Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 07/31/06 issue

Special Report | Darlene Druyun’s downfall: e-mail

Forensics investigators tracked correspondence in Air Force-Boeing scandal

By Patience Wait, GCN Staff

Story Tools:

  • Purchase a Reprint
  • Link to this page
Listen to this Story
One of the biggest procurement scandals in the last decade was the Defense Department’s discovery that a high-ranking civilian Air Force employee had steered acquisition contracts to Boeing Co.

And the way the government landed a conviction of the former Air Force principal deputy assistant secretary for acquisition was by using cyberforensics to unearth evidence from mountains of computer data.

The court sentenced Darlene Druyun in October 2004 to nine months in prison. Michael Sears, Boeing’s former chief financial officer, also was sent to jail for four months in February 2006. Both pleaded guilty to conflict-of-interest charges.

In addition to Druyun steering contracts, Sears negotiated with her under the table to give her a job at Boeing when she retired from the Air Force.

Joseph McMillan, special agent in charge at the Defense Criminal Investigative Service, part of the Defense Department’s inspector general’s office, played a lead role in the inquiry into Druyun’s actions.

“There was about [40] gigabytes of media that was examined, some domestically, some overseas,” McMillan recalled. “A gig is about a pickup truck of data, so you’ve got 40 truckloads of data you’re looking at, trolling through.”

While there were reams of electronic and paper documents to go through, McMillan and Michael Milner, DCIS’ computer crimes program manager, agreed that the case moved quickly. From the time DCIS was assigned to investigate to Druyun’s sentencing was about a year and a half, they said.

McMillan said one of his favorite findings was the now infamous “non-meeting” e-mail, from Sears to the office of Boeing’s chairman. It read in part, “Had a ‘non-meeting’ yesterday. Good reception to job, location, salary.”

“When it’s he said-she said, it’s kind of difficult to controvert something. In a lot of investigations that’s where the forensics is invaluable,” he said.

The string of e-mails that strengthened the government’s case against Druyun and Sears went back at least as far as September 2002, when Druyun’s daughter—a Boeing employee—sent an electronic note to Sears about her mother soon retiring from the Air Force and seeking a private-sector job.

During the same period that Druyun and Sears were discussing her prospective employment, Druyun was negotiating with the company on a $1.3 billion contract for NATO, a violation of federal law.

The investigators had one advantage in their search—the starting point of e-mails to and from Druyun. They used string searches and other techniques to build the connections between Druyun, Sears and others. While it was still a search through a giant haystack, McMillan said, “it was a pink needle in the haystack.”

McMillan said agents turned up evidence of other questionable correspondence, which extended the investigation into the full review of Air Force contracts handled by Druyun that was later ordered by then-acting Pentagon acquisitions chief Michael Wynne.

Milner said the Druyun case demonstrates how his program serves as a bridge between case agents and the evidence in computers. “It’s not enough for the case agent to say, ‘Find me the smoking gun,’” he said. “If you’ve got 40 truckloads of data, that’s a problem [if] you send that evidence to them and you don’t specify key words or context.”

McMillan said the e-mail evidence was important, but that very few cases are ever won or lost based on computer forensics.

“It gives you that additional piece that you might or might not have from oral interviews,” he said. “In the Boeing investigation, there was documentation that painted that picture for us, as to who knew what when. ... That helped paint the picture of intent.”

More news on related topics: IT Security, Acquisition / Contracts, Defense IT, Management, IT Management