In March 2019, Dov Goldstein became the primary suspect in a high-profile investigation concerning an information leak. Goldstein, an engineer at TDC, Denmark’s leading telecommunications company, was suspected of supplying confidential contract bid information to Yang Lan, a local representative of Huawei. TDC handles classified communications for the Danish government.
TDC initiated an internal investigation after confidentially for a $292 million contract appeared compromised. The two competitors for the contract, Huawei and Sweden’s Ericsson, had submitted their final offers privately to lead TDC’s transition to a 5G network. A sudden, last-minute revised submission by Huawei raised concerns from TDC executives and eventually led to the discovery of Goldstein’s involvement.
On March 4th, 2019 at 2:52 AM, Huawei unexpectedly submitted an emergency revised bid, which was considerably lower than their previous submission and undercut Ericsson by a suspiciously narrow margin. TDC executives suspected that details of the bids had been leaked, prompting an internal investigation. Initially, investigators suspected that the leak might have resulted from an external cyber intrusion. After finding no evidence of hacking the investigation shifted focus to the possibility of an insider threat. Only six TDC executives had access to the confidential bids. The internal investigation determined the following:
1. Video surveillance identified Goldstein as the prime suspect, leading to a forensic analysis of his laptop and phone records.
2. Someone had installed multiple long-range microphones in the TDC company boardroom. Investigators were unable to determine who installed them or why.
3. Goldstein maintained regular and extensive communication with Yang Lan, Huawei's country manager in Denmark.
Phone records indicated a 4½-hour dinner between Goldstein and Yang Lan at the Hotel d’Angleterr the day after Huawei submitted its initial bid for the 5G contract in October 2018. On February 26, 2019, TDC’s 5G committee made a preliminary decision to award the contract to Ericsson. The following day, Goldstein made several calls to Lan to arrange a meeting on March 4th. Just hours after this meeting, Huawei submitted their emergency revised bid.
A forensic analysis of Goldstein’s laptop revealed that on the morning of his meeting with Lan, a folder containing Ericsson’s final offer, and five PowerPoint presentations intended for TDC’s board and the 5G committee had been accessed. Additionally, CCTV footage from TDC’s security department captured Goldstein leaving the facility with his laptop in hand.
TDC's investigators reported being surveilled on city streets and at a restaurant where several team members met. The TDC security team then moved its investigation to the Plesner law firm with whom TDC had a relationship. The Plesner building security staff reported a drone hovering outside the 15th floor office where the team met.
TDC concluded that Goldstein was responsible for the information leak. No criminal charges were filed. Goldstein resigned from his position at the company in June 2019.
Denmark accepted Erickson’s offer. The government received a letter from the Chinese embassy threatening a negative impact on the relationship with China. Yang Lan permanently left the country returning to Huawei's headquarters in Shenzhen.
Tradecraft
Use of open emails and phones between Goldstien and Lan.
No indication of Operational Security measures
Lan spent six years cultivating Goldstien as a friend, often treating him to expensive meals.
There was no indication of financial payments to Goldstien.
There were indications of physical and technical surveillance.
Over the years, Lan spent lavish sums cultivating several friends at TDC.
Lan’s personal behavior made TDC senior executive vice president Jens Aalose suspicious that Huawei had access to inside information on Erickson’s bid.
Comments