Slashdot Mirror
McOwen Case Settled
ewilts writes: "Back in July, you ran a story about David McOwen, a computer adminstrator at DeKalb Technical College in Georgia, who was being charged for installing SETI software on school computers. This case has now been settled. See also the EFF press release
on McOwen's web site." Update: 01/18 16:11 GMT by M : It was software from distributed.net, not SETI.
Now, of course, he gets off light from the government.. but jeeze, think of the internet traffic charges he's gonna rake up from being slashdotted. YOU MEAN HEARTLESS PEOPLE! Have you no decency? Give the man a break.
A lot of people seem to be under the impression that the client he was running was SETI@home and was therefore innoculous.
Well, he was running some distrubuted.net-type decryption client where he would have WON MONEY had he been the one to find a key.
Not so humanitarian and innoculous now, is it?
Years in prison and a $400,000 fine are extremely way beyond reason, but I can see how this was a crime as he stole company resources for personal gain.
The $2100 fine does seem reasonable as I think he would have won $2000.
Perhaps it's a precedent for telling sys admins to stick to their jobs and keep the best interests of their employers in mind when installing software. This isn't about "sys admins choosing" it's about the appropriate use of someone else's property.
When I discovered that a developer had installed SETI on my co's production ecommerce servers ("but I nice'd it!") I had the loser fired -- after disabling the software. Am I against SETI? No (nor am I "for" it; I don't care). But the purpose of our servers, bandwidth, etc., is not racking up points in the SETI project.
Now, we have other servers that are intended for fun and exploration. But our production servers?
-- @rjamestaylor on Ello
<Cut to courtroom somewhere in the USA>
Defendant: "...and then I installed the application on all the computers."
Prosecutor: "You did this, fully aware that it was vulnerable and subject to attacks, which may paralyze the company email system, compromise data, or worse?"
Defendant: "Yes."
Gallery: *GASP*
Prosecutor: "And what was this application?"
Defendant: "MS Outlook."
The prosecutor, appearing struck, glances at a shadowy figure in the gallery who bears some resemblance to John Ashcroft in a trenchcoat and fedora, the figure quickly draws a finger across his throat and the prosecutor recomposes himself.
Prosecutor: "Your honor, the prosecution humbly requests all charges be dropped and that the defendant be released!"
A feeling of having made the same mistake before: Deja Foobar
Having full system access (such as 'root' on a *NIX box) does not always translate into having full authority (i.e. direct permission from real humans) to do all actions that are permitted by that level of access. The anti-hacking law he was charged under most likely has a clause about using a computer system in excess of the user's authority.
For example, while a sysadmin may have root access to a system that he must maintain, he may not necessarily be permitted to use that access to snoop through the VP's mail spool. Similarly, a McDonald's employee that has the restaurant keys so he can lock up at night is still trespassing if he abuses those keys to throw a wild party there at 4am. Finally, it's still car theft if a chauffer decides to just drive away with the car that he's got full physical access to.
What it all boils down to is how explicitly defined the sysadmin's authority was in this matter.
Although he got off relatively light, the precident set here is that sysadmins can no longer choose to install software at will.
The case was settled out of court. Absolutely no precedent was set.