Terry Childs Denied Motion For Retrial

snydeq writes "The former San Francisco network administrator who refused to hand over passwords for one of the city's networks has been denied a new trial and is expected to be sentenced Aug. 6. Terry Childs had been due for sentencing Friday but the court instead heard two defense motions, one requesting a new trial and the other for arrested judgment — essentially to have his original conviction overturned. The motions were both denied but the court then ran out of time before the sentencing phase could be conducted."

Comments

while ( 1 ) delay();

[blair1q]

Given the byzantine nature of the case, I have little doubt it will be appealed until his lawyers realize he's run out of money.

Re:while ( 1 ) delay();

[Anonymous Coward]

His appeal is most likely paid for by the Bar Association and the First District Appellate Project.

Re:while ( 1 ) delay();

[Anonymous Coward]

There is something wrong with this case...

Why was there a network engineer on the jury ?

I find that very weird... the network engineer can be thought of as a competitor and ofcourse he gonna find him guilty...

Good riddence... more work for me he must think... something among that line...

It's The Law!

[gyrogeerloose]

Withhold a password, go to jail.

Not really sure that justice was served here but the guy really was a first-rate dickhead.

Re:It's The Law!

[JWSmythe]

    You gotta watch what you say on here. I agree, but I've had people go off on me saying it.

    Myself, I kinda like the idea of job security, where I lock down the whole network so no one else can manage it. "Nope, you can't fire me, I'm the only one with the passwords."

    I've had to do cleanups after those a few times though. No one knew the passwords to a bunch of networking equipment in the datacenters, as well as quite a few servers. Nothing makes me warmer and fuzzier than sitting in a datacenter booting into single user mode to change passwords. It's always nice to tell the bosses "Don't panic, you'll see a lot of machines going down for a few minutes each. I'll bring 'em all back up."

    It's so much easier to manage the equipment when you have access to all of it. :)

Re:It's The Law!

[Mike Buddha]

Yeah, seems like this should have been a civil case, but I don't know if lives or people's welfare were on the line because of this jerk. If that's the case, then a-slammer he should go!

Re:It's The Law!

[jtownatpunk.net]

If being a dickhead is a crime, I'm in serious trouble. Can someone please provide a list of countries that won't extradite to the US? Soonish, please.

Re:It's The Law!

[Anonymous Coward]

Except if you had done that in this particular case you would of been rebuilding the entire network from the ground up. Terry Childs deleted the startup-config on most of the network equipment so that the only copy was in running-config. He kept the configuration of every device in an encrypted drive on his laptop. If a network device was restarted or power cycled, he would log into the device and copy over the running-config.

Re:It's The Law!

[Fulcrum of Evil]

please explain how this crosses the line into criminal conduct. From his perspective, it would be criminally negligent to turn over the passwords to a bunch of unknowns on a concall.

Re:It's The Law!

[jjohnson]

Why not just not be a dickhead? Lots of people manage it every day.

Re:It's The Law!

[Cramer]

... until you reboot the web server and don't have the password to the ssl cert. That's the beginning of a Bad Day(tm).

Re:It's The Law!

[ncohafmuta]

'From his perspective' is the key phrase here.
Judging the competence of his superiors is outside the scope of his job responsibilities.
Denying the company access to their legal property, i.e. the passwords, is considered theft.

Re:It's The Law!

[_KiTA_]

Withhold a password, go to jail.

Not really sure that justice was served here but the guy really was a first-rate dickhead.

I like the prescedent.

Cops: "We confiscated your external HDD, only it's encrypted. Give us your password."

SuspecT: "No."

Cops: "Passwords are property and thus you have to, as it's part of the HDD."

Suspect: "I claim 5th amendment rights."

Cops: "We have a Warrant for the seizure and search of this HDD, and you're blocking us from doing it. Therefore, you can rot in jail until you give up and give us what we want."

Re:It's The Law!

[JWSmythe]

    Well, it's not all that bad. If you're the admin for the company, you can likely buy new certs. It's not like they're all that expensive any more.

    Most folks I've known fix their cert so they don't have to type the password every time they reboot the machine. A server should come up into a good running configuration when powered on. It shouldn't require any sort of manual intervention. One place I was at didn't, and it caused all kinds of problems. Just imagine the loving phone calls that were coming in, when the machine was found hung at 6pm, and the guy with the password left at 5:30pm. The next shift reboots the hung machine, the web server didn't come up, and plenty of rather strong language flew around.

Re:It's The Law!

[JWSmythe]

    Sometimes you have to do what you have to do, even if that includes getting a few good people to figure out what the design should be. I'm not saying it would be me, even though I have done more than my fair share of figuring out other people's mistakes. A half dozen CCIEs (assuming it's all Cisco equipment) could likely do it in a day, if they had enough information to work with. If there were no network maps, and they only knew the sites where the equipment resided, it could likely take longer.

Re:It's The Law!

[Anonymous Coward]

Except if you had done that in this particular case you would of been rebuilding the entire network from the ground up. Terry Childs deleted the startup-config on most of the network equipment so that the only copy was in running-config. He kept the configuration of every device in an encrypted drive on his laptop. If a network device was restarted or power cycled, he would log into the device and copy over the running-config.

...AND then tried to flee the state with $10,000 and the configs.

But no, everyone rushes to defend him, insisting he did what any competent sysadmin would do.

Re:It's The Law!

[Cramer]

I've worked in places where the cert was left encrypted. An unencrypted cert can be stolen by anyone who gets into the server. For most people, that's not the end of the world. But if it happens to your bank or paypal, then it's a very different mess.

(Those people should be using SSL hardware where the key is protected. But that stuff isn't cheap, or easy to manage.)

Re:It's The Law!

[Anonymous Coward]

A half dozen CCIEs (assuming it's all Cisco equipment) could likely do it in a day

LMAO. Half a dozen Cisco engineers could rebuild the City of San Francisco's entire network infrastructure configuration in a day? Show me these guys, please.

if they had enough information to work with

Well, shit. It's a good thing that the City had all that information, and that the only copy of network maps and configs wasn't stored on Childs laptop... oh, wait... Shit.

See the above? That's what makes Child a first degree asshat who is largely deserving of the treatment he is receiving. He ain't no sysadmin martyr.

Re:It's The Law!

[JWSmythe]

    Show me the network map and details, and I can give a slightly better estimate. But since this is all hypothetical it really doesn't matter.

    It's not impossible to rebuild the map. I'm assuming we're talking about a bunch of LANs with WANs connecting them. Just follow the trails. I believe I said it would take longer without all the details. That would mean following every circuit and finding out where each end terminated. Some beancounter has the bills and knows every circuit they're paying for. Knowing the circuits and termination points, you'd have to check out each physical location and see what's there.

    I didn't say that would be a quick process. It would actually be quite time consuming. But I'd suspect someone at various sites would know at least some details of their setup. I seriously doubt he was running the whole network, and running around the city managing all the desktop machines.

    I have been dropped into situations where folks on site have no clue, so you spend time wandering around back rooms and looking in closets to find something resembling a demarc. A few times when I've been sent off looking for things, I'm not even on the right floor. Sure the office is on the 12th floor and the telco says it's in a particular place on the first floor. A few years ago the moved from a suite on the 4th floor, and before that they were in a very small suite on the 7th floor. Voila, smartjack on the 7th floor. Now you have to wonder which rocket scientist extended it from the ground floor, to the 7th floor, to the 4th floor, then to another wiring closet across the floor, and then up to the 12th floor.

    Another place I did work for had a wiring closet at the end of their building (building 4 of 10). It sure looked like where the telco ended. Nope, they ended in a locked closet in various buildings on the site arbitrarily. The line I was trying to find went from the closet building 1, to the closet in building 3, to the closet in building 3, and then finally to the customers suite. Even the guy who was responsible for the cabling confessed that he was thrown into the mess, and was trying to make sense of it as customers needed it. Most customers don't care where the wires go, they only care that if they plug into a jack it works.

    It's not an impossible job. It just wouldn't necessarily be very fun.

Re:It's The Law!

[westlake]

Can someone please provide a list of countries that won't extradite to the US? Soonish, please.

Every country has ways of dealing with the dickhead. Some are more permanent and more painful than others, so make your choice wisely.

Re:It's The Law!

[WillDraven]

What if it's NOT encrypted, and that's just noise left over from stress testing the drive with random read-writes? How exactly would justice be served by holding that guy in jail? Apologies if you were being sarcastic.

Re:It's The Law!

[JohnFluxx]

But his /contract/ said that he was not allowed to turn over the passwords without the proper protocols. Which were not followed.

Re:It's The Law!

[Cyberllama]

You say that, but do you recall what happened when he did give the passwords to them? They were immediately included in a legal filing against him which was part of the PUBLIC record -- meaning any idiot could see them. They had to shut their network down for days while they changed all the passwords on everything after they realized what an idiotic thing they'd done.

It sort of made his reasoning of "I'm not giving you the passwords cause you'll do something stupid with them" seem really, really justified.

And as I recall, it wasn't that he refused to give them over -- it was that he refused to give them over to "just anyone". He wanted to be sure that it was someone who wouldn't screw it up. Yes, he's an arrogant bastard who clearly and obviously looks down upon the people he works for -- but some of that seems to be justified. They clearly are at least a *bit* incompetent.

Re:It's The Law!

[Thinboy00]

Can you actually get "extended validation" (the URL bar turns green etc.) without using such hardware?

ObTopic:Why bother? Childs was an idiot.

Re:It's The Law!

[jewishbaconzombies]

Be a dickhead and mouth off to a cop. See how far that gets you in ANY country.

Re:It's The Law!

[shentino]

Bad move.

What if there was a blackout?

Re:It's The Law!

[shentino]

Did said contract ever make it into evidence during his trial?

Re:It's The Law!

[Coren22]

Ever heard of redundant power? Many Cisco routers have two power supplies, you run one to a UPS, and the other to wall, or another UPS. Routers don't generally take massive amounts of power to run.

Re:It's The Law!

[tehcyder]

Why not just not be a dickhead? Lots of people manage it every day.

You do know where you're posting, right?

Re:It's The Law!

[shentino]

UPSs don't last forever. Typically they only give you 15 minutes of power. A sufficiently long blackout will take down even the biggest UPSs.

Re:It's The Law!

[Anonymous Coward]

Its a guaranteed fact that there are more dickheads than nice people in the world. Pretty sure the entire population of the US of A is proof enough of that.

Re:It's The Law!

[Simetrical]

I like the prescedent.

Cops: "We confiscated your external HDD, only it's encrypted. Give us your password."

SuspecT: "No."

Cops: "Passwords are property and thus you have to, as it's part of the HDD."

Suspect: "I claim 5th amendment rights."

Cops: "We have a Warrant for the seizure and search of this HDD, and you're blocking us from doing it. Therefore, you can rot in jail until you give up and give us what we want."

Um, yeah. IANAL, but this is called "obstruction of justice". If the police have a warrant that permits them to search your hard disk, and you try to prevent them, that's a crime. You can't be compelled to testify against yourself, but you have to permit the police to access your property if they have a legitimate warrant.

Re:It's The Law!

[Simetrical]

What if it's NOT encrypted, and that's just noise left over from stress testing the drive with random read-writes?

Then it's not going to look like it's encrypted. An encrypted hard disk will almost always have some clear identifying mark, like some cleartext code at the beginning which prints out "please enter passphrase:" when you try booting from it, and tries to decrypt the key using the passphrase.

Of course, you might not know the password. No way to be sure, but the jury doesn't need to be sure. It just needs to be beyond a reasonable doubt, and not even that in civil cases.

Re:It's The Law!

[Coren22]

At that point, you are then talking about generators, which effectively last forever. This is a government agency, not a small business. With the draw of a set of 3800 routers, 2 ASA 5800 routers 48 ports of PoE, 48 ports of Gigabit, our 5k UPS lasts an effective 2 hours. I hardly expect it to take that long to start up a generator, even if there are problems.

Re:It's The Law!

[_KiTA_]

What if it's NOT encrypted, and that's just noise left over from stress testing the drive with random read-writes? How exactly would justice be served by holding that guy in jail? Apologies if you were being sarcastic.

The point would be to hold him in jail. As we've seen with WikiLeaks, the US still fully believes in jailing political opponents. They'd let the WikiLeaks guy rot in jail for the rest of time -- assuming they didn't just kill him -- if they could.

Re:It's The Law!

[Deagol]

Fortunately, you are wrong. See this Cybercrime blog entry (written by a law professor) for the gory legal details. The meat and potatoes of the post:

The Supreme Court has held, basically, that you're giving testimony - testifying - when you're communicating, i.e., when you're revealing your knowledge of certain facts or sharing your thoughts or opinions with the government. U.S. v. Kirschner, supra. You can't claim the 5th Amendment privilege to refuse to surrender physical evidence such as your blood, hair or saliva; it only applies to communications, i.e., to something that look like what a witness does when she takes the stand at trial.

Re:It's The Law!

[Simetrical]

Fortunately, you are wrong. See this Cybercrime blog entry (written by a law professor) for the gory legal details. The meat and potatoes of the post:

The Supreme Court has held, basically, that you're giving testimony - testifying - when you're communicating, i.e., when you're revealing your knowledge of certain facts or sharing your thoughts or opinions with the government. U.S. v. Kirschner, supra. You can't claim the 5th Amendment privilege to refuse to surrender physical evidence such as your blood, hair or saliva; it only applies to communications, i.e., to something that look like what a witness does when she takes the stand at trial.

Okay, I looked up a bit on Google, and it seems like this is unclear. Some lawyers argue for each position, but there's been no decision on the matter above the district court level. United States v. Boucher is the only case so far on the matter: a magistrate judge ruled that disclosing the key did constitute self-incrimination, but a district judge overruled him and said it didn't. Text of the district court decision is here.

The reasoning was that the court was only demanding that he produce the contents of his laptop, not that he tell them any information. They wouldn't mind if he typed the password into the laptop himself rather than tell it to them. Since the government knew in advance that there were files on the computer that belonged to him – which they'd practically always know when confiscating your laptop and finding an encrypted drive – he's not admitting anything by giving them the passphrase. It's no different from if they demanded the key to a locked cabinet, which they're allowed to do.

But this interpretation isn't binding anywhere yet. The question is still up in the air.

Re:It's The Law!

[Deagol]

Boucher was unique in that he was compelled to reveal *again* what he already revealed to the border guards: the data on the encrypted drive. Since he already gave up the evidence once voluntarily, compelling him to give the means to show them the same evidence didn't qualify for 5th Amendment protection. I personally think this makes sense. Had he never consented to the border search, the case (if any) would have hinged on the very issue we're all interested in.

The Cybercrime link above elaborates a bit on U.S. v. Kirschner, which supports the assertion that divulging unknown passwords constitutes testimony which can qualify to be protected under the 5th.

The specific issue of passwords may be unclear, but I think that the generic question of testimony of unknown facts leading to unknown incriminating evidence is pretty straight forward. It would be nice to see the SCOTUS address this issue once and for all, but I'm thinking it will take a while before this happens.

Not sure why you mentioned typing the password vs reciting it, but the same blog had an interesting article about how typing a cellphone password was ruled to have the same protections under Miranda as verbal testimony. I love that blog; it makes for some very interesting reading.

Re:It's The Law!

[_KiTA_]

I like the prescedent.

Cops: "We confiscated your external HDD, only it's encrypted. Give us your password."

SuspecT: "No."

Cops: "Passwords are property and thus you have to, as it's part of the HDD."

Suspect: "I claim 5th amendment rights."

Cops: "We have a Warrant for the seizure and search of this HDD, and you're blocking us from doing it. Therefore, you can rot in jail until you give up and give us what we want."

Um, yeah. IANAL, but this is called "obstruction of justice". If the police have a warrant that permits them to search your hard disk, and you try to prevent them, that's a crime. You can't be compelled to testify against yourself, but you have to permit the police to access your property if they have a legitimate warrant.

Yes, and that's the prescedent. Is it "You have to give us the password, as it's part of the property we have seized" or is it "You can claim 5th amendment rights since it's testifying against yourself." ?

The Court "then ran out of time"?

[Anonymous Coward]

Huh? Is the Judge an hourly worker? Did (s)he have to punch a timecard? What am I missing here?

Re:The Court "then ran out of time"?

[Revotron]

When you've got more pressing legal matters to preside over other than some self-righteous dickhead with a God-complex locking a whole city out of their own network, you will quickly find that you're running out of time.

The legal system is overloaded enough as-is. Just because His Holiness the Network Administrator doesn't want to go to federal PMITA prison is no good reason to cram more stupid shit into our crowded legal system.

Re:The Court "then ran out of time"?

[sed quid in infernos]

Schedules in some courts can be pretty inflexible when transport of a prisoner is involved.

Re:The Court "then ran out of time"?

[Anonymous Coward]

The judge isn't the only person in a courtroom, and the other people are generally hourly workers, yes.

Re:The Court "then ran out of time"?

[meow27]

"self-righteous dickhead with a God-complex "

please explain why the mayor of the city was the [one of the] only person he was willing to password/key to?

Re:The Court "then ran out of time"?

[Revotron]

What does the mayor have to do with Childs and his God complex? Your question makes no sense.

Re:The Court "then ran out of time"?

[Mr. Freeman]

Even salaried workers like to leave at 5:00 PM. I mean, let's say you aren't paid hourly, would you like to pull an all-nighter for something that can wait until next week?

Re:The Court "then ran out of time"?

[droopus]

Happens all the time. There are very fixed time allowances on appeals. For example, if you plead or are found guilty in federal court, you have ten days to file an appeal, or at least preserve your right to appeal. If you do not file within that ten days (even if you tell your lawyer to do so and he does not) you effectively waive your right to appeal. You may collaterally attack but collateral attacks are civil actions and you are no longer entitled to counsel.

Think that's unfair? There are cases that would blow your minds. How about a death row inmate who filed his pro se appeal late, and was denied appeal of his death sentence. He finally got heard in the US Supreme Court but Scalia and Thomas dissented, saying "too late, too bad, so sad.."

Time limit injustice is way too common, (and tolling is not often granted) but this injustice is not often discussed, because as I often say, citizens in the US know NOTHING about the system that can suck them in at a moment's notice.

Re:The Court "then ran out of time"?

[Anonymous Cowpat]

you effectively waive your right to appeal.

If you can't re-assert it at any time, it's not a right. (The conclusion, from the information that you give, is that you therefore don't really have a right to appeal.)

Re:The Court "then ran out of time"?

[droopus]

you effectively waive your right to appeal.

If you can't re-assert it at any time, it's not a right. (The conclusion, from the information that you give, is that you therefore don't really have a right to appeal.)

You raise a very interesting point, with which I heartily agree. The US justice system is neither fair nor equitable. Here is Scalia's dissent in Holland where he quites statutes and time limits, and as the final arbiter of the law, gets to decide what "rights" we have or not.

Re:The Court "then ran out of time"?

[dbIII]

Because the Mayor decided to turn up at the prison with his publicity advisor instead of anyone else employed by the city. The bullshit floating around here insists that Terry Childs had the power to choose who he would see instead of the reality of him being locked in a cell until somebody came to visit.
A petty press event designed to make the Mayor look like a "peacemaker" was yet another nail in his coffin.
The only lesson we get from this case is that it's better to quietly resign like one of Terry Child's co-workers did instead of arguing with weasels.

Re:The Court "then ran out of time"?

[Anonymous Coward]

How about a death row inmate who filed his pro se appeal late, and was denied appeal of his death sentence. He finally got heard in the US Supreme Court but Scalia and Thomas dissented, saying "too late, too bad, so sad.."

As you're well aware, Holland v Florida was a 7-2 ruling in favor of the defendant. That is the same margin as Roe v Wade which is still here 37 years later despite massive opposition to it. Just because two judges dissented doesn't mean the whole justice system is broken.

Re:The Court "then ran out of time"?

[droopus]

I don't usually reply to ACs, but...

I know Holland went for the defendant, and said as much, but two justices supported him being executed because he filed his paperwork late. Charming.

And I didn't suggest that statutory limits were the reason the justice system is broken...I KNOW it's broken because I just came through it. We have the largest prison population in the world and the highest per capita incarcerated population. So, what...we're a nation of criminals?

Lastly, there is no "massive opposition" to RvW. Only the fringe loonies want to criminalize abortion. Google away but here's one example:

http://www.pollingnumbers.com/poll-of-polls/roe-versus-wade.html

or

http://www.fivethirtyeight.com/2009/05/cnn-poll-record-support-for-roe-v-wade.html

The issue is dead, stare decisis after almost 40 years is a no brainer.

Re:The Court "then ran out of time"?

[tarp]

Everyone knows Scalia and Thomas are both lunatics who almost always vote against the fair and just outcome.

Re:The Court "then ran out of time"?

[Anonymous Cowpat]

it's somewhat terrifying that one person can rule in a manner so blatantly contrary to the interests of justice, and it be the final word on the subject (though, thankfully, he was dissenting here).

Actually, it's equally worrying that Appeals can be denied (especially in capital cases) on any basis other than lack of merit, or that a court will refuse to accept submissions from someone being represented by an attorney when the submission is a request to get rid of said attorney.

Miscarriage of Justice

[DarkKnightRadick]

Guy does his job even AFTER he's fired and he goes to prison for it? Ugh.

Sure he had a god-complex, but then again he designed the system from the ground up and was tasked with making it secure. I'd say he went above and beyond the call of duty. This is a notice to network admins that your bosses don't want security or good workers. They want "Yes!" men.

Re:Miscarriage of Justice

[MarkvW]

"He does his job AFTER he's fired?" HUH?!?!

When you're fired, your job is OVER. Your right to exercise control over the City's stuff is DONE.

Terry Childs is a stupid, neurotic fool. But there's no indication that he's a thief or a scumbag. He's been punished way more than enough by now. I hope the judge gives him credit for time served and ends this.

Re:Miscarriage of Justice

[Anonymous Coward]

Of course they want Yes men. Anything else is a Hollywood fairy tale. To be successful in real life, always say Yes, and stab the boss in the back when you're sure you won't get caught. This is how fortunes are made.

Re:Miscarriage of Justice

[Anonymous Coward]

You're full of shit. Nothing in his job description gave him permission to not cooperate with his supervisors in performance of his job.

And doing a job after b

Re:Miscarriage of Justice

[dougmc]

"He does his job AFTER he's fired?" HUH?!?!

When you're fired, your job is OVER.

... then you are no longer under any obligation to provide passwords or anything else related to your previous job whatsoever.

You can't have it both ways. Was his job OVER or not?

Re:Miscarriage of Justice

[sexconker]

Said passwords were company property he was holding on to.

Re:Miscarriage of Justice

[Anonymous Coward]

His job wasn't over at first. He was told that he was being reassigned and should hand over the password. After he refused to do that he was told to create new administrator accounts for the people taking over. It was only after refusing to do that and trying to leave the state that he was arrested and lost his job.

Re:Miscarriage of Justice

[Anonymous Coward]

Actually he was a thief. The report indicated he had harvested hundreds of passwords for various city employees. They were found on his home equipment.

The guy was an scumbag, and made the entire industry look bad.

Re:Miscarriage of Justice

[countertrolling]

Stupid and neurotic... Well there you go.. diminished capacity... Worked for Dan White. He got away with murder

Re:Miscarriage of Justice

[Dhalka226]

Sorry, but that's retarded. It's like saying you don't have to return a company laptop when you're fired if they forget to take it from your office before they throw you out of the building.

Just because your job is over doesn't mean you are allowed to hold on to things that do not belong to you. These aren't his passwords and it's not his network. It never was, despite what he obviously thinks in his little mind, but it certainly isn't anymore.

Re:Miscarriage of Justice

[Anonymous Coward]

The city (or more specifically, the department he served in) should have had a plan to prevent this from occurring. We was terminated for insubordination (for not turning over the passwords or creating the new accounts), at that point, he was essentially "dead" to his employers and it should have been handled as if he had died while still employed. Would they have brought criminal charges against a dead man if no one knew the passwords? Of course not.

Terry Childs may be an asshole, but last time I checked, that wasn't a crime.

Re:Miscarriage of Justice

[Mistlefoot]

In a black and white world maybe.

But both you and OP are being silly.

When your job is over that does not mean that legal obligations end.

I suppose my boss could invite me out for lunch, fire me, and then keep my car, which is parked on company property and accessible via a locked gate with a keycard. My keycard would no longer work, and he'd be under no obligation to do anything for me, a non-employee. Heck, my iPod in my desk drawer. Gone.

The law is rarely black and white and this case is no exception.

Child's went to lenghts to ensure that no one else had the passwords and to ensure that only HE could access the networks. Read some of the juror comments from the trial. This was not a black and white case.

Re:Miscarriage of Justice

[Kozar_The_Malignant]

>Terry Childs is a stupid, neurotic fool. But there's no indication that he's a thief or a scumbag. He's been punished way more than enough by now. I hope the judge gives him credit for time served and ends this.

He probably could have cut a deal for time served, if he wanted to at any time. However, he has now seriously pissed off the judge, the prosecutors, and probably the folks writing the pre-sentencing probation report. Not a good percentage play.

Re:Miscarriage of Justice

[AK Marc]

No, it's like saying you don't have to spend your own time documenting everything you did while there. They asked him to work after they fired him, then arrested him for not working for free after being fired. Writing down information is work. Returning a laptop to someone that shows up and asks for it isn't work.

Re:Miscarriage of Justice

[Kozar_The_Malignant]

>Guy does his job even AFTER he's fired and he goes to prison for it? Ugh.

If I fire my network administrator, and he tries to do anything to or with my network after that, he is a criminal, and hell yes he deserves to go to jail. I want his keys, his ID badge, his company laptop, cell phone, etc., and every password to everything; all of which will be changed immediately. If that isn't SOP where you work, you have problems.

Re:Miscarriage of Justice

[Anonymous Coward]

as long as he's going to be held accountable for his supervisor's behavior concerning those passwords (ie his boss fucks shit up), then yes, it did. It has to.. You can't hold someone accountable for something he has no power to control...in this case, his boss behavior.

Re:Miscarriage of Justice

[mysidia]

When you're fired, your job is OVER. Your right to exercise control over the City's stuff is DONE.

And so is your obligation to do any work.

Writing down or telling people lists of passwords is work.

Re:Miscarriage of Justice

[mysidia]

The passwords MIGHT be company property.

But someone who doesn't work for you has no obligation to do recovery work for you to get you back into possession of property, on your behalf.

I suppose you would think if he used biometric access controls, that his fingerprints and possibly his fingers became company property.

Re:Miscarriage of Justice

[deek]

This is a notice to network admins that your bosses don't want security or good workers. They want "Yes!" men.

They also want workers that will give access to authorised personnel. Terry didn't do that. Withholding his password is fine, but he also refused to give admin access to people he _knew_ were authorised for it.

I once had a co-worker that disabled admin rights for me (and some others) to the network switches and routers at work. He wanted to lock it down just to people that maintained it (his justification), although I learnt that he had given access to his clique, which included people that were certainly not responsible for network maintenance. Anyway, this prevented me from debugging issues that were handed to me to solve. I tried dealing with him directly, but he was frustratingly obstinate, dismissing out of hand any argument that I gave for my access. I eventually had to ask management to talk with him. Access was grudgingly given back to me.

Thankfully, the guy has now left the company. He caused me enough grief. If he had been like Terry Childs though, it would have been worse.

Re:Miscarriage of Justice

[mysidia]

Sorry, but that's retarded. It's like saying you don't have to return a company laptop when you're fired if they forget to take it from your office before they throw you out of the building.

Well, you can't keep the laptop, but that's because it is actually a possession that belongs to the person who purchased it, and it's not part of your body like your brain and facts in your brain are.

You won't be legally required to come to their office, and scan your thumb with the laptop to unlock it, or allow your finger to be removed for their use, if you had a biometric lock on the laptop.

If the laptop was passworded and protected with TrueCrypt, you don't have to go through the extra effort of informing the former employer of all the passwords and providing all decryption keys when you return it, unless you signed an agreement that you would do so.

You don't have an obligation to take the laptop and transport it back to your employer's office, if they had authorized you to leave it at home when you were employed; you can call and tell them to come and pick it up, and you can turn it over to law enforcement as abandoned property if they fail to come pick up their property after notification.

If the laptop was broken, even if you accidentally broke it or mistreated it when you were employed, repair will be their responsibility, unless there is an agreement to the contrary

Re:Miscarriage of Justice

[painandgreed]

Guy does his job even AFTER he's fired and he goes to prison for it? Ugh.

Nope. Wasn't his job anymore. Before he was fired he was reassigned to a different job. He was still employed by his job responsibilities no longer included maintaining that equipment. He was introduced to the new person that had that job and asked to give over the passwords. He didn't. It turned out he had booby trapped all the equipment so that only he could make any changes or repair the equipment if it lost power. Still, they were working with him to turn over the passwords to the new guy which he refused to do. The city was setting up another meeting to discuss this even when he decided to withdraw lots of cash and make signals that he was fleeing the country. That's when fed agents decided to arrest him. That's when he was fired. Only then did he say he would turn over the passwords to the mayor when he previously refused to turn them over to anybody because he was playing the "You can't fire me because I have all the passwords." routine a little to hardball. This was not a case of a worried system admin, it was a case of extortion. Perhaps a case of extortion because he is a paranoid nutcase rather than money, but still extortion.

Still, all of that is IIRC. Go back and look at the replies by one of the jurors here on /. who answered everybody's questions about the case and their decision and decide for yourself.

Re:Miscarriage of Justice

[Anonymous Coward]

They asked him to work after they fired him, then arrested him for not working for free after being fired.

No, they didn't. He was arrested because:
1) He refused to either provide passwords or create new accounts for the people taking over after he had been told he was being reassigned.
2) He hadn't submitted his passwords to a central repository, as required by the policies.
3) Had set up the equipment in such a way that recovery wouldn't be easy, like configuration files only being kept in RAM.
4) Tried to leave the state.

At that point he hadn't been fired yet. He had been told that he was being reassigned and had been put on leave after he refused to cooperate.

Childs had plenty of opportunity to get out of this. While it's certainly debatable whether or not he had malicious intent, I can't see how after the trial ended and all that information came out people still believe he was completely right or was put into a Catch-22 like situation that got him arrested, like you seem to believe.

Re:Miscarriage of Justice

[mysidia]

I suppose my boss could invite me out for lunch, fire me, and then keep my car, which is parked on company property and accessible via a locked gate with a keycard. My keycard would no longer work, and he'd be under no obligation to do anything for me, a non-employee. Heck, my iPod in my desk drawer. Gone.

He absolutely could do all these things, and none of them would be criminal.

You could have to go write legal demand letters, and possibly to court to take civil action for getting an order to compel the employer to release your property to you.

In reality he will probably come back in a few hours with police officers who will order your security folks to let them in, to allow him to confiscate his own property, and direct you to take it up as a civil matter if you object to him retrieving his iPod from the desk.

Re:Miscarriage of Justice

[Anonymous Coward]

You are correct, just like company equipment, he shouldn't use the passwords after leaving a job. Is that really what the case was about?

Re:Miscarriage of Justice

[sexconker]

When terminated, he has to rescind said property.
Biometric systems would simply need to be reconfigured on the last day of employment.

Refusal to do so is criminal.

It's no different than being told to "clean our your desk by Tuesday", and then locking the keys to your desk inside the desk.

He is criminally at fault and he is liable to pay to fix it. The fact that he was given the option to fix it himself (relinquish the passwords) has no legal bearing. He was actually given a break by his employees (as he would have been financially broken if he had been forced to cover the costs of having it "fixed" by a third party).

Let's try a car analogy.
You take your car into the dealer to have it serviced.
You don't like the work they do because it's taking to long, they're increasing the estimate, etc. and you decide to take the car somewhere else.
You go to pick up your car and the dealership thinks you're a jerk.
They lock the keys in the car and tell you to fuck off.

Re:Miscarriage of Justice

[Cramer]

They asked him to work after they fired him...

Nope. He was arrested for failing to return City property -- namely the password(s), but in searching his house, he still had other City property. (the facts are far more complicated than we'll ever know.) Had he simply turned over the password(s) (in person, in writing) upon termination, there'd be no story. Instead, he was an ass and refused to give the password(s) to any of his "idiot" (former) coworkers/bosses. To be fair, his boss(es) do share some of the blame for letting things get like this to begin with.

Re:Miscarriage of Justice

[PinkyGigglebrain]

Your job may be over but you are still bound by the NDA you signed and if said NDA states "Tho shall not give out the password to those not authorized to have it." and your contract said only the Mayor is authorized to ask for the password your kind of stuck.

That, or something like it, was what I heard was the case with Childs. Whether it is accurate I don't know, and I don't care. I lost any real interest in this case long ago.

Re:Miscarriage of Justice

[dbIII]

Wow, how did the above poster manage to get so many things wrong?

There were many articles on this case, I suggest reading one of them and ignore the extra "spin" (eg. "He was introduced to the new person that had that job" WTF did that come from?) put on by the above poster for some unknown reason. Painandgreed - why are you going on about things being "booby trapped" when the reality was just settings in memory, why lie about such things? Is there some sysadmin you hate and you want to project an idealised monster based on Terry Childs on them?
This was a case full of many WTF from start to finish - for example the Mayor didn't turn up becuase he was the only one that could solve the problem, he turned up because it made him look like some kind of diplomatic hero. Nobody can find the quote "I'll only give it to the Mayor" becuase I'll bet he never said it, but we all fell for such bullshit becuase we grew up watching Batman on TV.
I'm hoping some decent journalist shovels through all this bullshit and writes a decent book on the case, it's likely to be interesting.

Re:Miscarriage of Justice

[painandgreed]

Wow, how did the above poster manage to get so many things wrong?

I read /.

Re:Miscarriage of Justice

[ncohafmuta]

in your analogy I assume you actually own the car, i.e. have the title.
I wonder if you leased it, if the dealer is under the same obligation, since they own the car. Granted, you might be able to sue them for breach of contract, depending on the wording of said contract.
Similarly if you had a loan with the bank for the car, would the dealer be legally required to only release the keys to the bank?

Re:Miscarriage of Justice

[AK Marc]

Nope. He was arrested for failing to return City property -- namely the password(s),

If he had them written on paper that belonged to the city, they yes. But if he just has them in his mind (or even written on paper owned by him) then they are not city property. To claim some knowledge learned by an employee while on the clock is "property" and must be extracted at the expense of the former employee is to assert slavery is legal.

I don't care who was or wasn't an ass. I care whether you are required by law to work for free after being fired, and whether you are required to submit knowledge learned on the job to the former employee at your time and expense.

Re:Miscarriage of Justice

[Cramer]

You are completely, 100%, WRONG. Passwords are not simply "knowledge"; they are virtual keys. And since he heald the only key, it is not unreasonable for him to provide it. Writing down a password is not work. By that definition, the paperwork one signs in the process of termination is "work"; cleaning out your desk is "work"; pushing an elevator button is "work".

I strongly advise you talk to your lawyer before clinging to such nonsense and ending up in prison along side Childs.

Re:Miscarriage of Justice

[Ceseuron]

... then you are no longer under any obligation to provide passwords or anything else related to your previous job whatsoever.

You can't have it both ways. Was his job OVER or not?

Your assessment is incorrect. You're implying a second option where none exists. Unless the terms of hiring Terry Childs consisted of a complete transfer of ownership of the entire network from the City of San Francisco to Terry Childs himself, he had zero right to withhold any account credentials, both during his employment tenure and after his job was terminated. He also had no right to go through their network and booby trap the systems so only he could gain administrative access to them, rendering the entire system useless to anyone who might be filling his position in the future.

I work in IT for a mid-sized business involved in healthcare. Security is my top priority as it relates to our network and infrastructure and I stringently control who has access to what. However, if the person who signs my paycheck comes to me and informs me of a shift in my responsibilities away from the network or is terminating my position and demands that I hand over security credentials so the person coming in after me can do the job, I'll hand it over. I'll ask politely to be given a written request to cover my own ass before turning any information over, a reasonable request that any employer would probably willingly fulfill, be they government or not. But I don't have the right to go out of my way to sabotage the infrastructure to prevent future IT administrators from doing their job, even if I'm being terminated.

Re:Miscarriage of Justice

[Anonymous Coward]

Terry Childs may be an asshole, but last time I checked, that wasn't a crime.

No, but denial of service is. And he did that.

Re:Miscarriage of Justice

[AK Marc]

they are virtual keys.

How do you return them, then? You can't. You can share the information that is the virtual key, but they are all still nothing other than information.

And since he heald the only key, it is not unreasonable for him to provide it.

Irrelevant. Whether it's "reasonable" or "unreasonable" for him to do so is unrelated to whether he should be forced by law to do so. I guess that's the issue here. People think asses should go to jail for being an ass. "He got what he deserved." That's why all the obscenity cases are trialed against the most horrible, so that people push for a bad application of the law for a precedent, rather than letting that one guy go and adjusting the law after.

Writing down a password is not work.

Then what is it? It may be trivial work, but it is work none the less. It's creating documentation. I've made lots of documentation in my time, and my bosses and me both considered it work. So, what do you consider the creation of documentation to be?

By that definition, the paperwork one signs in the process of termination is "work"; cleaning out your desk is "work"; pushing an elevator button is "work".

Yes, No, and No. The process of termination is still part of the work. You aren't terminated until that's done, and it's work until the last signature. Cleaning out your desk isn't work. You can walk away without guys with guns running after you and holding you against your will. At worst, they'll take the cleaning of your office out of your last pay check. And pressing the elevator button isn't in any way required as part of the job duties (assuming you aren't an elevator operator) and is not related to any useful output by you for the company.

That you can't understand this shows you've chosen "sides" in this case and you are manipulating reality to fit your preferences. When you employer calls you up and says "I want this done and on my desk in the morning" it is work. When your employer calls you up and says "have a good weekend" going to the beach that weekend isn't work. Everyone else on the planet gets it but you. They demanded work after he was fired, and he was arrested for not doing the work under the terms they asserted. I don't care how much of a paranoid ass he is. I'm only concerned that after this case is done, there will be a clear precedent that failing to work for free after being fired can get you thrown in jail.

Re:Miscarriage of Justice

[dbIII]

Some of that stuff definitely came from somewhere else. I'd say your own imagination.
So who is that person that was given Terry Child's job before he left, when did he meet him and what was the name of that imaginary person's imaginary dog?
Stirring up trouble may be fun but it's quite childish.

Re:Miscarriage of Justice

[Anonymous Coward]

He was told that he was being reassigned and should hand over the password to someone who did not have authorization to have it.

FTFY.

Re:Miscarriage of Justice

[Anonymous Coward]

You are still entitled to the retrieval of your property... hate to break it to you. They are not entitled to free labor. If they wanted him to write the password down they needed to have that in a policy somewhere / job description / clearly laid backup plans in the event of death / job loss / change etc.

Re:Miscarriage of Justice

[westlake]

He's been punished way more than enough by now. I hope the judge gives him credit for time served and ends this.

It's not that simple:

Jackson ruled Friday that under a new California law that went into effect this year, Childs would receive fewer jail credits because he has prior felony convictions for robbery and burglary. Judge Delays Sentencing For SF City Tech Worker

No matter how old it is, a felony conviction tends to stick like glue. It surprises me a little that Childs is being cut any slack at all.

Re:Miscarriage of Justice

[fredklein]

Withholding his password is fine, but he also refused to give admin access to people he _knew_ were authorised for it.

Cite? The way I heard it, he was asked on a phone call [strike 1: "Giving your password over the phone to ANYONE."] by his superior [strike two: "Telling your boss your password"] to hand over the passwords. Did I mention this was a conference call with god knows who else listening? [strike 3: "Talking about a password in front of others".]

Those 'strikes' are from here: http://www.sfgov.org/site/uploadedfiles/dtis/coit/Policies_Forms/CCISDA_security.pdf , "California Counties “Best Policies” for the Countywide Information Security Program".

Re:Miscarriage of Justice

[DarkKnightRadick]

Yep. He had the passwords to the network and his job duties said that in the event of termination he was only to turn it over to his boss (which was the City of San Francisco, and in a person the Mayor, even though he is completely illiterate too from what I heard). Since he refused to turn it over to people who were in fact not nearly as qualified as him (but apparently played politics very well), this is how the whole fiasco started. I read about it on some news site but don't have a link handy at the moment, sorry. Google is your friend though.

Re:Miscarriage of Justice

[DarkKnightRadick]

No he didn't. While he still had the passwords, the network never went down and was completely usable.

Re:Miscarriage of Justice

[Cramer]

That you can't understand this shows you've chosen "sides"...

Yes, but not the side you think. I do not think Childs deserves to go to prison. But the law is the law. Just because you or I don't like it doesn't make them disappear. As I've said repeatedly, this situation should never have existed in the first place, but due to weak and ineffective management, Childs' ego was allowed to run free. (if he goes to jail, then management deserves to go with him. except that he's the only one who's broken any actual laws.)

What you are unable to get through your thick skull is that the passwords are company property; he refused to return this property (and apparently other documents and data), and in so doing, held the network hostage. Your payroll status does not matter when it comes to returning what is not yours to keep. Ownership applies to information as much as it does physical property. A company asset is still a company asset, even if it's copied to your hard drive in your laptop, carried into your home, and printed to your printer using your ink, your paper, and your electricity. When you are no longer employed by that company, you are required to return their assets -- in this case, delete the file from your hard drive (and make no attempts to recover it), and either return or destroy the printout.

Prior to being fired, he was ordered to hand over the password(s). He refused. He was ordered to setup accounts for others to access the systems. Again, he didn't. So they fired him -- "insubordination". He continued refusing to hand over the password(s) -- failing to return any and all company property, effectively holding the network for ransom. Any sane person could see where this was headed. Childs obviously wasn't one of them.

He was trying to extort his job back. He wasn't being malicious. He genuinely thought he was protecting the network, and that he'd get his job back when they came to their senses.

This is not a precedent for locking up sysadmins. It's a cautionary tale to remind everyone to not let this BS happen in the first place.

Re:Miscarriage of Justice

[Anonymous Coward]

In a black and white world maybe.

But both you and OP are being silly.

When your job is over that does not mean that legal obligations end.

I suppose my boss could invite me out for lunch, fire me, and then keep my car, which is parked on company property and accessible via a locked gate with a keycard. My keycard would no longer work, and he'd be under no obligation to do anything for me, a non-employee. Heck, my iPod in my desk drawer. Gone.

You suppose incorrectly; that's theft. You're being sillier than you claim the parent/OP to be.
Get over yourself.

The law is rarely black and white and this case is no exception.

In the details you presented, there's established case law. Go look it up. I'm not bothering.

Re:Miscarriage of Justice

[AK Marc]

Passwords are ideas. They are not property. From my understanding, there was never a charge of "theft" of the passwords, but "network tampering" because he allegedly accessed the network after he was fired (though that charge requires some damage, and there was no damage done). You are talking about who broke the law. Read the law he was charged with breaking. Tell me whether you think he broke it.

As a separate exercise, tell me what passwords have to do with the law that he was convicted of breaking. If you want this to be about "he's the only one who's broken any actual laws" then address your unfounded statements about passwords in the context of the law he was convicted of breaking and tell me if it has anything to do with passwords.

Re:Miscarriage of Justice

[Goeland86]

Technically, unless specifically stated in the contract, the company can't sue you for "locking the keys to your desk inside your desk".
The company would then spend several hundreds of dollars on a locksmith to force open and re-key the desk, but in no case is that grounds for a trial.
He didn't take the devices with him, he simply left them in a state that was otherwise unuseable. If the city wasn't smart enough to hire someone who could force their way into the devices to re-image them with a configuration of their choosing, that should have no impact on Terry Childs. He did not steal company (or in fact, government) property. He never did. He simply left devices in a secure state, arguing against reason that nobody knew well enough to handle the systems. A bit paranoid, and overly concerned with his job to be sure, but hardly a case to bring him before court. If his manager had been the slightest bit resourceful, he'd have found someone who could re-image those devices, wiping all previous data on them.
I'm assuming it's not that hard to do when you own the damn things and have full vendor support behind you!

Re:Miscarriage of Justice

[91degrees]

And this is the sort of rigid, inflexible thinking that got him into trouble.

They have a right to access their network. He does not. Thus both have an obligation to take reasonable steps to ensure that they can access the network and that he cannot. Providing the passwords is reasonable. Providing fingers is not.

Re:Miscarriage of Justice

[91degrees]

They got upset with me for doing my job after I was fired as well.

Now, I was an executioner for the State of Texas, but I don't see how that makes a difference.

Re:Miscarriage of Justice

[VenomPhallus]

That's far too simplistic. Contracts of employment aren't just active from the first->last day of employment. There are plenty of responsibilities and contractually enforceable duties that survive the end of a job. NDAs would be an obvious one. Non-compete or solicitation clauses would be two more.

I suspect you'd take a different view if your previous employer withheld your final pay cheque saying that all obligations between you had ceased the moment you walked out the door.

Re:Miscarriage of Justice

[shentino]

I fancy though that if he DID turn the passwords over to an unauthorized person they'd have turned around and nailed him for that anyway.

What Terry Childs should have done was *mailed* the password to the mayor.

Re:Miscarriage of Justice

[shentino]

*whoosh*

Re:Miscarriage of Justice

[shentino]

It surprises me more that they even hired the guy in the first place if he had a felony rap sheet.

Re:Miscarriage of Justice

[Cramer]

His idea of "authorized" was a bit screwy at best. I seriously doubt the City would've cared one bit about him once they had control of there network -- after all, any sane organization would change that password as soon as possible. (and audit everything to make sure he doesn't have any backdoors.) Granted, a sane org would never have gotten into this mess to begin with.

Re:Miscarriage of Justice

[Anonymous Coward]

It was work he was obligated to do earlier, but failed to do.

Re:Miscarriage of Justice

[metacell]

I seriously suspect you are trolling, sexconker, but let's analyse your statement just for the fun of it.

Knowledge is not property. There is no no law in the world which claims that the knowledge of something belongs to someone. Even the most draconian "intellectual property" laws in the world do not claim that it is illegal to, for example, tell the ending of a novel to your friend. "Copyright" is just what it sounds like: the exclusive right to manufacture copies of something. That right is the only thing you own when you own the copyright. You don't own the novel in itself. You don't own the information in it.

There are instances in which it is illegal to spread knowledge, for example, exposing military secrets, but that is not because the military "owns" the information. It is illegal because the information is classified and disseminating it would damage the country, regardless of who could be said to "own" it.

They lock the keys in the car and tell you to fuck off.

In my jurisdiction, this is not theft, because the car dealer does not appropriate the car for himself. However, it could still be illegal, on the grounds that the car dealer handles your property without your consent in a way which interferes with your own use of it.

However, information is not property, and having a secret password in your head doesn't mean you have your employer's property in your possession. Refusing to tell your employer the password is not legally equivalent to refusing to return the employer's property. It could be illegal to not tell the password, if the employer is legally obligated to be loyal to his employer or to follow its orders. It could also be breach of contract if he signed an employment agreement.

Re:Miscarriage of Justice

[metacell]

I agree that any person with some sense in their heads would try to cooperate with their employer. I'm not sure there is any legal obligation to turn over passwords, though. It depends on how the law is written in your country or state.

Re:Miscarriage of Justice

[metacell]

The flaw in that thinking lies in equating knowledge with property. There is an obligation to return property which has been placed in your care, because property normally has a specific owner, but there is in general no legal obligation to "return" secrets which has been entrusted upon you.

Of course, any sensible person would take reasonable steps to aid his employer in regaining control of the network, regardless of any legal obligation.

Re:Miscarriage of Justice

[Anonymous Coward]

Look at the last Slashdot story about Childs where one of the jurors reported the details on the case. Childs had processed requests from authorized people before, but after he had been told he was being reassigned he decided that the same people weren't authorized to make such requests anymore, which was one of the main points that led to his conviction.

Childs also didn't all of the best policies you linked:
"All production system-level passwords must be part of the security administered global password management database."

Had he done that there would have been no problem.

Re:Miscarriage of Justice

[metacell]

I suppose my boss could invite me out for lunch, fire me, and then keep my car, which is parked on company property and accessible via a locked gate with a keycard. My keycard would no longer work, and he'd be under no obligation to do anything for me, a non-employee. Heck, my iPod in my desk drawer. Gone.

No, your car and your iPod is physical property, and he would have to give you access to them in some way. However, if you stored personal information in your work computer with your employer's permission (like personal correspondence), I'm not sure the employer would be obligated to extract the information for you.

Re:Miscarriage of Justice

[metacell]

He also had no right to go through their network and booby trap the systems so only he could gain administrative access to them, rendering the entire system useless to anyone who might be filling his position in the future.

Eh, it IS a sysadmin's job to make sure nobody can take over the network without the proper passwords. It is conceivable that he was overly paranoid when configuring the network, or that he was planning to blackmail the city of New York all along, but so far I've seen no evidence of this.

However, if the person who signs my paycheck comes to me and informs me of a shift in my responsibilities away from the network or is terminating my position and demands that I hand over security credentials so the person coming in after me can do the job, I'll hand it over.

You seem to have missed that Childs' had been instructed, in writing, to only hand over the passwords to authorised staff. If he had revealed the passwords to his closest superior (who was unauthorised), and the employer had been a dickhead, they could have charged Childs' with negligence.

On the other hand, it is quite possible that Childs' was being a dickhead himself and that the whole problem could have been avoided if he had been more flexible. But if we're going to condemn him, let's do it for the right reasons.

Re:Miscarriage of Justice

[metacell]

Keeping someone in prison is expensive, so giving someone a longer sentence just because they're a dickhead and offend the judge or jurors is irresponsible against the taxpayers.

Re:Miscarriage of Justice

[AK Marc]

Then they should sue him for renumeration for the value of the lost work or the piece of lost work they thought they were owed. Not that he shouldn't have done it, but it isn't a crime to goof off at work. And to regain the work that should have been done isn't a criminal matter.

Re:Miscarriage of Justice

[Anonymous Coward]

Some people recognise the difference between job and duty and will continue to consider their duty even after their job is terminated.

Childs probably isn't one of these - from what I've read its more of an ego issue with him - but there are some cases where I would still consider it my duty to uphold the principles of the job, after the job itself has been terminated - at the very least until someone has replaced me in my duty.

Re:Miscarriage of Justice

[jeff4747]

Cite? The way I heard it, he was asked on a phone call [strike 1: "Giving your password over the phone to ANYONE."] by his superior [strike two: "Telling your boss your password"] to hand over the passwords. Did I mention this was a conference call with god knows who else listening? [strike 3: "Talking about a password in front of others".]

Are you really trying to argue that root passwords and typical user passwords are treated the same? When there's only 1 admin account?

Look, Childs could have easily said "Call me direct afterwards, and I'll tell them to you" to avoid the evil conference call.

Or, even better, he could have created new admin accounts for the new administrators when his boss told him to, long before this conference call. Thus not requiring the disclosure of his passwords. But Childs didn't like that 'his baby' was being taken away from him and he refused to do his job, resulting in the effective theft of millions of dollars of SF's equipment.

Re:Miscarriage of Justice

[Anonymous Coward]

He was told that he was being reassigned and should hand over the password to someone who did not have authorization to have it.

FTFY.

Bullshit. He was asked to give it to the person who was taking over administering the network. If Terry Childs was authorized to have the password in the first place, then certainly the person taking over his role would have that authorization as well. But he didn't want to give it up, so he refused. Repeatedly. Then he tried to flee the country with not just the passwords but the only config backups.

And before you spout any more of the nonsense about "they didn't follow proper protocols for obtaining the passwords", know that just a few weeks prior to his refusing to give out the passwords, he put some other passwords in a plain-text email and sent it out to someone, and CCed the very same people who were at the meeting in which he refused to divulge passwords. Protocol had nothing to do with it. He'd happily email passwords out, just not the passwords to the system that he wanted to maintain control over.

Re:Miscarriage of Justice

[Anonymous Coward]

The network administrator (and fellow Slashdotter) who sat on the jury (and consequently knows a few more details of the case than you or I) disagrees with you:

The questions were, first, did the defendant know he caused a disruption or a denial of computer service. It was rather easy for us to answer, "Yes there was a denial of service." And that service was the ability to administer the routers and switches of the FiberWAN.

That was the first aspect of it, the second aspect was the denial to an authorized user. And for us that's what we really had to spend the most time on, defining who an authorized user was. Because that wasn't one of the definitions given to us.

...

Somebody has to get access, and he refused to provide that. So he's leaving this very critical network in the city's hands, but saying that nobody can maintain it.

Re:Miscarriage of Justice

[david_thornley]

The city did have a plan. Childs violated policy, and made sure nobody could administer the city network except him. That includes his lawful replacement.

Re:Miscarriage of Justice

[Anonymous Coward]

Keeping someone in prison is expensive, so giving someone a longer sentence just because they're a dickhead and offend the judge or jurors is irresponsible against the taxpayers.

Teaching him to stop being a dickhead is what we are paying for. It seems he doesn't want to learn this lesson, so he'll have to be kept away from society for a while. He's had plenty of chances to end this mess and refuses to take them.

Re:Miscarriage of Justice

[sexconker]

The passwords are property.
The passwords are not his property.
He was in possession of them beyond his employment.
That is theft.
Theft is a crime.
He is criminal.
He stood trial as a criminal.

Re:Miscarriage of Justice

[sexconker]

Information can indeed be property.

Especially when you're the sole physical holder of said information and said information is owned by someone else.

Dude is a criminal.
You are a retard.

Re:Miscarriage of Justice

[dougmc]

NDAs would be an obvious one. Non-compete or solicitation clauses would be two more.

OK, but if it's not in the contract, it's not there.

I don't recall any contracts that said I had to provide assistance with their networks after I was no longer employed.

Re:Miscarriage of Justice

[Anonymous Cowpat]

interestingly, it has been repeatedly explained, on the other side, that information is not property in the tradional sense. Neither side seems to be able to back up their assertions that a password is company property that must be 'returned' (or not).

In any case, returning company property is not as clear cut as you think. If you have a company laptop at home when you're fired, and after you've gone home your former employer wants it back, they have to get a posession order from a court. It's only in defying such an order, or actually attempting to claim the laptop for your own that you're stolen it.

In any case, this was not a question of giving back pseudo-property to the city. This was a case of whether refusing to give the password(s) to someone from the city who wanted them represented a denial of service for the purposes of a statute that was never enacted to deal with situations like this.

Personally, I think the best outcome is for him to get substantially less than time served, and leave the city holding the bag.

Re:Miscarriage of Justice

[Anonymous Coward]

He's saying that since nobody can maintain it, nobody gets to have a punt at it.

Re:Miscarriage of Justice

[Anonymous Coward]

Nobody can find the quote "I'll only give it to the Mayor" becuase I'll bet he never said it, but we all fell for such bullshit becuase we grew up watching Batman on TV.

On Monday afternoon, he handed the passwords over to Mayor Newsom, who was "the only person he felt he could trust," according to a declaration filed in court by his attorney, Erin Crane.

Re:Miscarriage of Justice

[dbIII]

Page not found from that link - how terribly convenient.
I've learnt another little nasty weasel trick to beware of and it's suprised me as to how low people go here just to win an argument. Just say anything you like put in a link to nowhere under a domain that looks like it is credible.

Re:Miscarriage of Justice

[metacell]

Prison will hardly make him less of a dickhead. Most likely, he'll be even more bitter and convinced he's been unfairly treated when he gets out.

Locking him away for life would stop him from causing trouble, but would be unjust and expensive.

Psychological counseling might help, but there's no guarantee.

In any case, giving him a harsher sentence just because he's a dickhead won't help anyone. Sometimes you have to accept that there is no solution, and doing nothing causes the least damage.

Re:Miscarriage of Justice

[metacell]

I can't think of any legal situation where that holds true. There are situations where an employee is legally obligated to assist their (former) employer, but that has nothing to do with "owning information".

Re:Miscarriage of Justice

[mysidia]

Also, in such situations.. the recourse is civil, and the employee can't be arrested for "refusing to assist", at least not until a court order has been made, the employee is aware of the court order, and chooses to disobey the order.

But in that case the employee is criminally liable for contempt of court, not "theft".

Re:Miscarriage of Justice

[sexconker]

This has nothing to do with being required to assist the employer. It's about returning the employer's property.

Passwords are no different than physical keys, a company laptop, or a company car.

There's a reason the dude is in jail.
And you can huff and puff all you want, but you're wrong.

W R O N G .

Re:Miscarriage of Justice

[mysidia]

. Thus both have an obligation to take reasonable steps to ensure that they can access the network and that he cannot. Providing the passwords is reasonable. Providing fingers is not.

I agree that he has an obligation, but that it is a contractual obligation or fiduciary duty due to the employer-employee relationship.

There is no law on the books stating that an employee must divulge any password or security code to their employer immediately when asked, and listing a criminal penalty for failing.

That is, I am saying this is a civil obligation. The recourse against someone who fails to perform obligations or fulfill civil duties (such as doing what they agreed to do as part of an employment agreement policy or contract, OR... retaining information they agreed to retain), is a suit in civil court.

The employer can go to a judge and get an order issued for the employee to hand over the password.

But until the employee sees that order, there should be no criminal charge involved.

Re:Miscarriage of Justice

[deek]

You want a citation? Sure, no problem.

This is a comment from a juror presiding over his trial. The juror makes a number of very interesting comments in that slashdot article. It's worth a read.

Re:Miscarriage of Justice

[Anonymous Coward]

You mean the comment where the juror says

"Management in the city's IT organization was terrible. There were no adopted security policies or procedures in place. This was a situation that management allowed to develop until it came to this unfortunate point. They did everything wrong that they possibly could have to create this situation."

Terry Childs tried to secure the systems under his control as best he could, in the face of a total clusterfuck created by management.

"We were not allowed to let our emotions or biases determine the matter, because if they could there may have been a different outcome. Quite simply, we followed the law. I personally, and many of the other juror, felt terrible coming to this verdict."

Jurors "not allowed" to use their feelings?
Jurors who "felt terrible" about getting him in trouble?
This is supposed to help your case?

"I'm sure many people posting are of the mindset that he's not guilty because he shouldn't reveal the passwords, some policy says this or that, or whatever. "

Rules, laws, codes of conduct: "Whatever". Nice attitude.

etc.

Re:Miscarriage of Justice

[deek]

There's nothing like that in the citation that I gave. I'm not saying that management were perfect; they were not. Neither was Terry.

According to what I've read, he was asked to give access to a user he knew was authorised. Terry did not do this. That, to me, is an arrogant action. I believe Terry felt like he owned the systems he managed, and he was loath to part with control over them. That was wrong of him. He is now paying the price for that, which I think is too harsh, but that's the law there.

Check the date?

[Anonymous Coward]

August 6, 2010 will be exactly 65 years after the first Atom Bomb was used in war.

Re:Check the date?

[Anonymous Coward]

August 6, 2010 will be exactly 65 years after the first Atom Bomb was used in war.

Are you trying to imply that Terry Childs kept the SF wifi network root password to prevent Gavin Newsom from nuking Japan again? And only on the day of his sentencing will Darth Gavin have the power to destroy the world?

It seems plausible enough. Gavin seems very unlikely to have plans for world domination, which of course means that they are no longer mere plans.

Passive Aggressive DoS

[Trip6]

A new kind of security threat? Needs a shrink to solve?

that is the high security mode that is used some t

[Joe The Dragon]

that is the high security mode that is used some times and they did not use this he just turned off the password recovery forcing you to do a full reset to get back in.

For those who haven't been watching...

[afabbro]

A couple summations:

• Article1
• Article 2 (the last page highlights his paranoia)

Let's see:

Terry Childs:

• God complex and delusions of grandeur
• Anger management
• Obsessive/possessive
• Paranoid
• General creepy behavior

City of San Fran

• Poorly managed IT by definition when only one person knows the passwords to your routers
• Budget cuts reduced IT to impossible support levels

So I recommend that Terry Childs be put to death just for being a jerk and to make sure non of us ever have to work with him again/interact with him again. Then we fire the City of San Fran CIO and forbid him from ever working in IT again.

(bangs gavel)

Re:For those who haven't been watching...

[AK Marc]

Given that they apparently were really out to get him, doesn't that mean he was rational, not paranoid?

Re:For those who haven't been watching...

[Cerium]

Even so, that still puts him at -4 or -5 on the bad-thing-o-meter.

Re:For those who haven't been watching...

[Anonymous Coward]

Depends if the paranoia continues to exist independently of the people "out to get him". In his case, the paranoia was there prior to the dispute, so no.

You're suggesting thoughts are property?

[Anonymous Coward]

Dangerous ground indeed. And I suppose you have a MiB flashy thing to erase his knowledge of the network too? After all that is company property...?

Re:You're suggesting thoughts are property?

[AnttiV]

Indeed. Most, he should've been under an NDA not to disclose those passwords to third parties but considering knowledge gained while working "property of the company" is very, very dangerous road to go on. Just think. You work for the FBI/CIA/KGB/SUPO and you quit, or are fired. All you know is "company property"? Do they shoot you?

Re:You're suggesting thoughts are property?

[Narcocide]

Do they shoot you?

Only if they can find you.

Re:You're suggesting thoughts are property?

[Anonymous Coward]

No, stupid, you're suggesting "thoughts" are property. Information is property. This was about information, not thoughts.

Now, back under your bridge.

SysAdminDay

[Anonymous Coward]

Was sentencing delayed because Friday was System Administrator Appreciation Day?

Re: I have little doubt it will be appealed

[Anonymous Coward]

His and your mistake was/is to assume that Slashdot approval equals to Real World (RW) approval (also to remember Hans Reiser trial).
Another examples of RW denial and lunacy at Slashdot are denial of Windows' success in past and denial of iPad's success in present (and those denials ate not over yet).
Remember kids: geeks are really bad in RW smartness. If Slashdot screams "ZOMG! SELL!!!", you buy. And if t's a call to buy, you sell. PROFIT!

Most people use home equipment for work

[Anonymous Coward]

Firstly, unless you work in Military or classified networks, I can pretty much guarantee that every IT person uses their home equipment to perform remote admin. Secondly he was a network admin, he's bound to have a few TCP dumps or copies of DBs lying around. Thirdly, every bit of information spouted by non IT-literate managers and spokesmen, has gone through several layers to get to them, so unless it's a tech publication with an inside source take it with a pinch of salt. Finally if he'd been hacking into other city employee's accounts they would have charged him with that.

Re:Most people use home equipment for work

[mysidia]

You mean the list of VPN passwords?

Network admins are supposed to have and keep those. If they forget them, or can't find them, that means they cannot set the VPN concentrator back up if it should die an untimely death.

VPN group passwords are quite important. And having to change them causes a big mess for all the VPN users of the network, since every single vpn client using lost credentials will have to be manually reconfigured..

Re:that is the high security mode that is used som

[Cramer]

We don't know what state each device was in. He did have some systems setup with no, or minimal, boot config. Others had recovery disabled. Rebooting them is asking for trouble.

Not really news

[DerekLyons]

These kinds of (defense) motions are pretty much rote - and for that reason rarely granted. Don't make too much of the fact that they weren't granted.

This should be expected

[Anonymous Coward]

If you work for the government, expect to be tried and jailed
If you don't like those consequences don't work for the government
This applies to all government jobs

My integrity is worth breaking the rules, but...

[eepok]

My integrity is worth breaking the rules, but I know that if I rebel against the system in power, it's not likely that they'll publicly appreciate it.

Fight for civil rights or stand up against what you believe to be a corrupt and incompetent system that will only put public information in danger-- either way, you're going to get hurt.

A good person knows this, does it anyway, and just hopes that history can tell the difference between criminal and person with a good cause.

Oh, Christ, Not This Tedious Tale Yet Again...!

[RobotRunAmok]

snydeq, tell your puppetmasters at InfoWorld to just give this a rest, won't you? Childs was the kind of uber-dickhead SysAdmin that even normal, run-of-the-mill garden-variety dickhead SysAdmins are afraid to associate with lest they appear as parodies of the type.

He didn't have a higher calling. He's not Batman. This ain't no Ayn Rand novel. He was fired and refused to release property that belonged to his former employer. Period, end of story.

And it *would* be the end of the story if the friggin' Drama Club at InfoWorld would stop flogging it on slashdot..

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[Sigma 7]

He was fired and refused to release property that belonged to his former employer. Period, end of story.

If you're saying that he refused to release a password for a database, then either hire a consultant to forcefully reset the password, or contact the vendor of the software for a solution.

The same is already done for OSs like Windows or Linux - there's special Boot CDs that bypass the issue. There's no reason why you can't do the same with more complex databases. If you need to take the system down for this, then do it at night time when the impact is minimized.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[Anonymous Coward]

He was fired and refused to release property that belonged to his former employer. Period, end of story.

The agreement he had with his (former) employer specifies who he was to release that information to, and under what circumstances. The request did not come from an authorized person, and the circumstances were suspect.

If you work helpdesk in a corporate environment, you might need to handle passwords. If the rules say you are only allowed to give out a an employees password to the employee, you don't give the passwords to anyone else. Not even the employees boss, or the employees boss's boss. Not even your boss, or the CEO. NO ONE, except the employee.

That's basically what happened here.

http://www.cio.com.au/article/255165/sorting_facts_terry_childs_case/?fp=&fpid=&pf=1

"...what actually happened was that Childs refused to provide his superiors the passwords to the city's core FiberWAN network, effectively preventing them from administering the network. The network continued to function, and no city applications, data, or resources were lost or inaccessible."

Lets see what the "California Counties “Best Policies” for the Countywide Information Security Program" [ http://www.sfgov.org/site/uploadedfiles/dtis/coit/Policies_Forms/CCISDA_security.pdf ] has to say about that:

"Here is a list of things to avoid:
  Giving your password over the phone to ANYONE. ...
  Telling your boss your password"

So, the "Best practices" told him to NOT give his superiors the password, and certainly not over the phone (as they requested).

tl,dr: He followed the rules, and got screwed for it.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[Thinboy00]

Not having the passwords for the time it takes to arrest Childs and persuade him to give the passwords to the mayor is less damaging than taking the system down, even briefly, since it still runs without the passwords, provided you don't have a crisis.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[moronoxyd]

tl,dr: He followed the rules, and got screwed for it.

Oh, so the rules were that he where only to give the passwords to the mayor?
And that he was to install backdoors into the system for his own use in the first place?

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[laurelraven]

The problem with this is the way Childs set the systems up. These weren't databases, but the router configs for the core and edge routers of the network. He set them up so that attempting to restart them would clear the configs, taking down the network. He also set himself up as the only one with the backups to restore the networks.

The city did contact the vendor...in this case, Cisco. They spent weeks coming up with a solution on how to get the configs back without the passwords, but had not come up with any very good solutions by the time he finally surrendered them.

Effectively, the systems still ran...but if anything had happened, they would not have been able to recover the way they needed to. A simple power loss could have caused the network to go down for days and cost an amount I'm not confident to estimate to bring back up. Simple fact is that he never had a right to set himself up as the single point of failure...the often used example where I work is "What if you get hit by a car?" This actually happened to our sysadmin, so we know it to be a very real concern...if it had happened to him while he had that control over the network, there would be no way for anyone to take over. I hate to say it, but that behavior really should be criminal.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[paeanblack]

If you're saying that he refused to release a password for a database, then either hire a consultant to forcefully reset the password, or contact the vendor of the software for a solution.

Despite being a jackass with no bus-factor plan, he appears to have sufficient technical capacity to build a system that could not readily be broken into using the methods you suggest. Doing so would have wiped the router configurations (they were not committed to flash, no backups were kept)

The crux of his conviction was based on the fact that he did not grant access to the system when requested by his employer. There are many ways to do that beyond giving up the passwords he used. He could have created new administrative accounts with new passwords. He could have given them access to a console logged in with his credentials.

He thought he could stonewall them. He now has plenty of time to examine the stone walls he built around himself.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[Troed]

If the rules say you are only allowed to give out a an employees password to the employee

... then you fire whomever came up with the rules. No person ever should have access to the passwords of others. It's not needed and should not exist as a policy anywhere.

(Rationale, of course, is that people reuse passwords and that's something much harder to fix than to stop storing passwords in clear text)

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[jeff4747]

The agreement he had with his (former) employer specifies who he was to release that information to, and under what circumstances. The request did not come from an authorized person, and the circumstances were suspect.

You have a lovely theory.

Unfortunately, it's not so much true.

First of all, the people requesting the passwords were the same people that gave him the passwords when he started there. He changed the passwords, which was good practice. However, the "I didn't think they were authorized" argument kinda falls apart when the "unauthorized" people were the same ones that authorized his access. If they could authorize Child's access, they could authorize their own.

Secondly, in your very own CIO article, there's this:

For example, the city's court filings claim that police found an ID badge and access card of one of Childs' colleagues in his house, and that Childs had lists of usernames and passwords of other city employees, including his direct supervisor, Herb Tong. Childs' having these materials is difficult to justify, if true.

If he held the policy on not releasing passwords in such high regard, how come he had other people's passwords at home?

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[Raenex]

Simple fact is that he never had a right to set himself up as the single point of failure...the often used example where I work is "What if you get hit by a car?"

The industry term is "bus factor", in this case a bus factor of 1.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[Tragedy4u]

You're only partially correct on this, you are wrong in the aspect that the network configs weren't saved to flash they were. The network configs WERE protected from standard password recovery procedures, what made them difficult to break into was he disabled password recovery on all the network hardware and saved that into the configuration onto the flash.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[SirWhoopass]

He followed the rules, and got screwed for it.

There is debate as to whether the county policies were approved or in force at the time. Even if they were, that very same manual says in section 4.1 ...

"All production system-level passwords must be part of the security administered global password management database."

The specifics of the jailhouse attempt to give passwords to the mayor is almost beside the point. The real issue is that he was deliberately trying to prevent others from having control over the network.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[dave87656]

There's a simple rule when you work for someone. When they ask you for something, you give to them. I'm not sure prison is the right sentence but that is not my decision to make. But his actions were clearly wrong. Maybe he really did feel he was doing the right thing but IMHO it was still wrong.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[dave87656]

"Here is a list of things to avoid:
    Giving your password over the phone to ANYONE. ...
    Telling your boss your password"

The key may be the word "your" here. There is a difference in giving "your" password to your boss and giving system passwords to your boss.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[dave87656]

For example, the city's court filings claim that police found an ID badge and access card of one of Childs' colleagues in his house, and that Childs had lists of usernames and passwords of other city employees, including his direct supervisor, Herb Tong. Childs' having these materials is difficult to justify, if true.

Almost every modern system stores passwords encrypted. Being system administrator wouldn't give you access to those passwords in unencrypted form. That seems odd.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[jeff4747]

It's only odd if you assume he got the passwords from the system in question. He could have captured them another way. Say a "Change Password" website.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[dave87656]

Good point.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[mysidia]

"All production system-level passwords must be part of the security administered global password management database."

Ok... but who has the passwords to access the global password management database? Maybe that was the password they were asking for.... or for him to give people access to..

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[mysidia]

If he followed security best practices, there might be no system passwords that he knew.

e.g. Each user has a username and password, an AAA server authenticates this. He might have a local user for himself on devices as well, for backup purposes.

Having generic usernames and 'system-wide' passwords available is generally discouraged. Since activities by a 'system generic user' cannot be audited properly.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[mysidia]

What's wrong here, is that the charge is criminal instead of civil.

He didn't launch a denial of service attack against them to deny them the use of the service: "the ability to manage their network"

This is a perversion of the law for purposes it was not intended for, perhaps due to a misunderstanding of what 'denial of service' means....

changing the admin password to prevent access would be such a DoS.

INACTION, or the failure to have disclosed a credential is not an action to cause a denial of service condition, which his superiors are just as responsible for anyways, for not requiring him to provide that information before firing him.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[dave87656]

They are talking about router passwords and the like which he administered. My point was that the direction not to give your password to your supervisor doesn't apply to router passwords and admin passwords to databases, etc.

IMO it's not a valid argument.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[dave87656]

I agree. Making this a criminal act seems wrong to me. It might be cause for dismissal from his work but he didn't cause or try to cause any damage.

Where it's a little grey is that he is essence didn't give up control of the passwords and therefor the devices. Not sure about what to do there. Perhaps a fine, if that really did cause the city to have extra expenses, but I'm not sure about that claim either.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[mysidia]

In case you didn't know... if routers are using an AAA server "single signon", the user password is the same as the "router" password.

There may in fact be no router-specific passwords. In a secure environment, any generic accounts are removed/disabled on a router before it's placed into service.

Re:Oh, Christ, Not This Tedious Tale Yet Again...!

[dave87656]

Thanks, didn't know that.

Re:that is the high security mode that is used som

[JWSmythe]

    If I remembered it right, he left the routers with the config just in memory (like running-config on a Cisco). I'd guess the startup config was enough to bring it online, but not enough for it to do it's job. Sounds like a pain in the ass though, if someone were to accidentally unplug a cable at the datacenter. Not only do they have to wait for it to boot back up, but they also have to wait for him to send up the working configuration.

    Ya, it'd be a job of getting into machines and cleaning up, but it's not like it's an impossible job. It wouldn't be a job I'd want, but I'm sure there was someone there who knew enough about the network to make educated guesses at the correct configuration.

"His perspective" isn't a license for anything

[sirwired]

He was a front-lines IT grunt. His job was to do whatever his superiors told him to do, barring any requests to do something illegal. If his superiors order him to open the admin interface to the outside world, and change the password to "password"... other than requesting that the demand be put in e-mail to protect his name, he is supposed to do so.

Exactly what criminal law would not allow him to turn passwords over to his management on request, no matter how unqualified they are? None.

Holding your employer's equipment hostage pending an audience with the mayor? Yeah, that was, and is, criminal. It's called extortion.

SirWired

Re:"His perspective" isn't a license for anything

[JohnFluxx]

No, his contract said clearly that his superiors could not demand the passwords like that. There were clear protocols for transferring the passwords that the state refused to follow.

Re:"His perspective" isn't a license for anything

[roman_mir]

Why don't you repeat what he did at your job, see how it works out for you.

Re:"His perspective" isn't a license for anything

[JohnFluxx]

Well we know how it works out - they lock you away for doing what your contract tells you to.

Doesn't make it right.

Re:"His perspective" isn't a license for anything

[roman_mir]

contract definitely doesn't tell you to remove all configuration files to all pieces of equipment, keep all copies on your laptop so that you're the only one who can restart anything, then once you're already dismissed to keep the passwords and configurations away from your former boss while he is explicitly telling you to give it up on the phone, no matter how many people are listening.

Re:"His perspective" isn't a license for anything

[JohnFluxx]

> then once you're already dismissed to keep the passwords and configurations away from your former boss while he is explicitly telling you to give it up on the phone

Actually, yes, the contract does say that. The boss was not an authorized official for the passwords. If he had given up the passwords then he would have been in breach of his contract and could have been sued for that.

Re:"His perspective" isn't a license for anything

[roman_mir]

That's just a bunch of bullshit and technicalities. Have you actually SEEN his contract? Have you read it? Who signed the contract? What are the legalities around it?

Even if the contract absolutely states that there is only one person at all can get the passwords, if that person is on the phone with other people and telling you to say the password, that's it, it's that person's problem.

This guy is just an ass and I wouldn't want anybody like that 1000 miles anywhere close to my systems.

Re:"His perspective" isn't a license for anything

[JohnFluxx]

So what, the council made up protocols that should just be ignored?

You're an ass for being so free in violating your contract just because someone said so.

Re:"His perspective" isn't a license for anything

[DigiTechGuy]

If people don't wnat to do things the old fashioned way on a man's word and a handshake, but instead force me to jump through a bunch of hoops and sign mountains of paperwork and contracts... Well I'll either ignore it entirely if it prevents me from doing my job, or follow it to a T to piss them off. If they didn't want it that way they shouldn't have done it that way.

Re:"His perspective" isn't a license for anything

[Tim C]

If he had already been dismissed then how could he be sued for being in breach of a contract that neither party was bound by?

Re:"His perspective" isn't a license for anything

[roman_mir]

I am not an ass because I don't steal other people's systems. I don't prevent owners of the systems to use them. I don't make a huge scene out of stupid technicalities because I follow the spirit of the contract, not the letter. Only assholes and lawyers follow the letter and not the spirit.

Re:"His perspective" isn't a license for anything

[roman_mir]

There is the letter and then there is the spirit of any paper. Anything can be turned and twisted. Would you want to take a contract with an unknown employer on a handshake on an off chance he is a very honest person and will pay you for your work?

The point is that it was very clear to Childs what was happening and he did what he did only because he chose to be and asshole about it, that's all, we all know it, he knows it.

Re:"His perspective" isn't a license for anything

[Fulcrum of Evil]

Technicalities == details that I find inconvenient, right?

Re:"His perspective" isn't a license for anything

[roman_mir]

No, it's the difference between the letter of the idea and its spirit. The spirit of a contract like that would not include the admin hijacking any systems by removing property files and keeping them locked up from the owners of the system. Even if the letter of the contract says: only this person can be given the password, the spirit does not mean "and if you get fired and this person asks you for the password over the phone even if there are other people on line listening, you must keep it from them".

In this case the admin was behaving like an ass.

Re:"His perspective" isn't a license for anything

[Fulcrum of Evil]

The US goes for the letter of the law, with allowances sometimes made for not violating the spirit, so I don't see how this is relevant in any way.

dont perform IT for US companies

[Anonymous Coward]

let them outsource

Re:that is the high security mode that is used som

[Cramer]

Some were, some weren't. He learned about "no service password-recovery" and thought that was sufficient to keep people from messing with the device and so saved the config. But not all devices support that. And we don't know which are setup like that and which aren't. I'm not rolling those dice.

Other article

[Anonymous Coward]

I RTFA, and I didn't really know what the back story was... I found this article to have a better background of the case:

http://www.cio.com.au/article/255165/sorting_facts_terry_childs_case/?fp=&fpid=&pf=1

The hit by the bus scenario or wants job security comes to my mind in all of this foolishness...

password is by definition his, but not the account

[Anonymous Coward]

password is password, account is account

How much bollocks can you spew?

[Anonymous Coward]

How much bollocks can you spew? As well as all the other crap,

a) no, but the passwords couldn't be given to his boss, and couldn't be given over the phone to ANYONE. Those were the rules as written, if you think they're dumb, then you should sack the mayor and manager, not Terry

b) No, he didn't install backdoors. Got anything at all to back that complete bollocks up with? He *did* stop the password reset being allowed over the internet (crackers use the internet. Real employees will have keys to site).

Nope, it changes a lot, if you're not partisan.

[Anonymous Coward]

Nope, it changes a lot, if you're not partisan.

        * God complex and delusions of grandeur

No evidence. He WAS better at his job than his bosses were at theirs, though.

        * Anger management

And did Terry get his boss arrested for cracking? No.

        * Obsessive/possessive

Did terry get his boss arrested for keeping "his" passwords? No.

        * Paranoid

They were out to get him.

        * General creepy behavior

Ooooh! scary!!! Does this even count as a point?

  City of San Fran

        * Poorly managed IT by definition when only one person knows the passwords to your routers

And demanding a breech of the rules (disclosure of passwords over the phone)

        * Budget cuts reduced IT to impossible support levels

You forgot:

      * God complex and delusions of grandeur

His boss thought he could DEMAND the passwords. His boss thought he was above the rules

        * Anger management

His boss got him thrown in jail because Terry didn't respect his authoritah.

        * Obsessive/possessive

Boss thought Terry (after sacking) was still "HIS" employee and the passwords HIS possession.

        * Paranoid

They thought Terry was trying to blackmail them.

        * General creepy behavior

this entire escapade.

So that would be 1-7 against SF.

he overstepped his authority

[circletimessquare]

the city of san francisco could have decided to hand out the passwords to homeless people and plaster them on freeway billboards. and? who cares. the point is, the passwords were the property of the city of san francisco's, not terry child's. the story begins and ends there

that san franciso would poorly manage network security is almost a fact. i would wager good money on their network being compromised. again, who cares: completely besides the point. terry childs had no right to assert himself as an authority, regardless of how right or wrong he was. therefore, he deserves to be punished for believing he had authority that anyone with a normal ego would understand they do not

i wish people would stop defending this guy. we have enough egomaniacs in this world ruining it. why some slashdotters can't see that terry childs is the exact same kind of egomaniac is beyond me

Re:he overstepped his authority

[Ash-Fox]

the point is, the passwords were the property of the city of san francisco's, not terry child's. the story begins and ends there

A password is property? What are you smoking?

If the city had done that, they would be in jail

[Anonymous Coward]

If the city had done that, they would be in jail for security violations, breech of conduct and fined billions.

Terry had a duty to give the passwords to the AUTHORISED person in an AUTHORISED SITUATION. And for following his duty, they jailed him.

yes, the authorised person

[circletimessquare]

accord to terry childs

self-appointed dictator, following his self-appointed duty, of policing san francisco's network policy

he was an egomaniac who overstepped his bounds, and for that, he was jailed, and rightly so

why do people continue defending this asshole?

Re:yes, the authorised person

[Anonymous Cowpat]

because none of us wants to be in the same situation of having to choose between jail and knowingly causing the IT systems of a major city to be b0rked.

"Childs had processed requests from authorized"

[Anonymous Coward]

"Childs had processed requests from authorized people before"

Really? One such authorised request came under the "not in front of anyone who isn't authorised to have the passwords either".

Got any link for your assertion?

And how does an AC get modded up for Bollocks like this?

Re:"Childs had processed requests from authorized"

[Anonymous Coward]

Come on, how hard is it to look this stuff up.

Try here for starters:

Eventually we looked at it and we saw that in late June his manager had requested certain accounts to be created that would have access to certain routers and switches. And he did create those accounts, and he sent that back in an email with the user IDs and passwords, to which Richard Robinson was also copied. If his big concern was that Richard Robinson was not authorized to be a user, why -- just a week before -- did he copy him on an email that has user IDs and passwords?

yes, the password was the property of sanfran

[circletimessquare]

or more exactly, the security system for THEIR network, which the password was the key to

terry childs is like the auto mechanic in that seinfeld episode from the nineties, who doesn't think jerry is treating his car well enough, that he slaved so many hours repairing, so he steals his car. funny on tv, not funny in real life

yes, terry childs and the auto mechanic put a lot of hours and love into their technical efforts. but this in absolutely no way gives them any right to assert any authority

why the hell can't some slashdotters understand this simple concept?

Terry didn't try to do anything to or with

[Anonymous Coward]

Terry didn't try to do anything to or with the network. So, by YOUR assertion of deserving jail, Terry doesn't deserve jail and isn't a criminal.

"and every password to everything; all of which will be changed immediately"

Well, they have to do it because after they were given the password to the network, they published them in public.

I guess that the network admin who took over and the prosecuter of this case are both criminals and need to be thrown in jail...

What really confuses me is the vitriol against Terry here, even to the extent of COMPLETELY MAKING SHIT UP just to "prove" he's a crim. Why???

There was indication he was a thief!

[Slashdot Parent]

But there's no indication that he's a thief or a scumbag.

This is actually not quite true. Check out Terry Childs juror explains why he voted to convict:

IDG News: Going back, what was the one step he could have done to avoid prison?
Chilton: If he would have simply said, "I will create you an account and you can go in and you can remove my access if you want." If he had created access for someone else, I think that would have resolved it. If he had not decided to leave and go to Nevada a few days later and withdraw US$10,000 in cash, [Childs did this the day before his arrest, while under police surveillance] I think the police may have let it continue on as an employment issue and not a criminal matter.

you're not responsible

[circletimessquare]

for the world. you can't carry your weight, and the weight of incompetents

understand your boundaries. speak your concerns to the people in charge, and let it go

you don't solve problems by assigning yourself authority you don't have

Re: I have little doubt it will be appealed

[dave87656]

Another examples of RW denial and lunacy at Slashdot are denial of Windows' success in past

It depends on what you define as success. I personally haven't heard anyone here deny Window's financial and marketing success in the past. If you read carefully, you might notice that most criticism of Windows is of a technical nature. Things like BSOD and swiss cheese secutity, which most Windows users simply accept as normal, are for technically advanced "geeks" not exactly signs of success.

Child's mistake

[mysidia]

He gave the passwords to the mayor....

He should have negotiated a plea bargain. The passwords, for release, or a light sentence.

He threw away his only bargaining chip, and let a case go to trial, with odds against him.

"His Contract"? I call B.S.

[sirwired]

Since when does the employment contract for a front-lines IT grunt include the specific password policy for the equipment the grunt will be maintaining?

Do you have a link to this contract?