Battle Creek, Michigan Settles Dispute with ORBZ

Peter Sachs, Esq. writes: "According to a press release that now appears on its official website, the City of Battle Creek, Michigan has 'settled"' its dispute with ORBZ.ORG. The City concluded that ORBZ.ORG had no criminal intent to cause the City harm by testing the 'open relay' status its server. In fact, the Assistant to the City Manager said, '...we recognize that [ORBZ.ORG] has done us a service. We are going to be taking a close look at our policies regarding Lotus security updates and how we can avoid the issue in general'"

Comments

Absolutely amazing.

[nurightshu]

A government entity thinking clearly and levelly, and actually thanking geeks for trying to help them? Astounding.

Okay, everyone, it's time to pack up and go. Would the last one out of the server room please hit the BRS?

Re:Absolutely amazing.

[darkonc]

then one day, you find a house where the door is unlocked, and the house is armed.

Er, um.. that should have been "and the house (door) is alarmed. This actually happened to me once, when I was trying to find my way out of a place where I was doing some late night admin work.. I tried a door that turned out to be an entrance to a neighbor's space. The door was unlocked, but had a chain on it and an alarm (which was set up).

It was kinda half-amusing the conversation I had with the police when they arrived...

• Are you authorized to be in there?
• yes.
• then can you come out and talk to us for a while?
• no.
• why not?
• I don't have a key.
• are you sure you're authorized to be there?
• Yes. I've called the owner, he's on his way. . . . .

Battle Creek and Kellogg's

[asackett]

My personal boycott of Kellogg's products continues at least until they repay Ian for his legal expenses incurred as a result of the need to defend against the city's stupidity.

I understand that Kellogg's has nothing to do with the stupidity of the city, but they're the biggest taxpayer/employer in Battle Creek, and that's close enough for me. As an American, collateral damage means nothing to me!

Re:Battle Creek and Kellogg's

[hymie3]

Wait, is this a joke? What legal expense? Dude took down his site almost immediately.

He rolled over like a puppy getting patted on the belly precisely *because* he wanted to avoid legal expenses.

Of course, kelloggs does make Smacks. Maybe that's what I'm smelling.

Bad day in IT

[Nethead]

First the boss makes a stink about ORBZ an then they get slashdotted. Glad I don't work there.

Also

[NiftyNews]

"The City concluded that ORBZ.ORG had no criminal intent to cause the City harm by testing the 'open relay' status its server.

The City also announced that it really like to be capitalized when referred to. It also notes that the word "of" is still banned when referring to stories about The City.

Wait until they get /. 'ed...

[buff_pilot]

for a better link...

The email test triggered a weakness in the version of Lotus Domino software used by the City and caused a major slowdown of the City's email network for about a day on February 25, 2002.

The ./test triggered a weakness in the version of Lotus Domino software used by the City and caused a major slowdown of the City's network for about a day on March 22, 2002.

-jim

Wrong analogy?

[deepestblue]

"But, if I can draw the analogy that just because everyone should wear a computerized bulletproof vest doesn't mean that shooting people to find out who isn't wearing one is the best answer. ..."

Oh, no, you can't. People who don't wear bulletproof vests (unlike badly configured mail-servers) harm only themselves, not others.

Re:Shooting people to tests for vests

[Skapare]

Is that something you do with your boyfriend?

Latest News Story - Battle Creek Enquirer

[Lokinator]

http://www.battlecreekenquirer.com/news/stories/20 020322/localnews/1871053.html

Oh, my. These folks need Tech Help in just the worst way - won't someone write them with a set of correct definitions?

Score one for common sense, for a change.

[phillymjs]

Must be something in the air in Battle Creek. I don't know what Kellogg's is belching out of their smokestacks these days, but I wish the RIAA and MPAA assholes would get a whiff of it.

~Philly

Nope, you missed it

[hawk]

"The City" is known to mean San Francisco by all educated persons. The *real* question is why SF is involved in this. Was it infiltrating Battle Creek? Having dealt with California agencies while practicing law in Nevada, and being aware of their imperial pretensions, I want to know (and so should the residents of Battle Creek!).

:)

hawk, watching for californians under his bed . . .

What an embarrassment!

[dcavanaugh]

First, the writer [of the press release] describes spam as a "computer prank" instead of unsolicited commercial e-mail. The comment proves they don't know what spam is! Then we have the unmentioned IT person who somehow traced back the activity to ORBZ without realizing their Lotus server was a sitting duck for a DOS attack (intentional or not).

Let me guess (based on pure speculation):

• Lotus sever set up by the "consultant du jour", who handles support on a pay-as-you-go basis
  
• City calls for support, consultant quickly scans the log & points finger to ORBZ
  
• City mgmt. goes bezerk; legal dept. goes to DEFCON 1; unleashes nastygrams vs. ORBZ
  
• ORBZ explains cluelessness involved in having unpatched Lotus server; makes consultant look like idiot
  
• City finds new consultant; recommends upgrade to Linux+Sendmail+Amavis+Sophos
  

There are always exceptions, but the average municipality is not stealing the top minds from NASA to run their IT operations. Every once in a while, I peruse IT job listings. When I see a huge list of unrelated requirements combined with a pitiful salary, it's usually (a) municipal gov't, (b) school systems (same thing), or (c) retail. Before I get flamed by an army of municipal IT workers, I will clarify this sweeping generality: Municipalities hire too few people, they overcommit their resources, and the salaries encourage turnover. Surely, any reasonably qualified sysadmin (certified or not) would have detected & fixed the Lotus vulnerability (even if after-the-fact). The press release tells a story that makes it look like they have no dedicated IT staff whatsoever. I could be wrong on this, but if they spent less on lawyers and more on IT, this problem would have been prevented or quickly resolved.

According to Netcraft, the website at ci.battle-creek.mi.us is running "Microsoft-IIS/5.0 on Windows 2000." The prosecution rests. This Battle Creek operation must have been a real bundle of joy when they discovered the "Code Red" worm.