Randal Schwartz's Charges Expunged

After 13 years, Randal Schwartz has had his conviction expunged. In effect, legally it never happened. If you haven't heard about this one before, my take is that as a contractor at Intel, Randal did some over-zealous white-hat cracking free-of-charge; this embarrassed some people in management (he pointed out that their passwords were terrible) and management then chose to embarrass themselves further by having him convicted of a felony under an 'anti-hacking' law. More info can be had from the Friends of Randal Schwartz.

Comments

Congratulations

[Ron Harwood]

Congratulations to Randal - it's nice to actually read a good news story with regards to the legal system.

Re:Congratulations

[merlyn]

"He installed backdoors at 3 companies"

Objection! Assumes facts not in evidence, your honor!

Sustained.

Re:Congratulations

[merlyn]

I'll never claim that I wasn't stupid. It's not my job to get you to like me. The point of my case is to pay attention to the mistakes I made, because a lot of people have told me that they either have or could have made similar mistakes. Maybe some of you are so perfect that you wouldn't. Good for you. But don't be so quick to judge that nobody would be that stupid then. Please.

Legally Never Happened

[vux984]

Except that it did.

And all the effects can never be erased.

For example any "lists" he's been added to over the last 13 years will not be updated to reflect his new 'never was a criminal' status. Be it terrorist watch lists, no fly lists, FBI persons of interest list, or whatever else, not to mention his prints will remain in the system, etc, etc.

Re:Legally Never Happened

[hansamurai]

perl will take care of this...

@files = ("terrorist_watch_list.txt", "no_fly.doc", "fbi_persons_of_interest_list.ppt");
foreach $file (@files) {
        unlink($file);
}

Re:Ditto; FBI can still see it

[Anonymous Coward]

There was a PDF file linked on the http://www.lightlink.com/spacenka/fors/Friends of Randal Schwartz site states:

IT IS FURTHER ORDERED that the clerk of the Court shall forward a certified copy of this Order to all law enforcement agencies mentioned in the Court's file, including the following:
A. The Federal Bureau of Investigation, and
B. The Oregon State Police, and
C. The Oregon State Corrections Division, and
D. The Arresting Agency, Portland Police Bureau. So the FBI can't use it against him. The PDF file is a copy of the expungement order from the court.

Re:Its about damned time this was cleared.

[1010110010]

Are you fucking serious? After 13 years? You call that working?

How's that for revisionist history?

[tji]

The slashdot crowd has a short memory.. This is not a simple issue of "embarassing the management", as the summary states. In fact, in all the original writeups, I don't remember ever hearing executive passwords being an issue. The issues were egregious violations of corporate security policy, and basic logic:

- His position at Intel was not involved in security, intrusion detection, or other areas that might actually call for "white hat hacking" as part of the job function. He was a contractor, not an Intel employee, which I'm sure made Intel even more concerned about his security violations.

- He had installed backdoors on Intel machines, which allowed him to access the Intel network from outside the company.

- He took passwd files and ran cracking tools against them to break other users passwords.

- Not only was he cracking password files from Intel organizations, he was using Intel systems to crack password files from other companies, including O'Reilly and Associates.

See this writeup for information from the person involved in shutting him down.

Whether this was "white hat" hacking could be debated. In any case, it was fucking stupid. Bypassing network security for an inbound back door?!? Cracking password files from other companies on Intel computers?!? These are just stupid moves, which anyone should expect to get fired for doing.

Re:How's that for revisionist history?

[merlyn]

"His position at Intel was not involved in security, intrusion detection, or other areas that might actually call for "white hat hacking" as part of the job function.".

Wrong, I was a systems and network administrator. According to job description, that's part of the job.

Re:Ditto; FBI can still see it

[Wavicle]

and Randall still can't get a clearance without being upfront about it.

As someone who has gone through a security background check, worked at Intel and read the decision of the appeals court: I would be fairly surprised if Randal was able to get a security clearance even even if no conviction had occurred. The undisputed portions of the case suggest that Randal lacked an ethical barrier between him and either his curiosity about things for which he did not have access or his desire to gain respect by demonstrating his skill. This was 13 years ago maybe he has changed, I don't know.

Whether his intentions at the time were noble or not: he logged onto a system for which he knew his account should have been deleted; he ran a gate program on the system (after previously being told to stop running a gate on other systems); he cracked one of the passwords to someone with higher access on the system; he then logged on to the system using the cracked user's account; he transferred the password file to another machine; he ran crack on this other machine; he turned up 35 weak passwords; he said nothing; he left for a while to teach a class; he came back; he still said nothing; he re-ran crack on another faster machine (this is apparently what eventually got him caught).

Randal claims he did all this to re-gain respect at Intel's supercomputer division. I have no reason to doubt this is honest. The fact that he so freely gave so much information to the police suggests to me that he was trying to convey that he had no intention of harming Intel's business. However it is very, very bad judgment. Now if you were the agent assigned to his security background check, looking to see if his character demonstrates a likelihood of compromising sensitive information, even unintentionally, what would you think?