Slashdot Mirror
SF Admin Gives Up Keys To Hijacked City Network
snydeq writes "Jailed IT admin Terry Childs relinquished his hold over San Francisco's multimillion-dollar FiberWAN, handing his administrative passwords over to San Francisco Mayor Gavin Newsom, who was 'the only person he felt he could trust.' Childs is still being held on $5 million bail for his lockout of the city's FiberWAN, a case that has been called into question since an insider came forward with details about both the network and Childs himself. The case hinges on No Service Password Recovery commands Childs allegedly configured onto several Cisco devices, as well as dial-up and DSL modems the SFPD has discovered that would allow unauthorized connections to the FiberWAN. Childs intends to 'expose the utter mismanagement, negligence, and corruption at DTIS, which if left unchecked, will in fact place the City of San Francisco in danger,' according to his motion. The Department of Telecom and IS has cut 200 of its 350 IT positions since 2000 — pressure that may have contributed to Childs' actions, according to interviews with current and former DTIS staffers. Newsom secured the passwords without first telling the DTIS that he was meeting with Childs."
From my viewpoint, it appears that Mr. Childs wasn't so much a malevolent person as much as he was paranoid and protective. We've all met this admin before. He won't give you any rights that you may need to do your job because you could screw "his computers". I'm not saying what he did was right or legal but he may not be the white cat stroking, maniacally-laughing villain that the initial news reports made him to be.
Well, there's spam egg sausage and spam, that's not got much spam in it.
He's probably hoping for whistleblower protection, and intends to show that he was being terminated wrongfully for threatening to blow the whistle.
It may be a desperation move, but until the facts come out, we don't know. If it turns out that he was being terminated wrongfully, it's possible that the city of SF could be forced to keep him on their payroll... on the other hand, I'd speculate that he's grasping at straws.
I've read some about the "situation", and all I think all we know for certain is that we don't know anything for certain yet.
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
I agree completely.
There seems to be a lot more going on here than what we see.
The conspiracy side of me thinks that there's something fishy going on in the department. He found out and got fired because of it. Except he acted fast and hijacked the network. Hence why he only gave the password to the mayor...
Reading a lot of comments about him being a nut job. My question is - what if he isn't? Is it possible that as a administrator of a SAN/Network, he saw some significant security issues, and when he presented them to his supervisors was slammed for reporting the problem -- including being fired? I know from experience the feeling: Management does not like to know that they've screwed up, and will fight kicking and screaming rather that admit that they've done something wrong. For me -- most recently this includes bogus Business Requirements, and critical Business Requirements that are not being met. I've found significant security holes in the where I currently work. Presented the problems to management. The response - don't call use, we'll call you.
What was the point of holding back for so long now. Now he just lost the last hope for his negotiation.
Or, he wasn't holding back in order to negotiate, but because he wanted to get the opportunity to tell all of his grievances to the one person who he thought might have the power and wherewithal to "fix" the situation. From reading about the motions that his lawyers have filed in court, it seems that Childs is willing to risk going to jail just to be able to publicize the hard time he's been having at work for the past couple of years. In fact, he might have willingly accepted or even pursued the prospect of prosecution because he knew that he would then have a public forum to air his views, and possibly embarrass his bosses (which, despite their best efforts, he has).
The case hinges on No Service Password Recovery commands Childs allegedly configured onto several Cisco devices, as well as dial-up and DSL modems the SFPD has discovered that would allow unauthorized connections to the FiberWAN.
Mr. Paranoid Admin with a God complex had big freakin' huge vulnerabilities on his precious network?
It sounds to me like Mr. Paranoid Admin was so paranoid that people had started to do what they tend to do when Mr. Paranoid Admin is so paranoid they can't get anything they need done.
They'd started to work around him.
Net result: All sorts of little unauthorised connections popping up.
In being too paranoid, you wind up creating exactly the situation you fear the most: a network with lots of uncontrolled, unknown systems appearing creating security holes where none previously existed. Doesn't matter how many fancy "no unauthorised access" features your infrastructure has, sooner or later someone's going to succeed in working around them. The last thing you need to do is give them an incentive.
The more I read about this story, the more it reminds me of "The Fountainhead". This lone, brilliant man fighting the mediocrity of committees and less achieved managers. The government is NO place for a person like this. He'd be much better off running his own company with no bosses.
-- these are only opinions and they might not be mine.
Let's try this one instead:
You're responsible for maintaining a nuclear reactor. Your manager, who has no idea how to actually runs the reactor comes in and demands to be given all of the necessary keys and passwords to the reactor. The reactor is currently working flawlessly, and there is no obvious reason for your manager to need access to the system.
Do you:
A. realize that this could be very bad for the company, and protect the company by refusing to turn over access to an unqualified person?
B. turn over access to the access to an unqualified person, and just hope that they don't do anything which results in anyone's death, or your working 16hr shifts for the next 3 months straight.
I would argue that choosing "B" could be criminally negligent, and that A is the better choice, however, he should also immediately go to HR and explain why he's violating the order.
In this particular case, he might've saved the city of San Francisco millions of dollars in lost productivity from someone getting access who had no clue what they were doing.
Build it, and they will come^Hplain.
How many laws have you violated when it suited your purpose? I'd be willing to bet you do it a lot more often than a public person like a Mayor.
It's simple: I demand prosecution for torture.
Don't think much of yourself, do you ?
If I was working on designing and building a network, and I had it all up and running perfectly, should I destroy it because my boss tells me he has a better way ? What if I was a db admin who had already implemented a whole organisations internet requirements using (my|postgre)sql when a retarded buzzword compliant boss decided I should use access instead ? Should I delete everything and re-implement using access, or should I keep what I've done and start again separately with the access, so that when it all falls to shit I haven't lost anything ?
It's hard to implement two network designs concurrently, so it becomes one or the other. Why suffer the complete waste of time involved by starting again for the sake of a damn fool manager ? Better to hold out for as long as you can, so that there is a chance of getting the correct solution adopted. If they want to sack you for NOT doing something detrimental to the system, then that's their own stupid fault. If you do it their way and get fired anyway (because their way doesn't work), what have you gained ?
This guy wasn't holding anybody to ransom, making extortionate demands of his employers, or killing fluffy kittens. All he has done is refuse to give the keys to someone else's Ferrari (which he is ultimately responsible for) to a 14 year old crackhead joyrider.
This seems to me to highlight the difference between good employees and time wasters. A good employee will always have the interests of the employer at heart, and will assume ownership of problems using those interests as a basis for operation. A time waster turns up every day, does their "job" to the letter, no more, but frequently less. They don't care about the end product or the delivery of such. They just do the hours and take the money.
I know which camp I fall into, as I am used to being an employer and an employee. If I give someone a job, I would prefer they did it intelligently to achieve the best result as outlined in the requirements, not just do what I tell them, because if I have to tell you what is required for every little nuance, then I may as well have done the job myself.
Would you really just hand over the keys to a system that you spent years building, to someone who outranks you but has no idea of the power contained in having access to those keys ? For all you know they might leave the passwords on a post-it note on their monitor.
Final point - the civilian sector is NOT the army. You don't HAVE to comply with idiots above you, grow a pair and stand up for what's right. If you ARE right, then nothing too bad will happen. If you bend over for anybody with a title then you might get a title in the future, but at the cost of having any respect, self or otherwise. While it is only a movie, Crimson Tide demonstrates the principle quite well.
Are you suggesting that people who are pro-gun are automatically anti-gay?
Seems to work that way. However the reality is that a large number of you'all, seem willing to write off other people's freedoms (both those that are and those that should be) just to be able to protect yourself if the government decides to start treating you the way that you allow it to treat others.
The grass is only greener, if you don't take care of your own lawn.