who is Rambler Gallo?

Rambler Gallo was a technician employed by a private contractor operating Discovery Bay’s treatment facility in California. He maintained instrumentation and computer systems controlling the facility’s electrical and mechanical processes.

what sentence did Rambler Gallo receive?

Gallo received six months of home confinement and 36 months of probation. The judge also ordered him to surrender his computer and pay $44,250 in restitution.

how did Gallo access the water treatment system?

According to his plea agreement, Gallo installed software on his personal computer and the contractor’s internal network during his employment. It allowed him to access the treatment facility’s network remotely after leaving.

what did the Discovery Bay computer attack do?

Gallo sent a remote command to uninstall software serving as the facility network’s central hub. The software supported monitoring and control of water pressure, filtration and chemical levels.

was Discovery Bay's water contaminated?

The Department of Justice release did not report confirmed contamination or injuries. Prosecutors said disabling the monitoring software created a potential danger to the community’s water supply.

how was the water treatment attack discovered?

According to government sentencing documents summarised by the Department of Justice, employees discovered the monitoring software was offline the following day. They then took steps to restore the system and limit potential damage.

why is the Discovery Bay attack an insider threat case?

Gallo had maintained the facility’s systems as a contractor employee. He later used remote access established during that employment to damage the network after leaving his job.

Former contractor employee sentenced for water treatment plant attack

Rambler Gallo received six months of home confinement and three years of probation after disabling monitoring software at California’s Discovery Bay water treatment facility.

By Hannah LoweResearch Correspondent29 October 20263 min read

Illustration of a technician beside a dark control console overlooking water treatment tanks at dusk. — This image was generated using Artificial Intelligence.

What happened

A former contractor employee was sentenced in Oakland, California, on 8 May 2024 to six months of home confinement and three years of probation for damaging Discovery Bay’s water treatment computer network, the US Department of Justice said.

Rambler Gallo, 53, of Tracy, admitted remotely sending a command to remove software that served as the network’s central hub after leaving his job. The software supported monitoring and control of water pressure, filtration and chemical levels.

According to government sentencing documents described in the department’s 13 May announcement, the monitoring software remained offline until employees discovered the disruption the following day. Staff then acted to restore the system and limit potential damage.

The release does not report confirmed contamination, injuries or a loss of water supply. Its account concerns the removal of protective monitoring software and the resulting potential danger, rather than documented harm to residents.

The background

Gallo worked full-time for a Massachusetts-based private company which held a contract to operate Discovery Bay’s wastewater treatment facility. The indictment identified the business only as Company A. The Department of Justice said the facility served the water and wastewater systems of the town’s 15,000 residents.

His employment ran from July 2016 until December 2020. As an instrumentation and control technician, he maintained equipment and computer systems used to control the facility’s electrical and mechanical processes.

According to his plea agreement, Gallo installed software on his personal computer and within Company A’s internal network while he was employed there. This enabled him to connect remotely to the treatment facility’s computer network.

He submitted his resignation on 25 November 2020, giving two weeks’ notice. About five weeks after that notice, he remotely accessed the facility and sent the uninstall command, according to the department’s account of his plea agreement.

The sequence makes this an insider-risk case involving a contractor’s former employee, rather than an unidentified outside attacker. It illustrates how access established during employment can remain a route into an organisation’s systems after a worker leaves. The release does not explain what access-removal procedures were in place or why the remote connection remained usable.

The target was also different from the confidential files or financial accounts involved in many employee-misuse cases: the affected computers supported a physical treatment process. Disrupting such systems can deprive operators of information needed to oversee equipment and treatment conditions.

A related distinction appears in Insider Threat Roundup’s report on a former industrial company engineer charged over alleged system disruption and extortion. Prosecutors in that separate case alleged misuse of an administrator account. Gallo’s case, by contrast, had reached sentencing following a guilty plea, and the announcement described no extortion demand.

What people are saying

The Department of Justice said prosecutors argued in sentencing documents that Gallo had planned his actions to maximise disruption. The government also argued that disabling the monitoring system created a potential danger to the community’s water supply.

The department described the affected software as protecting the treatment system across Discovery Bay’s water service facilities. Its account linked the seriousness of the offence to the software’s operational role, not simply to damage to an ordinary workplace computer.

US Attorney Ismail J. Ramsey and FBI Special Agent in Charge Robert K. Tripp announced the sentence. The release included no individual statements from either official, and no comment from Gallo, his lawyers or the facility operator.

What happens next

Judge Haywood S. Gilliam Jr. also ordered Gallo to surrender his computer and pay $44,250 in restitution. The announcement did not set out a payment timetable or detail the losses covered by that amount.

The sentence followed a federal grand jury indictment on 27 June 2023. Gallo pleaded guilty to one felony count of transmitting computer instructions to intentionally damage a protected computer under federal computer crime law.

The FBI investigated the case, which was prosecuted by Assistant US Attorney Cynthia Frey with assistance from Kathy Tat and Kevin Costello. The release did not announce further proceedings or describe any subsequent changes to the facility’s remote-access arrangements.

Timeline

July 2016
Gallo began working for the contractor operating Discovery Bay’s treatment facility.
25 November 2020
Gallo submitted his resignation, giving two weeks’ notice.
27 June 2023
A federal grand jury indicted Gallo on one felony computer damage charge.
8 May 2024
Judge Haywood S. Gilliam Jr. sentenced Gallo to home confinement and probation.
13 May 2024
The Department of Justice published its announcement of the sentence.

Why this matters

The case shows how insider risk can extend beyond an organisation’s own workforce and continue after a contractor’s employee leaves. For operators of essential services, remote access to computers controlling physical processes requires particular attention because disruption can affect safety monitoring. Reviewing contractor access, removing connections when employment ends and checking whether operational monitoring remains available are relevant safeguards. The public account does not establish which controls Discovery Bay had in place or whether they changed after the attack.

Questions and answers

who is Rambler Gallo?: Rambler Gallo was a technician employed by a private contractor operating Discovery Bay’s treatment facility in California. He maintained instrumentation and computer systems controlling the facility’s electrical and mechanical processes.
what sentence did Rambler Gallo receive?: Gallo received six months of home confinement and 36 months of probation. The judge also ordered him to surrender his computer and pay $44,250 in restitution.
how did Gallo access the water treatment system?: According to his plea agreement, Gallo installed software on his personal computer and the contractor’s internal network during his employment. It allowed him to access the treatment facility’s network remotely after leaving.
what did the Discovery Bay computer attack do?: Gallo sent a remote command to uninstall software serving as the facility network’s central hub. The software supported monitoring and control of water pressure, filtration and chemical levels.
was Discovery Bay's water contaminated?: The Department of Justice release did not report confirmed contamination or injuries. Prosecutors said disabling the monitoring software created a potential danger to the community’s water supply.
how was the water treatment attack discovered?: According to government sentencing documents summarised by the Department of Justice, employees discovered the monitoring software was offline the following day. They then took steps to restore the system and limit potential damage.
why is the Discovery Bay attack an insider threat case?: Gallo had maintained the facility’s systems as a contractor employee. He later used remote access established during that employment to damage the network after leaving his job.