Slashdot Mirror
San Francisco Just As Guilty In Terry Childs Case
snydeq writes "Deep End's Paul Venezia follows up on the Terry Childs sentencing, stating that the City of San Francisco is as much at fault in this case as Childs is. 'The way that the San Francisco IT department has been run is nothing short of abysmal, and that has been pointed out time and again by anyone paying attention to this case,' Venezia writes. 'Plenty of dirty laundry was aired out in court as well, yet through it all, the city has had a full-court press on Childs, and being both the plaintiff and the prosecution it spared no expense to drill Childs into the ground.' Worse, perhaps, is the disproportion of the sentence, when compared with recent convictions for intended malfeasance on the part of several notable rogue IT admins."
"Printable version". TFS's link is to a two page version with six paragraphs per page.
Free Martian Whores!
"rogue IT admins" - I find that phrase humorous for reasons I cannot explain.
The teachers will crack any minute, purple monkey dishwasher.
Frisco's policy in this case is: "Punish what you can't understand".
Karma cannot be described by words alone.
Jail the city!
Every time I read something positive pertaining to the American justice system I seem to be two years older than the last time. How does he possibly deserve four years in prison for this?
"Going to war without the French is like going deer hunting without your accordion." ~General Norman Schwarzkopf
You can skip reading TFA; all of it that's relevant to the headline is in the article summary.
Most of the article is pointing out other people who did worse things and got lighter sentences. Frankly, I think that's a useless argument; for any crime, you can just about always find someone who committed a greater crime and received a lesser sentence. So what?
I think there's a lot of an interesting dialogue to be had about the Terry Childs case, but this particular article doesn't add anything to that discussion.
Sure, the SF IT department may be getting managed into the ground. Sure, maybe the city is as much to blame for everything as Childs is. But none of that matters now, does it? Nobody is going to file a case against SF city. Nobody is going to punish the SF IT department. Nah, the city will get to walk away scott free, continuing to practice poor procedures. All the wild, Childs has to live with his sentence as a convenient scapegoat. This case just serves a little more proof the the justice system, on all levels in this country (at least if you live in California) is completely FUBAR.
Motorcycles, Robots, Space Gossip and More!
Did a good job? The guy was keeping passwords and router configs in his head. He may be the best IOS programmer around, but that isn't the mark of a good job, that's the mark of an incredible idiot.
The world's burning. Moped Jesus spotted on I50. Details at 11.
It's good to be the king.
It must have been something you assimilated. . . .
Wow, a nuanced view of the problems.
Before this post gets modded as a troll or flamebait, it is my humble and sincere view as someone born and raised outside the USA, that Americans are often obsessed by finding a single cause for a problem and the idea that there might be multiple causes is rarely explored.
The real "Libtards" are the Libertarians!
We may not be able to bring any sense of "justice" to this act, but there should never be another computer-related event in San Francisco, and anyone with any sense of what really happened to Childs (regardless of his own aggravation of the incident) should also boycott the city.
The slightly smaller number of tourist and convention dollars will take decades to balance the scales, but it's worth a try.
So here's a question. If people are concerned about the magnitude of the sentence, what's the REAL problem? Some people say "others got light sentences so he should too"... I would ask "is the real problem that others' sentences were too light and this is the first time the punishment fit the crime?"
Now, whether Childs is actually guilty of a crime is another matter. I wasn't in the jury; neither was anyone else here. We don't have all the facts, and the facts we ARE seeing are carefully picked by people with an (understandable) bias. A jury has convicted him of essentially holding a city's IT infrastructure hostage, and if he is in fact guilty of that, probation or "time served" is inadequate. If he's guilty, I believe the sentence is wholly appropriate, and may even be on the light side. If he was, in fact, concerned about IT security, he certainly bungled how he handled it and certainly forced a lot of spending, but would be lacking the "guilty mind" that the law requires for a conviction of this sort.
What it all comes down to is intention. If he intended something malicious, the sentence is entirely appropriate. If he did not, he should not serve any prison at all. There's really not a lot of room for gray areas here.
As for the City of San Francisco being "as guilty"... well, yeah. Maybe someone should be sharing a cell with Childs. That's a separate matter, though. If Childs was malicious, it doesn't let him off the hook. And if Childs wasn't malicious, it doesn't excuse how he handled it. The smart play would have been to immediately give the passwords (and the reason for holding them, as well as the modems) to the FBI and then let the city and feds slug it out. The fact that he did nothing of the sort is probably what convinced the jury that there was malice, and therefore the "guilty mind". Whatever else Childs may or may not be, he handled this whole thing like an idiot.
Everybody gets what the majority deserves.
Lots of people have to work under supervisors who are total idiots. That doesn't give anyone the right to sabotage their supervisor or their company. What he did was basically blackmail: "Let me talk ot the mayor or I'll keep you locked out of your network." You can't let the guy off easy just because he happened to be harmless. Next time, you might not be so lucky.
The problem lies in that most US people seem to equal justice with revenge.
(2) Having been convicted, I would have run away. There are a lot of decent IT jobs in the Northeast..... almost 3000 miles away from the SF Government's reach. No different than running from Spain to Poland to start a new life.
Minor problem with your idea:
A Person charged in any State with Treason, Felony, or other Crime, who shall flee from Justice, and be found in another State, shall on demand of the executive Authority of the State from which he fled, be delivered up, to be removed to the State having Jurisdiction of the Crime.
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
FTA: "When faced with dangerously incompetent management, it's best to just look for another job."
I found this a very telling statement. If your management are bozos, don't try to change them or point out their bozo-ness. Just pack up and move on. They hold all the cards. You will be punished for trying to fix anything that makes them look bad.
How very sad and defeatist.
- Jasen.
This is a "productive. talented person"? Whether or not the city was run poorly (it is a city government, so it probably was) the fact is that he was holding the router and password configs hostage. Forget him getting fired and everything that happened, what would have happened if he got hit by a bus? He can claim that the other people were idiots, but idiots with access is better than a single person with access who dies, because then no one has access. I can even sympathize with holding the passwords, but what the hell would the purpose of not committing the router configs to memory be? So every time there is a power outage or a router needs to be rebooted they need to call him? That isn;t a good admin, no matter how stupid he thinks everyone else is.
"Information wants to be expensive" - Stewart Brand, the same guy who said "Information wants to be free"
I would suggest it isn't so much an "American" trait as it is a convenient news tactic in America. People naturally want answers to questions. The neater and tighter the answer, the more readily it is accepted by the masses, which, of course, means that the news makes more money because they are more trusted. Simplicity is a hallmark of human (not just American) thinking - this takes different forms in different cultures. The main Western logical process is distinct from Eastern varieties but simplicity within the given culture is the tendency. Looking at modern history books covering the Renaissance and comparing them with 19th century history books of the same, we have a much broader viewpoint than those writing in the 1800s had. This is in part due to different access to resources, but in part due to the development of thought over time away from the natural reaction: Simplicity.
Now, with all that said, this is only... one facet of the change in thought patterns over the past century.
Worse it is the mark of a megalomaniac. He was convinced he has made himself indispensable, that by keeping knowledge to himself, and endangering the systems in doing so, made his job totally secure. He though he ruled the roost and nobody could fire him. He found out the very hard way he was wrong. As the saying goes "The graveyards are filled with indispensable men."
The most important think in an IT person is that they are trustworthy. They have amazing access, and this that comes amazing responsibility. They need to be trustworthy to not abuse that access. He did, badly so. As such he really should never work in IT again. He's shown that he can't set aside his ego and such a person has no business having system level passwords.
Most Americans I've met are actually very rational people who are willing to consider others' viewpoints. It's not until you get into the court and political systems that things start to fall apart.
They say a little knowledge is a dangerous thing, but it's not one half so bad as a lot of ignorance. - Terry Pratchett
I'm not against a nuanced view of a problem, but I don't think this article actually is that.
It's more like the equivalent of grounding your kid for two weeks for shoplifting and having to hear about how all his friends got punished less for stealing bigger things. It's more a misdirection than a thoughtful examination of the issue at hand.
That's not to say that I'm advocating for what happens to Childs as fair/appropriate, incidentally -- only that I think this article makes a very weak argument against it.
Well, guess what. No matter how much you may think it, generalized poor management is not actually a criminal offense. Whereas, denial of service is.
Justice is not about fairness. It's "did you break the law, and if so what's the stated punishment?"
Was the ordinance used to convict him fair and reasonably applied? The only opinion that matters is the jury's, and they thought it so.
IMHO, Childs may have started out with the best of intentions in his "stand", but it escalated into a pissing match. And you really can't out-piss senior municipal managers and politicians, so you can indict Childs for picking a losing fight.
Welcome to the Panopticon. Used to be a prison, now it's your home.
That's true, but it's for the voters to decide if the boss is being an idiot (and fire him), not the cogs in the machine (i.e. the bureaucrats and admins). Their job is to obey and hand-over the keys to the leadership.
How well do you think it would go-over if my FAA boss said, "I need a copy of your audits so I can submit a report to Congress," and I said, "No." That's simply not my job to act in such a manner. My job is to obey the chain of command. Or quit. Those are my options.
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
Agreed. But does he deserve four years in prison? In most other professions, this would lead to a civil lawsuit and a fine, not a prison term on par with that of a violent offender.
"Going to war without the French is like going deer hunting without your accordion." ~General Norman Schwarzkopf
Well... San Francisco gave his boss the authority to ask and receive those passwords. What the boss does with those passwords are between his boss and San Francisco.
These comments are my own and do not necessarily reflect the views or opinions of my employer or colleagues...
The Economist ripped the US a new one last week for locking up too many people, many of them non violent offences. It wasn't so long ago that people were hanged for stealing a loaf of bread, but we backed off from excess punishment (probably a little too far in some cases). But the United States the trend seems to be regressing thanks to grandstanding politicians and bloodthirsty voters who won't countenance even the slightest hint of being "soft on crime". With the way things are going, I truly think that the US will soon bring back public executions before long and will be indistinguishable from countries like Iran in how they deal with crime.
Drill baby drill - on Mars
Its City property. And yes, its their equipment to be an idiot with. While Childs was following the policy to the letter, he should have realized his boss was a power hungry idiot that wasn't about to let his minion make him look like an idiot, and just handed over the passwords, packed up his shit and said "See ya!"
Insert funny smart-ass comment here.
I'm betting Governor Schwarzenegger wouldn't care enough to issue that extradition order. In fact he might even side with Childs (hypothetically hiding in the northeast) and slap-down the SF Mayor for being a dick.
There's also the possibility that the Northeast State would protect the citizen from extradition. That is what happened during the slavery days when states refused to return escaped blacks and instead gave them asylum (i.e. they used nullification of the US Fugitive Slave Act).
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
Whether he does or doesn't will be up to his lawyer to convince on appeal. The broader point here is that a whole lot IT guys seem to blindly be supporting him because he followed the letter of his contract to insane degrees. They paper over the fact that if this guy had been hit by a bus, his employer, the City of San Francisco, would well and truly have been up a creek without a paddle.
If this was such a big concern for Childs, why didn't he have these key passwords and router configs in the Mayor's office. Surely the Mayor has a safe or some other secured storage whereby this critical data could be securely stored in the event that the Mayor had to appoint someone else responsible. Where I work we have a safety deposit box where the originals of all the purchased software is stored, as well as a CD and hardcopy of all the passwords are stored. While it would probably be a bit difficult to keep going without me around, the guy that comes in after me would have a reasonably decent head start.
However harsh the sentence may have been, the fact is that Childs was a shitty IT manager. Being an IT manager is about a helluva lot more than being a clever router hacker, it's about documentation, about appropriate systems, and just as importantly about assuring, for whatever reason, that a smooth transition of IT management from one person or another can be accomplished. Childs didn't set up that damned network to benefit his employer, he set it up so that he was the cornerstone, and while the city has to take a lot of blame for not keeping a better eye on him, he violated some very basic tenets of sound IT operations and management. AS I've said before, I wouldn't hire the guy to manage a popsicle stand, I don't give a crap how brilliant he is.
The world's burning. Moped Jesus spotted on I50. Details at 11.
I'm betting the Governors involved would treat him as any other convicted criminal and Childs would add a few more years onto his sentence for escape/flight.....
I want peace on earth and goodwill toward man.
We are the United States Government! We don't do that sort of thing.
He was officially given total responsibility and authority, so it really doesn't matter who's property it was on paper. His boss was the de facto owner. The office bathrooms are the public's property too, but that but that doesn't mean the city offices have to allow any passerby to come the building and use it. For that matter, the offices themselves are public property, but try strolling into the Mayors office unannounced....
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
QED
What doesn't kill you only delays the inevitable
Did a good job? The guy was keeping passwords and router configs in his head. He may be the best IOS programmer around, but that isn't the mark of a good job, that's the mark of an incredible idiot.
You're right. He should have written the passwords on a sticky note on the side of his monitor, as all of the best books on security recommend.
Intron: the portion of DNA which expresses nothing useful.
The problem lies in that most US people seem to equal justice with revenge.
Oh great. Another example of us not understanding equals!
Try translating your argument into a different context. What if he wasn't employed by the government - should the punishment carry the same weight? What if he worked in a different field? It seems to me that if either of those conditions were different, he would have just been fired. After all, if a major company gives one person the password to their corporate bank account, and they won't tell it, did they really just steal hundreds of millions of dollars?
"Going to war without the French is like going deer hunting without your accordion." ~General Norman Schwarzkopf
(1) Childs was wrong. You don't withhold passwords from your employer. It's his property, and he's allowed to be an idiot with his own property.
Please cite a legal authority for your assertion that passwords are "property". Since they are intangible, I can only think that Intellectual Property laws would have bearing on that assertion. But, since the passwords were neither patented nor trademarked nor copyrighted (copywritten?), I don't see how your assertion can hold up.
In any case, even if you could make a "property" argument, that's not the basis of his conviction. He wasn't convicted for stealing the city's "property". He was convicted under an "anti-hacking" statute. Essentially what they got him on was "denying services to authorized users", which takes quite a bit of intellectual contortion, since no-one ever proved that his actions directly prevented services to any end-users, only that his inaction (i.e. his initial refusal to disclose passwords after his employment was terminated) temporarily inconvenienced administrators, until they could complete their password-recovery procedures. That's clearly not the scenario that the statute was meant to cover, and this turned out to be an incredibly novel precedent for applying "anti-hacking" rules to a run-of-the-mill employer/employee confrontation.
I don't think it's an exaggeration to say that this precedent endangers all of us in the IT field -- taken to its extreme, it means employers can lay claim to anything that ex-employees know, if it helps them run their systems or their networks better. Passwords, code optimizations, little quirks in configurations of various systems/subsystems, the list goes on. All of these are now potentially fair game for employers to force ex-employees to divulge, if they can make a plausible claim that -- however indirectly -- they are necessary to deliver services to their end-users. If the ex-employee refuses to comply, they're in violation of an "anti-hacking" statute. Silence = hacking. Wonderful.
What is even more amazing is there was a (supposedly) tech-savvy member of the jury, who should have been able to explain what a crock this was, but was swayed by the tech-illiterate arguments of the prosecution and thus could not, or would not, prevent this travesty of justice. He's even posted here on /. trying to rationalize his actions, and his vote.
I suspect, however, that some peer pressure was involved here, as often happens on juries (I know this firsthand from one of the juries on which I've served).
I think idiots worldwide seem to equal justice with revenge. It's just that in the USA it is hard to avoid these people. They flaunt themselves in public and on TV. There is no stigma to being an idiot in the USA, outside of academic circles. It's encouraged.
What if he worked in a different field?
He works in IT. Specifically, as a sysadmin like myself. That is extremely relevant to the case, and the fact of the matter is, as sysadmin, the very first rule is to never be the only one with access. Maybe put the password in a sealed envelope in the CEO (or Mayor's) safe, but make sure that several people know about the envelope.
Battlemaster--Game with friends in medival realms
Sorry to followup on my own post, but I neglected to mention the Free Speech aspect of this case. Free Speech means, in part, that (unless life or limb are in imminent danger, perhaps) one cannot be compelled to speak. But that's exactly what happened here. He was forced, by an "anti-hacking" statute, to utter something upon which he obviously preferred to stay silent.
Along Constitutional lines of thought, as a "what if" experiment, I wonder what would have happened if Terry had invoked his Fifth Amendment Right Against Self-incrimination. After all, there might have been something criminal in the passwords themselves (a terrorist plot, a threat against a head of state, an encoded fragment of a prohibited image). Could a mere California statute override the hallowed and vaunted federalRight Against Self-Incrimination? I guess we'll never know...
I wasn't attempting to measure the justice, or lack of justice, in the sentencing. You do bad enough to go to the courts, well, be ready for whatever comes down. There's nothing in most legal traditions that require every sentence for a crime be identical. It will be up to Childs' lawyer to try get the sentence overturned, reduced, new trial, whatever.
What I'm commenting on is the way in which a lot of guys around here just endlessly defend Childs, at best only giving a brief nod towards the fact that he had inadequately secured key data for a rather large organization's IT infrastructure. Part of the fault must surely be that there wasn't enough oversight, that he had been given too much power with too few strings, but even so, in his position, even taking his extreme view of the chain of command, a sensible IT administrator would have taken steps to assure the integrity of the infrastructure.
Imagine if Childs had been killed in a car accident days before city officials made their demands? Would you be defending him? Would any of the IT guys who post here be defending him? He's the classic model of a prima dona, a self-important delusional nutcase who whether out of some megamaniacal urge, or out of simple self-interest, made sure that he was indispensable. If I take the latter view, then yes, he deserves some judicial censure, whether jail time, or whatever. If the former, then what he needs is psychological help. Whatever the case, he's a shitty IT guy, pure and simple. I don't know him personally, but I know his type, the too-clever-by-half hacker types. These guys are dangerous to put in charge of any critical infrastructure.
The world's burning. Moped Jesus spotted on I50. Details at 11.
What if you worked at a nuke plan and your boss wanted the codes over the speakerphone and you did not know if people on the other end where able to run the system and you know that your boss was not able to run the systems.
I agree with your points about IP and what this decision means for future IT folk. I wouldn't blame the jury for the result, though.. Most of the problems that I had on a jury were that all of the interesting stuff happened before the trial. That's when the discovery took place and various motions occurred on what would be allowed and what wouldn't. By the time the trial happened, we were only allowed to see a small part of the testimony with some huge holes in it. We had to decide the outcome based on what they showed us, not on the complete facts of the case. If we could have asked our own questions, it would have been a lot different deliberations.
Intron: the portion of DNA which expresses nothing useful.
Who hired that idiot? I keep seeing people here state that Childs is a total egomaniac and deserves punishment for that. But who is responsible for Childs? His managers, of course.
Managers exist to manage people. Childs had the obligation to know how to manage routers, his managers had the obligation to know how to manage Childs.
Childs was one part in a big system, if he wasn't performing correctly someone else should have noticed this and replaced him, just like Childs should replace a router that wasn't performing correctly in the network he managed.
The linked thread is really interesting -- I'd missed it the first time around and it adds a lot to this discussion.
2) Having been convicted, I would have run away. There are a lot of decent IT jobs in the Northeast..... almost 3000 miles away from the SF Government's reach. No different than running from Spain to Poland to start a new life.
US Constitution, Article 4, Section II, Clause 2:
"A Person charged in any State with Treason, Felony, or other Crime, who shall flee from Justice, and be found in another State, shall on demand of the executive Authority of the State from which he fled, be delivered up, to be removed to the State having Jurisdiction of the Crime."
You achieve nothing in your interstate flight but a quarantee of conviction on a new and stiffer felony charge.
You will be doing hard time even if your prior conviction is overturned.
You mean kind of like how a lot of non-Americans like to find the property of "being an American" as somehow intrinsically to blame in so many situations?
All people need to simplify. You will never understand everything, so you research carefully the things that interest you, and everything else needs to be ignored or fit into a bite-sized piece of intellectualism that you don't need to give any thought to. Nationality has nothing to do with it.
What do you mean "so what"?
First there's the question of precedent.
Second there's the question of just punishment
While the city may have a shitty IT setup, is that illegal? Probably not. However what Childs did WAS illegal.
That is the difference. I know that some geek types seem to think the law should be whatever strikes them personally as fair but that isn't how it works. Childs broke the law, he was tried and convicted of it (and one of his jurors had a CCIE so none of this "stupid jury" bullshit).
If the city is being negligent then a lawsuit can, and should, be brought against them. None of that makes what Childs did right or legal.
Please, please would all Slashdot posters go and READ UP ON THE CASE before posting. The facts please, not the opinions form mother Slashdotters. So much uninformed kneejerk here. Slashdot itself had some good links, including one to an interview with aforementioned CCIE juror. How are you any better than the people you like to look down upon if you cannot be bothered to get your facts straight for something you have strong emotions about?
I don't think it's an exaggeration to say that this precedent endangers all of us in the IT field -- taken to its extreme, it means employers can lay claim to anything that ex-employees know, if it helps them run their systems or their networks better.
I disagree. Childs was asked to provide access to the relevant networks while still an employee and refused.
You can't set yourself up as the only person with access to something and refuse to provide it to anyone else, including your superiors, so, yeah, I think it's an exaggeration to make the generalization you did.
In most cases you still wouldn't see criminal charges filed for doing even that, but this isn't most cases.
"The problem lies in that most US people seem to equal justice with revenge."
There being insufficient order, turning up the pain until there is order is reasonable.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
"They paper over the fact that if this guy had been hit by a bus, his employer, the City of San Francisco, would well and truly have been up a creek without a paddle."
Which is a management issue, not a technical one, so the one to blame must be a manager. Was Childs in a manager-level position or in a "mere" technical one?
"However harsh the sentence may have been, the fact is that Childs was a shitty IT manager."
Truly so. But was he in a managerial position to start with? All I can find about him is that he was a "network administrator", a "network engineer" or an "IT administrator", never a manager, so he was not the one to say how the passwords should have to be managed nor the one to deal with policy violations. In fact, as per this reference (http://blogs.sfweekly.com/thesnitch/2010/08/terry_childs_sentenced_hacker.php) it seems clear that upper SF management agree this being a case of bad management: both Terry's direct manager and the security manager were displaced (they are not fired -yet, probably not to ashame that very SF upper management).
My defense of him has nothing to do with whether or not I think he is innocent (I do not; I think he is fully guilty of a crime). My defense is that he was given a four year conviction for something that really should have gone to civil court.
"Going to war without the French is like going deer hunting without your accordion." ~General Norman Schwarzkopf
The dude wouldn't turn over passwords when ordered by his Senior Associate. That's just insubordinate in any circumstance, regardless of the job, and will get your ass fired in most places. Terry could have handled things differently if he didn't trust his immediate supervisor, but he didn't. He chose to lie all the way up the food chain and took the for-the-good-of-the-network chip on his shoulder with him.
boycott slashdot February 10th - 17th check out: altSlashdot.org
Well, he wrote his own ending here with his crazy and obstinate attitude. But this could all have been avoided if he had been even a half-way competent sysadmin. Yes, it's possible he could have been demoted or even fired, or whatever, because it's pretty obvious his attitude sucked, but the mayor could have reached into the safe, pulled out the passwords, handed them to the replacement, and life would have gone on. Instead, he chose the path of most resistance. I don't feel the least bit sorry. He's guilty of severe malpractice.
The world's burning. Moped Jesus spotted on I50. Details at 11.
I'd mod you up if I had any points right now ...
What's he going to do, get another IT job and offend again? They should have given him community service. The guy's career has already been wrecked.
We are way too much about jail in California and the US. You shouldn't go to jail unless you are violent, or an incorrigible repeat offender. California is bankrupting itself putting taxpayers in jail for crimes like these and for smoking, it is fucking crazy.
You haven't talked to any religious people as an atheist, have you?
My blog. Good stuff (when I remember to update it). Read it.
I would disagree with that assessment. I have had multiple conversations in which the topic is "THE cause of ..." while it seems perfectly obvious to me that there are multiple causes. So I don't think it is limited to the media.
The real "Libtards" are the Libertarians!
5th amendment doesn't hold here; everyone knew he was withholding the password, the password is not incriminating -> not protected under 5th amendment.
"Going to war without the French is like going deer hunting without your accordion." ~General Norman Schwarzkopf
I was told in jury selection that my case was one where only the guilt would be deliberated, the sentence was (due to legal reasons) not to be set by the jury. Basically if we found guilty the person was getting life imprisonment, and if we found not guilty the left the courtroom free.
Odds are the lawyers didn't like this, and the Judge may not have liked it; but, this is the state the courts are in after yet another round of overzealous legislation to "fight crime." In Jury selection questioning, I told the prosecuting attorney that I had reservations about the two extremes of the outcome. He asked me if I thought he was guilty but not deserving of a life sentence, would I be tempted to declare him not guilty, to which I replied "Yes, because the Jury shouldn't have the choice of sentencing stripped from it's duties." Naturally, I was excused from Jury duty.
So that man's trial was populated by people who were all right having the determination of degree of punishment stripped from them; in other words, they had people who selected with a bias to send him away for life before hearing the facts. Was he guilty? Who knows? But I guarantee you that nobody on that Jury was allowed to determine if extenuating circumstances meant he should only get 20 years instead of life.
I could understand it if he wanted to be a whistleblower in this situation, but you don't do it by holding the system hostage. Like you said, you document everything, and then you go to a responsible party with your issues. You might lose your job over it, but that's a hell of a lot better than going to jail.
You haven't talked to any religious people as an atheist, have you?
I'm agnostic, so not really. One of my good friends is a priest though, and we get into some good discussions. One thing we agree on is that anyone who tries to force or shame others into following their religion rather than leading by example is either very insecure in the veracity of their claims or simply a fool.
They say a little knowledge is a dangerous thing, but it's not one half so bad as a lot of ignorance. - Terry Pratchett
Furthermore, justice AND revenge both do not mandate prison and/or being subject to physical or sexual abuse. There are many things that can be done in BOTH cases besides the obvious one. Prisons cost too much money and have too much lobbying pressure to maintain or grow the punishment/revenge system we have today.
Having pedophile tattooed on your forehead should be enough...
Terry Childs is going to have career problems for life, no need to waste money holding him in a cage as if he was a wild animal threatening the peace - or even put an invisible fence around his house is not worth it.
Democracy Now! - uncensored, anti-establishment news
I like that rule, I wish it could always be the case too! I'll give you a real life example of my situation. I created said envelope with all the key passwords and sensitive documentation to allow another to step in should I be hit by a bus. It was placed in the safe in the CFOs office.
You may or may not have guessed it but the CFO was fired and his position was removed. Since this was an executive decision they of course waited until way too late to tell me. The COO and Controller emptied the safe and now I do not know where that paperwork wound up. I changed my critical passwords and VPN encryption keys. Then the time came where they wanted the list of passwords. I asked them where the old list was and I haven't heard anything since.
Now for my own sanity I still keep a copy of the records but it is no small feat to change all the sensitive passwords so I keep them in the safe of the owner who has already twice forgotten that he has it. He asks me for it personally sometimes. If the time came I don't believe he would know its in his safe.
This is why I can feel at least some sympathy for Terry Childs although he definitely didn't act in any way professionally. He deserves to be punished but his punishment doesn't fit the crime given what's been brought to light about his management.
My other question is why in a city the size of SF was there only one person responsible for critical city infrastructure? If two people had been working together the whole time then the project would never have been in jeopardy unless Childs managed to corrupt the second guy which I guess is possible if some the ineptitude of management was in fact true.
5th amendment doesn't hold here; everyone knew he was withholding the password, the password is not incriminating -> not protected under 5th amendment.
We don't know for sure that the password was non-incriminating. Certain combinations of letters, numbers and/or symbols are criminal ipso facto (how soon we forget the "munition" crypto algorithm, expressible on a t-shirt or other relatively compact media?).
If some piece of information could be incriminating, generally speaking we give broad latitude for the holder of the information to invoke the Right Against Self-Incrimination, since to determine whether it's incriminating or not, one would have to divulge it, which is a Catch-22, since it might result in criminal penalties for the divulger. Of course, the way to cut through that Gordian Knot is for an agent with the power to do so to offer Limited Immunity, with respect to that particular piece of information. Free of any possibility of incrimination, the holder of the information can then be compelled to divulge it, in accordance with usual rules of testimony, production of evidence, etc.. As far as I know, no-one offered Terry any kind of Limited Immunity in this case.
"equate" typo more like
"Going to war without the French is like going deer hunting without your accordion." ~General Norman Schwarzkopf
So 4 years is just and appropriate because he was a shitty admin and had a bad attitude?
I may not personally feel sorry for him (haven't given that aspect much thought), but this is clearly a gross miscarriage of justice, and that outrages me regardless of the target.
>Try translating your argument into a different context. What if he wasn't employed by the government
With some other employers, we might still be looking for his body.
Some mornings it's hardly worth chewing through the restraints to get out of bed.
"Boss, I can't give you those codes over speakerphone. Call me back on a regular phone and I'll give them to you.
Doesn't matter. It's his system. You hand over the codes. And if you truly believe he can't run it, you quickly drive out of the blast radius.
I never said it was just. I'm trying to make the point that thumbing your nose all the way up the chain of command, whether to cover your own ass or because of delusions of grandeur, will guarantee that you have a less than sympathetic ear in court. He wrote the ending. Ask him why he did. The court is not bound in sentencing by the average that other IT administrators' malfeasance previously was set. Beyond that, as others have pointed out, none of these other situations are comparable; different jurisdictions, different criminal charges.
And all of it could have been avoided if Childs actually knew what being a system/network administrator actually meant.
The world's burning. Moped Jesus spotted on I50. Details at 11.
I think a lot of people blindly support him because they can easily see themselves in a similar position and have no desire to be railroaded should they find themselves in the same position. While Childs did abuse his position and gave every sysadmin a bad name he doesn't hold all of the blame and if management had been more on top of the situation none of this unpleasantness would have happened.
Why on earth would a city the size of SF have only one sysadmin? This is the real root of the problem. If there had been a team, the project would have been properly built out as they check each others' work.
Also, let's note that Childs was NOT an IT manager, he was a sysadmin and found his IT manager to be really bad at his job which is pretty evident from the lack of enforcement of passwords entered into their password management system. He/she should have caught that early on and again would have avoided the whole mess. I wouldn't hire the guy either though. Anyone that plays such games with passwords and keys should not have any business being a part of it.
What if his laptop was dropped? Suddenly all those keys would be lost. It was an accident waiting to happen and brings into question his skills to begin with.
I've dealt with some pretty inept management in my day however. I've created the DR document should I be hit by a bus, I placed it in the safe of the CFO only to have the CFO position removed without any notification to myself. Six months later the COO and controller are emptying out his safe and they take no inventory of what was in it. They notified me at that time and I promptly changed VPN keys and passwords which was a huge pain in the ass. Six more months later they ask me for the same document again, I know it's outdated by then but I ask them where the old document was and they went looking for it. I still have no idea whether they found it as they don't answer my emails unless they need something. To cover my ass I made a new envelop and gave it to the owner to put in his safe at home. He routinely talks to me and even went so far as to ask for that information so I provided it. He and I both have peace of mind as I then won't have to worry about what happens when I separate myself from this company. Of course keeping that document up to date is also not an easy task.
One of my fellow admins, who, let's face it, should retire wanted to watch a video online. He was using IE6 no less and just clicked install when it asked him to. Naturally he got a lovely virus and I again had to go through the process of auditing and changing passwords as anything could have been leaked during that time.
It's at least easy for me to put myself in Childs situation. I wouldn't like to nailed to the wall like he was, of course I behave much more professionally than he did so I'm not really that worried about it. It does naturally make me want to side with him though. Despite the risks he was taking it does make sense that his management would have mishandled the information. Personally, I've gone through four bosses in the seven years I've worked here. Trust in authority is earned, not granted which is why when our new IT director came on board he didn't have full access until I deemed he was trustworthy per directions from a VP and the owner.
The chain of command isn't always easy to spell out.
Go put a chain and padlock on your neighbor's gate and see if you get in any trouble. You haven't stolen his property, so everything should be a-ok, right? (Heck, you haven't even trespassed, since he has to warn you once before it's a crime)
He denied access to the replacement administrators. They are authorized users of the system's configuration utilities.
Only because you're trying really, really hard to turn this into something it's not. Not turning over the passwords blocked the new adminsitrators from accessing the systems, just as if he DDoS'ed the management ports.
Why do people attribute to one country's people things that obviously apply to all people? Why do people think this post is in any way insightful?
Do I just need to start my inane generalizations with "Before this post gets modded as a troll or flamebait, it is my humble and sincere view..." to substantiate my otherwise vaguely hypocritical flamebait post?
But for plan B you can go to jail / be given the blame for doing it.
I completely agree.
I have been in a similar situation, asked to grant access I really did not feel comfortable with. I stated my objections in writing, offered an alternative but stated it was my boss' decision. In doing this I covered my ass and did my duty, but was not causing issues. Most of the time they accept my alternative, once I was told to do it anyway, and did.
Your job as an IT professional is to present risk analysis and ensure those making decisions understand the consequences of those decisions, not to be a brick wall preventing your higher ups from making them. If you really disagree, quit. I have done that as well when policy changed and I wasn't comfortable.
I think the problem is that people like yourself keep trying to pretend its not.
In every justice system the world over, 'justice' does equate to some form of revenge.
Its just the way nature works, you should probably accept it, it'll be a whole lot easier than trying to pretend that the instincts that have evolved into all life on Earth can be ignored.
People are animals. Animals will do as much as they can for themselves until something pushes back against them. Revenge or retribution is one of those things we do to self regulate our species ... its instinct, its natural, its not going away no matter how much you try to pretend you're 'better' than that.
When some serious crime is committed against you, you will want revenge and theres nothing you can say or do that will stop that.
Its always fun to pretend though.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
If you don't "write mem" your configurations, you don't deserve to be an admin at all.
Before this post gets modded as a troll or flamebait, it is my humble and sincere view as someone born and raised outside the USA, that Americans are often obsessed by finding a single cause for a problem and the idea that there might be multiple causes is rarely explored.
As opposed to what distinguished country, where every man is a philosopher king who never makes a snap decision?
Plenty of dirty laundry was aired out in court as well, yet through it all, the city has had a full-court press on Childs, and being both the plaintiff and the prosecution it spared no expense to drill Childs into the ground.
Wow, that metaphor is more confused than an eel at a hovercraft convention. The word on the street is that Infoworld editors are sharper than tacks, but when the rubber hits the road it seems the prose flies like a banana.
OK, consider if he were to behave like that in a bank. In a bank, he could hold money hostage, and cost the bank a fortune. So most banks implement separation of duties policies to prevent stuff like this, and their procedures would prevent a megalomaniac from rising to this position in the first place.
So we know there are proven procedures to protect a company from malicious admins, and those procedures are not secret. They could have been implemented by his bosses in city hall. But they weren't. Yes, his boss should be held liable for not adequately ensuring safeguards existed, and he should have been fired as soon as they jailed Childs. (That he wasn't stinks of favoritism, but those kinds of shenanigans are pretty much how every corrupt city operates under the covers.)
I'm pretty sure the punishment wasn't levied for the refusal to cooperate while he was employed, or of how the system did or didn't work after he was gone. The reason he got four years was how he behaved after he was ordered to turn them over by the court. You can generally piss off your boss and risk only your job, but lesson 0 is don't mess with the courts. They are the exact set of people who have the authority and ability to get revenge, and they love to show it.
For that matter, I doubt that either the courts or the city wanted anything to rush in this case. I'm sure they figured he'd get off with time served, and they wanted to ensure that he got plenty of that to begin with. The longer he sat in a cell, the more punishment he'd receive, regardless of the eventual outcome. That part is a complete abuse of the justice system, but when it's perpetrated by the justice system itself, well, there's nothing an individual can do except run against the scumbags in the next election.
John
And all of it could have been avoided if Childs actually knew what being a system/network administrator actually meant.
More importantly the four year sentence could have been avoided if the courts actually upheld the constitution and laws of this country. Instead its much more common for the 'authorities' in any branch to react on a personal level, and really stick it to the people they don't like regardless of whether or not its appropriate. THAT is the real crime here. Personally I keep that in mind- and stay out of trouble. It bothers me a lot that people in power are allowed to act is such a petty and spiteful manner and are given a pass because 'the guy was a jerk'. Right, cause its only ok to be an asshole when you're in charge...
You protest, you make damn sure your protest is written down on paper so you have a copy and rejected, and then you hand them over. When the shit hits the fan, you're covered. As sad as that may sound, this case has proven exactly that.
Once said nuke codes have been turned over to the incompetent moron, all bets are off. My advice is to get as far the hell away from the potential fallout area as possible, as quickly as possible. When they question why, you explain "I was forced to give the passwords to the reactor to a guy I wouldn't trust with a potato gun, under protest. Once I was forced to comply, under law, I wanted the hell away."
Only if you don't know what you're doing.
You have the boss send the request in writing. Print it out before running to your car.
Only bad sysadmins do not have a CYA file where every moronic management decision is documented thoroughly.
Please cite a legal authority for your assertion that passwords are "property". Since they are intangible, I can only think that Intellectual Property laws would have bearing on that assertion. But, since the passwords were neither patented nor trademarked nor copyrighted (copywritten?), I don't see how your assertion can hold up.
/. trying to rationalize his actions, and his vote.
True. The servers were property and he was withholding access to that property.
Essentially what they got him on was "denying services to authorized users", which takes quite a bit of intellectual contortion, since no-one ever proved that his actions directly prevented services to any end-users, only that his inaction (i.e. his initial refusal to disclose passwords after his employment was terminated) temporarily inconvenienced administrators,
The administrators are authorised users as well. They are authorised at a higher level. Why does the anti-hacking statute not cover this?
But the law doesn't really work like that. Intent is quite important. It seems likely that Childs deliberately arranged things in such a way that it would be extremely difficult for his replacement to administer the servers he had a right to administer.
What is even more amazing is there was a (supposedly) tech-savvy member of the jury, who should have been able to explain what a crock this was, but was swayed by the tech-illiterate arguments of the prosecution and thus could not, or would not, prevent this travesty of justice. He's even posted here on
He had access to all the evidence, and had an explanation of how the law works rather than the interpretation of a computer user, expecting the law to work like a computer and have no flexibility in interpretation at all.
"I can see how Childs might have been convicted by a largely nontechnical jury." That doesn't jive at all with one of their previous articles "Terry Childs juror explains why he voted to convict" http://www.infoworld.com/d/adventures-in-it/terry-childs-juror-explains-why-he-voted-convict-212 . I'd hardly say a jury containing a CCIE non-technical.
Ya Terry is getting screwed way more than he should be, but he is not innocent.
Followed select portions of the contract. Had he followed it all, he would have put the configs and passwords in the city IT config management system.
This means he pretty much wasn't following the contract to the letter, he was making up his own rules otherwise nothing would have happened. He would have got fired, the city would have pulled the passwords from the config system, changed them and moved on.
He violated basic common sense management practices and didn't follow city policies when they suited him, yet yelled that he was only following policy on other parts.
I REALLY WISH people would get it into their heads that THE CITY HAS A PASSWORD AND CONFIGURATION MANAGEMENT SYSTEM IN PLACE THAT HE DID NOT USE which makes what he did clearly nothing more than extortion.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
" Then the time came where they wanted the list of passwords. I asked them where the old list was and I haven't heard anything since."
You realize that this is dangerously close to Childs' attitude.
When they asked you, you should have (as I would) informed tham that they had a list of the passwords from the CFO's safe. You have since changed them, knowing the safe was 'compromised', and you did not know the disposition of the contents. And then you should have delivered without hesitation, to the CEO, owner, or their authorized agent, the new passwords. And perhaps a written admonition to notify you whenever a critical exeuctive or manager is dismissed, so that you can take appropriate action.
When I was installing small-business systems, it was expected, mandatory, that I leave the business owner with those passwords and access details. When we provided access for our clients, the router configs were delivered on floppy (this is a while ago), and passwords again made delivered as well. Where they had a trustworthy or critical telecom or cable provider, they also got a copy of passwords. All of these also got a disclaimer, that if the passwords were compromised or given to unauthorized agents, or changed without notifying us, our responsibility for the functionality of the system, and SLAs, terminated as of the action, not on date of notification. I had two or three incidents where the passwords, etc., were misused or compromised, and we did not have any real difficulty with the client. Once they changed providers and the new provider ran roughshod through the network with predictable results. We explained the policy, and they clammed up. The owner blamed us, but in a year we were 'back in'... In anothe case, the owner changed consultants and ditched us, and made the changes in the middle of the night without notice. Hey, it's a 'Haitian divorce'. When he did notify us, we of course offered all asssistance, and saved the new player a lot of time figuring things out. That old boss saw no value in further annoying disgruntled customers or competitors. But if a client ever asked me for passwords, they got them. It's their system. If they really wanted to mess it up, they paid for it.
Oh well, my $.02
deleting the extra space after periods so i can stay relevant, yeah.
When the writer refers to the "plaintiff" in a criminal case. If he's that clueless (the plaintiff is part of a civil case; there is no plaintff in a criminal case) one such a simple point, what else is he using words he doesn't know the meaning of about.
Yeah, Childs' manager was, apparently, an asshole and an idiot. What he was not, however, was in criminal violation of the law. He was, in fact, specifically entititled to demand the passwords from Childs, and Childs was specifically required to fork them over.
The sentence might have been a little harsh, but IIRC, the network in question was configured in such a way that if it lost power longer than the UPS's could handle, it couldn't boot back up without Childs' help, and didn't this network handle the 911 system for the city?
If thats what happened we might consider thinking about it that way, but thats not what happened.
What happened is the nuke plants policy is to put all those codes in a known secured location so that authorized personal can get to them. Instead he didn't do that, then when they wanted to move him over to being a janitor since he clearly wasn't a good admin he continued to refuse to follow policy and then refused to do anything else citing policy as his excuse.
You don't get to not follow policy then use it as your excuse.
You either follow it or you don't, he was picking and choosing to suit his agenda at the time.
He also would never have been hired to work at such a location because they have better screening policies to prevent megalomaniacs from being that close to such potentially dangerous equipment.
This situation wouldn't arise at a nuclear plant ... they would have shot him much earlier on for all the shit he was doing against policy.
You might want to get some facts about the case ... like what he actually did and what policies he was/wasnt' following.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
He doesn't get a life sentence cause I shouldn't have to pay for supporting him.
I will however be happy to pay for the gun and the bullet. Anything to ensure he never has any chance of contributing to the gene pool and saving the rest of the world from having to deal with him.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Childs wasn't just a jerk. He was an incompetent. The big mistake was ever letting the guy have even the smallest amount of meaningful responsibility.
The world's burning. Moped Jesus spotted on I50. Details at 11.
The point that I haven't heard anything since is pointing out that they screwed up and didn't want to admit it but couldn't point the finger anywhere else. I suggested to the COO and the CEO/Owner that we just keep it in a safe at his house. I regularly work up there too so it makes keeping the thing up to date relatively simple. Make no mistake, I am never the only person that has a production password.
I definitely hold the people responsible accountable and the chain of command is jacked here as I've been through four bosses in seven years. When the new IT director came aboard per the owner's instructions I did not give him full access. I slowly increased his access as I felt comfortable with his abilities and now he has the same level of access I have which coincidentally means I can finally take a vacation. This I very much enjoy!
but when you busy yourself holding the usa responsible for crimes which are essentially human failures, not uniquely american failures, as if americans somehow had a monopoly on hubris or ego or arrogance in this world, then you reveal yourself to have some sort of chip on your shoulder and complex about americans and americanness
but don't worry about it. in your life time, china will be the new bully on the block. and then you can busy yourself blaming every neurosis you can identify about the human condition as something that is uniquely a chinese crime. what blazing insight (rolls eyes)
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Marley wore a Chain of Command because he had no idea how to remove it.
--
Ths sg n vwls.
I would presume either he or his lawyer didn't want one. I can find no speedy trial motion from his lawyer. Generally speaking, the defense wants to time to prepare and such a motion is not filed. However if they feel things are taking too long or as a certain kind of tactic, they can file one. At that point the judge tells the state "Ok get your shit ready we are going to trial soon," and sets a date. I can't find the California law on the matter (though I know they are a state that has one) but 6 months is pretty typical for a felony. If the state is not ready to present by that time, the court will give them no choice, they can go to trial unprepared or drop the charges.
However this only applies when the defense files for it. The court doesn't force a speedy trial if both sides are happy with a later date. Nor normally in that event it is either because the defendant is out on bail or because the defense has a really weak case, but regardless. Unless his lawyer filed a motion and it was ignored, which isn't likely because the appeals courts hear those things as a priority, then it is not an issue.
It is one of those rights you have to assert. If you want a speedy trial, you have to ask for it. Same deal as a right to council during questioning. You have to tell them you are not answering questions and want a lawyer. I mean you can just not answer questions, but if you don't ask for a lawyer they don't have to get you one.
If this was such a big concern for Childs, why didn't he have these key passwords and router configs in the Mayor's office
He was going to get around to doing it, but he had so much junk assigned to him to be done that he couldn't get basic essentials like documentation finished?
shrugs
Following the letter of your contract is what individuals are supposed to do, when doing work for the government. The contract is written for a reason, contracts are meant to protect both parties.
I want to clarify that I didn't use the term "scapegoat" to imply that Childs was a completely innocent victim being raped and pillaged by the big evil city. What I was trying to say is that it would be a pity of the city's IT department used Childs as a scapegoat for fixing their own incompetence. As in, "Well, now that he is gone, things will be working out fine and dandy around here from now on."
In other words, my point was that the problems with the SF city procedures are not fixed yet and I hope the Childs ruling does not keep them from getting fixed (in other words, being used as a scapegoat to avoid an overhaul of the city procedures). Perhaps that explanation will quell some of you respondents that are insisting that I neither know the facts or that I am making an uninformed assertion.;)
Motorcycles, Robots, Space Gossip and More!
But was it denial of service if physical access was never denied? If you have physical access to a machine, you can get the root password, or at least reset it. This is why they lock these things up.
Any sufficiently unpopular but cohesive argument is indistinguishable from trolling.
Please cite a legal authority for your assertion that passwords are "property".
Go put a chain and padlock on your neighbor's gate and see if you get in any trouble.
Well, in criminal terms, that's "vandalism", as a Tort, might be considered "trespass to chattels" (warning: IANAL). Withholding a password is not "vandalism", and I think that would be even more of a stretch than the "anti-hacking" statute under which he was convicted.
Essentially what they got him on was "denying services to authorized users", which takes quite a bit of intellectual contortion, since no-one ever proved that his actions directly prevented services to any end-user
He denied access to the replacement administrators.
But they are the providers of the "service", not the intended beneficiaries of it. I think that's an important legal distinction to make -- there's no evidence that Terry ever targeted the users of the network with any kind of malicious intent. It was merely a scuffle amongst the providers of the service, something that happens all the time in workplaces. Even if he had remained in the employ of the City of San Francisco, he could have -- and reportedly did -- keep information about the particulars of the network, its architecture and its configuration, from other administrators and his management. This happens every day in workplaces all across the U.S. and in fact the world. No-one is compelled to disclose everything they know about their work, at the request of anyone and everyone who works in the same place. While a secretive, distrusting and/or insular employee may be grounds for disciplinary action, up to potentially -- actually, as it turns out in Terry's case -- termination, having "special" knowledge about the network, and not sharing it, is not "hacking" and not criminal.
I think the main disconnect here is that people view passwords as disconnected facilitators of "access" (however that is defined), more analogous to a physical key than to a piece of information. But I see those passwords as being at the end of a continuum of "special knowledge" that one may have about a network, or some other IT system, whether it be Operating System, application, or network infrastructure. What use would it be to give someone a password to a network infrastructure device, but they have no clue how to configure it, how to troubleshoot problems, how to even understand the role that the device plays in the overall infrastructure? Having the password to a router, a switch, a fiber concentrator, or whatever, doesn't mean you can do anything useful with it. So the threshold isn't just "password", in practical terms it's "password + other special knowledge necessary to do something useful with that access". Certainly Terry had "special knowledge" about FiberWAN that he wasn't willing to share with his co-workers or management. Passwords were only the tip of the iceberg. But to criminalize this behavior threatens to drill deep into the iceberg to other forms of "special knowledge" that workers withhold from each other and from their management on a regular basis. That's why it's such a dangerous ruling, and why it has vastly overextended the concept of "hacking", which is about protecting the society at large from the malicious actions of individuals against electronic systems.
I don't think it's an exaggeration to say that this precedent endangers all of us in the IT field -- taken to its extreme, it means employers can lay claim to anything that ex-employees know, if it helps them run their systems or their networks better.
Only because you're trying really, really hard to turn this into something it's not. Not turning over the passwords blocked the new adminsitrators from accessing the systems, just as if he DDoS'ed the management ports.
It didn't block
You're comparing murder to this? Wow. Talk about having no sense of scale.
"There is a way that seems right to a man, but its end is the way of death." Proverbs 16:25 (NKJV)
.... He's shown that he can't set aside his ego and such a person has no business having system level passwords.
but he'd make good management!
Be seeing you...
what about the policies that left him as the only admin for the network or that woman who has snooping around the IT office / his desk and takeing disks and no one told him the she was the new IT person.
Did a good job? The guy was keeping passwords and router configs in his head. He may be the best IOS programmer around, but that isn't the mark of a good job, that's the mark of an incredible idiot.
No - he was keeping them on media that he carried on his person.
1/12 is still largely non technical. In fact it's the smallest proportion of technical that you can have on a jury which isn't entirely non-technical. And as he says, he didn't make any technical considerations anyway. All the knowledge & experience in the world is worthless if you choose not to use it.
FGD 135
Childs is to IT as Hustler is to free speech. If it applies to the "worst"of us it applies to the rest of us.
So he was bad at his job. But here's the question you're only giving a brief nod to: is being bad at your job a crime worse than murder?!
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
doing the limit when others are doing 70+ is not safe.
Try doing 55 on I-294, I-355, I-88, Tri-State Tollway, Jane Addams Memorial Tollway and other roads.
Most cars + trucks are doing 70+ in a 55 and cops let you get away with at least 60-65 and likely 69-70. and on I-94 after the state line you can get away with 70 in a 65.
"Moved to a legal system"? I think it's better said "finally recognized the fundamental character of our (and all) government."
We are the people the Constitution was written both to protect, and to protect against.
really, it's only two more... that's why they had to make it so long. Had they followed normal sentencing he would have been convicted and still walked out the door for time served while he was waiting to be tried, they had to have the judge extend the sentencing to prove a point.
exactly! He DID give the passwords to the network's "owner" that was the Mayor within "reasonable" time, less than a week after being locked in jail. And he did so without any kind of civil court order to turn over the "property" so the city never actually established in court that they OWNED the property they accused him of "stealing". The PROPER procedure to follow would have been to get a judge to issue an order for Childs to turn over the "property", then they would have easily had him for contempt of court and could have sweated him in jail for as long as it took. As the DA and IT manager never LEGALLY ASKED for the passwords in any kind of binding manner his prosecution was literally under false pretexts, a waste of money, and abuse of official power.
Childs wasn't just a jerk. He was an incompetent.
Are still on that?
If being incompetent in IT is a felony, we need a hell of a lot more prisons.
He certainly sounds incompetent, but he's in jail because hes a jerk- and thats _wrong_.
Well, this is what I read:
"The COO and Controller emptied the safe and now I do not know where that paperwork wound up. I changed my critical passwords and VPN encryption keys. Then the time came where they wanted the list of passwords. I asked them where the old list was and I haven't heard anything since."
So far, he seems to have left the COO and Controller either cowed that they didn't know htey had the passwords they were looking for, or confused that their net admin just answered a question with a question. Note he hadn't given them what they asked for, and didn't indicate at the time that they didn't have the authority to get them. So my concern was that he was close to using Childs' excuse - incompetence of superiors.
Then I read this:
"Now for my own sanity I still keep a copy of the records but it is no small feat to change all the sensitive passwords so I keep them in the safe of the owner who has already twice forgotten that he has it. He asks me for it personally sometimes. If the time came I don't believe he would know its in his safe."
I'm a little lost - is the 'owner' the COO? Probably not, so I'm fairly certain that either the COO and Controller did get their passwords (either by finding them or asking again with different results, good for them) or they did not (which would reinforce my point).
It's not nearly as clear to me as you claim it is to you. Either way, Vancorps seems to still have the job, so he (?) has a much better assessment of the situation than I do. No surprise there.
deleting the extra space after periods so i can stay relevant, yeah.
I'll add -since I apparently don't know when to leave it alone (surprisingly _i"m not in prison!):
The big mistake was ever letting the guy have even the smallest amount of meaningful responsibility.
Then why isn't the person responsible, manager/department head/whoever, rotting in jail next to him?
they FIRED somebody with special knowledge and CRIMINALLY charged HIM for not helping them out. That is the big problem here. What is the "statute of limitations" on turning over passwords? I know one of my former employers kept a password I set in place at least a year after I was "escorted to the door", and I expressly told my boss all my work was documented in my computer and office paperwork. In less than 3 months they were asking for help and they had not even reviewed the material I left them. Would I be "liable" for not disclosing in that case? Once they announce I'm terminated, that's it, they stop paying, I don't owe them anything.
All the city really needed to do was to schedule some downtime and plan a router reset once they knew what was configured. Like other posters have said, they would have had the same "damages" if he would have quit and left the state, or if he had been "hit by a bus". The manager's lack of planning for firing this person (and it was planned for months) is at fault, not the employee's cooperation. It's a "cost of doing business" that you have to rework your security.... after this case, your boss can claim that cost is "hacking" on your part and a criminal act.. very, very scary considering they can "police escort" you in on criminal charges for an employment dispute.
So, what you're saying is that people will more easily believe a big lie then a small one.
I disagree, in many western cultures there is an attitude against just "accepting" the "truth" (smiles and nods). Hence the saying "truth is stranger then fiction". This is why we have such insane laws around misrepresenting the truth in media. As for eastern culture, well define simple. A Thai girl seems to operate on simple things, if she's hungry, she eats, if she's tired, she sleeps but this all goes out the window when you try to understand the social dynamic, who is higher, lower, indebted, honoured, distrusted, and try doing this without speaking Thai (oh the joys of tonal language). It may look simple on the outside, until a Thai girl spends three hours explaining what happened in a 10 minute conversation with one of her friends. Even in the west we have quite complex social systems (games people play in the office, sociopaths, even just finding a girl friend)
The thinking that humans crave simplicity is flawed as we tend to fill our lives with complexity be it a complex social systems, complex technologies, complex learning or many other complex systems. If we had a primal drive for simplicity, we'd have never left the trees.
Don't get me wrong, this is not a yank bash, I think American society is as nuanced as most societies, maybe a bit more open then say Thai or Japanese but just as complex. But your news channels tend to be full of crap and not indicative of your society as a whole, more a product of a bad subset of Americans.
Calling someone a "hater" only means you can not rationally rebut their argument.
Because that guy may be an incompetent, but he's not a criminal.
The world's burning. Moped Jesus spotted on I50. Details at 11.
It what way is he worse than the person that started it all off - the woman the was caught by Terry Childs in an office she shouldn't have been in and removing the hard drive of the person responsible for network security? Certainly authority was given later after the person responsible for network security resigned, but it looks like Terry Childs is a very minor case of overstepping authority in his own department. The entire thing is petty office politics in a disfunctional workplace escalated to the point where they put someone that did not roll over instantly to an unusual instruction into jail.
Think about that stupid ambush meeting tactic and you'll see there was no way there could be a good outcome - hand over the passwords to unauthorised people and he's in deep trouble, and it turned out waiting until the unauthorised people were out of earshot was deeper trouble and a media circus (met by the Mayor and a publicity agent instead of his boss, technical consultant, or anybody else interested in doing the job instead of camera time).
While a notebook full of passwords in a safe would have answered this problem, consider that the entire password issue is mainly a beat up because he handed them over anyway, and that anyone competant enough to work on the devices that had physical access to them could change the passwords anyway. Configuration information gets lost, but nobody gets locked out forever and THEY HAD THE PASSWORDS IN LESS TIME THAN IT TOOK TO GET A REPLACEMENT FOR HIM ANYWAY.
So that's it - jail for not handing over passwords to the wrong people and sitting and waiting for somebody else to turn up. I think you need to reconsider whether overblown emotive words like "megalomaniac" actually fit the situation. I suspect you are bringing in a pile of your own baggage from IT restrictions you suffer from and demonising this man as a Bastard Operator from Hell.
Would they really? It happens more than you think and results in less downtime than you think, and until now nobody went to jail over it. I've personally been in a situation where I had to take over a pile of systems blind - no passwords, no labels on the machines revealing their role. What the hysterical people posting to these articles do not understand is that once you have physical access to a device it really doesn't take very long to get control of it.
The only crime I see here is workplace bullying taken to the extreme of putting the guy in jail - sloppy work practices that cannot physically hurt somebody are not a crime.
city IT config management was not in place when he started the job and over the time from when he stared to him going to jail lots of staff where going though layoffs and he was doing big time over time at the same time.
For some people documentation is job number one - for others maintaining network uptime is job number one.
Remember that after he was asked in a room full of people not authorised to know the passwords he was stuck in prison and had to wait for somebody to come to him. Just because it was the Mayor, a PR guy and TV cameras doesn't mean he asked for that.
Where is the evidence that he actually would not agree to turn it over to anyone else? It's been asserted a lot, but remember some of the early claims that tunred out to be utter bullshit.
"The great strength of political Conservatives at this time (and for a generation) is that they are open to the thought that matters are Complex. Liberals got into a reflexive pattern of denying this. I had hoped twelve years in the wilderness might have changed this; it may be it has only reinforced it. If this is so, the current revival of liberalism will be brief and inconsequential." -Senator Patrick Moynihan, 1996.
Take that for what you will.
Doing a shitty job doesn't sposed to land you in stir for 4 years. You get fired. That's it. And your boss gets fired for not firing you a long time ago.
The US has gone well and truly insane. Really. People here are all bat-shit bonkers. Before my life is over, it's going to get world class ugly. Smile and have a nice day!
Social Credit would solve everything...
It's not equivalent. The state has an obligation to treat similar cases similarly. Equal Protection and Due Process and all that, you know. Therefore pointing out that Childs' sentence is way out of line with sentences handed out in similar cases is a a compelling argument that his punishment was, in fact, unfair.
Mart
"I know I will be modded down for this": where's the option '-1, Asking for it'?
When some serious crime is committed against you, you will want revenge and theres nothing you can say or do that will stop that.
There are lots of thing that I want on an instinctual level. When I see a very attractive woman walking on the street I'd really like to have sex with her. When I hear someone spouting ignorant nonsense I'd very much like to bring my fist into sharp contact with their nose.
We're not animals. We have the ability to think rationally and make a conscious decision to not give in the reptile riding on the back of a monkey. Well, most of us anyway. Whether we actually do so is mostly a matter of choice.
People replying to my sig annoy me. That's why I change it all the time.
No, they charged him for actively blocking access to the old systems.
No, because 'Exhibit A' for the defense at any trial would be your documentation, proving that you _were not_ blocking access.
The fact that we call it "hacking" instead of "vandalism" isn't terribly relevant. Language changes. In both cases, you are denying someone access to their property.
Ah, I see. You wrote a thousand words to pretend that this is about something completely irrelevant.
It's really simple. It wasn't Childs's network. They said "return control to us". Childs said "No".
Even if we wander off into your fantasy land where passwords are knowledge instead of means of access, then Childs should have created new admin accounts for the new administrators. He explicitly refused to create those new accounts, which is when he got fired. At that point, it became an attempt to recover his passwords instead.
Not your, or Childs's, decision. The boss says "give them access". The correct response (after getting the request in writing) is to say "Yes, sir/ma'am". The incorrect response is to say "No! They aren't good enough!".
Oh come on. This argument is absurd.
He was not passively sitting in his office until the police showed up and arrested him. He refused to create new admin accounts. He was told his insubordination would get him fired. He continued to tell his bosses "No". That's when he got fired and his bosses asked for his passwords. At which point he still said "No".
To claim that Childs was absolutely passive in this entire adventure is insane.
Therefore pointing out that Childs' sentence is way out of line with sentences handed out in similar cases is a a compelling argument that his punishment was, in fact, unfair.
That's just it -- the author didn't manage that. All of those sentences were pretty well on the same order of magnitude.
He certainly sounds incompetent, but he's in jail because hes a jerk- and thats _wrong_.
It sure would be wrong if he was in jail because he is a jerk. But he isn't. He is in jail because he was found guilty of felony network tampering.
Did he just say "Fuck Occam and his rusty ass razor?" Sounded just like it...
When the only tool you have is a claw hammer every problem starts to look like the back of someone's skull.
+1 irony
Sometimes, life itself is sarcasm...
That's more like it. However read it, consider the Mayor's showmanship in court and you'll see that good or bad Terry Childs was a toy in a nasty little profile boosting game in a disfunctional city government. He deserved to lose his job, but not prison time. I still stand by it being a ridiculous beatup over office politics gone wrong which we would never have seen in an organisation that didn't have cops on the payroll or somebody that wanted to look like a hero in front of the cameras.
His employer wanted to hurt him and went law shopping until they found something they could make fit, after a few tries and some truly outragous claims. That is not justice, it's Chinese Communist style "might is right".
Should you get jail time for speeding?
You get a fine.
Why can't he get a fine? or be barred from IT work for X years? What is the point of locking him in a cage like a rabid animal? punishment can take many forms.
Democracy Now! - uncensored, anti-establishment news
again, you miss the point... he was fired for not documenting, so be it. Once he was fired, there was no other duty to the boss. They FIRED HIM!
In the US we have "innocent until proven guilty" in our legal system... as this is a CRIMINAL trial, not a CIVIL trial the burden of proof is that he COMMITTED a criminal act, not omitted something that denied them access. He did not deprive them of their property in ANY way. There was no evidence AFTER being fired he DID ANY damage to their systems, none. He didn't give them the passwords, so what? They had PHYSICAL access, they COULD have gotten control back.. that is the COST of firing an employee that knows more than you.
If you don't see what happened here, essentially they had no backup plan, and couldn't even hire smart enough people to reset the passwords without wrecking their network! It would not have been easy to redo the network, but it was running stable until they had the time to reconfigure it. Sure that is extra cost, but given the terms of letting him go, they should have spent the money on a network rebuild anyway. (again, not the EMPLOYEE's fault THEY don't trust him anymore) Any additional cost was the MANAGEMENT'S fault, not the employee's. This sets a DANGEROUS precedent that an employer can use CRIMINAL charges if you don't give them what they THINK they need, when they think they need it AFTER they let you go.
Absolutely wrong.
His boss told him he was being reassigned, and told him to give access to his replacement. Childs refused. His boss gave him lots of chances to change his mind, and Childs continued to refuse. Then he was fired. When fired, he was required to return control to his boss, which he refused to do.
Again, absolutely wrong. The city couldn't use the administrative features of their network, because Childs first refused to create an admin account for his replacement, and then refused to turn over his passwords when fired.
This isn't about "backup plan", or competence of the city. That's a red herring thrown about by Childs's supporters in an attempt to turn this into some sort of evil government plot.
This is very, very simple: Childs blocked access to the new administrators of the network. After WAY too many chances, he continued to block access. That's a DoS attack.
So...didn't pay attention to the case at all? Just leaping in at the end with what the case 'means' without any knowledge? Password recovery is a major security hole, so it's routine to disable password recovery mechanisms. Which Childs did. That means the only way in without Childs's passwords was to factory reset the equipment, thus wrecking the network.
And still absolutely wrong.
This became a criminal matter because Childs made it a criminal matter with insane levels of stupidity and ego. He had many chances to do it the right way (create that new admin account), and many chances to do it the wrong way (you're fired, now turn over your passwords). Childs chose to elevate this situation into a criminal matter....oh wait, I'm sorry. I didn't capitalize that word in an attempt to make it seem more important. Childs chose to elevate this situation into a CRIMINAL matter.
This case doesn't set some sort of DANGEROUS precedent, because only a trivial number of people are so STUPID. This is not a "one little guy trying to do the right thing and the MAN locking him up". This is a MORON who's EGO was so enormous that he 1) Got himself fired, despite many second chances, and 2) Got himself arrested.
Personally, I'm HARD pressed to come up with a reason to BE so obstinate, unless Childs was hiding something really bad IN the flash memory of those routers. (That's a capital period, btw)