Slashdot Mirror
Terry Childs Case Puts All Admins In Danger
snydeq writes "Paul Venezia analyzes the four counts San Francisco has levied against Terry Childs, a case that curiously omits the charge of computer tampering, the very allegation that has kept Childs in jail for seven months and now appears too weak to present in court. Count 1 — 'disrupting or denying computer services' — is moot, according to Venezia, as the city's FiberWAN did not go down due to Childs' actions. Venezia writes, 'Childs' refusal to give up the passwords for several days in no way caused a disruption of the normal operation of the FiberWAN. In fact, it could be argued that his refusal actually prevented the disruption of normal network operation.' Counts 2 through 4 pertain to modems Childs had under his control, 'providing a means of accessing a computer, computer system, or computer network in violation of section 502,' according to case documents. As Venezia sees it, these counts too are spurious, as such devices are essential to the fulfillment of admin job requirements. 'If Childs is convicted on the modem charges, then just about every network administrator in the world could be charged with the same "crime,"' Venezia writes. All the authorities would have to do is 'point out that you have a modem or two, and suddenly you're wearing pinstripes of the jailhouse variety.'"
'If Childs is convicted on the modem charges, then just about every network administrator in the world could be charged with the same "crime,"' Venezia writes. All the authorities would have to do is 'point out that you have a modem or two, and suddenly you're wearing pinstripes of the jailhouse variety.'"
It still beats having to wear a suit to work.
If you don't like what someone does, but strictly speaking it's not really illegal, then find something else they did, (something that maybe a lot of people do and get left alone for) that has some silly, overly-broad definitions you can twist, and soak him for that instead. (ether as substitute punishment for the former that you can't make stick, or just plain in retaliation for doing something you didn't like)
As usual, the legal system that makes me sick to my stomach some days.
I work for the Department of Redundancy Department.
FTFA:
that's the point really. His keeping the passwords is really no different than a VP keeping a laptop or company automobile. There are several civil steps that need to be gone through before "keeping" something you were previously entitled to have and protect becomes "criminal".
Consider the case of loaning a car to your long term SO for many years, then the relationship goes south and you show up with the cops to take back the car she's had for several years. Yes, you can get it back, but the cops will tell you to get a judgment first and won't just let you take it. In the same way the new manager saw a "rogue" employee that was cut off, isolated, and anti-social and first tried to illegally fire him. When that didn't work, then he started harassing about the passwords and created a situation with the prosecutor to get the passwords or throw the guy in jail... a leap of about 6 other legal processes.
Like has been said before.. modems and back doors in your office or home office (if expected to work from home/call in) are quite common for admins. VPN access to servers for when they crash is common. Those don't really figure into the "criminal" part because they didn't ASK if he had them and didn't ASK him to return them... packing his cardboard box on the way out the door is not formally "asking". As far as wiping the configs, that was paranoid overkill, but considering how often city office property gets stolen, wiping the config keeps thieves from getting the network settings to the whole thing which is more valuable than any one office of downtime due to power failure.
"keys to the kingdom" passwords are quite common.. I'm the only person at my 1000 person company with ALL of a certain server's passwords plus some network ones. There's a small number of people I would release those to... if I was pre-accused of malicious intention before I even left I'd probably handle the transaction thru a lawyer.
Like he predicted, when the city hired consultants (again not thru a legal means, just some random company to "fix it") and they started breaking stuff they didn't understand isn't his problem... Remember he was accused of "damages" even though the manager had no cause to make that ... they only poor performance he demonstrated was being disgruntled. Assuming he was doing damage and calling the cops is bordering on criminal filing a false report.
The proper course of action would have been for the DA to sue him in small claims court for the password. Make a valid case and allow him his grievance before a judge, then honor the ruling. Then a judge would have thrown him in jail until he talked for contempt... there's no time limit on contempt, so no need to file other charges! Frankly they're not a good lawyer if they didn't think of the simplest legal thing first.
I can't believe this megomaniacal prima dona is now somehow the posterboy of the IT people. There were ways for this nutbar to get out of the quandary while still saving his ass. Instead, he holds a network [b]that does not belong to him[/b] for ransom.
Well, it's just like 1st Amendment cases involving pornography, marching down the street in neo-Nazi uniforms or hooded bedsheets, or the like. You have to fight the idiots who would deny basic rights or make a mockery of law unilaterally, even when they go after the dirtbags. Letting them ignore the law when they beat down the unpopular is just giving them a free pass to do the same to you in the future, when it strikes their fancy.
If a job's not worth doing, it's not worth doing right.
After he is let go, he no longer has permission.
However, he cannot be prosecuted on the basis of actions he took at the time he had permission to take them.
There would be a 4 word phrase for that: ex post facto law. Explicitly prohibited by the constitution.
Along with Bills of Attainer, which is almost what throwing someone in jail without trial for a year with a $5 million bail amounts to, he has been declared guilty by the state and is being punished without trial.
A few years later when the finally gets a trial, they'll say "oops, my bad", and let him go, after using various means of persuasion to ensure he doesn't proceed with any lawsuit for the false imprisonment.
Here is the deal as I see it. He's an admin with a bit of an attitude, yet he did his job well apparently. Everytime that I'm asked to do inane bs at work, I turn it into a paperwork exercise. That is to say that I am happy to paper the office of whichever vp wants reports and to be in charge. Soon, they ask me to 'just take care of it' as I see fit. Either you want a competent admin or you don't. Once you get one, you have to trust them and work with them, even if there are conflicts of personality. This is simply because you as a vp or cxo cannot replace that person. You are forced to work with them... deal with it.
Positional authority is a powerful thing. If you as a cxo are afraid to give it to someone, get some certs... or perhaps learn to delegate and deal with that.
The fact that this made the level it did in courts is indicative of the fact that management is not willing to give away any power to anyone. In much of this situation, they had no need for what they ask for, and should not have had it.
In the cold light of day, if they gave him that much control, they got what they deserve. When you give someone that much power/authority, you must be nice to them. This is a situation that repeats itself across the globe without end. This particular one just happened to make the news because Terry has big balls.
No matter what happens, this is a simple case of bad management. period.
Support NYCountryLawyer RIAA vs People
> As far as wiping the configs, that was paranoid overkill, but considering how often city
> office property gets stolen, wiping the config keeps thieves from getting the network
> settings to the whole thing which is more valuable than any one office of downtime due
> to power failure.
When I left my last job as Sr. SysAdmin (they laid me off, for someone cheaper), they were absolutely sure I had left back doors into the network, and that I could sabotage everything. They couldn't find the backdoors (because they didn't exist), and ended up changing the OS on every server. In that beautiful move, they screwed up an awful lot of stuff. Ha!
The funniest part was, some of the people who they kept on were thieves. They were stealing confidential data, and abusing the network for personal gains. It took two more years for them to figure that one out. All I can do now, since I have no involvement in that company, is sit back and laugh. :)
The "keys to the kingdom" were on file with senior management though. Shit happens. I could get hit by a bus. I could get shot in a botched convenience story robbery. I could just decide not to ever come to work because I got a better offer. Why cripple their company?
Serious? Seriousness is well above my pay grade.
"By withholding information about the configuration, he stole from his employer on the way out."
I don't know about this Terry Child fellow or anything to do with what he's alleged to have done. But that is one bat-shit insane sentence.
Are you saying that an individual cannot just quit his or her job and walk out the door? And if they do should rot in jail and be stripped of all possessions? On the basis of a private companies say-so? WTF?? Who the fuck modded this bullshit up??
They fired him, he walked...but he's forever beholden to them and every employer he's ever worked for because he holds some knowledge about their network?
What a fucked up world you live in, sorry but you're a little fascist, any individual, from the CEO to the Janitor has every right to leave a position and never look back, if the world implemented your policy we'd all be too terrified to work for anyone! Some HR schmuck wants to fuck with you after you leave, HE DIDNT TELL US SOMETHING WE NEED PUT HIM IN JAIL AND STRIP HIM OF HIS POSSESSIONS! Jafiwam demands it!
You the only IT person for a small company and want to quit? TO BAD! Don't dare walk out the door, if you do according to Jafiwam the little fascist you deserve to rot in jail and have all your possessions stripped away from you. Oops didn't document what that script does, STEALING! JAIL FOR YOU. Didn't tell them about that Cronjob before you left? STEALING! Didn't document that object properly, didn't let them know about that revision, didn't pass on that message? STEALING, STEALING, STEALING!
Didn't write a 2000 page manifesto brain dumping every tiny little bit of trivia and knowledge that you have about their business, STEALING!
The idiocy is truly unbelievable around here sometimes.
That's not necessarily true. Just like the security guard, if the policy said no one enters the building without ID and a company Badge, then not letting anyone in without either of those is appropriate.
The same can be said about a corporations bank account or credit card numbers. It's completely ethical and responsible to not disclose those things to anyone you cannot personally verify their right to access the information. Credibility is only a stones throw from socially engineering the information away from someone. The police in the room could have been attempting to get access to install illegal taps on a public official or anything other then what they were doing. Childs was probably within his rights to demand that he be contacted by the proper people in a manner that he could verify their identity. The mayor was most likely his point of contact and his superior which is why he refused to do anything until he could give it to them.
Here is a thought experiment. Suppose I walked into your building in a uniform of some sort and asked you for the passwords to your servers and access to the server rooms. I gave you ID that matched the name on my uniform and claim I was hired by the company to perform a security audit of the system.
Do you
A- give me access and the passwords
B- tell me to get lost
C- contact your superiors and verify that I am legit then give me the passwords and access
C- is the right answer (even though A happens all to often). But Childs wasn't in a position to contact his superiors or the mayor could have been his superior and instead stated that he would give the information to the mayor. When the mayor came around, he surrendered everything without hassle.
Comment removed based on user account deletion
Terry Childs held something at ransom or rendered useless that didn't belong to him.
What was the ransom he demanded? How was a network with zero downtime rendered useless?
The code, hardware, and configuration all belong to his employer. By withholding information about the configuration, he stole from his employer on the way out.
They had the configuration. They could pull out the flash card with the configuration on it and put it in a new router and it would work great. Of course, without the passwords, they couldn't log in to see it, change it, or any of that, but that didn't prevent it from being 100% operational, as well as being something that could be backed up, replaced, and all that without problem.
He fucked himself and he deserves what he is getting.
He was fired, then after being fired, was asked to fulfill an obligation to an organization he no longer had an obligation to. He may not have been professional. He may have been an ass. But he did nothing illegal, let alone criminal. If they threw people in jail just for being asses, I'd nominate you to be at the front of the line.
Learn to love Alaska
More like an employee is charged with looking after the office and keeping it secure so they hide the keys. They then refuse to give up the keys to a person who has no need or reason to enter the office. Employee states that they will give up the keys if told to do so by an appropriate person in authority. Employee then gets arrested.
Silly rabbit
The things you mention (customers, schematics, etc) are a lot different than a password. If the company has any clue what the're doing then that small, trivial password becomes completely useless immediately after he is fired. I can't remember if it was the root passwords he refused to give up or his own account's password. If it was his own there is no reason for the company to need them. If it was the root passwords why was he the only one with them? One person should not hold all the root passwords for the company's equipment and I'm pretty sure he had a boss that should have made arrangements in case Terry suddenly died.