Slashdot Mirror
Terry Childs Found Guilty
A jury in San Francisco found Terry Childs guilty of one felony count of computer tampering. The trial lasted four months. Childs now faces a maximum sentence of five years in prison.
← Back to Stories (view on slashdot.org)
he is a sysadmin that refused to disclose passwords to an office which had the prudence to disclose ALL of those LIVE passwords and usernames as evidence in a public court ... exposing personal information of millions of citizens in public databases ...
i doubt that randomly selected array of 20-30 americans would be able to understand how insanely stupid this is.
Read radical news here
Remind me never to do the right thing ever again.
It is my understanding his employment was specific in that he would only disclose the password to the mayor alone. This never happened, thus he never disclosed the password. This case did not require any technical knowledge to grasp the facts, so I am unsure how the jury could come to this result.
What this really all comes down to is that once a company fires you or lets you go you are still obligated to that company.
I don't care if it's a government organization or a corporation as far as I'm concerned once they let you go there should be no more ties to anyone from either side.
I guess it's true...the shackles don't come off even if they put you back in the general population.
"Bah!" - Dogbert
The lesson here is to do whatever your boss says, even if it is incredibly stupid and will make your job entirely unmanageable...
Well, I would have to agree that my 'inner security geek', would have had to swallow really hard a few time before stating production passwords over a teleconference with unknown people. Hell, I would expect to be fired just for doing that.
Damned if you do, damned if you don't. Sometime you just have to suck it up and go look for another job. The sad part is that Terry was probably just a conscientous civil servant, and the boss was a know-nothing political appointee. Terry had probably seen more than a few of these appointed ass-hats come and go, and figured this was just another little tempest that would blow over.
Poor guy
Wherever You Go, There You Are
Fuck off. He followed the fucking city policy, maybe he was a jerk about it, but that doesn't make you right about him.
Let's say he was hit by a bus, killed, and consequently unable to disclose the password. Would he be guilty of computer tampering in that case? How about the bus driver?
Yes. Security rightly assumes that the weakest link of any computer/information protection is the humans. He followed their policy about how to deal with people trying to get access, no matter where or how powerful those people were.
He should be commended, not disgraced.
I wonder how the guys who took over Terry's job feel now. I'd be looking for alternative employment at this point -> like maybe a ditch digger or something that just might not get you pooched by the judicial system.
Talk about setting a dangerous precedent.
It was very probably being a jerk that got him convicted - people are much more likely to convict the headstrong than the guilty. I don't know if he really was guilty of anything, I've not really examined the evidence, but it's a well-documented psychological flaw of individuals that looks and personalities have a far far greater bearing on who is convicted than the actual evidence itself. There is no fix for this bug that is not worse than the bug itself.
Even if he were guilty, his real "crime" would be being a little too uptight, perhaps being an a-hole a little too often, and maybe being a little obnoxious. Note that these are only true if he actually is guilty of something. I fail to see how a purely punitive system is going to be useful in correcting these issues, which are not uncommon amongst those with Geek Syndrome (aka Asperger's). In the same way drunk drivers are sometimes ordered to attend AA meetings, the most suitable punishment (again IF he is guilty) would be to require him to attend an Asperger's group and/or get checked-out by a pdoc for some sort of treatment regimen. (Asperger's is not, technically, treatable but CAN aggravate other problems that are.) This would be cheaper than prison, by a LONG way, be far more likely to be effective, AND would be more likely to increase his value to society (whereas prison rots skills and therefore decreases value).
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
This guy was in the employ of the city government, which necessarily acts differently than a corp, which makes your analogy false. His direct bosses don't make the rules, the elected officials do. The difference is crucial. Furthermore, his following the rules was not to the detriment of the city.
There is just no way around it, no matter how big a douche your employer is, or how wrong or unfair you think it is, or how big a mistake they are making... withholding your employers' passwords will land you in jail.
Some may work up some emotion over this, but I don't think this will really be a surprise to many people.
Here's a hint; when you end up in a room with the cops and a lot of your management, fine, ask for your lawyer, but don't plan on using that same management's written policy against them. They are management - they wrote the policy. They're telling you their new policy. Verbally. In no uncertain terms. With the cops present.
You cannot lock your customers out of their equipment. This is not a legal theory our society will ever adopt, nor should it. Imagine if the courts agreed that IT staff has discretion to withhold their customers' own passwords. "They weren't smart enough to have it." "They asked for it the wrong way." "They once had a written policy that I shouldn't tell them."
OK, so no one can ever fire you. When can't you come up with an excuse to lock the equipment and walk off? Imagine if the courts blessed it! You could pull that burn off and coast, untouchable. Yeah, that philosophy really has legs.
You: "Give me the password."
Your employee: "No."
You: "You're violating my policy - I need the password."
Your employee: "I disagree. I have my own interpretation of your policy."
You: "You're fired."
Your former employee: "Great, now I definitely won't give you the password."
You: "Obviously I'm not paying you to refuse to do what I'm asking. But you still have my passwords."
Your former employee: "Fine, but since you're not paying me, I'm not your slave. You can't force me to perform."
Hear that sound? It's the eyes of every slave who ever lived rolling back in their heads.
Think about it. Childs could, if he truly was motivated by fear of violating a policy, have called his lawyer into the room, to say: "no problem, we'll give you the passwords, we just need you to release us from liability for disclosing those passwords, one pager, sign here..." He didn't, because this was about ego, not policy. He just didn't want to have to cave and do what they said. He's not the first - many an outsized ego has landed its owner in prison.
Tired of Political Trolls? Opt Out!
Fuck off
I know absolutely nothing about the San Francisco network. But I find it interesting that Childs said, "These idiots can't be trusted with the passwords," and the second the idiots got the passwords, they published them for the world to see.
Sure enough, those idiots should not have been trusted with the passwords. Hard to fault a guy when they immediately proved him right. :-)
By the way, since this is a municipal system, here are some of the functions I've seen municipal systems handle:
1. 911 calls over VoIP.
2. Fire dispatch, as in "Building on fire here"
3. Police dispatch, as in "Crazy guy with gun over here."
4. Police data, as in "The license plate you just pulled over is driven by a violent felon."
5. Videoconferencing that connects lawyers to their clients
6. Utility billing/disconnect, as in "These people need their water/power/garbage cut off."
I could go on and on.
Wanna see your basic "evil hacker" movie play out in real life? You couldn't take over the world, but you could make some people miserable. Maybe even get a few of them killed when help doesn't arrive when it should...
Not all computer networks are about making sure Sally in accounting gets her email.
He put his boots up on the table and made a face. "The sig," he smirked. "You can waste your life in search of the sig."
This is a post written by someone who has clearly never actually been to a country with corrupt police, and having been to a few my self I was quite happy to get back to Western Europe/N.A. where people don't realize just how lucky they are that bribery is something we talk about on TV not the only way to accomplish anything.
The police do not have the authority to force you to disclose passwords. You see, here in the US we have these things called rights.
I think Terry Childs would disagree with you. He didn't tell the police his passwords, and he went to jail for 5 years.
Jury nullification consists precisely in ignoring that particular instruction: that you should only apply the law and not judge the law itself. Duh. This notwithstanding, if you say you agreed with the law, and thought it had broken it, well, then, obviously you did the right (moral) thing and have a lot more info on the case than random slashdotters. Well done.
As an American, I am profoundly depressed by this thread. I respect the juror who is posting his perspective here, and greatly appreciate the fact he's taking the time to explain what happened from an insider's perspective. But his account reveals a terrible devolution of our system of justice: the ordinary citizens on a jury no longer protect us against an inappropriate or unfair application of the law.
It makes me furious every time I hear a juror come out of the jury room and say "I don't think he really did anything bad, but according to the judge's instructions, I had no choice but to convict." No, you had a choice. The brilliantly cynical and untrusting rebels who wrote the Constitution put you there to make the choice. Not an unfeeling robotic choice, not a judge-directed decision, but an independent decision that truly reflects the informed judgment of a "jury of peers."
The jury has become, not an independent check against the juggernaut of government prosecution, but a mere puppet of the system. In such a legal system, any one of us can be sent to jail for life on the government's whim, because there's not one of us who doesn't -- knowingly or unknowingly -- violate several laws daily; we count on juries to say, when appropriate, "ok, maybe he technically violated the law, but this prosecution is unreasonable, and we're not going along with it."
Our system was designed to make it really, really hard to convict. And really easy to acquit. If the prosecutor doesn't like the case, he can toss it out. If the judge doesn't like the case, he can toss it out. Heck, if the judge doesn't like the jury's "guilty" verdict, he can toss it out (but he can't set aside a "not guilty" verdict). Why has the jury come to believe they can't exercise at least the same power as the prosecutors and the judge routinely do: the power to toss out a case that just ain't right?
We specifically spent hours on the question of intent and making sure we were beyond a reasonable doubt. As to the removal of the other juror, there's way more to that story than any paper knows, and I don't want to go much into it, but he was definitely dismissed "for cause", not because he was some type of lone holdout or something like that.
The law we used was CA Penal Code 502. We did not make up any laws or definitions in reaching our decision. Just take a look at the number of posts and opinions here which fall in both directions. Do you think they have more facts about the case available to them, who may have read some articles and blogs about it? Or do you think I may have more information upon which to base my opinion, after listening to five months of testimony, reading hundreds of emails, many sent by Mr. Childs himself, showing his state of mind and intent? There's way more to the story here than simply a good tech guy all of a sudden being requested to turn over some passwords.
Yes, I was on the jury (see my post further on down). An essential part of jury deliberations is keeping an open mind, explaining your thoughts and opinions, and listening to the opinions of others. This was not the case here. I really won't go into the details on the matter as to not reveal personal information or background on the juror, but not only did he not do those items above, he also refused to follow the jury instructions and the legal definitions as provided by the judge that we had to use in our determination of the facts.
While you are allowed to look at testimony differently and debate that, you can't decide that a legal definition as provided by the judge is something you don't agree with and therefore won't follow. Essentially, you're supposed to follow the facts and then come to a conclusion. The problem here was that one person had a conclusion beforehand, and wanted to change the facts to fit it. It just doesn't work that way.
Bet you one of the conditions of Childs' "release" is a prohibition on using computers for the next 5 years.
You did what you thought right, and interpreted the judge's jury instructions as carrying the same weight as black-letter law. But they don't, and as others have pointed out the catch-all term "jury nullification" can be the right thing to do when the law is an ass, or when the prosecution has wildly overreached. Hopefully this'll be overturned on appeal, and I really would like Childs' managers and the key prosecutor's names to become as well-known as Childs. There was (and still is) plenty of blame to go around.
As others have pointed out, if the employer did not have a police force and court system handy, this never would have become a criminal matter.
Remain calm! All is well!