Ex-Microsoft employee charged with passing blogger trade secrets Prosecutors: Angry worker sent blogger Windows 8 code, internal documents

Image 1 of / 11 Caption Close Ex-Microsoft employee charged with passing blogger trade secrets 1 / 11 Back to Gallery

An ex-Microsoft Corp. employee accused of leaking Windows 8 code to a tech blogger -- and bragging about breaking into the Redmond campus -- now faces federal criminal charges following allegations that he stole trade secrets.

Arrested Wednesday, software architect Alex Kibkalo is accused of stealing Microsoft trade secrets while working for the company. Investigators contend Kibkalo was also caught bragging about leaking Windows 7 program files, as well as an internal system meant to protect against software piracy.

Having spent seven years working for Microsoft, Kibkalo is alleged to have leaked Windows 8 code to a French technology blogger in mid-2012, prior to the software’s release. Kibkalo was apparently angry over a poor performance review.

Writing the court, a Seattle-based FBI special agent said Microsoft brought its concerns to him in July, nearly a year after corporate investigators suspected Kibkalo had leaked parts of Windows 8. He is said to have admitted to passing the information to the blogger – unidentified in charging papers – after a meeting in an online forum.

Kibkalo, a Russian national who worked there and in Lebanon for Microsoft, is also alleged to have stolen Microsoft’s “Activation Server Software Development Kit,” a propriety system used to prevent the unauthorized copying of Microsoft programs.

Speaking with the FBI, a Microsoft manager said the software development kit “could help a hacker trying to reverse engineer the code” used to protect against software piracy, according to charging papers.

Microsoft came to believe Kibkalo sent the software development kit to the French blogger and encouraged the blogger to share it online so others could crack protections on Microsoft products, the FBI agent said in charging papers unsealed Wednesday.

Corporate investigators confronted Kibkalo in September 2012 during an interview in which he’s alleged to have admitted to sharing the software. Kibkalo is alleged to have admitted to sharing unreleased Windows programs as well as company memos and documents; Microsoft investigators claim he was angry after a poor performance review.

According to charging papers, the blogger posted screenshots of a pre-release version of Windows 8, presumably due to Kibkalo’s leak.

On Sept. 3, 2012, the blogger sent the stolen software development kit code to a Microsoft employee asking that he or she verify it, the FBI agent said in court papers. The worker went to a Microsoft executive instead.

The code was later confirmed to be authentic, prompting corporate investigators to dredge the Hotmail account the blogger used to contact the Microsoft worker. While the blogger took pains to protect his identity – he claimed falsely to be in Quebec and used an assumed name online – a Microsoft team dubbed Trustworthy Computing Investigations attempted to track the blogger down.

While searching the blogger’s account, Microsoft investigators found an email from Kibkalo in which he shared Windows 8 “hot fixes” through an online hosting system, the FBI agent continued. Windows 8 had not been released to the public at the time, and was the subject of much speculation in the industry.

Investigators claim to have recovered instant messages Kibkalo exchanged with the blogger showing Kibkalo was sharing trade secrets illegally.

“I would leak enterprise today probably,” Kibkalo told the blogger during an Aug. 2, 2012 exchange, according to charging papers.

“Hmm,” the blogger replied. “Are you sure you want to do that? Lol.”

Told the leak would be “pretty illegal,” Kibkalo is alleged to have responded “I know :)”

Kibkalo is alleged to have claimed to have previously leaked large portions of Windows 7 prior to its release. In an exchange with the blogger, Kibkalo purportedly described sneaking into Building 9 on Microsoft’s Redmond campus and attempting to copy a server.

Kibkalo was arrested Wednesday in Seattle. Charged with theft of trade secrets, he is expected to appear in U.S. District Court later Wednesday for an initial hearing.

Check the Seattle 911 crime blog for more Seattle crime news. Visit seattlepi.com's home page for more Seattle news.

Seattlepi.com reporter Levi Pulkkinen can be reached at 206-448-8348 or levipulkkinen@seattlepi.com. Follow Levi on Twitter at twitter.com/levipulk.