Slashdot Mirror
Juror Explains Guilty Vote In Terry Childs Case
alphadogg writes "Terry Childs, the San Francisco network administrator who refused to hand over passwords to his boss, was found guilty of one felony count of denying computer services, a jury found Tuesday. Now, one of those jurors (Jason Chilton, juror #4) is speaking out in an interview with IDG News Service's Bob McMillan: 'The questions were, first, did the defendant know he caused a disruption or a denial of computer service. It was rather easy for us to answer, "Yes there was a denial of service." And that service was the ability to administer the routers and switches of the FiberWAN. That was the first aspect of it. The second aspect was the denial to an authorized user. And for us that's what we really had to spend the most time on, defining who an authorized user was. Because that wasn't one of the definitions given to us.'"
As someone who saw through Terry Childs early on, I found myself in the minority here. I took one of my first big karma beatings just pointing out a few ways how this narrative of him being a idealistic professional locked up by his evil, stupid bosses was pretty obviously not possible, even just looking at the bare facts.
What struck me was the way so many of us in the industry instinctively acted out our prejudices, made assumptions, hunted out any shred of fact that supported him (selective and misleading quotes from the CA rulebook, for instance), and even assiduously avoided rational counterarguments and conflicting evidence.
And now here we are at the end of the trial. The evidence is utterly damning. Long before he was fired, he was asked by someone for access to these systems and refused. We know he knew the guy (his boss' boss) was authorized, because there's written evidence in Childs's own emails to that effect. There was no moral justification for what he did. He was just being a criminal, the same as if someone you trusted locked you out of your computer.
Just read:
Thanks for your comments, I hope I can address them all. First, he was not fired before asked for access to the FiberWAN. And there's a big distinction there -- not only was he asked for passwords, he was asked for "access". I can understand not giving up your personal username and password, but also not allowing anyone else there own access is entirely different. However, he did go into this meeting knowing that he was being "reassigned", so I'm of the frame of mind that he actually thought he was being fired. After a long period of different claims -- including that he didn't remember them, that he himself had been locked out of the system for three months (even though he was working on it that morning), providing incorrect passwords -- he was placed on administrative leave. He was even scheduled to have a meeting the next week with the CTO of the city to discuss the matter. However, he made one of the biggest mistakes then that he could have. While under police surveillance, he decided then to leave the state and make cash withdrawals of over $10,000. He was arrested, and that's where it became a criminal matter instead of simply an employment matter.
I think this is a good moment for all of us to reflect on how rallying around this lying criminal stained our profession, and how we should practice the same objectivity with ourselves and those "in the downtrodden world of IT" that we expect in others.
Tired of Political Trolls? Opt Out!
If he had not decided to leave and go to Nevada a few days later and withdraw US$10,000 in cash, [Childs did this the day before his arrest, while under police surveillance] I think the police may have let it continue on as an employment issue and not a criminal matter.
I can understand the police thinking, "wow, he's locked down the network, and now trying to run away. What is going to do to the network once he gets to Mexico?" Secondly, this:
Eventually we looked at it and we saw that in late June his manager had requested certain accounts to be created that would have access to certain routers and switches. And he did create those accounts, and he sent that back in an email with the user IDs and passwords, to which Richard Robinson was also copied. If his big concern was that Richard Robinson was not authorized to be a user, why -- just a week before -- did he copy him on an email that has user IDs and passwords?
So there is evidence to say it was about control of the network, and not about security policy (there's more if you read the article).
Still, it's really hard for me to say anything he did deserves jail time. Getting fired, yes, he should have been, but jail time? That seems a bit much. Someone once said, "If you skate close to the edge of the ice, you're likely to fall in," and I guess that's what Terry did here, and he got burned.
Qxe4
Not really. I've served on a couple (in San Francisco even) and they pretty much just dismiss you and send you on your way right after the verdict. You can come back for sentencing if you want, but after weeks/months in the courtroom thats pretty much the last thing you want to do.
I guess you could put a note in there or something, but most of the time unless you read up on the statutes in question you don't know how much jail time he's facing or whatnot. And personally, I think to be completely objective its probably better not to know. Your job is to apply the law and answer the question if beyond reasonable doubt did the defendant break the law. That's it. You have to do it objectively and I think knowing that you're personally responsible for sending some guy to jail for 20 years might make some people "iffy" on returning a guilty verdict. Its pretty black and white - there's no "guilty, but only by a little bit". Obviously there are some cases (death penalty, civil suits) where the jury does make the decision on the outcome after the "who won" phase, but for something like this its up to the judge.
I would certainly hope that they give him time served considering he's been in jail a couple of years already. Having read a bunch on this and followed the story my opinion is that he's guilty, but honestly he should have just been fired and fined. Its not like he was trying to defraud the city or personally gain from this or from what I can tell had any malicious intent beyond "these guys are idiots". I wouldn't hire him, but in the grand scheme of things it sounds like he's just a jerk who could still be a productive member of society.
You have to do it objectively and I think knowing that you're personally responsible for sending some guy to jail for 20 years might make some people "iffy" on returning a guilty verdict.
I disagree. I think a big part of the jury's job is justice, not necessarily just determining guilt or innocence. There needs to be a better brake on politicians for requiring ever increasing and ridiculous punishments for a crime, and one big brake would be a jury refusing to convict because the sentence is too severe.
Need a Python, C++, Unix, Linux develop
http://online.wsj.com/article/SB10001424052748704471504574438900830760842.html
You're a criminal too. You just haven't been charged yet.
From this guy's discussion it sure sounds like the jury convicted Childs for literally doing nothing - as in not revealing the password when asked.
That seems completely out of line with the reason for "denial of service" laws in the first place - unauthorized access leading to various sorts of downtime.
Childs clearly had authorized access up until the point in which they decided to "transfer" him and it doesn't sound like he tried to access the systems afterwards.
He may have been an ego-maniacal dick about how he managed the systems when he was authorized, but being a dick is not a criminal offense.
I think a doctrine of calling inaction after authorized actions denial of service is the kind of thing that is so overbroad it could lead to all kinds of unfairness - a maintenance guy sees a leaky roof in a server room, gets transferred to another building and doesn't tell anyone about it and a week later the computers in that room get flooded, is he now criminally responsible for that denial of service?
When information is power, privacy is freedom.
Because it's common practice in IT for this to happen. The underling needs the information to do his job, his boss doesn't. You don't spread sensitive information around simply because you can. Especially since his boss, as chiefly a manager, may not have the training to properly handle all the information.