When corporate security becomes a weapon: the eBay case

In August 2019, Ina and David Steiner were running EcommerceBytes, a trade publication about online commerce, from their home in Massachusetts. For nearly twenty years they had covered platforms, their rules and the difficulties faced by sellers. Some of their articles and reader comments irritated eBay’s leadership. That editorial disagreement should have remained a communications issue. It became a retaliation operation.

Over several weeks, former members of eBay’s security organisation sent anonymous messages and deliberately alarming deliveries to the couple: live insects, a funeral wreath, a bloody pig mask and a book about coping with the loss of a spouse. Advertisements placed in the victims’ names also invited strangers to visit their home. A team then travelled to Massachusetts, watched their movements and tried to place a GPS tracker on their car.

The bizarre details should not obscure the central lesson. The perpetrators were not intruders who hijacked eBay’s resources. They worked inside the organisation responsible for security, intelligence and resilience. Skills intended to protect people and operations were used to intimidate two journalists.

From public criticism to an internal target

EcommerceBytes published information for online sellers: fee and policy changes, competition between platforms and statements by executives. The coverage that caused anger inside eBay was neither a cyberattack nor a physical threat. It included public figures about the chief executive’s pay and criticism of eBay’s commercial strategy.

Court records describe aggressively worded exchanges between senior executives. The publication and its authors were no longer treated as outside stakeholders or critical journalists, but as a problem to be neutralised. That change of category is crucial: once criticism is labelled a threat, an organisation can start justifying measures that have nothing to do with protecting the business.

A campaign designed to look spontaneous

The operation combined three forms of pressure. The first used deliveries and humiliating advertisements. The second used fake accounts presented as disgruntled sellers. Their messages were meant to grow progressively more threatening and culminate in publication of the couple’s home address. The third phase moved from the digital world to the street: surveillance of the home, travel from California and a plan to track the car by GPS.

According to the criminal statement of facts accepted by eBay, the team then intended for another security manager to offer the Steiners help stopping the harassment that his own colleagues had created. The false rescue was meant to generate goodwill towards the company and potentially influence future coverage. This was therefore not a series of uncontrolled pranks. It was an operation with escalation, a cover story and a desired outcome.

Security resources turned against the victims

The participants had expertise that made the operation credible: open-source intelligence, anonymous accounts, temporary phones and payment methods, discreet travel and surveillance. They also tried to use their positions to obscure the trail after local police began investigating.

This is what separates an ordinary individual offence from a governance failure. Several people took part, meetings occurred and expenses were incurred. Colleagues could see fragments of the operation. Yet internal barriers did not stop it before the victims themselves noticed the vehicle following them.

The GPS plan failed. David Steiner photographed the licence plate of a suspicious car and gave the information to Natick police. The rental vehicle led investigators to eBay employees. As the investigation closed in, digital evidence was deleted, false explanations were prepared and records were falsified. Obstruction and evidence tampering were added to the stalking conduct.

Seven convictions and independent oversight of eBay

Seven former employees or contractors on the security team were charged and convicted. Jim Baugh, the former Senior Director of Safety and Security, received 57 months in prison. David Harville, the former Director of Global Resiliency, was sentenced to 24 months. Other participants received prison terms, home confinement, supervised release and fines. The final sentencing took place in July 2024.

Accountability did not stop with individuals. In January 2024, eBay entered into a deferred prosecution agreement with the US Department of Justice. The company admitted the facts set out in the agreement, accepted the statutory maximum $3 million criminal penalty and was required to retain an independent compliance monitor for three years. The charges may be dismissed only if eBay complies with the agreement and commits no new crime during that period.

That response is more structural than a fine alone. An independent monitor can examine responsibilities, escalation procedures, evidence preservation, training and whether staff can genuinely report an abusive instruction.

The civil case ends in 2026

Ina and David Steiner had also brought a civil action against eBay and several former executives. After an initial agreement was not finalised, the parties announced a public settlement in July 2026.

The couple are to receive $48.7 million in compensation: $46.15 million from eBay, $2 million from former chief executive Devin Wenig, $500,000 from former executive Wendy Jones and $50,000 from former communications chief Steve Wymer. A further $7 million is committed to charitable contributions, bringing the total to $55.7 million. The three former executives covered by the civil settlement were not charged in the criminal case.

The absence of a confidentiality clause matters as much as the amount. It allows the victims to discuss the case, researchers and compliance leaders to study its mechanisms, and the public to distinguish criminal convictions from civil allegations resolved through settlement.

What security leaders should learn

The eBay case offers a useful test for businesses, public bodies and associations with security or investigative functions.

• Separate protection of people from reputation management. Public criticism does not become a security incident because leadership dislikes it.
• Require a written mandate and two-level approval for any investigation involving an outside person. The purpose, legal basis, authorised methods and duration should be recorded.
• Audit unusual expenses, urgent travel, temporary phones and contractors. Individually these signals may appear routine; together they can reveal an operation with no legitimate purpose.
• Provide a reporting route outside the hierarchy concerned. Staff cannot safely report an abusive instruction if the only recipient is the person who issued it.
• Trigger automatic preservation of evidence as soon as a complaint, police request or internal report appears. Deleting messages should be technically difficult and immediately visible.
• Assign incidents involving executives or the security team to an independent party with access to logs, expenses and business communications.

AI lowers the cost of harassment

The 2019 campaign required several people, fake accounts, travel and manual coordination. Generative tools can now produce message variants, synthetic voices, fabricated visuals and the appearance of collective outrage at speed. They do not erase financial trails, access logs or physical movement, but they reduce the cost of intimidation and make the initial assessment of a threat harder.

The answer is not limited to buying better detection tools. It starts with governance that prevents an organisation from authorising abuse in the first place: defined mandates, separation of powers, logging, spending controls and protection for whistleblowers.

In brief

The eBay case is not a story of technology becoming autonomous. People selected a target, used professional resources, bypassed controls and then tried to conceal their actions. Technology increased their reach; internal culture and a lack of counterweights cleared the path.