Slashdot Mirror
McOwen Case Settled
ewilts writes: "Back in July, you ran a story about David McOwen, a computer adminstrator at DeKalb Technical College in Georgia, who was being charged for installing SETI software on school computers. This case has now been settled. See also the EFF press release
on McOwen's web site." Update: 01/18 16:11 GMT by M : It was software from distributed.net, not SETI.
Although he got off relatively light, the precident set here is that sysadmins can no longer choose to install software at will. As a sysadmin for a large media congolmerate, I find it more and more difficult to simply administer my systems because all the suits want to know every move I make three weeks in advance. This decision simply adds an element of criminality to an already bad situation.
This generally looks like a reasonable settlement. The monetary damages are a bit dissapointing, though. Remember to ask permission (and get that permission in writing) when you make large, questionable, changes to the systems you are responsible for.
he should have been just ired then.....saying he HACKED a system that he had full administrative rights to is rediculous....its like calling the police on your house keeper for breaking and entering even though she has a key and is contracted to do work in your house.....if she was having parties then you fire her, you can not get her on breaking and entering.
I am the Alpha and the Omega-3
This story has been convered in a recent Slashback article: here.
Distributed.net
:)
He ran the dnetc.exe client on a ton of school PC's in Georgia.
The funny thing, is that it took several "security experts" a lot of work to figure out what dnetc.exe actually was
Actually, he was running RC5. The problem the school had with this is that with RC5, there is a change (albeit a very limited one) that you could win money. He had not stated that he would give the money to the school...
p c&s=50009562&f=122097561&m=1110950822 p c&s=50009562&f=122097561&m=7450963242&r=5150986242 #5150986242 = 39&threadid=518510&start=1 = 39&threadid=518184
This was widely discussed among many of the more well known distributed computing teams. Check it out.
Read about it here:
http://arstechnica.infopop.net/OpenTopic/page?a=t
http://arstechnica.infopop.net/OpenTopic/page?a=t
http://forums.anandtech.com/messageview.cfm?catid
http://forums.anandtech.com/messageview.cfm?catid
Glen
Track your fuel economy
Now, of course, he gets off light from the government.. but jeeze, think of the internet traffic charges he's gonna rake up from being slashdotted. YOU MEAN HEARTLESS PEOPLE! Have you no decency? Give the man a break.
A lot of people seem to be under the impression that the client he was running was SETI@home and was therefore innoculous.
Well, he was running some distrubuted.net-type decryption client where he would have WON MONEY had he been the one to find a key.
Not so humanitarian and innoculous now, is it?
Years in prison and a $400,000 fine are extremely way beyond reason, but I can see how this was a crime as he stole company resources for personal gain.
The $2100 fine does seem reasonable as I think he would have won $2000.
Wow! I'm sitting on a friggin' gold mine. Who in their right mind would ever pay upwards of $35 for ONE MINUTE of time on a PC?? You can buy a good system that's paid for itself in just one hour of time!! Lets see, going by the usual inflated legal dollers, this 1.5Ghz P4 I've been burning in for the last two weeks has just wasted $713,000. boggle.
try { do() || do_not(); } catch (JediException err) { yoda(err); }
Perhaps it's a precedent for telling sys admins to stick to their jobs and keep the best interests of their employers in mind when installing software. This isn't about "sys admins choosing" it's about the appropriate use of someone else's property.
When I discovered that a developer had installed SETI on my co's production ecommerce servers ("but I nice'd it!") I had the loser fired -- after disabling the software. Am I against SETI? No (nor am I "for" it; I don't care). But the purpose of our servers, bandwidth, etc., is not racking up points in the SETI project.
Now, we have other servers that are intended for fun and exploration. But our production servers?
-- @rjamestaylor on Ello
<Cut to courtroom somewhere in the USA>
Defendant: "...and then I installed the application on all the computers."
Prosecutor: "You did this, fully aware that it was vulnerable and subject to attacks, which may paralyze the company email system, compromise data, or worse?"
Defendant: "Yes."
Gallery: *GASP*
Prosecutor: "And what was this application?"
Defendant: "MS Outlook."
The prosecutor, appearing struck, glances at a shadowy figure in the gallery who bears some resemblance to John Ashcroft in a trenchcoat and fedora, the figure quickly draws a finger across his throat and the prosecutor recomposes himself.
Prosecutor: "Your honor, the prosecution humbly requests all charges be dropped and that the defendant be released!"
A feeling of having made the same mistake before: Deja Foobar
So this means that before i install anything, good or bad, that i must *explain* each and *every* piece of code, and clear it with the people that entrust me with their network and am paid to be the expert on, and responsible for its upkeeep? What if i install VNC, antivirual update, research software for a better network, prety much anything they decide they dont like that day.. i goto jail? Seems to me our ablity to even do our jobs has just been limited drastically. Sure, wholesale personal use is wrong, but the way it sounds now im libel if managemnts mind changes tomrrow on anything.....
---- Booth was a patriot ----
Production systems are controlled environments - last thing you need is some unaudited, unexpected and unauthorised changes messing them up.
...or opening up a security hole.
Every piece of software installed present a potential threat. Did it come from a reliable source? Does it have security flaws? Obviously, there has a be a reasonable balance between maintaining security and giving users the flexibility they need to do their jobs. I get very irritated when a company won't let me install software I need -- or just want! -- on my desktop at work.
This balance tips increasingly in favor of security as if installation is (1) on a server, (2) on a production server, (3) on a lot of machines. Maintaining that balance is a sysadmin's job. And this guy was definitely not doing his job.
All that said, aren't criminal charges just a little out of line? He should just have been professionally reprimanded, or maybe fired. But a lawsuit?
The statute he was charged under, the "Georgia Computer Systems Protection Act" can be found at http://www.clark.net/pub/rothman/gacode.htm
My guess is that he was accused of "appropriating" the computers at the school, which the Act defines as "computer theft." But as I read the Act, it sounds like using one's work computer to visit a non-work-related website without one's employer's permission would also qualify as the crime of "computer theft," even if it were on your own time. In fact, it might be arguable that using one's work computer on one's own time to write a letter to one's congressman could be "computer theft" as defined under the Act, if your boss didn't give you permission to do it.
Take a look at it, it is pretty interesting reading . . .
SecurtyFocus
Financial Motive Alleged
Willard says that McOwen was singled out for prosecution partly because he had ignored his supervisor's warnings. "In this case, Mr. McOwen was expressively prohibited by his superiors from downloading these programs and was informed on many occasions by his supervisors to stop downloading programs," said Willard. "They were aware that he was doing it and he had gone in and cleaned it up on numerous occasions." Joyner insists McOwen received no such warning.
Prosecutors also claim that McOwen had a financial motive for volunteering the school's machines. McOwen was a top producer on distributed.net for "Team AnandTech," a group sponsored by a hardware forum site which is still the second ranking contributor to the RC5 research project. A $1,000 prize goes to the individual contributor who recovers the RC5 encryption key. "McOwen placed a program on computers, that in his estimation would benefit him personally, including computers that has sensitive student financial and identity information without authorization," says Willard. "There is concern about the program itself compromising or providing the basis to compromise sensitive personal or financial information, there is the matter of Mr. McOwen's unauthorized activities on this computer, and finally there is the point that there was misappropriation of state property."
He was warned several times, and the software had repeatedly been uninstalled. This isn't the only article I've read that discussed this fact. I may not agree with the charge or the penalty, but he should have been fired for ignoring his supervisors continued requests.
You've granted them physical access. You have not, however, granted them absolute permission -- you've granted them conditional permission to enter your house to perform their job duties, and you've explicitly denied permission for them to be in your study at all. By definition, trespassing has to do with going where you don't have permission to be, rather than going where you don't have access to -- you can trespass on an empty lot that lacks physical access control but has signs specifically denying you permission to go there.