Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
The Courts Government News IT Your Rights Online

Terry Childs Case Puts All Admins In Danger 498

Posted by kdawson from the if-they-want-to-get-you dept.
snydeq writes "Paul Venezia analyzes the four counts San Francisco has levied against Terry Childs, a case that curiously omits the charge of computer tampering, the very allegation that has kept Childs in jail for seven months and now appears too weak to present in court. Count 1 — 'disrupting or denying computer services' — is moot, according to Venezia, as the city's FiberWAN did not go down due to Childs' actions. Venezia writes, 'Childs' refusal to give up the passwords for several days in no way caused a disruption of the normal operation of the FiberWAN. In fact, it could be argued that his refusal actually prevented the disruption of normal network operation.' Counts 2 through 4 pertain to modems Childs had under his control, 'providing a means of accessing a computer, computer system, or computer network in violation of section 502,' according to case documents. As Venezia sees it, these counts too are spurious, as such devices are essential to the fulfillment of admin job requirements. 'If Childs is convicted on the modem charges, then just about every network administrator in the world could be charged with the same "crime,"' Venezia writes. All the authorities would have to do is 'point out that you have a modem or two, and suddenly you're wearing pinstripes of the jailhouse variety.'"
This discussion has been archived. No new comments can be posted.

Terry Childs Case Puts All Admins In Danger More

Terry Childs Case Puts All Admins In Danger

Comments Filter:

  • On second thought, I'd be in for a long stint.

    Never mind.

    • Obligatory KITH link. (Score:4, Funny)

      by ebbomega ( 410207 ) on Tuesday February 24, 2009 @09:13PM (#26977875) Journal

      This is a classic [youtube.com]

    • Re:Too bad "being an asshole" is not a crime (Score:5, Insightful)

      by mabhatter654 ( 561290 ) on Tuesday February 24, 2009 @09:34PM (#26978005)

      that's the point really. His keeping the passwords is really no different than a VP keeping a laptop or company automobile. There are several civil steps that need to be gone through before "keeping" something you were previously entitled to have and protect becomes "criminal".
      Consider the case of loaning a car to your long term SO for many years, then the relationship goes south and you show up with the cops to take back the car she's had for several years. Yes, you can get it back, but the cops will tell you to get a judgment first and won't just let you take it. In the same way the new manager saw a "rogue" employee that was cut off, isolated, and anti-social and first tried to illegally fire him. When that didn't work, then he started harassing about the passwords and created a situation with the prosecutor to get the passwords or throw the guy in jail... a leap of about 6 other legal processes.

      Like has been said before.. modems and back doors in your office or home office (if expected to work from home/call in) are quite common for admins. VPN access to servers for when they crash is common. Those don't really figure into the "criminal" part because they didn't ASK if he had them and didn't ASK him to return them... packing his cardboard box on the way out the door is not formally "asking". As far as wiping the configs, that was paranoid overkill, but considering how often city office property gets stolen, wiping the config keeps thieves from getting the network settings to the whole thing which is more valuable than any one office of downtime due to power failure.

      "keys to the kingdom" passwords are quite common.. I'm the only person at my 1000 person company with ALL of a certain server's passwords plus some network ones. There's a small number of people I would release those to... if I was pre-accused of malicious intention before I even left I'd probably handle the transaction thru a lawyer.

      Like he predicted, when the city hired consultants (again not thru a legal means, just some random company to "fix it") and they started breaking stuff they didn't understand isn't his problem... Remember he was accused of "damages" even though the manager had no cause to make that ... they only poor performance he demonstrated was being disgruntled. Assuming he was doing damage and calling the cops is bordering on criminal filing a false report.

      The proper course of action would have been for the DA to sue him in small claims court for the password. Make a valid case and allow him his grievance before a judge, then honor the ruling. Then a judge would have thrown him in jail until he talked for contempt... there's no time limit on contempt, so no need to file other charges! Frankly they're not a good lawyer if they didn't think of the simplest legal thing first.

      • Re: (Score:3, Interesting)

        by Anonymous Coward

        Passwords are not property, the city should have gotten them before firing him. Once they let him go they had no reasonable expectation that he would give them any "knowledge" which is all that the passwords are.

        • Re:Too bad "being an asshole" is not a crime (Score:5, Informative)

          by TechForensics ( 944258 ) on Tuesday February 24, 2009 @11:50PM (#26978745) Homepage Journal

          Passwords are not property, the city should have gotten them before firing him. Once they let him go they had no reasonable expectation that he would give them any "knowledge" which is all that the passwords are.

          Sorry. I'm a lawyer and you're only partly right. Passwords may not be "property" but it can still be potentially harmful to withhold them. If a plaintiff could prove harm or even better, immediate irreparable injury, a court would say give 'em up or go to jail, go directly to jail, do not pass go, do not collect two hundred dollars.

          • Re:Too bad "being an asshole" is not a crime (Score:4, Interesting)

            by N1AK ( 864906 ) on Wednesday February 25, 2009 @04:19AM (#26979889) Homepage

            Sorry. I'm a lawyer and you're only partly right. Passwords may not be "property" but it can still be potentially harmful to withhold them.

            If a salesman is fired, is he breaking the law if he refuses to work for free advising his old company about their customers (Who else do they buy from, What are their priorities, etc)? If a engineer leaves, does he have to produce detailed schematics for anything the company owns?

            If the admin followed the rules he was employed under (assuming the company has a password policy) then I can't see why a password should be treated better than the job related knowledge required in most careers.

            • Re: (Score:3, Insightful)

              by TheVelvetFlamebait ( 986083 )

              I can't see why a password should be treated better than the job related knowledge required in most careers.

              Passwords are different because:

              a) they are small and trivial to communicate (unlike your examples), and
              b) they are (for all practical purposes) essential for the running and maintenance of an important and expensive part of many companies

              When a sales company fires a salesman, they can try to recoup the salesman's loyal customers, or they can bear the losses. There will be plenty of others.

              When an eng

              • Re:Too bad "being an asshole" is not a crime (Score:5, Insightful)

                by kextyn ( 961845 ) on Wednesday February 25, 2009 @10:05AM (#26981849)
                The things you mention (customers, schematics, etc) are a lot different than a password. If the company has any clue what the're doing then that small, trivial password becomes completely useless immediately after he is fired. I can't remember if it was the root passwords he refused to give up or his own account's password. If it was his own there is no reason for the company to need them. If it was the root passwords why was he the only one with them? One person should not hold all the root passwords for the company's equipment and I'm pretty sure he had a boss that should have made arrangements in case Terry suddenly died.

              • Re: (Score:3, Insightful)

                by N1AK ( 864906 )

                Passwords are different because: a) they are small and trivial to communicate (unlike your examples), and

                Firstly, the effort required to communicate the data isn't important. Either you work for the company or you don't, if you don't then you are free to choose to do what you wish. I could request that you put "N1AK is awesome" in your signature, is it a crime for you not to perform this trivial act? Would it be different if I used to employ you?

                Secondly, there is plenty of things a Salesperson could t

          • Re:Too bad "being an asshole" is not a crime (Score:5, Interesting)

            by julesh ( 229690 ) on Wednesday February 25, 2009 @06:26AM (#26980401)

            Sorry. I'm a lawyer and you're only partly right. Passwords may not be "property" but it can still be potentially harmful to withhold them. If a plaintiff could prove harm or even better, immediate irreparable injury, a court would say give 'em up or go to jail, go directly to jail, do not pass go, do not collect two hundred dollars.

            Why should I be under any obligation to do something for an organisation that is no longer my employer to prevent harm from coming to them? Sure, if it's my job I have to do what they ask me to, and if my negligence causes them harm then I could be in trouble. But if I'm no longer under contract, why should I do anything? Why, in fact, can I not say, "Oh, those passwords? Well, when I left my job with you they were no longer useful to me so I destroyed my copies of them, as security best practices dictate I should do with any confidential information I no longer require?"

            • Re: (Score:3, Interesting)

              by furby076 ( 1461805 )

              Why should I be under any obligation to do something for an organisation that is no longer my employer to prevent harm from coming to them? Sure, if it's my job I have to do what they ask me to, and if my negligence causes them harm then I could be in trouble. But if I'm no longer under contract, why should I do anything? Why, in fact, can I not say, "Oh, those passwords? Well, when I left my job with you they were no longer useful to me so I destroyed my copies of them, as security best practices dictate I should do with any confidential information I no longer require?"

              You are absolutely correct - once they fire you then you are no longer responsible to provide them with any services (unless you signed a contract stating otherwise). Even if it causes their system to fail it is no longer your responsibility. They can offer you money...or they should have thought of that BEFORE firing you (e.g. sending you an e-mail two days in advance stating "please document all systems you have access to, how you access them, including login credentials and all back-door access and g

        • Re:Too bad "being an asshole" is not a crime (Score:5, Interesting)

          by Anonymous Coward on Tuesday February 24, 2009 @11:53PM (#26978761)

          Except from TFA -

          In this statement, the defense asserts that those present during the questioning were simply not qualified to hear the passwords. This impromptu meeting took place at the police station in the Hall of Justice, not in the DTIS offices, and Childs was brought there while in the building doing work on the FiberWAN. Those present included various members of the San Francisco Police Department, representatives from HR, and an unknown group of people on the other end of a speakerphone.

          If this is true, then his refusal to divulge the passwords becomes a lot less problematic from an ethics and security standpoint. You don't give up the master keys to a seemingly random group of people, including those that don't work in the department and some unknown others on the phone.

          To think of this another way, you might not have a problem giving up your Social Security number and debit card PIN number to a bank employee while you're in their office conducting business, but if there were a half-dozen other people in the office too, listening to the conversation, you would certainly think differently.

          Up until now, I'd been under the impression that Childs' refusal to divulge the passwords occurred during a private discussion or meeting with his boss -- not in a situation like this.

      • Re:Too bad "being an asshole" is not a crime (Score:5, Insightful)

        by zappepcs ( 820751 ) on Tuesday February 24, 2009 @10:23PM (#26978271) Journal

        Here is the deal as I see it. He's an admin with a bit of an attitude, yet he did his job well apparently. Everytime that I'm asked to do inane bs at work, I turn it into a paperwork exercise. That is to say that I am happy to paper the office of whichever vp wants reports and to be in charge. Soon, they ask me to 'just take care of it' as I see fit. Either you want a competent admin or you don't. Once you get one, you have to trust them and work with them, even if there are conflicts of personality. This is simply because you as a vp or cxo cannot replace that person. You are forced to work with them... deal with it.

        Positional authority is a powerful thing. If you as a cxo are afraid to give it to someone, get some certs... or perhaps learn to delegate and deal with that.

        The fact that this made the level it did in courts is indicative of the fact that management is not willing to give away any power to anyone. In much of this situation, they had no need for what they ask for, and should not have had it.

        In the cold light of day, if they gave him that much control, they got what they deserve. When you give someone that much power/authority, you must be nice to them. This is a situation that repeats itself across the globe without end. This particular one just happened to make the news because Terry has big balls.

        No matter what happens, this is a simple case of bad management. period.

        • Re: (Score:3, Insightful)

          by Score Whore ( 32328 )

          I think you completely fail to understand something very specific about server administration: You don't own the boxes. Your employer does. Your knowledge of passwords, etc. is so that you can do your job. In every company I've ever worked for I never have the authority to grant or revoke access to a system. I had the capability since I had root access, but that didn't grant me authority. It's not the job of an administrator to decide who does and doesn't have access any more than it is the job of a securit

          • Re:Too bad "being an asshole" is not a crime (Score:5, Insightful)

            by sumdumass ( 711423 ) on Wednesday February 25, 2009 @01:29AM (#26979197) Journal

            That's not necessarily true. Just like the security guard, if the policy said no one enters the building without ID and a company Badge, then not letting anyone in without either of those is appropriate.

            The same can be said about a corporations bank account or credit card numbers. It's completely ethical and responsible to not disclose those things to anyone you cannot personally verify their right to access the information. Credibility is only a stones throw from socially engineering the information away from someone. The police in the room could have been attempting to get access to install illegal taps on a public official or anything other then what they were doing. Childs was probably within his rights to demand that he be contacted by the proper people in a manner that he could verify their identity. The mayor was most likely his point of contact and his superior which is why he refused to do anything until he could give it to them.

            Here is a thought experiment. Suppose I walked into your building in a uniform of some sort and asked you for the passwords to your servers and access to the server rooms. I gave you ID that matched the name on my uniform and claim I was hired by the company to perform a security audit of the system.

            Do you
            A- give me access and the passwords
            B- tell me to get lost
            C- contact your superiors and verify that I am legit then give me the passwords and access

            C- is the right answer (even though A happens all to often). But Childs wasn't in a position to contact his superiors or the mayor could have been his superior and instead stated that he would give the information to the mayor. When the mayor came around, he surrendered everything without hassle.

          • Re: (Score:3, Insightful)

            by neomunk ( 913773 )

            Your rant is only accurate if policy is to give the golden keys that can shut the city's network down to any manager that asks for it. I HIGHLY doubt that such is the case.

            Remember, this guy didn't just build a computer for a person and then not hand the passwords over, he was in charge of a public-owned network. I would be aghast if the city had network policies that gave root access to anyone who thought that they needed it, and especially those who were so cocky about it as to ask in a room full of peo

      • The proper course of action would have been for the DA to sue him in small claims court for the password.

        Small Claims Court is for... small claims.
        Usually anything less than $5,000 in value.

        Are you going to argue that those passwords were worth less than $5,000?

      • Consider the case of loaning a car to your long term SO for many years, then the relationship goes south and you show up with the cops to take back the car she's had for several years. Yes, you can get it back, but the cops will tell you to get a judgment first and won't just let you take it.

        If the title & registration of the car is in your name, yeah, they will just let you go take it. It's proveably your property.

      • > As far as wiping the configs, that was paranoid overkill, but considering how often city
        > office property gets stolen, wiping the config keeps thieves from getting the network
        > settings to the whole thing which is more valuable than any one office of downtime due
        > to power failure.

            When I left my last job as Sr. SysAdmin (they laid me off, for someone cheaper), they were absolutely sure I had left back doors into the network, and that I could sabotage everything. They couldn't find the backdoors (because they didn't exist), and ended up changing the OS on every server. In that beautiful move, they screwed up an awful lot of stuff. Ha!

            The funniest part was, some of the people who they kept on were thieves. They were stealing confidential data, and abusing the network for personal gains. It took two more years for them to figure that one out. All I can do now, since I have no involvement in that company, is sit back and laugh. :)

            The "keys to the kingdom" were on file with senior management though. Shit happens. I could get hit by a bus. I could get shot in a botched convenience story robbery. I could just decide not to ever come to work because I got a better offer. Why cripple their company?

        • Re:Too bad "being an asshole" is not a crime (Score:4, Interesting)

          by sumdumass ( 711423 ) on Wednesday February 25, 2009 @01:45AM (#26979273) Journal

          I have servers that I set up 10 years ago for small businesses and I'm probably the only one with the passwords assuming they are still running (486 and Pentium II machines running either Netware 3.something or some dos app). I get calls every once in a while from companies I haven't done business with in over 5 years asking me if I could remember the pass words to the servers.

          I generally type everything out and put it in a sealed envelope within a binder with all the server specs, applications, network diagrams and so on. The problem is that someone has either decided they didn't need it and tossed it or whoever replaced me did something with it and it can't be found anymore. Most of the times, someone changed them and they aren't the same anymore. I think one situation occurred where a company raided an office because a manager was embezzling and the cops never returned the binder. Management leaves or whatever. Sometimes they need it only for data recovery or some sort of migration to a newer system and sometimes they are still using the crap but need to change something.

          Filing the "keys to the kingdom" with the management doesn't always work well so check that they are still there and still current every once in a while.

      • Re: (Score:3, Insightful)

        by BitZtream ( 692029 )

        I'm not really sure what dimension you live in, but in the one your are posting in, your are wrong.

        If your SO has a car thats titled in your name and you break up and demand it back by calling it stolen, the police will make them turn it over immediately. There will be no waiting or courts involved as there is no need to be. They may not arrest your SO, they may not charge them, but you will certainly get your car back pretty much as soon as you prove its yours. It doesn't even matter if you are married,

    • Free Terry Childs!

      • Free Terry Childs with purchase!

        • Re: (Score:3, Funny)

          by liquidsin ( 398151 )

          *Free Terry Childs must be of equal or lesser value to that of purchased Terry Childs. Must be a California resident to claim prize. Valid only while supplies last.

          • Re: (Score:3, Funny)

            by andy_t_roo ( 912592 )

            "Warning [physics.uwo.ca]: This Product Attracts Every Other Piece of Matter in the Universe, Including the Products of Other Manufacturers, with a Force Proportional to the Product of the Masses and Inversely Proportional to the Distance Between Them."

    • Then you will never truly achieve 'BOFH' status, Grasshopper.

      Open your mind, and the lusers files! It can be beau coup fun!

      Transcend your permissions, and make backups of your PHB's pR0n folder-blackmail can be sooo fun!

      Become One with the database, there is more exploitable info there than you have time to exploit!

      Achieve One-ness with the Network, and your C*O's password-the benefits can be multi-million$'s if played right

      Go forth in the world, and achieve greatness! Be Bold!, Be Brutal!, Be Unforgiving(l

  • When modems are illegal... (Score:5, Funny)

    by MrEricSir ( 398214 ) on Tuesday February 24, 2009 @09:08PM (#26977839) Homepage

    Thankfully I'm stealing my neighbor's wifi, so I don't have to worry about being caught with a modem.

    • Re: (Score:2, Insightful)

      by Anonymous Coward
      Whoops! Looks like you forgot that you have to modulate and demodulate signals to connect to a wireless network!

  • the admin's response (Score:5, Insightful)

    by commodoresloat ( 172735 ) on Tuesday February 24, 2009 @09:08PM (#26977843)

    'If Childs is convicted on the modem charges, then just about every network administrator in the world could be charged with the same "crime,"' Venezia writes. All the authorities would have to do is 'point out that you have a modem or two, and suddenly you're wearing pinstripes of the jailhouse variety.'"

    It still beats having to wear a suit to work.

  • First, this story sounds very one-sided and has quite a bit of sensationalism. Ok, a lot. I'm sure they can charge him with something to the effect of unauthorized access to a government computer system. Nobody's going to be pointing out modems as tools of a crime. That's like saying having a car means you're a bankrobber because bankrobbers use getaway cars.

    • Re: (Score:3, Interesting)

      by Dun Malg ( 230075 )

      I'm sure they can charge him with something to the effect of unauthorized access to a government computer system.

      You're sure? How can they charge him with unauthorized access when his only action was to not give them passwords? The passwords were set when he was still employed, and had the authority to do so.

      • Re:This seems hard to swallow (Score:5, Interesting)

        by pavon ( 30274 ) on Tuesday February 24, 2009 @09:38PM (#26978031)

        He maintained access to a system which he had no right to access, while refusing to give the owners of that system the means to remove his access in a manner that wouldn't significantly disrupt the service.

        Still I have a hard time seeing this as a crime. If an employee won't give you the keys to your vault, then you fire them, call a locksmith and sue the ex-employee for damages. No criminal charges, just a civil liabilities. That is what should have happened to Childs, no more no less.

        • Re:This seems hard to swallow (Score:5, Informative)

          by arkhan_jg ( 618674 ) on Wednesday February 25, 2009 @03:23AM (#26979667)

          He was sprung with a surprise secret audit, and claims he caught the auditor taking a hard-drive, at which point he confronted her. At which point she locked herself in, and called the CIO.

          On July 9, 2008 and at all relevant times, Richard Robinson was the Chief Operations Officer of DTIS [the San Francisco Technology Information Services Department]. Defendant unwittingly found himself at a meeting with Robinson in a room at the police station at the Hall of Justice. Present at that meeting were Lt. Greg Yee and Vitus Leung from the City's Human Resources Dept. Waiting outside the room but joining the meeting midway was Inspector Ramsey. The meeting was unorthodox and short on civilities. Defendant was told that he was being reassigned and was asked to disclose the FiberWAN passwords in addition to other passwords. There was no advance notice to defendant of this request. The surrounding circumstances of this request were unnerving and troubling to defendant at best. He resisted this surprise request to disclose the passwords to the FiberWAN, telling Robinson that no one was qualified to have the passwords. Under the pressure of the situation, defendant gave password information that could not be validated. During this exchange wherein defendant was questioned regarding the passwords, a speakerphone was on the desk in meeting room and people were listening in on the other end of the phone connection in a different part of the City.

          Would you have given over the root passwords for your network and servers in those circumstances? Especially since you're likely to take the blame and/or get sued if some monkey screws something up and then blames it on you.

          As you say, a civil action would have been more than adequate to recover them - he only wanted to hand them over in secure fashion to someone qualified to know them. He did hand them over the Mayor, "the only person he felt he could trust," a few days later, after he was already in jail.

          OK, Childs had a bit of a God complex, but after years designing something that intricate, and being the only 24/7/365 support for a few years due to budget cuts, it's understandable. They've basically charged him for having the tools, access and knowledge to actually do his job.

          Ironically, after claiming he was the one threatening the network, the city put the list of vpn passwords they found in his house into evidence unredacted, thus compromising half of the vpn 2-factor security for the entire network, forcing them to reset them all 2 days later; locking everybody out of the vpn access entirely. This was the first network outage since they imprisoned Childs, and was directly caused by the incompetence of the city technical management.

    • he had LEGAL means to have those, so the "hacking" point is moot. If they expected him to work late, or work from home, then it was part of his job tools. That access is a civil matter, unless it is PROVEN he caused actual, measurable harm... as he was in jail from the date of accusation, they have absolutely no trail to prove anything.

      Again, if that was true your boss could fire you while your on vacation, and having taken your company laptop and cell for emergencies, then charge you with theft and hacki

    • They charge gun owners in their own homes with possession of a tool of crime while serving warrants for other people, so that's not much of a leap.

      • Re: (Score:3, Insightful)

        by ckaminski ( 82854 )
        What they can charge you with, and what they can convict you with, are two very different things, and depend greatly on your lawyer and the judge and jury you draw.

  • popular trend in the courts lately (Score:5, Insightful)

    by v1 ( 525388 ) on Tuesday February 24, 2009 @09:12PM (#26977871) Homepage Journal

    If you don't like what someone does, but strictly speaking it's not really illegal, then find something else they did, (something that maybe a lot of people do and get left alone for) that has some silly, overly-broad definitions you can twist, and soak him for that instead. (ether as substitute punishment for the former that you can't make stick, or just plain in retaliation for doing something you didn't like)

    As usual, the legal system that makes me sick to my stomach some days.

  • Don't be rediculous... (Score:3, Insightful)

    by Pichu0102 ( 916292 ) on Tuesday February 24, 2009 @09:16PM (#26977891) Homepage Journal

    All the authorities would have to do is 'point out that you have a modem or two, and suddenly you're wearing pinstripes of the jailhouse variety.'"

    Of course they wouldn't do that.
    They'd use that fact as leverage to extract whatever they want from you first.

  • So not only did he withhold passwords.

    And have modems attached to computers.

    But it's going to take 250,000$ [infoworld.com] to fix.

    Can the defense claim insanity on behalf of the prosecution, 'cause I think we've just hit bat country!

    • Re: (Score:2)

      by dbIII ( 701233 )
      Oh really? I suggest reading Bruce Sterling's "The Hacker Crackdown" to get a history of how these costs are overstated when somebody wants a show trial.

      • Re: (Score:3, Interesting)

        by jamstar7 ( 694492 )
        Like AT&T trying to show that they had to buy a spendy mainframe for the exlusive use of one tech writer and then a supervisor for said tech writer so they could pad the 'damages' in a trial by the cost of the mainframe, 6 weeks 'work' by the tech writer at 40 hrs/week & the same for the supervisor, when the very same manual that was 'stolen' was for sale for like 10 bucks?

        • Re: (Score:3, Interesting)

          by Ellis D. Tripp ( 755736 )

          Very similar to the way that the "street value" of seized drugs are reported after a bust.

          If a large pot grow gets busted, the total crop gets valued as if it were broken down into tens of thousands of nickel bags and sold at retail.

  • Section 502 (Score:5, Informative)

    by russotto ( 537200 ) on Tuesday February 24, 2009 @09:22PM (#26977931) Journal

    Section 502(c) states in part

    Except as provided in subdivision (h), any person who commits
    any of the following acts is guilty of a public offense:

    (6) Knowingly and without permission provides or assists in
    providing a means of accessing a computer, computer system, or
    computer network in violation of this section.

    OK, "knowingly" makes sense, but "without permission"? The man was the network administrator; he was authorized to make decisions about how the network is accessed, it goes along with the job. Who was he to get permission from, himself? If he made bad decisions, by all means dismiss him, but prosecuting him is unreasonable.

    And since they dropped the most serious charge, can we admit his 8th amendment rights were stomped and pissed-upon by the 5 million dollar bail requirement?

    • Re: (Score:2)

      by nettdata ( 88196 )

      The man was the network administrator; he was authorized to make decisions about how the network is accessed, it goes along with the job. Who was he to get permission from, himself?

      Oh please...

      You have NO way of knowing that it was his decision. And it's a government... odds are that he was NOT allowed to make that decision.

      I know that in my shop, the network admins do not have that kind of autonomy. They can make all the recommendations they want, but it's not their decision.

      For all we know, he may have asked his superiors for permission and they failed to give it, and he went ahead and did it anyways.

    • Just because you are the administrator of something, doesn't mean you can do whatever you like with it, or that you have full decision making powers over it. Your employer, contractor, whatever ultimately gets to decide how things work. For example you might feel that SSH is the best way to access servers remotely. However your company might not like that, they want to monitor the traffic, so they insist on telnet over VPN only. You can argue with them, but if the ultimately say "This is the way it's going

  • Jeeezzzzzussss (Score:2, Insightful)

    by MightyMartian ( 840721 )

    I can't believe this megomaniacal prima dona is now somehow the posterboy of the IT people. There were ways for this nutbar to get out of the quandary while still saving his ass. Instead, he holds a network [b]that does not belong to him[/b] for ransom.

    • Re:Jeeezzzzzussss (Score:5, Insightful)

      by Dun Malg ( 230075 ) on Tuesday February 24, 2009 @09:40PM (#26978043) Homepage

      I can't believe this megomaniacal prima dona is now somehow the posterboy of the IT people. There were ways for this nutbar to get out of the quandary while still saving his ass. Instead, he holds a network [b]that does not belong to him[/b] for ransom.

      Well, it's just like 1st Amendment cases involving pornography, marching down the street in neo-Nazi uniforms or hooded bedsheets, or the like. You have to fight the idiots who would deny basic rights or make a mockery of law unilaterally, even when they go after the dirtbags. Letting them ignore the law when they beat down the unpopular is just giving them a free pass to do the same to you in the future, when it strikes their fancy.

    • Re:Jeeezzzzzussss (Score:5, Funny)

      by socsoc ( 1116769 ) on Tuesday February 24, 2009 @09:45PM (#26978073)
      Those damn IT people and their correct usage of HTML tags on a tech website, always holding BBCode tags hostage for ransom...

    • Re: (Score:2)

      by db32 ( 862117 )
      Just to play devil's advocate it WAS his network assuming he paid taxes. Arguably he was trying to protect the tax payers investment. I haven't exactly kept up on it, but I thought he even told the judge/lawyer something to that effect (I'm not giving him the passwords because he is an incompetent tool that will break it all). Now...whether he went about doing this in the correct fashion is certainly another issue, but if every citizen protected public investments like that we wouldn't have a 10 trillion

  • Someone needs a geography lesson ... (Score:5, Insightful)

    by tomhudson ( 43916 ) <barbara@hudson.barbara-hudson@com> on Tuesday February 24, 2009 @09:24PM (#26977951) Journal

    FTFA:

    'If Childs is convicted on the modem charges, then just about every network administrator in the world could be charged with the same "crime,"' Venezia writes

    Even if convicted, the Childs case doesn't establish jurisprudence for 95% of the world.

    • Re: (Score:2, Insightful)

      by ElectricTurtle ( 1171201 )
      Yeah, too bad it's in the 5% that matters, given that CA has pretty much the highest tech density in the world, sets all the trends, and it's also home to ICANN.

  • Who's in charge? (Score:5, Informative)

    by __aaaehb3101 ( 610398 ) on Tuesday February 24, 2009 @09:42PM (#26978059)
    While I haven't been in this specific situation(ie. jail), I have been in a similar situation.

    At a previous employer(this is one of the reasons I no longer work there) my supervisor demanded that I give him all my passwords. I asked him why he needed them I could give him any specific access he needed on demand.

    When I was hired I was given a number of NDAs to sign one of them specifically covered the process I used to connect to various remote systems, and the passwords I used. My supervisor(with no IT or technical background of course) continued with his demands for all my passwords, for days. After repeatedly trying to explain that even if I was to give him my passwords, without understanding how you use various access levels to accomplish tasks, he could end up causing massive problems.

    In an attempt to meet these demands, I asked for a signed release from the specific NDA that covered my passwords and process. He informed me that he did not have that authority, so I asked him how I could honour my NDA if I gave him information I was not permitted to give anyone. BTW my supervisor did have his own passwords, and had a process to have new ones created.

    Long story short, I refused and then a few days later I arranged to transfer to a different department. With this case as a guide I would legally have been wrong no matter what I did, glad I'm out of IT right now.
    (If anyone cares, I later found out the reason my supervisor wanted my passwords was that his id/passwords had been burned through lack of use and using the wrong passwords. And he did not want his supervisor to find out he had had no access for weeks. His supervisor would have been notified if anyone requested a password reset or new ID.)

    • Well in your case, you'd be covered. The problem here isn't specifically with him not handing over his personal passwords, the problem is that he's locking people out by doing so. Now while it is a poor system where only one guy has top access, that doesn't change anything. If your passwords don't stop the lawful owners from getting at their stuff, then there's no problem. The problem is when your passwords are the only way to get at it. Then if you refuse to hand it over, you can be in trouble.

      It would be

  • Analysis (Score:5, Informative)

    by GiMP ( 10923 ) on Tuesday February 24, 2009 @09:45PM (#26978075)

    First, I'll remind everyone that the code 502 in question is only applicable in California.

    The phrasing of the law at the root of this discussion is, "Knowingly and without permission provides or assists in providing a means of accessing a computer, computer system, or computer network in violation of this section."

    What I imagine the prosecution will argue is that Terry Childs had no right or explicit permission to configure remote access. The defense will likely counter with the fact that as their Systems Administrator he had implied permission as part of his job's duties. Depending on the outcome, this might trigger Systems Administrators to seek contracts shielding themselves from such risks, or seeking express, written permission for everything they do. Of course, considering how badly companies abuse their employees, and how many employees are naive enough to not protect themselves legally, it will likely just be ignored and we'll see more cases like this.

    • Re:Analysis (Score:5, Interesting)

      by GiMP ( 10923 ) on Tuesday February 24, 2009 @10:00PM (#26978155)

      The other possible outcome is that they'll say that he had permission to configure access, but when that privilege was renounced, that he should have removed remote access... in which case, I question how they would ever expect to let anyone go if they would have to go through such trouble each and every time?

      The truth is that often enough, companies don't change passwords, or at least not all of them, when a Systems Administrator leaves. Even in very small shops, it is very difficult to keep track of all the places passwords might be hiding, where remote access might left enabled. For other employees, it isn't as tough, they might have access to one or two systems, but for an SA? You might never be able to lock them out completely, and simply rely on trust, morals, and the law. For instance, an SA might have set up a router just to test new IOS releases on, test, etc. Nobody else would have used it other than that SA, and nobody else would have known of it of it or thought of it. Such a router could be on the network for years without being noticed. Such issues will only become more apparent with "VM Sprawl", where you might have thousands of virtual machines. Without strict auditing, and even with it, you'll easily miss a stray virtual machine floating out there.

      The point is, once you give someone access to your network and your systems, to the level that a CTO, Senior Systems Administrator, or Network Administrator might have access, you can't ever be certain of locking them out of your systems, and you shouldn't be able to punish them for not remembering to lock themselves out -- only because it is too easy to make such mistakes or to have such oversight.

      Personally, whenever I've left a job, I've done my best to forget everything possible that was specific about their configuration. I'd rather not remember the IP addresses of their machines, their passwords, or anything else -- there is too much liability.

  • where the most pedestrian news is given the most ridiculous fear-driven spin, made front page in breathless write up, and a bunch of yammering legal ignorants wlll ape right along

    and then these same people will ridicule stereotypes outside their domain who supposedly fall for propaganda and hysteria all the time

    take a look in the mirror friend

    no, slashdot, this case does not set the precedent you believe it does

    CONTEXT. its a magical concept. consider it some time

  • I posted this in response to the Groklaw Summarizes the Lori Drew Verdict [slashdot.org] article, but it's 100% valid here as well:

    Look, the fact is, if The Man wants to get you, The Man will get you. It doesn't matter what the laws are, exactly - they'll find something to hit you with.

    That was true before the Lori Drew trial (Terry Childs charges), and it's true now. The precedents set by this case in no way make being on the internet (owning a modem) one bit more "risky". If you don't do anything to bring down the wrath

    • And complaining about that is a hysterical overreaction? WTF?

      • Re: (Score:2)

        by Stormie ( 708 )

        Complaining that this case "puts all admins in danger", or that you can now be thrown in jail for owning a modem, is a hysterical overreaction.

        • Not really. (Ab)using laws sets precedents. If the guy ends up going to jail for just owning a modem, then how is it an over reaction to say that you can be thrown in jail for owning a modem?

          • Re: (Score:2)

            by Stormie ( 708 )
            The overreaction is in believing that your situation is in any way different today to how it was yesterday, BEFORE this guy got thrown in jail for owning a modem.

    • Re: (Score:2)

      by dbIII ( 701233 )
      IMHO we're seeing Terry Childs in the hotseat here and not Nancy Hastings whose hard drive was taken away for no legitimate work purpose I can see becuase Terry was the one the caught the new security person exceeding their authority and kicked up a fuss about it. He is being sacked for taking photos as evidence to present to management, but now that has turned into "intimidation".

      If I saw someone acting so suspiciously I would also confront them. If it isn't your job to pull apart computers full of confi

  • The citys also runs the jail system so that speeds that part up out side of a city things likely do not go that fast.

  • Comment removed (Score:5, Interesting)

    by account_deleted ( 4530225 ) on Tuesday February 24, 2009 @10:04PM (#26978183)
    Comment removed based on user account deletion
    • besides it does not matter. Sharing a password that you know as a result of your employment is wrong. Using it without permission or after employment is wrong. Simply not telling people the passwords is your right( although it might be being a jerk). Analogy: I hire a locksmith to reset the combination to my vault. He knows the combination, he set it. I have a dispute with said locksmith over another matter and tell him i will no longer need his services. Then i lose, forget or whatever the combinati

  • A Moot Point ? (Score:4, Funny)

    by shashark ( 836922 ) on Tuesday February 24, 2009 @10:20PM (#26978253)

    Count 1: disrupting or denying computer services is moot

    Joey: It's a moo point
    Rachel: You mean a moot point ?
    Joey: No...no, a moo point ... like a cows opinion, doesn't matter ... it's moo.

  • So what if Childs is an asshole, it's his right as an American to be one.

    Boo-hoo if the SF IT dept risk management plan couldn't handle a rogue employee refusing to give up the password.

    It's a pretty dangerous precedent if people can be legally forced to disclose information against their will.
    Isn't that what the 5th amendment was for?

    Prosecutor:
    Does your mother have AIDS? YOU MUST ANSWER
    Witness: ...Yes
    Prosecutor:
    BURN HER AT THE STAKE!!!!

    Yay Mcarthyism

  • Sounds kind of like the "possession of criminal tools" charges so many cases have added on, when said "tools" are ANYTHING used to commit the crime. Always seemed to me just a way for prosecutors to add an extra set of random charges for extending a sentence, or extra bargaining room for a plea.

  • Future sys admin dialogue? (Score:3, Funny)

    by DeathElk ( 883654 ) on Tuesday February 24, 2009 @11:56PM (#26978777)

    Tony: Hi Mike, how ya doin'? How was Joilet?

    Mike: Oh, it was bad. Thursday night they'd serve a wicked pepper steak.

    Tony: Can't be as bad as the cabbage roll at the Terra-Phelavo penn.

    Steve: Or that oatmeal at the Cook County slammer.

    Tony: Well, they're all pretty bad.

Slashdot Top Deals

If all else fails, lower your standards.

Close