant inserted a software "time bomb" into the client's
RealWorld financial accounting system.

        According to the suit filed on behalf of John Lustig Meats,
Inc., the consulting firm, Sparrow Systems, Inc. of Lansdale, PA, had
provided hardware and software support to Lustig for a number of
years. On May 3rd, 1991, Lustig engaged Sparrow to upgrade the
company's RealWorld system to the new version 6.0. The contract
specified customized programming services in addition to software and
installation charges. Lustig paid Sparrow in excess of $20,000 for
installation of the upgrade.

       On September 15, 1991, Lustig's RealWorld system suddenly
crashed. It would no longer accept orders, nor would it generate
customer information, invoices, or receipts. As a result, the suit
claims, Lustig was forced to handle orders manually, and suffered lost
profits and goodwill, as well as additional personnel costs, and
"investigation and analysis" expenses.

       The "investigation and analysis expenses" refer to Lustig's
hiring of a second consultant, who rather quickly found and disarmed
the time bomb, which was date-sensitive, and had been triggered by the
system clock.

        A brief filed on behalf of Sparrow Systems specifically denied
that a time bomb was installed on Lustig's system. It is interesting
to note, however, that in a short article which appeared in a local
newspaper the day after the suit was filed, Sparrow's president,
William Mann, was quoted as saying, "We don't have any comment about
whether we did or did not install a time bomb." Representatives of
Sparrow Systems have refused comment on the case during preparation of
this report.

        Several uninvolved system consultants indicated that
installation of time bombs, while not standard practice, was not
unheard of as a hedge against clients who failed to pay for services.
A counterclaim filed on behalf of Sparrow Systems alleging that Lustig
owes the consulting firm $2,700 seems to support this theory.

       The case raises serious issues about such practices, including
the ethical considerations involved in placing a potentially damaging
software device in anyone's system, much less that of a client.

        While Lustig v. Sparrow is a civil matter, it remains unclear
as to whether criminal action might be an option in similar cases.
Noted computer crime prosecutor Ken Citarella, of the Westchester
County District Attorney's Office, indicated that the critical
question in determining whether a criminal prosecution was warranted
would be ownership of the software in question. In this case, it
appears that Lustig purchased the RealWorld upgrade through Sparrow
Systems, authorizing Sparrow to make certain agreed-upon custom
modifications, none of which was the inclusion of a crippling time
bomb. As of this writing, Sparrow still retains the source code,
pending the outcome of the litigation.

Downloaded From P-80 International Information Systems 304-744-2253