IT Worker's Revenge Lands Her In Jail

aesoteric writes "A 30-year-old IT worker at a Florida-based health centre was this week sentenced to 19 months in a US federal prison for hacking, and then locking, her former employer's IT systems. Four days after being fired from the Suncoast Community Health Centers' for insubordination, Patricia Marie Fowler exacter her revenge by hacking the centre's systems, deleting files, changing passwords, removing access to infrastructure systems, and tampering with pay and accrued leave rates of staff."

Comments

Makes the rest of us suffer...

[Anonymous Coward]

Every time some person does stuff like this and it hits the press, every other IT person ends up suffering when the PHBs realize what the sysadmin or the Cisco guy is capable of.

Will this mean better security? Of course not. It just means that oftentimes someone who shouldn't have access to enable secrets or root passwords gets those as a "backup".

Re:Makes the rest of us suffer...

[hendersj]

Really, I think this just highlights something I've said for years: If you don't trust your IT people, they shouldn't be your IT people.

It's a job requirement to be trustworthy when working in IT. Those who aren't pull crap like this.

Even if she hadn't gone to jail, if she got caught tampering with systems (either while employed there or after being terminated), she should never, ever, under any circumstances be trusted to admin a system again.

Ever.

Re:Makes the rest of us suffer...

[Venik]

Really, I think this just highlights something I've said for years: If you don't trust your IT people, they shouldn't be your IT people.

And if you decided to fire them, make sure you terminate their access to your network in a timely manner. Somehow I seriously doubt Ms. Fowler actually "hacked" their systems. It is far more likely that after four days she discovered her remote access account still works and she took full advantage of this.

Re:Makes the rest of us suffer...

[Nadaka]

One difference is the respect that is shown and compensation provided to accountants, managers, legal advisers and so on. Meanwhile IT guys are basically treated like janitors.

Re:Makes the rest of us suffer...

[zolltron]

Meanwhile IT guys are basically treated like janitors.

The irony of your comment is that it reproduces exactly the line of thinking that you criticize. You realize that janitors, by having physical access to almost all parts of a business, are capable of more havoc than IT folks. They often have physical access to all the same systems that IT people do and much more. If potential to cause damage should correlate with compensation, I'd argue that the janitors should get paid the most in any organization.

Re:Makes the rest of us suffer...

[Americano]

Then you find a new job. You don't damage their systems and delete their data to "teach them a lesson."

Imagine if your doctor, after years of telling you to get your cholesterol under control, decided to amputate a leg because you didn't take his admonitions with the seriousness and "respect" he felt that you owed him.

Imagine if your mechanic came to your house one night and cut your brake lines because you hadn't praised his work as effusively as he felt you should have when you picked up your car.

This "you better treat us right, or else," is unprofessional bullshit. Someone behaving unprofessionally towards you is not cause to behave the same way in return.

Re:Makes the rest of us suffer...

[Hazelfield]

If you don't trust your IT people, they shouldn't be your IT people.

I think the managers sort of realized that, and that's why they fired her.
Maybe the true lesson to learn is this: don't let former employees keep their access. Not even for a few days.

Re:Makes the rest of us suffer...

[Mister Whirly]

Owner status trumps technical experience every time. Trust me, any PHB stupid enough to demand access to areas they know nothing about and then go messing about is going to screw something up. When they realize just how much money it will take to fix their screwups, sooner or later they will realize why it isn't smart to give themselves access to said areas. But if the owner demands the keys to the kingdom he owns, he get them whether or not it is the smart move or not. How long do you think any employee who refuses an order from the owner is going to last? And how do you go about determining who is qualified to make the decision if someone is qualified?

Re:Makes the rest of us suffer...

[dgatwood]

No one should have root passwords. The mere existence of a root password is a fundamental security hole. If everyone has a user account and certain people have sudo privileges, you have:

• An audit log
• A trivial way to cut off that person's admin access (with or without cutting off all access)

Combine this with a proper centralized authentication/directory services system, and you're done.

Re:Makes the rest of us suffer...

[TapeCutter]

This so called moron* is your employer (or their representative), HE has given YOU access to HIS equipment, not the other way around. He pays YOUR bills in return for you following HIS rules while operating the equpment HE has given YOU access to. It is his perogative to break anything that belongs to him, your job is to ADVISE him not to do so (and repair it when he says "opps"). If you don't like it when he ignores your ADVICE you are free to relinquish the access HE has granted to HIS property and leave, you are not free to force your advice on him (unless he is performing an illegal act). If because of personality/intelectual problems you cannot abide by this universal employer/employee contract and have come to believe it's you right to deny him access to his property then he will need HIS passwords to grant access to the person he replaces you with when he fires your contemptuous arse. The same principles apply to everything from the combination to the company safe to the keys to the janitors closet, the only thing you have an implied right to withold from your PHB are your PERSONAL passwords, swipe cards, etc. You DO NOT have the right to deny your employer access to their property, regardless of how much better you think you can care for it.

* - If he is the moron then why is it that you are working for him?

Um good?

[Hatta]

Person commits crime, goes to jail. Fascinating reporting there.

Harsh Sentence

[Manip]

I love how computer crimes are measured on an entirely different scale to all other crimes. While I think her crime was serious, when you look at the prison sentence relative to other things it seem disproportionate. If she had done the same thing without a computer I bet she would see less than 1/2 the jail time.

Re:Harsh Sentence

[Monkeedude1212]

No, I'm pretty sure she would have been rehired and promoted into a management position.

Re:Harsh Sentence

[Delusion_]

My point is that you are convicted by a jury of your peers and not a jury of your victims for a good reason; a jury and a judge have a better ability to be dispassionate.

That we involve victims in sentencing hearings is abominable, as is that we enforce arbitrary minimum sentencing regulations.

If I am guilty of a crime, what I did is what should matter, not how good or bad a person the victim was. Rather than go down Hypothetical Alley with you about the value of human life, I'd like to keep our hypothetical closer to the facts:

Would this crime be more heinous "your IT department", as you put it, were genuinely good people? Would it worth less sentencing if it took place at an equivalent organization whose IT staff was lazy and whose managers were bombastic annoying pricks? Surely not. In that case, your opinions as the victim as to what the guilty party deserves regarding sentencing are too compromised.

What?

[segedunum]

Fowler's attack on the company's firewall, which had caused a "lockout", took Federal Bureau of Investigations (FBI) three months to resolve.

What? Seriously. What? What the hell is a lockout and why would it take anyone three months to solve a firewall issue?

Re:What?

[Charliemopps]

I'm fairly sure I know exactly what she did. Most companies have the same security flaw. They have their network hardware resolve user names and passwords the same way all their workstations do. They also have a "Lockout" if you get the password wrong a certain number of times (usually 3.) I'm sure you've seen this before. The vaulnerability is, if you then have everyones email be: userid@yourcompany.com, anyone can very easily pull down a full listed of userids from the exchange server. The companies address list literally has every userid in the company. You then simply write a script to hit a piece of network equipment 3x with a garbage password for every single user in the company. Because it's a telnet connection it's REALLY fast. The system locks out every single user. If the admins weren't smart enough to reserve a single master login (and they usually are not) you can cripple the entire company.

did she really "hack" it?

[darjen]

or did she use passwords she already had to get into the system? I wouldn't be surprised if this was yet more abuse of the word "hacking".

Re:did she really "hack" it?

[TheRaven64]

Given some of the 'hacks' that have been reported here over the last year, I think hack now means 'use a computer in a way that the writer does not completely understand.'

Re:Yeah, but...

[MobileTatsu-NJG]

is she hot?
Also, does she run linux at home?

You may choose only one.