Man arrested over Cisco source code theft

Police in the UK have arrested a man in connection with the theft of source code from networking equipment maker Cisco Systems in...

Police have arrested a man in connection with the theft of source code from networking equipment maker Cisco Systems in May.

The Metropolitan Police Computer Crime Unit searched residences in Manchester and Derbyshire on 3 September, confiscated computer equipment and arrested a 20 year-old man suspected of committing "hacking offences" under the Computer Misuse Act of 1990.

While authorities could not discuss the specifics of the case, the arrest was linked to the Cisco source code, according to Julie Prinsep, a Scotland Yard spokeswoman.

The suspect has since been released on bail and is scheduled to appear before authorities at a London police station again in November, Prinsep said. Computer equipment seized in the searches is being forensically examined, she said.

A Cisco spokesman said in a statement the the company is encouraged that an arrest was made in the case.

"As we have previously reported, we are continuing to co-operate with law enforcement agencies on this matter. We view the arrest as what will likely be one of many steps in this matter.  We will take every measure to protect our intellectual property," the spokesman said.

The arrest marks a major breakthrough in the case, which involves the posting of more than 800Mbytes of source code from Cisco's Internetwork Operating System (IOS) to a Russian website in May.

IOS is a proprietary operating system that runs on much of the networking hardware which Cisco makes.

Malicious hackers made off with code for versions 12.3 of IOS after the thief compromised a Sun Microsystems server on Cisco's network, then briefly posted a link to the source code files on a file server belonging to the University of Utrecht in the Netherlands, according to Alexander Antipov, a security expert at Positive Technologies, a security consulting company in Moscow.

Antipov said he downloaded more than 15Mbytes of the stolen code after an individual using the online name "Franz" briefly posted a link to a 3Mbyte compressed version of the files in a private internet relay chat forum on in May.

The link provided was only available for approximately 10 minutes and pointed to a file on an FTP (File Transfer Protocol) server,, which belongs to the University of Utrecht in the Netherlands. That server is open to the public for hosting files of files smaller than 5Mbytes, according to the university's web page.

Antipov subsequently posted some of that code on a Russian security website,, to call attention to the reported theft, but denied knowing Franz. 

At the time, Cisco said it was working with the US Federal Bureau of Investigation (FBI) to pursue the hackers. The FBI was not able to comment on the arrest.

The arrest in the Cisco theft follows other recent successes in cybercrime cases.

In June, the FBI announced arrests in the source code theft for a much-anticipated version of the popular computer game Half-Life from the network of game maker Valve.

In May, German police arrested men in connection with creating the Sasser internet worm and a Trojan horse program called Agobot. On 9 September, prosecutors in Verden, Germany, indicted an 18-year-old student in the Sasser worm case.

Paul Roberts writes for IDG News Service

Read more on IT risk management