The Trial of Terry Childs Begins 502
snydeq writes "Opening arguments were heard today in the trial against IT admin Terry Childs, who was arrested 18 months ago for refusing to hand over passwords to the San Francisco city network. InfoWorld's Paul Venezia, who has been following the case from the start, speculates that the 18-month wait is due to the fact that 'the DA has done no homework on the technical issues in play here and is instead more than willing to use the Frankenstein offense: It's different, so it must be killed.' On the other hand, the city — which has held Childs on $5 million bail despite having already dropped three of the four charges against him — may have finally figured out 'just how ridiculous the whole scenario is but is too far down the line to pull back the reins and is continuing with the prosecution just to save face,' Venezia writes. The trial is expected to last until mid-March. San Francisco Mayor Gavin Newsom, to whom Childs eventually gave the city's network passwords, will be included in the roster of those who will testify in the case — one that could put all admins in danger should Childs be found guilty of tampering."
All admins (Score:5, Insightful)
Re: (Score:2)
Well the issue is that if they disclose the passwords and he fucks things up, they can already be screwed, so this precedent has potential to just invalidate their only option
The law is an ass. (Score:2, Insightful)
Re:Childs should get twenty years (Score:5, Interesting)
so you would rather that he broke the policy that was given to him with regard to passwords and let unauthorized people have access? The city policy only allowed him to give passwords to the Mayor, which he did as soon as he was allowed to. If you are fired, and some random people ask you to give up the password, would you? If you say yes, then you will end up at the wrong end of a lawsuit, as that would make you criminally culpable in whatever havoc those people caused on the network.
Re: (Score:3, Interesting)
The water treatment plants were amongst the infrastructures that he disabled.
Uhm, come again?
Nothing was "disabled." Nothing was turned off. The situation was quite simply that the routers were secured down to the point where, without having admin credentials, someone could not CHANGE them. This is not "negligent", this is smart design.
Then we get to the exorbitant bail amount, the fact that he's being held in lockup without a bail reduction even though better than 3/4 of the case has been dropped due to la
Re: (Score:3, Insightful)
What. Do. You. Do?
Uh, you give them the passwords.
Christ, how is this even a question? Your *boss* tells you to do something? Then you fucking do it! Have a problem with it? Go over his head to his boss. And if that guy tells you to go pound sand? You do your fucking job and hand over the passwords.
In short: This guy was an idiot. That network wasn't his personal property and he had no right to refuse access to it for those in a position of authority, regardless of his impressions of their professio
Re:Childs should get twenty years (Score:5, Insightful)
I worked for a company that performed services for companies that had a lot of personal information. Our systems were kept pretty tight.
For a while, I was the only IT person in the company. I had the primary passwords for much of the company's infrastructure, and the policy manual that was worked up allowed me to give those passwords to two other people on request - the President and my departmental Vice President of the company. The VP was three rungs up the ladder from me.
Neither had the chops to do anything with the passwords, but of course they could easily have hired someone who did. I also had to keep the current passwords in an offsite lockbox at a local bank and only the three of us had access to that box. That way, if I got hit by a bus (or terminated for cause, quit under suspicious circumstances, or whatever) the company could continue operations smoothly.
My boss's boss walked in my office one day and asked for a password for one of the main systems. After a long, involved, and rather unpleasant conversation, I was threatened with termination if the passwords were not handed over. As I started to pack my crap up, the President walked in the room and thanked me for my diligence in following security protocol. It was a surprise audit. I don't think I would have been terminated if I had handed over the passwords, but I'm sure my clearance to possess them would have been revoked in a very large hurry. And that would have been the correct action to take.
There are circumstances where you DO NOT have the authority to give information to your boss. If there is a policy against it, the policy trumps your boss's ability to ask you for the information.
I don't know for sure the policies in place at this particular department, but it is very possible that the boss was not authorized for that information. Passwords and security information do not necessarily follow the chain of command - they follow a chain of responsibility and/or trust, and that isn't always perfectly aligned with the chain of command. If Childs' boss was not authorized for the information, he did the right thing in insisting that the information be turned over to the people his security protocol manual specified.
If Childs' boss WAS authorized for the information by policy, and Childs honestly felt the boss would misuse the information for something illegal and/or was gunning for Childs, then his actions may or may not be justifiable in this case - he's going to have to produce some proof that his boss had an illegitimate purpose. That could be tough.
Re: (Score:3, Insightful)
I assume that part of the unpleasant conversation was you suggesting that the VP or Pres get involved, and this was rebuked.
Re: (Score:3, Interesting)
Then how would you suggest a security audit be done? How else can we find out if someone will violate security policy than by giving them a chance to do exactly that?
I've been subjected to those kinds of audits on several occasions. Yes, they're mildly insulting. But they're also necessary, aren't they?
Re: (Score:3, Insightful)
Re:Childs should get twenty years (Score:4, Insightful)
I disagree. Sorry, but if you're going to trust me with very sensitive data, you need to be able to trust me with it, and that means testing me in such a way that the results are valid.
Which is no way means it's pleasant, or fun, or is anything other than a complete horror show. On the other hand, I was ready to leave the company with my head held high because I stuck to my principles, and there's a part of me that is proud of that.
It still sucked fetid donkey balls when I was going through it, and I have no desire to repeat the experience.
But if you can come up with another test that can demonstrate without doubt that an employee's personal integrity is worth more to them than any specific job, I'm certain a whole lot of people who are responsible for important data would love to hear it.
Re: (Score:3, Insightful)
That was the defense that many of the accused at the Nuremberg trials tried.
It didn't work then either.
Re: (Score:3, Informative)
The site policy was for the passwords to be entered in a security database. He may have disagreed with the policy but he was not entitled to refuse to comply with it.
I find the claim that he did not recognize his superiors or that his actions were genuinely motivated by a desire to protect the network as somewhat incredulous. His actions are rather more consistent with attempting to preserve his job security by ensuring that he was th
Re:Childs should get twenty years (Score:4, Insightful)
Re:Childs should get twenty years (Score:4, Insightful)
He had a responsibility to the people of the city who depended on the city infrastructure not to recklessly endanger that infrastructure. As a trained professional, in his professional jidgement, giving the passwords to his boss would have been dangerous. He acted reasonably (and within policy), insisting on moving somewhat higher up the chain of command, and drawing attention to the incompetence of his boss.
Your boss has no moral authority. He's just another employee, no different from you.
Re: (Score:3, Informative)
The guy was creepy. When he was arrested, his PC contained pages and pages of usernames and passwords. He had $10,000 in cash on him when he was arrested, and a loaded 9mm.
No one on here wants to hear those details. He was a saint. A true hero. Whatever, mark the info above as Trolling (not even sure how that applies, as those are public records from the case as well as the official SF security policy), but it is what it is.
Re:All admins (Score:4, Interesting)
There is a potential for problems if a very manager with very insecure security tendencies asks a sysadmin for very important passwords. In some circumstances, the sysadmin might feel justified not handing the passwords over as it would compromise the security of the existing system.
Re:All admins (Score:5, Insightful)
It doesn't matter since in this case, the people this guy works for asked for the passwords. He is completely free of guilt should they screw things up and no court would hold him responsible for doing exactly what his duties required him to do.
He never owned these passwords, the hardware, the systems, or the infrastructure he worked on. When the owners asked for the password, he should have noted his concerns, and given them up.
Re:All admins (Score:5, Insightful)
The answer is obvious. You simply put it in writing that in your professional opinion someone without an educational background or specific vocational training related the security and operation of whatever system you are dealing with should not operate its administrative features. You than state that you cannot be solely responsible for security or system failures if you are not permitted to be the gatekeeper. You then hand over the passwords if your employer or client agrees.
There is really no problem here at all.
Re:All admins (Score:5, Insightful)
Except when they still ass rape you for killing their system. Yes, this happens. You're the admin, you're responsible! Sucks to be you! Sure, you have some bullshit in writing, but who cares? Go look for another job! Oh, you want to sue us now? Go right ahead, see who has the deeper pockets.
Either way, you lose.
Re: (Score:2, Troll)
It's not like this guy started yelling the passwords while his bosses were screaming "La La La La" with their fingers in their ears. He has a very clear request from his management that they requested the passwords. What they do with them from that point on is solely their responsibility.
If employees could simply do what they wished at work because they didn't happen to like what their place of employment was doing, we would have a very different workplace these days. That obviously isn't the case.
Mod parent up! (Score:4, Insightful)
If anything, the fact that you wrote down that there might be a problem would be used against you. You set a trap or something. That's how you knew there would be a problem.
This is management. Does anyone who's ever held a tech job believe that you writing down that your boss is, effectively, an idiot won't be used against you?
Re: (Score:2)
Now, you may live in an alternate reality where being an asshole is the number one concern in any situation, but here on Earth, liability is not the only issue when a system has the potential to be compromised.
If my boss asks me to do something which has the potential to destroy the systems I am responsible for, it's not just the ability to run away and shout "not my fault!" in as loud a voice as possible to my next potential employer- see, it turns out I (and most people) like keeping my/their current job.
Re: (Score:3, Interesting)
The courts have held people liable for 3rd party actions in MANY cases. For example, you're the host of a party, and you let guests get good and drunk, and you then let them drive anyway. Or you have a hazard in your house, and a crook breaks in and hurts themselves. Or you're sick and tired of someone siphoning your gas, so you put razor blades around the inside of the filler flap. Or you're in the military and you obey an order that is contrary to military law (in which case, unless you frag the pers
Fired him first? (Score:5, Insightful)
> the people this guy works for asked for the passwords
My impression was, that in a nice show of cluelessness, they decided to fire this guy first, and then ask him for the passwords which they didn't have (i.e., they didn't have any plan of action if he got run over by a bus or otherwise dropped dead).
Re: (Score:2)
My impression was, that in a nice show of cluelessness, they decided to fire this guy first, and then ask him for the passwords which they didn't have (i.e., they didn't have any plan of action if he got run over by a bus or otherwise dropped dead).
I think this is ultimately where the case might hinge, and if it's true that they fired him first then in my opinion (I'm not a legal professional) he might have a chance of winning. On one hand, say you are fired and your employer later discovers you took something of theirs with you, well you would obviously be charged with theft. But in this case we are dealing with information, in the guy's head, not physical property. At what point does information become property? What if he had something illegal hidd
Re: (Score:3, Informative)
Re:Fired him first? (Score:5, Funny)
The sweet Humanscale Freedom High-back chair in plum vellum with the graphite frame in which I am now sitting begs to differ.
Re:Fired him first? (Score:5, Funny)
The sweet Humanscale Freedom High-back chair in plum vellum with the graphite frame in which I am now sitting begs to differ.
You bastard! I replaced you and now I'm sitting on a milk crate!
Re: (Score:2)
Re:Fired him first? (Score:4, Insightful)
He didn't "steal" the passwords. He knew them because it was his job to know them. He can't simply "unknow" them once he is fired. Nothing was "taken" from them, their passwords are still there, happily guarding the system against unauthorized access.
As far as being obliged to divulge this information to his former employers, I see no reason he should do so. He is no longer their employee, so they can not compel him to tell them anything. They might have thought to make sure they were in a position to replace him before they fired him.
The only way I see him being liable for anything is if he accessed their systems after leaving their employment. If he didn't, I'd say the city can get stuffed.
Re: (Score:3, Insightful)
Sadly, that's the real issue. This nutcake (who did his job without problem and they fired for his "attitude" rather than anything related to his ability to actually do his job) is being persecuted because he's weird. I mean who wouldn't give up a password when guys with guns were demanding it and threatening you with jail if you didn't? It mattered to him that they weren't on the authorized list. But to the
Re:Fired him first? (Score:5, Insightful)
the employer does not provide any services to you; and, you are not obligated to provide any services to the ex-employer. Those passwords are not the property of the employer; but merely a method for controlling the assets of the employer. The failure of the employer to implement methods to regain control of their assets is not the ex-employees problem.
Re:Fired him first? (Score:4, Informative)
It would seem the prudent thing to do, if you find yourself in a similar situation, would be to turn over the damn passwords.
Hmmm ... Apparently you missed the earlier post's link to the article about the official policy of the county government. It included this summary excerpt:
So if he'd handed over the password to his bosses, he would have been charged with a violation of official published policy, and that charge would have probably stuck. By following the official policy, he may well have succeeded in winning the court case. Of course, it didn't stop the city from implementing what's almost certainly an illegal incarceration before trial. We'll have to keep checking to see how it turns out, and whether he can get restitution for the jail time.
In security-related situations, it's often a good idea to know the official published policy. When asked to violate it, it often can help to point out that what you're being asked to do is illegal, and ask if they really intended that. (If you're a contractor, you might try grinning and saying that you charge extra for illegal acts. Tell them that your consulting firm has a policy against performing illegal acts without first getting the explicit job description on paper with all the right signatures authorizing the higher rate, indemnification for possible charges, etc. It can be fun to watch their reaction.)
Re: (Score:3, Informative)
He was also ordered to surrender them to someone department policy said he was not allowed to tell and who was likely to screw things up and blame it on him.
He did the responsible thing and insisted on following policy in a manner that ensured the network continued to function.
Re: (Score:3, Informative)
Just to quote their policy:
Re: (Score:2)
Information is not physical property. Otherwise you could call up an old sys admin 5 years from now and ask him how he solved a problem. It's information he gained on the job, and he still has it so clearly he needs to go to jail if he does not tell you how to fix the problem.
The Nick Burns question (Score:2)
This really comes down to;
Is Nick Burns a dick, or is he not a dick?
That's it. Pick your camp and fuck off. There is really nothing else to discuss, there is no middle ground.
Re:All admins (Score:5, Informative)
Except he did have a lot to worry about, if you read about it. What happened is he caught a former coworker who got promoted to a different department, without his knowledge. He thought she was fired because she just vanished, and he never saw her again. He catches her searching through peoples desks, and removing hard drives from their computers. She claims he was taking illegal pictures of her and disrupting her "secret audit", which is why she had him arrested and held on a $5 million bond. (The "illegal pictures" he took never surfaced). That's right, he was arrested before being fired, and before refusing to give up the password. The "refused to give up the password" was when she called him in jail and demanded it. Still a woman who, as far as he knows, was fired, not promoted, demands the password over speakerphone in a police station. He says no way. His boss pipes in over the speaker phone and says "Just do whatever she says, or else", and he says no, it's against corporate policy to discuss that sort of thing over speakerphone where anybody can pipe in, but if the boss or the mayor calls in person without speakerphone, he will. They hung up and told the police to process him.
As far as he knows, an ex-employee was breaking in and snooping though peoples files and desks. And I guess she must be blackmailing his boss, for the boss to be says "do what she says or else". If Childs doesn't own the network, how do you reason this middle management fuck owns it?!!? The OWNERS didn't ask shit. At any rate, for him to have given the password like that violated company policy, which he told them, he told them they had to get it in person, and they REFUSED. He told them he'd tell the Mayor, he told the police, who refused to tell him what he was being held on, that he would tell the Mayor, who as the people's representative, is the owner of the network. At this point, people ran with the fact that he was a corporate spy of some sort, because his CITY OWNED CELL HAD A CAMERA IN IT JUST LIKE ALL CELLS, and also he used a firing range, highly illegal, only outlaws use firearms, remember! He also was looking at storage space, a clear crime. When all he really did was refuse to give a password to a co-worked who was "fired" but actually secretly promoted to conduct "secret audits" by searching desks and desktop HDs at midnight on a Friday night. And, to repeat, he was arrested and charged before he even was asked for the password. AND he was asked for the password in a way that was against corporate policy, and also possibly a felony.
Re: (Score:3, Informative)
Surely you mean all admins who refuse to provide passwords when asked by an authorised official at the company they set the passwords for?
The person who asked Childs for the passwords wasn't an authorized official.
Re:All admins (Score:5, Insightful)
If someone higher ranking than me from our accounting division wants the Domain admin password, should I hand it to them? What about the head marketing person? How do you determine who it is "Safe" to hand over the passwords to?
Re:All admins (Score:4, Interesting)
It's called CYA - report it to your direct manager, if you are overridden, have it all in writing for the blame game which is certain to happen later.
Re: (Score:3, Interesting)
Sure you turn over the password, they delete something and YOU are on the hook for obstruction of justice.
Being forced to 'hand over the passwords' should be like a vehicle transfer. The moment you hand the keys off to the person who you are obligated to give them to THEY become responsible for the entire network including their own fuck ups.
Re: (Score:3, Informative)
Re: (Score:2, Insightful)
What about IT admins who configure systems to use Biometric authentication?
Do they have to cut off their right hand, if a manager asks them?
IT admins' user accounts on enterprise systems may use the same password the person uses on personal systems, like their bank account.
What if the hand scanner includes liveness detection?
Passwords and authentication credentials aren't for managers, they're for technical workers who can actually competently administer the systems they access.
They don't need
Re: (Score:2)
Re: (Score:3, Insightful)
Re:All admins (Score:5, Informative)
I remember it being different than that. He wasn't supposed to tell anyone other than the mayor what the password was. Some new manager showed up one day and said "Hey, what's the password?" He says "I can't tell you." So the new manager called the police. Then as soon as the mayor showed up and asked for the password, Mr Childs told him.
As far as i remember, there was zero authorized officials at the company to receive the password.
Re:All admins (Score:5, Insightful)
It's not his fault for knowing the policy better than his own supervisor. He followed it to the letter, but his boss got his knickers in a twist and decided to get him arrested. I hope he's made to choke down that choice with a lovely pink slip in his Christmas stocking.
Frankenstein Offense? (Score:4, Funny)
Then will Mr. Childs employ the Chewbacca Defense?
this is why governments are outsourcing (Score:2, Insightful)
between this genius who thought everything belonged to him and people like I met in my 1 year of working as a consultant for a government agency it's not wonder government is outsourcing. i met this one admin years ago who refused to let his NT domain be part of the larger NT network and it caused all kinds of permissions issues. funny thing was that because of the union rules they couldn't make him do it. and the only reason he refused to let his NT domain work with the others in the organization is becaus
Network Design? (Score:5, Insightful)
Why was the network designed so that one single account (or password) held the keys the kingdom? That's just stupid.
"Administrator" groups for Windows machines
Multiple root SSH keys and/or Kerberos logins for Unix boxen
TACACS user-based authentication for routers.
If the dude just left and said "I'm done with you folks, no I'm not handing over my passwords", then fine...go into the user admin system, nuke his passwords and get on with your life.
If the dude deliberately went in and reset passwords and changed network access before walking and then tried to blackmail the city, then that's sabotage/blackmail/downright illegal and should be punished.
If the dude walked out without giving passwords to anyone and the system was poorly designed so that admin passwords had to be forcefully recovered via single user mode or the like, then the city should just eat crow, lick their wounds, and install a real network AAA system.
What would have happened if the dude had been run over by a beer truck on the way to work? Would the city have been screwed as well?
Dude.
Re: (Score:2)
Why was the network designed so that one single account (or password) held the keys the kingdom? That's just stupid.
"Administrator" groups for Windows machines
Multiple root SSH keys and/or Kerberos logins for Unix boxen
TACACS user-based authentication for routers.
Probably because the guy they hired to avoid problems like this, created the problem. There is always a way that someone can ruin your day. You can't always avoid placing a lot of trust into the hands of a few or even one individual.
Ever fly on a
He was in a catch 22 (Score:5, Informative)
I was initially very skeptical of Childs until additional information came out about the case that changed the story notably.
Their policy prohibited Childs from simply handing passwords over to his boss, when asked by the mayor he handed them over as requested. I think the bigger issue is one of policy on security and a lack of industry best practices by the city. What holds the greater weight, policy or your bosses request? Depending on where you work, handing over your passwords to anyone can readily be a criminal infraction. At a minimum they could have asked Childs to create an additional account with full administrative access and that account could then have been used to disable Childs account.
I know at my employer I am not allowed to share my passwords with anyone, including my supervisor. I have an official backup with equivalent access to myself and my refusal to hand over passwords would not prevent anyone else from taking over for me. If my employer wanted they could simply reset my password and gain access to my account. The issue in San Francisco is there wasn't anyone else who had equivalent access to begin with. Their network was complex and the city had cut to the bone on staffing ahead of time.
Lessons can be learned from this from a management standpoint, the city took an antagonistic approach and did not update their policy and instead asked Childs to break it. Their security personal should have known industry best practices and instead asked Childs to violate them and hand over his password. Ultimately the case showed incompetence in city management and embarrassed them, and that's the only reason I can think of the city pressed the case.
Re:He was in a catch 22 (Score:4, Informative)
Re:He was in a catch 22 (Score:4, Insightful)
Of course, all of the passwords then found themselves in a public court document. Oops.
And so his point about security being mis-handled by others was proven true. The moment they got the passwords, they told the entire world what they were.
Wouldn't have waterboarding been better for all? (Score:2)
If they would have just threatened to waterboard the guy, and let him walk after he gave up the passwords, there would have been no harm, no foul, and no need to waste the taxpayers money putting a frazzled worker in jail.
We're all getting frazzled these days, and maybe we need to realize that, take a deep breath, and stop tossing everyone in jail and tearing people down left and right in all arenas, and try and claw our way back to being a civilized people.
Right now, I think we are all acting like animals.
Terry Childs and the female boss (Score:5, Interesting)
Sorting out fact from fiction [yahoo.com] in the Terry Childs case (InfoWorld)
Re: (Score:3, Interesting)
In the court filing four days later, the city contended that Childs had "booby-trapped" the network to collapse during this power outage by not writing the device configurations to flash on some number of routers.
You know, some Cisco guys just have bad habits of not pressing "CTRL+Z" then entering "wr mem" when they're done working on a Cisco appliance. Maybe he just made a mistake?
If he wins will he have to retest for certificatio (Score:2)
If he wins will he have to retest for certification or as he all reedy been put on a black list? but even if he is people will likely still look the other way and he can keen them on his CV.
Re: (Score:2)
Incompetent Imbeciles (Score:2, Insightful)
There is no face to be saved (Score:2, Insightful)
and is continuing with the prosecution just to save face,'
So, what do taxpayers think about their public funds being thrown away just to "save face"? This charade will end soon. Maybe another generation or so.
For the love of God... (Score:5, Informative)
Guess who got the passwords as soon as they asked? That's right!
THE MAYOR.
End of subject, folks. Stop posting about him "being an ass" or "getting what he deserves" or "setting a bad example." He set the best example by not caving in and handing the "keys to the realm" to some new face he didn't know the technical knowledge of, and was specifically prevented from releasing by the very policy which kept him employed.
This is a PR campaign to save face and nothing else. Someone high up the food chain did something idiotic (calling the police instead of HR / legal dept) and blew things out of proportion. Now they have to see it through, or they'll look like fools and lose their jobs. CYA territory.
I hope the lot of them are fired, and Terry gets to sue every last one.
Re: (Score:3, Interesting)
I decided to read a couple of articles about the situation after reading the parent post. That's led me to believe that IT admins everywhere should be supporting this guy wholeheartedly. When you get down to the point of it, this is a guy getting shafted as a result of sticking to the documented policy.
I realize that it's a long-running joke around here that people don't RTFA. RTFA.
Re: (Score:2)
How so "stolen"? (Score:2)
The equipment was still in the same place it was before. The software was the same as before. The service was the same as before.
So how did he steal anything?
Re: (Score:2)
I have a copy of the keys to your home.
None of your keys are gone. All your stuff is still in your home. All your food is in your fridge. And your bed still smells the same. I only came in and watched a bit of TV. You didn't even know till I told you.
So I did nothing wrong?
Or how about this one:
I have your bank codes, which I changed so you cannot access your money.
Your money is still there. The amount of money is still the same. Your money is still serving the bank.
So I didn't steal anything?
Except nothing like that happened. (Score:2)
His job was to be in there so being in there is irrelevant. That's part of what he's supposed to be doing.
Re: (Score:2)
How about you tell me "watch my house and make sure nothing gets stolen, here are the keys" and two days later you show up, so drunk you can barely stand and demand I give you the keys "'cosh ah wanna getsh the cousch an' star' a fire!", would you consider it to be the right thing for me to do to just give you the keys and say "sure, have fun, there's a bottle of lighter fluid under the sink"?
/Mikael
Re: (Score:2, Insightful)
Re: (Score:2)
An even better analogy might be if I get drunk and I start looking like I'm going to drunk-dial my boss and my friend takes my phone away from me until I sober up, should my friend be charged with a crime? Should I be mad at him or grateful?
The 18 months it has taken just to get to this point and the 5 million bail is just ridiculous. It can certainly be argued on both sides which was the better judgment call for Terry to make, but this level of persecution for what he did is just piss and vinegar by people
Re: (Score:2)
It's more like the owner asking for the keys to the cold-fusion warop/bagel generator that powers his home systems. You know as soon as he goes into the room, bad things are going to happen. You're saving lives by not giving him access.
So you're dumb (Score:2, Insightful)
You forgot to keep a copy of the keys yourself? I call that stupid. And in the case of this guy's manager, criminally stupid.
Most people are smart enough to give their caretakers copies of their keys. Your analogy stinks.
And even if it didn't stink in that way, it stinks in another way. You could just shell out to have a professional locksmith break into your house and change the locks. Which is what you would have to have done anyway if the caretaker was kidnapped by the mafia or otherwise disappeared (the
Re:How so "stolen"? (Score:4, Insightful)
Nah, more like the chauffeur refusing to give the keys of the Rolls to the empty headed daughter. He did hand them over to dad.
Heh, that's nearly a car analogy.
Re: (Score:3, Insightful)
Re:Why is this guy being treated as a Martyr to IT (Score:4, Insightful)
The owners of the network are the public. An employee should act in the best interests of the employer at all times -- even if doing so conflicts with the views of immediate superiors.
Re: (Score:2)
Oh, Please! IT infrastructure is the plumbing of the 21st century. This guy is a plumber. It is not his job to decide who should or should not have access to the network any more than it is the job of the master control technician at NBC to decide what to air at 8pm on Thursday nights.
Re: (Score:3, Insightful)
Oh, Please! IT infrastructure is the plumbing of the 21st century. This guy is a plumber. It is not his job to decide who should or should not have access to the network any more than it is the job of the master control technician at NBC to decide what to air at 8pm on Thursday nights.
So, let's run by this completely hypothetical scenario then. Say, you are in charge of the plumbing at a facility called "Chernobyl" and your supervisor is asking you to run a few tests, that violate the security protocols.
Since he's just a plumber (or operator) I guess you're with the Chernobyl supervisor here... enjoying the glow-in-the-dark effect...
Terry Childs said no. I'm with Terry. Policy isn't there to be ignored the first time someone tells you to. Especially if the policy is much smarter than the
Re: (Score:3, Insightful)
You make a wonderful point, it boggles me how many posters here seem to be fine with the idea of letting the city burn if you were following the rules like a good little citizen that never questions those in power.
Re:Why is this guy being treated as a Martyr to IT (Score:5, Insightful)
This guy denied access to the owners of that network. Just because there isn't a law to fit the crime doesn't mean he is innocent of wrong doing. Hell, it's not a stretch to say that for a time, before they recovered it, he had stolen the entire network from them.
Take your word smithing and semantics and stick 'em where the sun don't shine. What he did was wrong for it, and he needs to be punished.
What do you mean "Just because there isn't a law to fit the crime doesn't mean he is innocent of wrong doing." That's exactly what it means. If there's no law to fit his "crime," then by definition there is no crime committed. Perhaps he's guilty of being an asshat, but doesn't mean he's criminally liable according to your definition.
It's quite a stretch to say he had stolen the entire network. In fact, it's absolutely false. They could have done a hard admin reset on the routers and affected systems and been back in complete control of them. They chose not to, for various legitimate reasons, but the network remained in the possession of the legitimate owners.
You complain about word smithing and semantics yet that's exactly what you are doing. What he did may be wrong, but the question as to whether any laws were broken is far from a given. To punish him for breaking no laws would be absurd and your assertion that he should is equally absurd.
Re: (Score:3, Insightful)
That's true. But if I changed your locks and kept the keys, charging me with "stealing your house" is not legitimate.
Since you like that door analogy.
Re: (Score:3, Informative)
He didn't do that though. He told the managers that he would turn the password over to the mayor (the OWNER's duly elected representative). A few days later, the mayor asked him for the password and, as promised, he told him.
Re: (Score:2)
How is there no law to fit the crime?
If I hire say a lock smith to work on my house, and then they do not provide the key to the house but instead say rob it or trash it, there is all kinds of laws to fit those crimes. This is not some sort of new thing.
By the way I am being charitable here by assuming that you can have a "crime" without a "law" makes any sort of sense to talk about at all.
Re:Why is this guy being treated as a Martyr to IT (Score:5, Interesting)
Bail should be set as a deterrent to flee before a trial is finished, not to keep someone indefinitely in a cell.
And this is probably why they did it. His bosses probably knew (or were told by their lawyers) right off that they didn't have a chance of convicting him of anything. So they used one of the standard legal ruses to keep him in jail while they delayed the trial. It's not especially unusual for people to be jailed before a trial for longer than the longest legal sentence. It's even done when conviction couldn't get a jail sentence at all. The idea is to keep someone in jail as long as you can, by any means that will work. Then it doesn't much matter if the court exonerates them; you've shown that you can incarcerate them sufficiently long without a trial.
Parts of the US Bill of Rights were designed to prevent this sort of imprisonment. It hasn't worked very well in this case. And it's not the first time that such things have been done in the US. Anyone not aware of this problem is naive and ignorant of history.
The only real question is whether he can get restitution from the courts afterwards. History says he probably won't.
This sort of story is why I gave up on security/admin jobs early on. I read some stories similar to this, and figured out that the non-technical people above my immediate boss were highly likely to pull such stunts, perhaps with me as a chosen victim. The only way to win that game is not to play it, because the higher ups can see all the cards and do all the shuffling. Of course, when I and thousands of others started figuring this out, it inevitably led to our current sorry state of widespread computer insecurity.
One thing we might add to this story is a question about whether SF will be able to hire a competent person to replace him. I certainly wouldn't want to interview with them, except maybe to see if I could get some inside information about their current policies (after which I'd simply ignore any job offers).
One thing I'd suggest to anyone in his position: If your superiors demand that you give admin passwords to non-technical people, you should hand in your resignation along with the passwords. Tell them right out why you consider this a threat to your own legal safety as well as the computer systems. Chances are they won't be surprised, because they knew what was planned. After all, anyone with the root passwords can edit any file and fake lots of evidence, including the timestamps on files.
Re: (Score:2)
he was a network admin and the passwords were for switches and routers. sure you can reinstall the Cisco IOS, but then you have to set up the VLAN's, BGP and other crap that will result in massive downtime for things like traffic lights and mass transit which is networked these days.
one time our network guys screwed up spanning tree and it took 30 minutes to rebuild it from scratch. meanwhile no one had any kind of network access
Re: (Score:2)
Reset the router, change the configuration register to ignore boot up config, go to enable mode, load the config from NVRAM, set a new enable password, "wr mem", change configuration register, reload. 10 minutes, tops. There's no "reloading" of IOS needed.
He had high security turned on that block password (Score:4, Informative)
He had high security turned on that blocked password recovery as some of the network stuff was out in open at some sites and not in a locked room. With the high security you have to do a full reset to get back in without a password.
Re: (Score:2)
he was a network admin and the passwords were for switches and routers. sure you can reinstall the Cisco IOS, but then you have to set up the VLAN's, BGP and other crap that will result in massive downtime for things like traffic lights and mass transit which is networked these days.
No problem, log into the web based change management system (probably RANCID) cut and paste the most recent config into a spare switch/router/whatever (inserting your own password of course), then forklift upgrade, downtime a minute tops. Then wipe the old device and swap it into the next unlocked device. No need to "break into" a device like this unless you actually need to change something, or an old device breaks and needs replacement.
What, you say they have no backups, no change management system?
Re: (Score:2)
Re:anyone here who defends this man (Score:5, Interesting)
Childs deserves defense not because he appropriately handled a showdown with management he had no hope of navigating successfully, clearly he did not. Rather, he should be defended against having the prosecutorial powers of the city leveled against him and being deprived of his freedom for many months over a matter that should have gone no further than the termination of his employment.
Re: (Score:2)
Wasn't he terminated before they even asked for the passwords? If it was me they'd have to hire me back as a very, very expensive consultant before I'd even speak with them.
Re: (Score:2)
You metaphor is false.
The parallel would be if I hired you to set up and administer my computer, later demanded that you had over the admin credentials, and you refused because you didn't think I could handle it competently. I would be within my rights to fire you and perhaps even sue you, but not to have you thrown in jail.
He is accused of 4 crimes (3 were later dropped). (Score:3, Insightful)
It is up to the legal system to determine whether he committed any crimes.
So far, all you have is the accusations and even 3 of those 4 were dropped. So "he deserves punishment" for things that no one is now claiming he did?
Weird.
Re: (Score:2)
Re:anyone here who defends this man (Score:5, Insightful)
So what you're saying is that because he was accused of something, he is automatically guilty even though the accusations where later withdrawn? [slashdot.org]
I sure as hell hope that you never wind up on a jury for *anyone*.
Re: (Score:3, Informative)
He didn't decide for himself, he was following written policy.
If I hire a general contractor to build my house and I instruct him to hire you to key the locks, he is your boss, but he is NOT entitled to a copy of the keys.
Re: (Score:3, Informative)
For God's sake, that's circletimessquare! If you don't know who that is, lurk more. Until then, DO NOT FEED THE TROLLS!
Re: (Score:3, Insightful)
Perhaps, and it is indeed your right to ignore the grammar rules of the the language you are writing, but you also have to be aware that anyone reading it will naturally make judgements about you because of that.
Capital letters and punctuation are not just "convention", they do help with reading comprehension in the same way that paragraph breaks do. I don't think that ignoring the grammar rules just because you don't like them is an any way superior; as the GP said, it makes you look like an ass just for t
Re: (Score:2)
That may be an offense for a juiced-up district attorney, but it's no legal strategy with which to prosecute a case.
It gets thrown out before it ever gets to a jury.