Titan Rain
The analyst who followed the intrusion, and lost his job for it
Shawn Carpenter, a security analyst at Sandia National Laboratories, traced a series of intrusions into defence contractor networks and found a sustained, organised campaign systematically removing sensitive material — later given the codename Titan Rain and widely attributed to actors operating from China.
He shared his findings with the FBI and Army counterintelligence. Sandia dismissed him for doing so. He sued for wrongful termination and won substantial damages.
The point at which persistent state-sponsored intrusion became visible in the West — and a case study in organisational incentives, where the institution treated disclosure as the incident.
The Hacker Chronicles
Volume Two — Going Pro
This page is the summary. The chapter — ‘Titan Rain’ — follows the case properly: what was known at the time, who decided what, and how it actually unfolded rather than how it was later retold.
Two more volumes this year.
Going Geopolitical in October, Going Strategic in December.
Never shared, never sold. One-click unsubscribe.
Or email contact@ronanblake.co.uk
with ‘list’ in the subject.