Slashdot Mirror
Judge Orders Former San Francisco Admin Terry Childs To Pay $1.5M
0WaitState writes "A judge Tuesday ordered a former city worker who locked San Francisco out of its main computer network for 12 days in 2008 to pay nearly $1.5 million in restitution, prosecutors said.' Keep in mind the network never went down and no user services were denied, and given that Terry Childs was the only one who had admin access (for years prior) it is difficult to understand how they came up in $1.5 million in costs, unless they're billing Terry Childs for the City's own failure to set up division of responsibility and standby emergency access procedures?"
I forget a lot of what he said, but one of the points which stuck out for me was that Terry kept the keys / passwords out of the key management system, which was against policy. He kept the Keys to the Kingdom in his head, which is just bad IT policy. He also cleaned the backup configs on switches so that any reboots would essentially wipe them clean.
/. poster was on the jury. He'll chip in with better information than anyone else. As for the fine... Well, if he doesn't have that money, he'll default like everyone else would and live off welfare. Shows the system works, eh?
Like I said, a
Finally had enough. Come see us over at https://soylentnews.org/
It's probably billing him for the temerity to actually take his case to trial.
You know, exercising his constitutional rights. That's something the "justice" system has to punish at all costs.
Here's some info for you.
Here's more.
Or, to put it in a more sinister way: You get a heavier sentence if you insist on asserting your constitutional rights to a trial, to confront your accusers, to privacy from searches without probable cause, to avoid incriminating yourself, etc.
Certainly the management of San Francisco has some responsibility for what happened.
However, I disagree with the assessment that Terry Childs is without blame, as is implied in the article summary. If I hold hostages and demand ransom but later release the hostages, does that mean I did nothing wrong? While Childs didn't literally take hostages, figuratively that's exactly what he did.
The justification for making Childs pay restitution is that the city of San Francisco attempted other means of gaining control of the systems while Childs refused to cooperate. Those attempts cost some money, and that's money that would otherwise be billed to taxpayers.
Why should I feel that Childs is being treated unfairly? He had to know that if he fought those in power, they would find a way to take him down.
How is it out of hand? It's been reported that the spent $900,000 trying to regain control of the network. The amount that he is being asked to pay is not particularly excessive. Would you prefer that $900,000 gets billed to taxpayers?
Terry Childs was clearly on an excessive one-man power trip. I don't think too many on /. think that deserves jail time though.
A firing for unprofessional conduct: sure.
A $1.5M fine? This just adds to the farce.
I'm sure the head of the IMF will get a fair trial.
He has already been convicted (by the media) and is in jail. ... now all we need to do is to get most of Wall Street in jail.
They have been tried in the media but not put in jail.
Mr. Childs clashed with the new Security Manager on the subject of authentication and control, which led to poor formal review.
Sorting out fact from fiction in the Terry Childs case
he's paying it to the department of technology, not justice
Just because it's not a court-ordered bribe doesn't mean it's definitely not a punishment verdict.
How much is a full review of the network, from the bare bones upward, including reflashing all firmware, and checking all servers going to cost in a city wide network?
$1.5m would be cheap for that.
It blows my mind that the guy spent any time at all in jail for this, especially after the city lied about the access (they had access several days before he tuned over the passwords). It's worse when the city again lied, time and time again, in fact, in painting his actions and configurations as nefarious when they're all common practice. The sniffer thing, the modem stuff, the paging issue. Those lies the city told should have been a get out of jail free card for him by painting the city as the scumbags they are.
He did one thing wrong to his bosses, his bosses (via lawyer proxy, I assume) then turn around and lie in court, which is the real crime.
Along the same lines, this is why so many innocent people wind up striking plea bargains.
A friend of a friend is currently serving the second year of a one year sentence (!) for a crime he didn't commit. He didn't take it to trial, because the prosecutor threatened him with 10 years, and his lawyer convinced him that it just wasn't worth the risk.
I'm not claiming he's an innocent man. Just that he didn't commit the particular crime he's actually serving time for. It's a "Sleep with the dogs and pick up their fleas" sort of thing.
It annoys me when certain admins feel that they are freedom fighters when operating their boxes, makes them incredibly annoying to work with.
That's ok, you're equally annoying to work with because you don't take security seriously enough. There are some other people that I know of that didn't take security serious enough, who was that? Oh yeah, the security folk at Boston Logan International.
And how about this guy from last month:
http://www.geek.com/articles/news/man-wrongly-accused-of-child-porn-learns-to-password-protect-wifi-the-hard-way-20110426/
I bet he takes network security a lot more seriously now. Sysadmins that take security seriously are important because most other people aren't, except the malicious hackers.
Part of the problem is that the level of Security or a System is inverse to its level of Accessibility.
The more people can access systems and the more they can do with them, the less secure they can become.
The trick is finding the balance people are willing to live with (short of unplugging the computer, which makes it REAL secure BTW), and finding ways to mitigate/lessen the threat left by vectors where you find yourself.
I think the real problem is that too many non-security people don't view Computer Security as a serious issue, and too many security people view it as the major issue. This means when they both sit down at a table and try to find the balance point, neither side is happy and both sides feel the other one doesn't understand where they are coming from (which is often true).
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.