ALEXANDRIA, Va. (CN) – Taking a fired tech consultant to court, the College Entrance Examination Board says the man tried to extort it on his way out, threatening to share trade secrets with national news organizations unless the board paid up.
Abbreviating its name to CEEB, the board brought the complaint in Alexandria with its staffing agency, Judge Technical Services Inc.
The Dec. 13 complaint comes exactly one week after the board claims it received a threatening email from its former director of information security and compliance, Carl John Kelle.
“I did not ever want to do this,” Kelle wrote, as documented in an exhibit filed with the complaint. “I wanted to work for you until retirement. But you cut me, no notice at all…So I have interviews established with three national scope news organizations.”
The board gives no reason for why it terminated Kelle’s contract on Dec. 5, saying only it was within its rights to do so.
Kelle’s email, some of which is redacted, continues: “All I ask for [sic] to not have those discussions are six weeks severance payable at the same rate you have been paying me in full before Friday, December 16.”
“No discussions, no arguments, except the first lawyer I hear from [sic] then I will speak with the press,” the email concludes.
Court records do not show if the Arlington man has retained an attorney.
The board says it hired Kelle in August as a temporary consultant through Judge Technical Services Inc. Earning $70 an hour for his services, according to the complaint, Kelle would have netted roughly $16,800 if the board complied with his alleged request.
Kelle was assigned to assist with data security and vulnerability evaluation, and the board says any disclosure of its confidential data would violate a written agreement Kelle signed with the staffing agency when he was hired.
“Having been hired to analyze and enhance CEEB’s security, Kelle used that precise knowledge to instead attempt to extort money from CEEB by threatening to disclose any potential vulnerabilities in those security systems to third parties,” the complaint states.
The board says it began studying Kelle’s digital records in depth when it received his Dec. 6 email. That investigation showed that the one-time compliance director had started amassing its confidential data from his very first day on the job.
Kelle used CEEB’s email system, according to the complaint, to forward more than 1,800 emails to his own unsecure personal email account. It says Kelle had made it so that any communication made through his work email would automatically forward to his personal, allowing Kelle to create the illicit cache with ease.
The documents contained detailed blueprints of CEEB’s data security systems, operating procedures, infrastructure and an extensive list of potential weaknesses in CEEB’s cyber network.
These blueprints, according to the complaint, describe databases where the board keeps student test scores or other “personally identifiable information.” There were also detailed security maps information containing the board’s”disaster recovery program,” according to the complaint.
The board says firewalls, port addresses and CEEB network IP addresses were found in the misappropriated documents as well. If released, according to the complaint, any of these items “could be used as a roadmap for hackers to specifically target CEEB’s most sensitive information.”
“Having this access makes it easier for a hacker to navigate within CEEB’s networks to find exactly what they are looking for,” the complaint states.
Saying Kelle still has the board emails on his personal devices, the board and its staffing agency want an injunction to bar Kelle from accessing or distributing any information further. The companies also want the U.S. Marshal’s office to seize Kelle’s phone, computers and/or tablets for forensic imaging.
If Kelle does not cooperate or distributes proprietary information, the board contends that its “multiple years building its strong reputation and goodwill” in the industry will be quickly and catastrophically undone.
“The harm caused to Judge’s reputation and goodwill would result in monetary losses of at least six figures, before even taking into account the expenditures that would be necessary to begin to remediate the harm caused by Kelle’s unlawful conduct,” the complaint says.
In addition to the injunction request, the board says it will file a separate arbitration suit.
The board and staffing agency are represented by Joseph Schuler and Erik Winton of Jackson Lewis in Reston, Va. Winton declined to comment outside the complaint.