Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

3 of 4 Charges Against Terry Childs Dropped

kdawson posted more than 5 years ago | from the childs-play dept.

Government 189

phantomfive writes "Terry Childs, who was arrested nearly a year ago for refusing to turn over the passwords to San Francisco's FiberWAN network, has been cleared of three of the four charges against him. The dropped charges referred to the attachment of modems to the network; the remaining charge is for refusing to turn over the password. The prosecutor has vowed to appeal, to have the charges reinstated. We have the original story, and the story where Childs tells his side, for those who want a refresher."

Sorry! There are no comments related to the filter you selected.

Great! (-1, Offtopic)

hotfireball (948064) | more than 5 years ago | (#29162709)

Great, I am first!!! Now I go read story...

Re:Great! (-1, Offtopic)

Anonymous Coward | more than 5 years ago | (#29162713)

Actually the party was cancelled

Re:Great! (-1, Offtopic)

hotfireball (948064) | more than 5 years ago | (#29162837)

I also got some replies!! Yay!! :)

Re:Great! (-1, Offtopic)

Anonymous Coward | more than 5 years ago | (#29162735)

Fr1st ps0t!!1!

Re:Great! (2, Informative)

pushf popf (741049) | more than 5 years ago | (#29162875)

All he needs is written authorization from the city to turn over the passwords to whoever they say. Any other refusal just makes him a dick and he belongs in jail.

As an ex-employee, it's no longer his call as to "who gets the keys"

Re:Great! (4, Insightful)

drinkypoo (153816) | more than 5 years ago | (#29163161)

As an ex-employee, it's no longer his call as to "who gets the keys"

Wrong! The SOP was that he was only to turn the passwords over to the Mayor. This has been covered extensively. This requirement DOES go away if you're fired... you don't [by default] have to turn over ANY passwords! Just say "I don't work here any more, and I don't have your passwords." Meanwhile, if you do still work there, then you're still bound by the agreement you already made to follow the policies and procedures, which means he was bound to turn the passwords only over to the mayor.

In other words, the only charge not dismissed by the judge is the only one which he ever should have been accused of (if any) and he has a solid defense against it. We shall see how it plays out, but it is not nearly as cut and dried as you imagine or pretend.

Re:Great! (2, Insightful)

pushf popf (741049) | more than 5 years ago | (#29163411)

As an ex-employee, it's no longer his call as to "who gets the keys"

Wrong! The SOP was that he was only to turn the passwords over to the Mayor. This has been covered extensively. This requirement DOES go away if you're fired... you don't [by default] have to turn over ANY passwords! Just say "I don't work here any more, and I don't have your passwords." Meanwhile, if you do still work there, then you're still bound by the agreement you already made to follow the policies and procedures, which means he was bound to turn the passwords only over to the mayor. I'll give passwords to anybody who can produce written authorization from any executive, officer or elected official with the authority to do so.

"SOP" is completely meaningless unless it's law or a written policy authorized by the City, that the employee signed.

If the Mayor wants the passwords, that's fine with me. In fact, assuming it was just a few logins, I'd even give it to him for free, regardless of whetehr I was still an employee or not. In fact, if they want to pay for my services, I'll happily root all their servers and routers and tell them what the new passwords are.

. OTOH, I guess that explains why I'm not in jail and have more business than I can handle. The first rule of successfully working with others is "Don't be an asshole."

Re:Great! (2, Informative)

Anonymous Coward | more than 5 years ago | (#29164291)

You failed to realize that in fact he stated that he would give the passwords to the mayor, which he did.

Re:Great! (1)

GodfatherofSoul (174979) | more than 5 years ago | (#29163855)

So, by that logic if I horde a bunch of my company's hardware and get fired for it, I don't have to return it since I'm no longer an employee? Your argument is flawed.

Re:Great! (1)

Ma8thew (861741) | more than 5 years ago | (#29164001)

No, because that's stealing.

He should have offered his resignation ... (2, Insightful)

Zero__Kelvin (151819) | more than 5 years ago | (#29163675)

"All he needs is written authorization from the city to turn over the passwords to whoever they say. Any other refusal just makes him a dick and he belongs in jail."

Bullshit. A skilled system administrator can get root / Administrator access so long as they have access to the machine, so the benefits of giving the password up are far outweighed by the benefits of following industry standard security practices. All too often incompetent upper management needs to be protected from it's own incompetence. You can't make it my job to keep a system running smoothly and simultaneously let any incompetent idiot have root access to it. You can write me a note for the teacher all day, I'm not going to accept it. I'm going to explain to them that they can have the passwords in exactly one manner, and that is concurrent to my resignation. If they want them that bad, they get both. That is where Childs went wrong, but he may well have had the best of intentions.

All of that being said, jail for this guy is absurd, as anyone who actually reads the article and reads Childs' explanation would almost necessarily conclude the same.

Re:He should have offered his resignation ... (1)

Sun.Jedi (1280674) | more than 5 years ago | (#29163955)

A skilled system administrator can get root / Administrator access so long as they have access to the machine

I challange your usage of the word, "skilled"." The hardest part is reading.

Owait ... this is /., I see your point now. :P

Re:He should have offered his resignation ... (3, Insightful)

ka8zrt (1380339) | more than 5 years ago | (#29164735)

Ya know... that is not always the case. Or to use your vernacular, with emphasis... BULLSHIT! I have administered systems which were secure enough that they would not boot up into single user mode and grant access without the root password, and the drives were secured in such a way that not even pulling the drive and putting it in another system would help... the boot loader required a password to decrypt the filesystem. Given that this machine was up for like 10 years last I knew, when it was finally taken out of commission... reboots were rare. As for exploiting holes in remote access routes, such as through sendmail, http, etc... the only active routes into the system were for Kerberos (e.g. ports like kerberos, kpasswd, and klogin) and considered at the time to be secure short of the resources of the likes of NSA, CIA or DOD.

Now in the particulars of this case, Child's practice of not committing configurations to NVRAM complicates the problem, and makes it even more impossible for the passwords to be recovered. Ever spent some time configuring a router, holding off on the saving to NVRAM to test the configuration, and then lost power? If the scripts to configure the routers were some place only he knew (such as on a USB key, or hidden away some place on a 300GB drive, perhaps in an encrypted file), it was no problem for him if a unit rebooted. But try to reboot to gain access... guess what, you just lost what you were looking to find. And since we are talking about a router, even if he had committed the configuration (and associated password) to NVRAM, how would having physical access help you? Most routers I have seen, the best you can do is to reset to factory defaults with a little magic button, and provide no way to boot off of other media and still access the configuration on the switch. Nor can you pull the drive and put it in another PC and go that route. As someone who helped write the firmware for networking gear, I know. Only those of us who did that work even had a clue on how to get at a shell like environment to get at the stored configuration. But again, we are bitten by the lack of writing to non-volatile storage in this case. And if you are going to try to brute force a password... it would not help if the password for the console access is "KGToNBhChA2ayofcVL1voA". Granted, using such a password on quite a few switches/routers would be stupid, unless you scripted that access (something I have done). But then there are the countermeasures against such brute force attacks, such as delaying login re-attempts for 5-15 seconds, locking accounts after so many failed logins, etc.

So, with all this said, someone needing to try to gain access to some machines had better either hope they have the configurations stored someplace off the switch to enable restoration, or hope that they only have to assume a position of humility (e.g. the mayor asking Childs) in having to ask for the administrator password which has hopefully not been locked down. Because, if that is not the case, they are going to soon be assuming the same position a ex-LEO or child rapist is said to be forced to assume in prison...

Oh... and as for resigning (can one say he was really given a chance to do so properly) and giving the passwords to someone who was not supposed to get them, he could quite possibly be held responsible for the resulting damages if it was contrary to procedures. And given that this has all the appearances of being one pissing match of a turf war... I would be very afraid that that would be the case were I in his position, and as such, the case is IMO totally absurd, and perhaps just has some folks wanting to make a name for themselves...

Re:Great! (1)

ka8zrt (1380339) | more than 5 years ago | (#29164199)

Written authorization from the city? Does this mean that some idiot department manager in the sanitation department should be able to write up some letter, hand it to him, and get the passwords? I doubt it, but that would still be fulfilling what you wrote. At a minimum, it would have to be someone in his chain of command, and if the SOP at the time was to only turn them over to the mayor, then he would almost certainly be legally liable even if he turned them over to say the DA. While IANAL, I have in the past been the owner of those "golden passwords" and had very through lawyers advise me of this in the past when I have left previous employers, and any lawyers he speaks to are no doubt advising him of the same. He cannot be expected to know changes in policy, and if the DA (who may or may not be elected in SFO) or some city councilman was not in that group before... well...

I will say this... First, if all it takes is the mayor asking for them and receiving them, then at a minimum the mayor is being something I cannot say politely here, if not perhaps negligent., if that is all it took to regain control of the network. And secondly, having worked at places such as CompuServe (which carried high security DOD traffic over our network when I was there), if there was not a policy of putting critical (non-personal) passwords in a sealed and clearly labeled envelope, which was locked in a secure safe (such as the mayor's office), then someone was at least a fool. We called this the "incase you are hit by a bus" envelope, because sometimes, folks are hit by a bus or BART train. Crap happens, and if I had been such a person and they had needed one of my golden passwords which only I knew... well, they could get it. And each time I changed it, I put the new one into sealed envelope, put what the password was for (e.g. "Kerberos Server"), along with my name, date, and who could access it (e.g. "CEO, President, EVP of Operations") and took a trip upstairs to put it in the corporate admin's safe. And the old envelope was retrieved, verified to be secure, and shredded.

Witch hunt (5, Insightful)

joaommp (685612) | more than 5 years ago | (#29162721)

Always seemed to me this was not much more than a witch hunt. Why else would them set a bail higher than for killers and rapists?

Re:Witch hunt (5, Insightful)

Anonymous Coward | more than 5 years ago | (#29163339)

politics 101. pissing of the ones in power is the worst crime you can commit.

Re:Witch hunt (0)

Anonymous Coward | more than 5 years ago | (#29163423)

Exactly. Pissing of the ones in power > killing someone.

Captcha = damages

Re:Witch hunt (0, Informative)

Anonymous Coward | more than 5 years ago | (#29163701)

high bail does not mean witch hunt. Bails in US court systems are generally broken, with more minor crimes often having legally required higher bails than more major crimes.

Also, please look up the definition of "witch hunt", and of "scape goat". In a witch hunt, there would have been little to no chance of a finding fo innocence. With a scape goat, it doesn't matter whether innocence or guilt is found, only a temporary person on which to pin blame until the issue fades by the wayside and the true screw-ups can slide by without getting caught.

Re:Witch hunt (1)

joaommp (685612) | more than 5 years ago | (#29164101)

Thank you for the correction.

(but anyway, I still think everyone got what I meant - and please don't be too harsh on a non native english speaker, which everybody here seems to assume everybody else always is.)

Re:Witch hunt (1)

Auraiken (862386) | more than 5 years ago | (#29163997)

Totally agree, someone tag this story "hero".

This guy should never have had to go to jail over this garbage. They could still have had court cases in a civil fashion.

1M bail and 1yr in jail...? (4, Insightful)

Manip (656104) | more than 5 years ago | (#29162789)

I'm sorry but this guy has already had time served. Even if they do find him guilty one year in jail for what he did is far more than enough. Plus 1M bail? Is he a violent criminal? ...

This sounds like a classic story if ignorant people making decisions about technical crime and getting scared. I aim that both at the city and at the judge who set the original bail.

We need special technical trials for things like this within which both the defence and prosecution are allowed to bring in technical witnesses to put the case into perspective for non-technical people (as opposed to "HACKER! Get the pitch forks!").

Re:1M bail and 1yr in jail...? (5, Insightful)

Seumas (6865) | more than 5 years ago | (#29162821)

Ignorant people are afraid of the technologically savvy the same way they are afraid of science. They don't understand it, so rather than bettering their knowledge and informing themselves, they'd rather fear the worst and attack those who represent a threat (that is, those who know something they don't).

Also, why didn't the guy just say "dude, it was a complex random password and I've completely forgotten it"? They can't force you to give them a password that you've forgotten, surely? Also, is a partial "moral victory" really worth an entire year of your short life span?

Re:1M bail and 1yr in jail...? (1)

joaommp (685612) | more than 5 years ago | (#29163109)

Well, it's a new different kind of bullying.

Re:1M bail and 1yr in jail...? (4, Funny)

Hurricane78 (562437) | more than 5 years ago | (#29163179)

Well, they should be afraid. Because I'm going to kick their asses for their ignorance!

(*blend to underwater lair under a volcano*)
Release the sha... what?... OK, the sea bass...

MUHAHAHAAAA

Re:1M bail and 1yr in jail...? (5, Informative)

Zombywuf (1064778) | more than 5 years ago | (#29163755)

He didn't say he'd forgotten it because he was simply doing what his job description told him to do. He was called into a room with a dozen people he didn't know, he refused to hand over the password to these people. When a single person (the mayor) who was authorized to know the password asked for it, he handed it over without hesitation.

Re:1M bail and 1yr in jail...? (1)

rpervinking (1090995) | more than 5 years ago | (#29165423)

What a crock. You and I both know that the people that Childs met on July 9th were authorized to receive those passwords. To pretend that between then and when he was arrested on July 12th he had no opportunity to meet with anyone that he could identify as authorized to receive those passwords is farce. To maintain that, once in jail, he had no idea that maybe the people he was meeting were who they were claiming to be is either paranoid fantasy or, what we both know it to be, a simple lie.

He had some axe to grind, he ground it, he got to make a grandstand play by dragging the mayor into a personal meeting with him. Congratulations. He got what he wanted. He continues to reap what he sowed. Boo hoo.

Re:1M bail and 1yr in jail...? (4, Insightful)

LordKronos (470910) | more than 5 years ago | (#29162971)

We need special technical trials for things like this within which both the defence and prosecution are allowed to bring in technical witnesses to put the case into perspective for non-technical people

Huh? Special technical trials? Why? The current system already allows lawyers to bring in expert witnesses [wikipedia.org] to explain stuff. And lawyers are allowed to do a bit of story telling during their opening and closing arguments, and they can use that opportunity to explain thing in other terms (including car analogies, if they choose).

A lot of us around here always complain about legislature creating special laws to make illegal things that are already illegal under an existing law. Let's not turn it around and start asking for special trials when the cases can already be accommodated by the existing court system.

Re:1M bail and 1yr in jail...? (4, Insightful)

Jah-Wren Ryel (80510) | more than 5 years ago | (#29163159)

Huh? Special technical trials? Why? The current system already allows lawyers to bring in expert witnesses to explain stuff. And lawyers are allowed to do a bit of story telling during their opening and closing arguments, and they can use that opportunity to explain thing in other terms (including car analogies, if they choose).

Once upon a time a "jury of your peers" really meant peers, and not just the most easily swayed people in the jury pool. I'm not saying every single person on the jury needs to be a network engineer, but you can pretty much count on the prosecutor objecting to anyone in the pool with any technical expertise relevant to the case.

So, not special trials per se, but a process that rules out anyone with domain knowledge relevant to the trial is fundamentally broken. The number of really bad car analogies that get made here everyday among the relatively technically astute should be proof enough that requiring the issues to be dumbed down for an uneducated jury is not a very good way to run the system.

Re:1M bail and 1yr in jail...? (0)

dbIII (701233) | more than 5 years ago | (#29163807)

With respect, none of this is as complex as DNA and other forensic evidence which is handled quite well in criminal trials every day. Explaining these things is one reason why some trials take a long time.
Jury selection is another story and if a prosecutor or defence thinks they can more easily sway someone with no pre-existing knowledge on the subject then they will select accordingly.

Re:1M bail and 1yr in jail...? (5, Insightful)

ScrewMaster (602015) | more than 5 years ago | (#29164171)

With respect, none of this is as complex as DNA and other forensic evidence which is handled quite well in criminal trials every day.

With equal respect, have you ever been through jury selection? I have (a number of times unfortunately: every time I move they waste a day of my time not selecting me) and the GP is correct. The system selects for the most ignorant of any issues relevant to the proceedings, and anyone who could be presumed to have knowledge of mathematics or statistics suffer the first peremptory challenges issued. Don't want someone who can see through the numbers the trial lawyers and their expert witnesses pull out of their nether regions. I'm just a software engineer, and every god damn time I was asked what I do for a living I was promptly removed from the jury. The people that were left were often very nice people (you get to know some of your potential fellow jurors in the jury pool beforehand) but not people that I would want on my jury, if I were accused of a computer crime ... especially if I were innocent. The naked fear so many individuals have of computers, and especially those who are accused of computer crimes is unnerving. Fear of the unknown is not intrinsically irrational: but fear of gaining understanding is.

All the juries I've (almost) been on are filled with people to whom a trial about computer systems is, in fact, just as unfamiliar and frightening as a trial involving DNA or other complex evidence, and might just as well be about DNA so far as their level of understanding is concerned. The idea of a technical court is not a bad one at all, particularly given the importance of sophisticated science and technology to all of us, not just those with technical backgrounds. Imagine judges with engineering or science degrees running the show in such trials. Honestly, if we had such courts the patent system probably wouldn't be broken and the RIAA would have been laughed out of court from day one. I can just see a judge who just incidentally happened to have a degree in computer science asking an RIAA attorney: "So, you're claiming that a logged IP address infallibly identifies an individual copyright infringer? Hm. Not on this planet, bucko."

Truly, in these times ignorance is not bliss, and we as a society are paying the price for allowing our adversarial system to dumb down those who judge us. Remember, our justice system was developed in much simpler times. The pace of change being what it is, it's too much to expect the law itself to always be on top of things, but it shouldn't be too much to expect our juries to really be composed of our peers.

Re:1M bail and 1yr in jail...? (2, Interesting)

dkleinsc (563838) | more than 5 years ago | (#29164777)

That's interesting: the trial I was in had a jury with a chemist and 2 software developers. The only person booted for professional reasons was an attorney. However, this was in a county court system that put a lot of effort into making the jury pool a wider selection of people in the interests of getting a fair trial (silly concept, I know).

YMMV, but blind cynicism about what a well-run court would look like is about as useful as blind trust in the court system. If you're in an area where judges are elected, talk to the judicial candidates about your concerns regarding jury selection, and go ahead and base your vote on their answer. Yes, they may still lose/win based on TV ads that say "Judge Smith is tough on crime", but politicians actually notice when their constituents talk to them directly.

Re:1M bail and 1yr in jail...? (4, Interesting)

sumdumass (711423) | more than 5 years ago | (#29165047)

Speaking of incompetent but well meaning people on the jury, I used to work with a girl who sat on a jury trial over a murder where two boys (14 and 16) shot and killed some girl who was obsessed with one of them, enlisted the help of his mom and another friend (a 19 year old woman) who took the body to a barn across the county and caught it on fire.

This girl on the jury came into work after the first day of trial and told us they were going to fry if she had anything to do with it. I wrote a letter to the judge and defense attorney about this. She was left on the jury and the death penalty was taken off the table. I was also arrested and brought before the judge and told that if I threaten a juror it was a felony and so on before being release 5 miles away from my car with no way to get home but walking with no charges ever being filed. I was totally flabbergasted and had no idea what was going on. The jury was then sequestered.

Years later, someone else that used to work there told me she had told the judge that she only said those things because I kept telling her to convict the people. I never spoke to her directly, I was just there when she was bragging about how much power the jury had (and hence, how much power she had because of it) I guess I had the same last name (no relation) as one of the defendants and throwing me under the bus was her way of making sure they paid while she stayed out of trouble.

Re:1M bail and 1yr in jail...? (1)

ScrewMaster (602015) | more than 5 years ago | (#29165223)

Honestly, it sounds like you should have taken that higher up the food chain. You did the right thing, and the system burned you for it. If nothing else, that sort of abuse should have been made public at the time: a quick call to a local reporter might have earned you a public apology.

Re:1M bail and 1yr in jail...? (1)

Kjella (173770) | more than 5 years ago | (#29163809)

So, not special trials per se, but a process that rules out anyone with domain knowledge relevant to the trial is fundamentally broken. The number of really bad car analogies that get made here everyday among the relatively technically astute should be proof enough that requiring the issues to be dumbed down for an uneducated jury is not a very good way to run the system.

So in a medical misconduct trial you want 12 doctors on the jury, able to understand the medical evidence? In a copyright infringement trial, you want 12 copyright experts which inevitably have tight links to the copyright industry on the jury? I certainly don't think you'd want 12 policemen with domain knowledge on what police work involves in a trial about excessive police violence.

I'm not saying it's perfect, but it's better than any other system we've tried. Honestly, if you compare it to the 1700s when they decided this was how US trials should look like (ok, the jury system is probably older and inherited somewhere) then the people on the jury certainly weren't educated. Honestly, if you can't dumb down the essence of the case to where normal people understand it, there's something very wrong.

Re:1M bail and 1yr in jail...? (1)

Jah-Wren Ryel (80510) | more than 5 years ago | (#29164007)

a process that rules out anyone with domain knowledge relevant to the trial is fundamentally broken.

So in a medical misconduct trial you want 12 doctors on the jury...

No. Please read what I wrote more carefully and refrain from succumbing to obviously incorrect interpretations.

Re:1M bail and 1yr in jail...? (1)

ScrewMaster (602015) | more than 5 years ago | (#29164299)

So, not special trials per se, but a process that rules out anyone with domain knowledge relevant to the trial is fundamentally broken.

So in a medical misconduct trial you want 12 doctors on the jury, able to understand the medical evidence?

Possibly. But the GP's term "domain knowledge" can mean different things: you don't necessarily have to have specific knowledge of the particular fields involved in a trial to be a better juror. Honestly, a jury with a basic understanding of scientific method, and an adequate command of math and statistics would help a lot. Is that asking too much?

Re:1M bail and 1yr in jail...? (0)

Anonymous Coward | more than 5 years ago | (#29164649)

I certainly don't think you'd want 12 policemen with domain knowledge on what police work involves in a trial about excessive police violence.

You needn't worry about that, police brutality won't ever reach the courtroom.

Re:1M bail and 1yr in jail...? (1)

laron (102608) | more than 5 years ago | (#29165219)

So in a medical misconduct trial you want 12 doctors on the jury, able to understand the medical evidence? JWR was talking about that the current system would exclude any doctor (in practice probably everyone who knows the difference between Eustachian and Fallopian tubes) from the jury in such a case.

Re:1M bail and 1yr in jail...? (1)

sjames (1099) | more than 5 years ago | (#29165463)

One can take peer too far either way. Certainly we can't compose juries entirely of other defendants for the same trial, but by the same token, having people who don't even understand what you're supposed to have done or what you should have done (or not done) instead isn't good either.

Perhaps a medical misconduct trial shouldn't have 12 doctors as jurors, but it shouldn't have NO doctors as jurors either. It surely shouldn't be composed of 12 illiterate professional ditch diggers who couldn't figure out how to get out of jury duty. It really shouldn't be packed with 12 people who are pissed that they've been shanghaied under threat of arrest and paid far less than minimum wage for their trouble (not to mention worried about how they're going to pay the rent now that they're missing work and/or had to hire a last minute sitter).

Re:1M bail and 1yr in jail...? (1)

sumdumass (711423) | more than 5 years ago | (#29164895)

Once upon a time a "jury of your peers" really meant peers, and not just the most easily swayed people in the jury pool. I'm not saying every single person on the jury needs to be a network engineer, but you can pretty much count on the prosecutor objecting to anyone in the pool with any technical expertise relevant to the case.

The issues here isn't really technical. It can much easier be explained as in a matter of general security. Let say some people who you didn't know called you into a room at your office and demanded you give them your keys to the building. Now keep in mind, you signed an agreement stating that you would only give them to a certain person in a certain department or his replacement when if that happened. Now would you give the keys to these people without knowing who they were or would you give them to the people your security contract authorized? As a matter of reference, I can appear like I belong in a building, I can appear like I am someone's replacement, but you shouldn't just take my word for it before giving me the keys. When the Mayor (the authorized person) requested the keys (passwords), he turned them over willingly without delay.

SO this doesn't need to be a complex technical matter. It's just a matter of security. Imagine those people above was the bank holding your mortgage or landlords agent and you still had no idea who they are but they wanted the keys to your house. I know a network isn't a home but the problem is with general security and not technical in general.

Re:1M bail and 1yr in jail...? (4, Insightful)

MrKaos (858439) | more than 5 years ago | (#29163077)

This sounds like a classic story if ignorant people making decisions about technical crime and getting scared. I aim that both at the city and at the judge who set the original bail.

There is a saying, There is no such thing as a bad student only a bad teacher. If the legal system is ignorant about how 'technical crime' should be addressed it's because we, as technology professionals, have failed to lobby for the appropriate changes to be made to law to handle these cases properly.

We need special technical trials for things like this within which both the defence and prosecution are allowed to bring in technical witnesses to put the case into perspective for non-technical people (as opposed to "HACKER! Get the pitch forks!").

Why? The framework for all of these things already exist in the legal system. All this world changing technology has been unleashed over the last decade or two and Information Technology is maturing as a profession. It's a bit unrealistic to expect the legal system to make quality decisions about how the law should be adapted to handle those changes while the people responsible for delivering the technology do not get involved in educating those who can codify the law to behave reasonably.

It ridicules us to point the finger and say 'look at how ignorant they are' when in reality we should be more self critical and understand that this is the treatment we should expect if we are too apathetic to influence the legal system appropriately.

Re:1M bail and 1yr in jail...? (4, Insightful)

Yetihehe (971185) | more than 5 years ago | (#29163299)

There is a saying, There is no such thing as a bad student only a bad teacher.

You haven't seen some people who don't want and/or are incapable of learning the most basic scientific facts. Yes, you could spend with them 5x the normal time for normal student, but is it really worth it? We need someone to clean the streets, and really intelligent ambitious people don't really want to do it. Typical street cleaner doesn't need to know what an Ohm's law is.

Re:1M bail and 1yr in jail...? (1)

MrKaos (858439) | more than 5 years ago | (#29163693)

You haven't seen some people who don't want and/or are incapable of learning the most basic scientific facts.

That is irrelevant because the target audience is layers and politicians. They have to be educated or, at the very least, ambitious to be able to perform their work. They don't need all of the details, just the executive summary of the consequences and recommendations of how they should act to achieve the appropriate outcome.

You are not talking to the masses here, you are talking to a select group of people who are professionals, intelligent and used to considering things. We are talking about people who are actually interested in the risks posed to society by ill-founded decisions made law.

Re:1M bail and 1yr in jail...? (4, Interesting)

Anonymous Coward | more than 5 years ago | (#29165483)

I have to disagree with your entire statement. Lawyers are busy people, a lot the local ones are my clients.

They don't have time to learn more about anything other than law.
There is no way to educate someone who doesn't have a desire to learn, or who has themselves convinced that they don't have time to learn.

Some of my clients ask for my opinion on cases, and I've been an expert witness on 2.

One good example is this one. A local kid "cracked" into his schools (completely unprotected) "teacher only" network share and looked at his grades, then told the "network administrator" (read:80year old librarian) about the security issue.

A month later, some grades were changed in this system (still unprotected to this day btw) and they threw the book at this kid.

I can access this system from the parking lot, with my cell phone.

After explaining this to the court, the prosecutor still insisted that the kid must have hacked into the system because of half of an answer to a single question,

Lawyer : "Are you suggesting that any one member of the jury could have done this easily?"
Me: "Probably not, but" >> "Thank you, no further questions."

When the expert witnesses get cut off in the middle of their explanations, how in the hell are we supposed to educate anyone?

Fyi, the kid was released because someone else went in and deleted the entire network share while he was still in jail.

Re:1M bail and 1yr in jail...? (1)

Zigbigadoorlue (774066) | more than 5 years ago | (#29164879)

We need someone to clean the streets, and really intelligent ambitious people don't really want to do it. Typical street cleaner doesn't need to know what an Ohm's law is.

And what you think the technically uninclined are pushing down the gates to get at those street cleaning jobs? Nobody "really wants" to do menial street labor.

Re:1M bail and 1yr in jail...? (0)

Anonymous Coward | more than 5 years ago | (#29163477)

Oh, God, don't you think we've TRIED? Forget the legal system; you can't get the ordinary person on the street to deal with the idea that computers are science, not black magic!

I've been blogging technology for ten years just trying to teach basic, basic, junior-high concepts. When you do this, you are not believed. Trying to show that computers are logical, that software is written and compiled in a practical fashion, that the user can take steps to secure themselves, hell, just showing people how to SAVE AND OPEN ONE GODDAMN FILE is an exercise in futility. They look at you like you're crazy, like you're claiming to have seen Elvis flying a UFO.

Computer science suffers in America. Duh, SCIENCE suffers in America. There is no education. We have a big farm full of dumb, superstitious animals to work with. We're lucky to get trials at all.

Re:1M bail and 1yr in jail...? (2, Insightful)

ScrewMaster (602015) | more than 5 years ago | (#29164317)

Oh, God, don't you think we've TRIED? Forget the legal system; you can't get the ordinary person on the street to deal with the idea that computers are science, not black magic!

"Any sufficiently advanced technology is indistinguishable from magic" - - Arthur C. Clarke

The problem is, a lot of people are insufficiently advanced, and are unable to make that distinction.

Skipping and whistling a happy tune (0)

Anonymous Coward | more than 5 years ago | (#29164641)

There is a saying, There is no such thing as a bad student only a bad teacher.

Bullshit. An instant's reflection shows it for nonsense. Of course there are bad students. That's why there are GRADES; maybe you've heard of those. The same teacher taught those in class who got excellent grades, and those who got terrible grades. Sure, there are good and bad teachers, but that doesn't mean there are not good and bad students. I think the saying you are looking for is "there are no stupid questions, only stupid answers." That one is intellectually honest and pithy.

The mark of a really good student is one who doesn't need a teacher. He can, like, go forth and study and ask and learn. You read a book, you learn stuff. Repeat as desired and as necessary.

And you are wrong when you say that it is technology's job to teach the legal system. It is the fucking legal system's job to learn technology. The legal system is the 800 pound gorilla, but it serves the people. It has a solemn duty to inform itself as necessary for any given case. Both before deciding to bring the fucking case to court, and during prosecution.

Re:1M bail and 1yr in jail...? (1)

mpe (36238) | more than 5 years ago | (#29164717)

We need special technical trials for things like this within which both the defence and prosecution are allowed to bring in technical witnesses to put the case into perspective for non-technical people (as opposed to "HACKER! Get the pitch forks!").

It's already possible to bring in such people, they are known as "expert witnesses". The issue here is more the lack of a prompt trial. Maybe what's needed is a rule along the lines that someone is automatically found "not guilty" if their trial does not start within a certain time of their being charged.

fuck a ni6gA (-1, Troll)

Anonymous Coward | more than 5 years ago | (#29162819)

Actual crime (2, Interesting)

somanyrobots (1334451) | more than 5 years ago | (#29162863)

Shocking! The charge that sticks is the only one related to what he actually did wrong! I know the "City of San Francisco" is royally pissed, but even if they're throwing the book at him they have an obligation to stay within the bounds of fact.

I hope he's let off the hook, personally. The damage he's done to his career (who'll hire a DBA who would hijack the whole network?) is probably enough punishment even by itself. And the details of the offense (hostage-taking to avoid a pink slip) are sufficient to keep him from being hired in any field, technical or not.

Re:Actual crime (4, Insightful)

GaryOlson (737642) | more than 5 years ago | (#29162905)

...sufficient to keep him from being hired...

After this thorough exposure and experience with the legal profession, law firms should be recruiting him. Not to mention his arrogance and narrow focus on a crucial point of fact indicates he would fit well in with lawyers of the same personality traits.

Re:Actual crime (3, Insightful)

dbIII (701233) | more than 5 years ago | (#29162943)

And the details of the offense (hostage-taking to avoid a pink slip)

I'm not really sure that makes sense either but we should know soon. It really just looks like management that was so spectacularly bad that they called in the police to handle a simple workplace dispute. It should have been escalated up the chain away from these clowns to some form of adult supervision before calling in the police.
Just a bit of wild speculation here, but it will be very interesting to find out if the inexperienced "IT security" person that sparked all this off is a relative or lover of the new management that handled this all so badly. If I found a complete stranger wandering about removing hard drives containing sensitive information I would be asking rude questions, taking photos and making threats about calling the police as well. The only way you tell a surprise security audit from a robbery is by having someone known within the company follow them around to avoid STUPID situations like this. If a manager can't get anyone or do it themselves they really have to put in their notice and get a job with less responsibility.
Very wild speculation here, but wouldn't it be funny if the entire thing was revenge for making the new manager's mistress cry?

Re:Actual crime (4, Informative)

dbIII (701233) | more than 5 years ago | (#29163651)

I withdraw my wild accusation. The security officer was promoted internally to the post and when she rang the CIO to complain about being caught doing what she was previously not authorised to do it doesn't mean she knew him personally. It's looking like office politics that has been mismanaged so badly that it has been allowed to escape into the legal system with some incredibly wild claims to stop it looking like an over-reaction, just triggered by an employee that wouldn't do what he was told without a reason. The secret promotion thing was just too weird, I would expect at least an email saying "your new computer security officer appointed today is X, please assist her in her work" instead of secret security audits by someone secretly assigned to the position. That shows a both a spectacular level of distrust of employees and poor management.
It really looks like he made someone angry and they decided to put him in jail in revenge.

Re:Actual crime (4, Insightful)

Sun.Jedi (1280674) | more than 5 years ago | (#29164207)

First, switch CISSP with DBA.

Lets not forget...
  1. 1. The network he was unable to attend to (because of being jailed inappropriately) ran FINE in his absence. He has skills, and previous descriptions indicate this is not a simple network.
  2. 2. He stuck to his beliefs. I think this is a good quality, especially considering it cost him his freedom for a period of time.
  3. 3. In spite of the negative connotations of imprisonment, I'm sure there is educational value from his situation.
  4. 4. In my personal opinion, from whats been published, management screwed the pooch on this one, he did the right thing, in several situations.

I would hire him.

But Why Go to the Trouble? (3, Interesting)

mpapet (761907) | more than 5 years ago | (#29162889)

I opined on the last story that he was playing the 'power game' from the bottom of the political strata. By most accounts he was at the top of the network knowledge, so a technically important guy. 'Network God' doesn't translate into political power and he got burned.

But what else is in the plea deal? I can't help but think there's waaaay more to the story given the political heat this guy brought on himself. Maybe the plea deal keeps him quiet?

Plea? What plea? (5, Insightful)

Bacon Bits (926911) | more than 5 years ago | (#29163341)

The defense made a motion challenging the evidence and the judge agreed that there was not sufficient evidence to support 3 of the 4 charges. There was no plea here. The court threw out the state's allegations for lack of evidence. There was no evidence because what he did was probably not sufficient as a matter of law (a matter of fact would probably have been decided by a jury). The charges were merely trumped up. Fabricated. Lies.

And yet they still kept this man in jail for a year awaiting trial for a ridiculous amount of bail money for a non-violent crime.

Excelent way to link to that interview. (4, Informative)

MartinSchou (1360093) | more than 5 years ago | (#29162903)

Link to an old Slashdot story that then links to an archive page that doesn't even have the word Childs on it.

You have to go to page three of the archive to find the bloody interview [infoworld.com] !

Why the hell is it so difficult to provide direct links to the actual articles?

Re:Excelent way to link to that interview. (3, Interesting)

MartinSchou (1360093) | more than 5 years ago | (#29162909)

*sigh*

Apparently that wasn't the interview either. Where the hell is that interview?

It's like watching cable news doing a circle jerk talking about how a twitter post talks about a blog post that mentions an article that refers to an interview where the reporter asks a question about something, but no one even cares about showing the relevant clip!

Re:Excelent way to link to that interview. (2, Insightful)

drinkypoo (153816) | more than 5 years ago | (#29163127)

It's like watching cable news doing a circle jerk talking about how a twitter post talks about a blog post that mentions an article that refers to an interview where the reporter asks a question about something, but no one even cares about showing the relevant clip!

They do that kind of thing on the news all the time. When they do, it is always a sign that they want you to blindly accept what they are telling you. They will tell you about a hundred times what the video clip shows and then finally show it to you after they've programmed you to accept their version of events.

Not saying that's what's happening here, but when someone hides the facts from me, I assume they are acting nefariously. Incompetence qualifies, if you are behaving as if you had a clue.

Re:Excelent way to link to that interview. (1)

Lumpy (12016) | more than 5 years ago | (#29163173)

That's fox news, CNN and CNBC.

I dont see that happening on NPR or other reputable new sources.

People need to stop watching the Equivalent of the national Enquirer for their news.

Re:Excelent way to link to that interview. (4, Interesting)

Zak3056 (69287) | more than 5 years ago | (#29163629)

I dont see that happening on NPR or other reputable new sources.

NPR doesn't show video clips at all. :)

All kidding aside, I think you have your blinders on. I listen to NPR for, on average, an hour a day (most of my morning and evening commutes) and while I find them to be superior to most other news outlets other than the BBC, there have been plenty of times that I've noticed them talking about something at length, before playing the source material (and sometimes they don't play the source material at all), which is the exact behavior that the GP described. I also listen to right wing talk radio, and while the entire reason that they seem to exist is to program responses into people, their methods of doing so are a bit different. Someone like Limbaugh or Hannity absolutely loves playing soundbites (original source material in this case) over, and over, and over, but they're often taken out of context or referencing a slightly (in some cases completely) different subject.

Charges were not dropped... (5, Informative)

Anita Coney (648748) | more than 5 years ago | (#29162929)

I don't have to read the article to know that. If the charges were dropped, the prosecutor would not be vowing to appeal. When a judge gets rid of charges, they're dismissed. When a prosecutor voluntarily gets rid of charges, then they're dropped.

Pathetic accusations (0)

Anonymous Coward | more than 5 years ago | (#29162945)

From TFM, it states:

Prosecutors have alleged that last year between June and July, Childs, who had been in charge of implementing the new network for the city, essentially commandeered the system, setting up his own passwords and denying access to other network administrators. They also alleged he installed devices on the network that could have caused a full system failure if power were to be shut down.

I mean, WTF? Installed devices on the network that could cause a full system failure if powere were to be shut down? I mean, LIKE A ROUTER?

Re:Pathetic accusations (4, Informative)

walmass (67905) | more than 5 years ago | (#29163165)

IIRC, he allegedly changed the Cisco configs but never saved them on NVRAM. You can power-cycle Cisco devices and have a 60-second window to get in without knowing the password [cisco.com] That was the big problem.. had he saved the configs to NVRAM, the City could have just power-cycled the devices during a maintenance window, gone in and reset the passwords. But the configs being only in volatile memory meant that if they tried that, the boxes would have lost the config, resulting in the "full system failure"--they City network would have gone down.

Re:Pathetic accusations (1)

baegucb (18706) | more than 5 years ago | (#29163415)

Cisco passwords are trivial if you have physical access to the device. It's been a couple of years since I've done it, so I'm not sure if you lose the configuration using the methods I know. But if in doubt, try it on one device at a time. One of the links mentions how he gave up the password they wanted, and they promptly screwed it up. Do none of SF "network analysts" know how to backup stuff? Even using crude methods?

Re:Pathetic accusations (2, Interesting)

asaul (98023) | more than 5 years ago | (#29163199)

As I recall it was something to do with the routers that if they lost power, they lost configuration - something to make sure if gear was stolen then it didnt come up with any of the secure networks details.

From memory someone viewed this as him setting up some sort of timebomb instead of being good security practices, and charged him as such.

Re:Pathetic accusations (0)

Anonymous Coward | more than 5 years ago | (#29163349)

No--that is extremely bad logic and lame justification. Power does go out, and UPS's occasionally fail to come online. Those are real threats against the highly unlikely event tht a router would be stolen from a data center or a switch room. Bottom line: that is NOT good security practice. Show me one citation where this is recommended.

some of the routers where in a place with little s (3, Insightful)

Joe The Dragon (967727) | more than 5 years ago | (#29163539)

some of the routers where in a place with little security and that is where you may want to use that config.

Re:Pathetic accusations (1)

_Sprocket_ (42527) | more than 5 years ago | (#29164761)

Overzealous prosecutors (4, Informative)

MikeRT (947531) | more than 5 years ago | (#29162973)

It's a little known fact that prosecutors cannot be sued for anything they do in court [reason.com] to a defendant. Prosecutors are truly the worst part of the system since they are unaccountable to the public and are rewarded for getting convictions, not enforcing the law wisely. As a profession, they are so corrupt that they make civil lawyers look sympathetic since civil lawyers are at least limiting themselves to cases where you can kinda sorta see how their client was genuinely harmed.

Re:Overzealous prosecutors (4, Interesting)

Attila Dimedici (1036002) | more than 5 years ago | (#29163085)

It's a little known fact that prosecutors cannot be sued for anything they do in court [reason.com] to a defendant. Prosecutors are truly the worst part of the system since they are unaccountable to the public and are rewarded for getting convictions, not enforcing the law wisely. As a profession, they are so corrupt that they make civil lawyers look sympathetic since civil lawyers are at least limiting themselves to cases where you can kinda sorta see how their client was genuinely harmed.

Most prosecutors answer to the District Attorney, and can be fired by the DA almost at will. The District Attorney is an elected official. In those cases where the prosecutor doesn't answer to the elected District Attorney (or essentially the same office with a different title), they answer to the elected head of the of the executive branch of whatever level of government they represent (Mayor, Governor, President, etc). If your local prosecutors are loose cannons, campaign against their boss.
The only reason that prosecutors appear to be unaccountable to the public is because the public doesn't pay enough attention to local politics/civics

Re:Overzealous prosecutors (1, Insightful)

Anonymous Coward | more than 5 years ago | (#29163191)

Only problem is, like so many people convicted of crimes, by the time they are in the system by a corrupt DA, they can no longer vote and may even possibly be limited to what they can protest (due to being in jail or whatever).

"Just change the law" or "just vote them out" doesn't work when the most affected people can't participate. Effectively, the corrupt can silence opposition at will.

Re:Overzealous prosecutors (1)

misexistentialist (1537887) | more than 5 years ago | (#29164111)

Local politics are easily controlled by a small number of individuals/families. In my area most candidates are chosen from the local aristocracy. The DA is the son of a former mayor, the DA's son is a state Representative, etc.

Re:Overzealous prosecutors (0)

Anonymous Coward | more than 5 years ago | (#29164655)

Campaign all you want, but nothing will ever change. Ever. Go read the comments in the IBM outsourcing article to get an idea of how fucked we are as far as changing things for the better. This trial isn't an attack against childs, it's a warning shot at other admins. I'm beyond scared andfuly in the dread category.

Re:Overzealous prosecutors (1, Insightful)

Anonymous Coward | more than 5 years ago | (#29163155)

Prosecutors can be sued, but you have to show that they were not acting in good faith. Mike Nifong, the prosecutor for the Duke "rape" case was tried and disbarred for his conduct. There's accountability, but a prosecutor has to go from being a jackass to trying to screw over justice to get a lawsuit going.

what was this about? (1, Interesting)

Anonymous Coward | more than 5 years ago | (#29163171)

What led up to this? This didn't happen for no reason. This wasn't just an ex-con with a temper, nor was it a disgruntled employee wishing revenge. Terry Childs would not have brought this on himself merely for revenge, he's way too smart for that. He was there to protect the network, to keep it running and safe. That must have been a factor.

One of the quoted articles says that the city owned the passwords to the network, so Childs was obligated to provide them on command. The moral of the story is, get your commands in writing and follow the chain of command.

Re:what was this about? (2, Interesting)

eosp (885380) | more than 5 years ago | (#29164031)

Remember, when asked for the passwords the first time it was over a teleconference with a large group of people whom he did not know. I don't care who's on the other line and what they're threatening; you don't give passwords in such a situation. That is why he wanted to speak with the mayor.

Remaining charge? (1)

Vellmont (569020) | more than 5 years ago | (#29163277)

The article doesn't specify what the actual remaining charge is, only that it's about not revealing the network passwords.

Can someone explain how not revealing a password is actually illegal? Contempt of court?

He did everything by the book (4, Informative)

dbIII (701233) | more than 5 years ago | (#29163281)

Here's a chunk of the SF password policy, shamelessly taken from a post by Jeana Pieralde at http://www.burbed.com/2008/07/15/terry-childs-and-the-san-francisco-fiberwan-computer-network/ [burbed.com]

"Password Policy"
As such, all County employees (including contractors, vendors, and temporary staff with access to County systems) are responsible for taking the appropriate steps, as outlined below, to select and secure their passwords.
All system-level passwords (e.g., root, enable, NT admin, application administration accounts, etc.) must be changed on at least a monthly basis"
"Do not share County passwords with anyone, including administrative assistants or secretaries.

All passwords are to be treated as sensitive, confidential County information.

Here is a list of things to avoid
-Telling your boss your password.
-Talking about a password in front of others.
-Telling your co-workers your passwordwhile on vacation."

http://www.sfgov.org/site/uploadedfiles/dtis/coit/Policies_Forms/CCISDA_security.pdf

So announcing it at a meeting was right out.
The person that should have taken this all into hand and resulted in a normal dismissal instead of an arrest is Chris Vein. He was originally an accountant but many CIOs are and some manage to pick up management skills and familiarity with technology along the way.
Here is what http://blogs.zdnet.com/BTL/?p=4692 [zdnet.com] says about him:

San Francisco's CIO Chris Vein calls himself an "accidental CIO." His background includes working in and around the White House during Reagan, Bush and Clinton administrations. For the city of San Francisco, Vein's political background has turned out to be an important asset.

It's still possible he got there by merit, but it starting to look like a political appointment. On his linkedin page he describes himself as "Delivering strong and effective leadership", which often means someone that fires people for no good reason to show they are "strong" but maybe I've just seen too many bastards in action that like that word. These things may give an insight or maybe not, but the end result of getting the police involved in a workplace dispute demonstrates to me that he is not paticularly effective, let alone the situation where there was only one person that could do the job. BTW San Francisco, do you have your free WiFi from 2006 yet? If not you now know the name of the guy that was in charge of delivering it.

One more bit (5, Interesting)

dbIII (701233) | more than 5 years ago | (#29163333)

From http://www.linkedin.com/pub/chris-vein/7/110/71b [linkedin.com] you can see that Chris Vein was a senior advisor at the White House after only three years in the workforce! I do not think such a rise is possible by merit or desirable in an honest government.
I hope this case looks deeply at the motivations behind getting the police involved. I'm also extremely curious as to what the $1million that has to be spent to repair the "damage" is required for and hope the defence and judge push hard for an explanation of this unusual claim

Re:One more bit (1)

ScrewMaster (602015) | more than 5 years ago | (#29164551)

I'm also extremely curious as to what the $1million that has to be spent to repair the "damage" is required for and hope the defence and judge push hard for an explanation of this unusual claim

It's a bullshit claim, I'm sure. Such things are always vastly inflated so as to make law enforcement believe that a serious crime was committed. The old Bell System did that when a couple of (ahem!) "hackers" released some supposedly confidential internal documents back in the early eighties (if I remember correctly.) They were claimed to be worth some insane amount of money, when it turned out that anyone could order them for a couple of bucks. There's also a degree of ass-covering involved in situations like this. Now, when you get right down to it, this sounds more like a matter of bad policies enforced by poor management, leavened by politics. The end result is as expected, but the fact that cops got into the mix is just unconscionable.

Although, if Childs is correct about the level of incompetence in that particular IT department, it may well turn out that that million dollars is a lowball figure. Never underestimate the power of the truly stupid to cause damage far beyond their pay grade, given the opportunity.

Re:He did everything by the book (1)

ScrewMaster (602015) | more than 5 years ago | (#29164509)

The person that should have taken this all into hand and resulted in a normal dismissal instead of an arrest is Chris Vein.

Of course, had he actually been a good manager, there probably would have been no need for any of this, much less a dismissal.

Re:He did everything by the book (2, Interesting)

Jim Hall (2985) | more than 5 years ago | (#29164517)

On his linkedin page he describes himself as "Delivering strong and effective leadership", which often means someone that fires people for no good reason to show they are "strong" but maybe I've just seen too many bastards in action that like that word.

I'm not defending this person at all, but I wanted to disagree with you on this point. I'm a senior IT manager, and I would describe myself as delivering strong and effective leadership. What strong and effective leadership means to me is helping people to reach the next level (where interested) and achieve their personal goals, while matching the right skills in the right people to the right problems. I bring people together, and have proven myself particularly effective in getting opposite sides to come together to make a decision that everyone believes in, or at least supports (the two are not always connected.)

It's all about good leadership, which often balances out to communication (particularly "listening" and "coaching/mentoring.")

I suspect it's as you mention in your comment: you've seen too many bad bosses fire people, then describe themselves as "strong and effective." Certainly the position requires making the tough decisions when someone isn't working out, or when you're in a budget contraction, but being "strong and effective" isn't about firing people.

Re:He did everything by the book (1)

dbIII (701233) | more than 5 years ago | (#29164831)

I'm mostly commenting on poor managers that describe themselves this way while others will describe them very differently. There is often a desire to be seen to make a change and look "strong" and the easiest way for an incompetant manager to do this is to fire someone and pointlessly incur disruption and costs. They get the implication of force and not the concept of good management.

The lesson to be learned (2, Informative)

raybob (203381) | more than 5 years ago | (#29163589)

for sys/net admins is to keep in the back of your mind that your actions can be scrutinized somewhere down the line, even if you are the most conscientious, morally upright employee.

If you work in an environment where you are the key technical resource, and others don't have the chops to safely manage the systems you designed/built, you still need to be sure that you put mechanisms in place to track access first, and then you need to provide equivalent access as agreed with management, to other administrators. Since you have the tracking mechanisms there, you can unravel who did what if there is an issue.

I know that it's hard to do this if you work in a hostile environment, or one where people are defensive about their jobs. This is especially true if you are the lead or only techie with the skillset to safely operate in the environment. But without being too paranoid about it, try to inform management as to what you're doing occassionally, track access of yourself & others (if you exclude yourself by using other means of authentication or access, you won't have a leg to stand on, since your actions weren't logged and you could have 'hidden' them).

Try to foster a trust environment with your peers, help them along in becoming competent while giving them access appropriate to their skillset (but make sure others know they are accountable for their actions), and you would improve your chances at exonerating yourself if the PHB's ever start pointing the accusing finger at you.

Why isn't he turning over the passwords? (1)

Henry V .009 (518000) | more than 5 years ago | (#29163641)

That's the one thing that confuses me. He still hasn't turned over any passwords, right? Why not?

Re:Why isn't he turning over the passwords? (1)

treat (84622) | more than 5 years ago | (#29163739)

That's the one thing that confuses me. He still hasn't turned over any passwords, right? Why not?

I don't know whether he is. But if he is supposed to, who is he supposed to turn them over to, and would this be legal?

Re:Why isn't he turning over the passwords? (3, Informative)

dbIII (701233) | more than 5 years ago | (#29163849)

He gave them to the Mayor in person not long after imprisonment. That would be approximately a year ago.

Re:Why isn't he turning over the passwords? (1)

anonicon (215837) | more than 5 years ago | (#29163915)

Wrong. He turned over the correct passwords to the Mayor of San Francisco when the Mayor visited him in jail (sorry, I read it but can't find the story link now). As soon as he turned over the passwords, someone who wasn't in jail promptly botched the network.

Re:Why isn't he turning over the passwords? (1)

Henry V .009 (518000) | more than 5 years ago | (#29164321)

I looked up the story. It's sort of bizarre. Unless he had no supervisor and reported directly to the mayor, he didn't have much justification for not turning over the passwords at the get-go.

Re:Why isn't he turning over the passwords? (2, Informative)

phantomfive (622387) | more than 5 years ago | (#29165203)

According to another poster, it was against standard policy [slashdot.org] to give your password to your boss. Apparently he was only supposed to turn the passwords over to the mayor, and no one else. In any case, if someone requests your password, you should only give it after they request it in writing, then you have evidence of the event in case something happens.

Re:Why isn't he turning over the passwords? (1)

Auraiken (862386) | more than 5 years ago | (#29164117)

He's innocent. Handing over the passwords at this point would be like saying they were right.

Cruel and unusual? (1)

tufa.king.nerdy (1622029) | more than 5 years ago | (#29163805)

I'm not sure how him being in jail is any different from being held hostage. They're waiting on a ransom. If I went around and changed all the server passwords at work, I think they would have to not only prove it was me, but also that I was being malicious before I'd spend that much time in jail. I'd probably just get fired for being a lousy employee before it got this far. MPO is that the City of SanFran should be responsible for hiring someone to fulfill their duties. It sounds like they did to me, but he's being held against his will because of it. If they had a problem with him, they should have fired him and moved on. Another issue I have is him being held over a password. Other than the obvious, what's the difference between that password and his own gmail password? Is this leading up to some sort of password ownership? COSF is the government. While they may have no interest in someone's WoW password, this sounds like it's going in the wrong direction to me.

Re:Cruel and unusual? (1)

ScrewMaster (602015) | more than 5 years ago | (#29164373)

COSF is the government. While they may have no interest in someone's WoW password, this sounds like it's going in the wrong direction to me.

They went in the wrong direction a looooong time ago.

Preliminary Summary (1)

Tablizer (95088) | more than 5 years ago | (#29164653)

It appears that Terry Childs is being made the scapegoat of bad policies and procedures. The correct thing to do is to fire those who made the policies and procedures, and learn from those mistakes.

In fact, since humans make mistakes, merely require them to give a public apology. Those who've made prior mistakes are often more careful than those who've made none.
     

This is crazy! (2, Insightful)

samuX (623423) | more than 5 years ago | (#29164887)

i did not know about this case so i went up looking back to all the story and trying to figure out what happened i've runned across these two that explain a bit http://www.infoworld.com/d/adventures-in-it/why-san-franciscos-network-admin-went-rogue-286?page=0,0 [infoworld.com] http://www.infoworld.com/d/data-management/childs-attempt-protect-network-password-gone-awry-978 [infoworld.com] What i'm now missing is what were his duties in the contract and who he had to provide those passwords. this document http://www.sfgov.org/site/uploadedfiles/dtis/coit/Policies_Forms/CCISDA_security.pdf [sfgov.org] cited in some post here is only about personal passwords and not system ones. So a sysadmin keeps an eye on security, he's asked by his boss in front of unauthorized people to reveal those passwords, in a improvised meeting in a place outside the place where he works. he refuse to say those passwords, he's suspended for unsubordination and some days later he's arrested, and he's still in prison He can only be guilt of being an asshole or too paranoid but since he was the only one responsible for the whole SF Wan who wouldn't have been ? you really would have give away your passwords knowing that if the day after the network would have been down it would have been your only responsability ? - "B....bbbut i gave the password to my boss!" - "Nice work! now you are fired and you'll be charged for the problem you caused with your inefficency" no really.. this story is crazy i really hope he will be released soon but then what about his lost job ? what about the loss in credibility he has to suffer due to ignorance of news that portrayed him as digital version of bin laden ?

It's been a year already? (3, Informative)

synthesizerpatel (1210598) | more than 5 years ago | (#29165221)

Really the classic bit of this story is how the prosecutors included a list of usernames and passwords in their court filing which couldn't have been a better home-run for the defense in terms of 'See what happens when you give the passwords out to these idiots?'.

A year of his life gone though.. This should be a cautionary tale for any IT person.. When things get so bad that you're angry and not making good decisions.. just quit. Find somewhere else, relax. A job at burger king is better than going to prison.

responsibility (1)

celle (906675) | more than 5 years ago | (#29165271)

You do realize that SF has to get Childs on something don't you. Otherwise Childs could sue SF farther into bankruptcy than the entire state of CA currently is for wrongful prosecution, imprisonment, etc. Not to mention possible criminal prosecution for the SF officials involved if they lose. This whole thing smells.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?