IT team lead attached to State Courts installed remote desktop app risking 18,000 files, gets jail

The files contained login credentials, secret keys and network architecture details of the State Courts’ network.

The files provided details of varying degrees to systems of the State Courts, including the Integrated Case Management System used for daily criminal court work. The names of other systems were redacted from court papers.

While the remote connection was established, five executable files were transferred into Janarthanan’s laptop by Hari Balan.

Two were quarantined by Windows Defender and three were successfully executed, tampering with the laptop’s firewall rules and anti-virus functionality.

Janarthanan saw the files being transferred and asked Hari Balan about it, who said he was trying to bypass the laptop’s security so it could pass the ISACA’s security checks.

Minutes later, the SEED team was alerted to the presence of the transferred files on the laptop.

They contacted Janarthanan at about 9.30pm about the running of UltraViewer.

Janarthanan denied it and claimed that the laptop was unresponsive. He complied with instructions to disconnect the device from the internet and perform a full virus scan.

He was also told that the Government IT Security Incident Response unit would contact him to collect the laptop.

At around the same time, Hari Balan told Janarthanan that the laptop’s security and network policy blocked its use for the examination.

Janarthanan then used his personal laptop to take the exam.

He deleted the majority of the files in the downloads folder in his work laptop and cleared its browsing history in order to conceal the offences.

He also deleted the UltraViewer application folder containing logs and the application file before handing the laptop over for investigations.

On Aug 14, 2025, a representative from the Corporate Services Division of the Singapore judiciary lodged a police report about the unauthorised installation of the remote desktop application.

Janarthanan was investigated by the Technology Crime Investigation Branch of the Criminal Investigation Department.

He denied knowledge of UltraViewer prior to the incident and lied that he had been experiencing connectivity issues with the laptop’s virtual private network (VPN) that day.

He claimed he was re-installing the VPN application when the laptop stopped responding, and was force-rebooting it when the SEED team called him.

He confessed in a subsequent statement in September 2025.

IMPACT

Janarthanan admitted that his actions endangered the safety of the files, which could have been exfiltrated or stolen when the remote connection was established.

Investigations confirmed, however, that no exfiltration took place. While the files themselves did not contain any sensitive case-specific information, the files contained information that could potentially be used to gain unauthorised access to systems that had sensitive and confidential information, such as case information and judges’ notes.

To mitigate Janarthanan’s actions, the State Courts’ Innovation, Technology and Transformation Division undertook a change of all implicated security keys and took measures such as password changes and key rotations.

The State Courts also conducted a comprehensive review of their systems and traffic logs to ensure that no anomalies, unauthorised access or data exfiltration occurred, the court heard.

They also reviewed the data handling practices for vendors to ensure best-practice compliance.

The Government IT Security Incident Response unit conducted its own investigations and the Digital Forensics Branch of the CID also performed a forensic examination of the laptop.

Deputy Public Prosecutor Matthew Choo sought seven to nine months’ jail, saying Janarthanan had been entrusted with a laptop containing sensitive information.

“He ought to have known better, as a team leader of the State Courts’ cloud system team, to not allow unauthorised accesses to and make unauthorised modifications to the laptop,” said Mr Choo.

“Ironically, he did so to take an examination for information security.”

He said the offences endangered sensitive information and could have caused significant disruption to the systems of the State Courts.

Defence lawyers S Balamurugan and A Ravidass of Regal Law sought three to four months’ jail instead.

Mr Balamurugan said his client’s personal laptop had battery and screen issues that day and he had no other viable option available, so he used the company-issued laptop to sit the exam.

He had installed the remote desktop application solely for the exam and not for any criminal or other improper purpose, said the lawyer.

He added that his client had an unblemished record and had built a long and stable career in the IT industry.

He has two children back in India with his wife and his family is facing financial difficulties, said Mr Balamurugan.

District Judge Lorraine Ho noted however, that the risk of harm was great as there could be a systemic attack causing possible public alarm and fear.

There was also a potential for damage to the reputation of the judiciary’s case management system, as there could have been access to court case files.

Judge Ho said the offender had allowed an unknown foreign entity to have unauthorised access to data in his laptop.

For causing the unauthorised modification of computer contents, Janarthanan could have been jailed for up to three years, fined up to S$10,000, or both.

For endangering the safety of documents belonging to the State Courts via a job he had under a government contract, he could have been jailed for up to two years and fined up to S$2,000.

CNA has contacted the State Courts for more information.