Slashdot Mirror
Judge Orders Former San Francisco Admin Terry Childs To Pay $1.5M
0WaitState writes "A judge Tuesday ordered a former city worker who locked San Francisco out of its main computer network for 12 days in 2008 to pay nearly $1.5 million in restitution, prosecutors said.' Keep in mind the network never went down and no user services were denied, and given that Terry Childs was the only one who had admin access (for years prior) it is difficult to understand how they came up in $1.5 million in costs, unless they're billing Terry Childs for the City's own failure to set up division of responsibility and standby emergency access procedures?"
We will make an example out of you, who cares about justice?
... who had had exposed hundreds of LIVE login/passwords to city administration system as 'proof', endangering the public system and the private information of citizens and even more, will pay ?
nothing ? i guessed as much. its all ok if you are a moron at the helm of a company or a public office. no really - i am much more polite and eloquent than what wordage you read here, but, i am at a loss to find any word other than moron for publicly exposing hundreds of live login/passwords in a public court. really. morons.
it appears terry childs was right.
Read radical news here
That explains why American culture is so obsessed with vigilante justice - the actual judicial system is fucking retarded .
Terry Childs did some mistakes. I think the restitution for damages is more justified than the criminal punishment he got.
CU, Martin
I forget a lot of what he said, but one of the points which stuck out for me was that Terry kept the keys / passwords out of the key management system, which was against policy. He kept the Keys to the Kingdom in his head, which is just bad IT policy. He also cleaned the backup configs on switches so that any reboots would essentially wipe them clean.
/. poster was on the jury. He'll chip in with better information than anyone else. As for the fine... Well, if he doesn't have that money, he'll default like everyone else would and live off welfare. Shows the system works, eh?
Like I said, a
Finally had enough. Come see us over at https://soylentnews.org/
I just RTFA. It says the money is to
repay the city for its efforts in trying to regain control over the FiberWAN network and later test it for vulnerabilities. City officials had been worried that Childs, who helped set up the network but clashed with his supervisors, might try to sabotage it.
Mind, he already spent 2 years in custody and was convicted to 4 years of jail.
At first I thought the citizens were going to have to pay for the cleanup and fixing of all the problems, along with the trial and all that. Now that I know this criminal with no job prospects will be paying the $1.5M I can sleep better at night.
My personal ideas about job integrity end at or a little before the threat of getting arrested so I could argue I don't think what he did was wise (I would've made the guy wanting the passwords put it in writing and then quietly laughed when they broke things), but I don't think the punishment fits the crime at all. Why is there never a middle ground in the justice system between ruining someones life and letting them go free?
And why can't the city just let this one go? They won a long time ago.. back when he was fired, jailed, etc and he surrendered the passwords without the network ever going down.
He did not care about security other than his own job security. He was one of 'those' types of IT people. You know the ones I mean -- they think "job security" means keeping all the secrets locked away so that only he can fix things when they are broken. Furthermore, they tend to behave as if they own the networks and servers they maintain and they tend to hide their limitations of knowledge and experience from others as well as being unwilling to share what little knowledge they actually have. There might have been a time when that was common enough to be acceptable, but today's business and government leaders see through this.
Good riddance to bad rubbish. "Vendor lock-in" is evil regardless of who practices it.
so I looked myself and found this article
http://sfappeal.com/news/2011/05/sf-network-engineer-convicted-of-witholding-passwords-ordered-to-pay-15-million-restitution.php
"No city services were ever affected, but officials said they could have been crippled if power had somehow been shut off.
A jury convicted Childs in April 2010 of a computer tampering-related charge, and today San Francisco Superior Court Judge Teri Jackson ordered him to pay $1,485,791 in restitution to the Department of Technology,"
he's paying it to the department of technology, not justice.. so... no...
every day http://en.wikipedia.org/wiki/Special:Random
The problem isn't that we're defending him. Most people on Slashdot think he's an idiot and a criminal. The problem is the $1.5 million fine. That's around 20 years of his salary (at a comfortable $75k/yr). It's not a matter of whether or not he's guilty or deserves punishment, it's a matter of letting the punishment fit the crime. That pesky eighth amendment that mentions no excessive fines.
That scratching sound is onda technology getting added to the "don't use" list all around the world.
"...unless they're billing Terry Childs for the City's own failure to set up division of responsibility and standby emergency access procedures?"
What exactly is being insinuated here? That it's the City's fault that Childs decided to commit a crime?
Sorry, pal, it doesn't work that way. Yes, the city has a lot of work to do to clean up its IT policies, but that has no bearing whatsoever on Childs' decision to commit a criminal act.
"Ask not what your country can do for you." --John F. Kennedy
Terry Childs was clearly on an excessive one-man power trip. I don't think too many on /. think that deserves jail time though.
A firing for unprofessional conduct: sure.
A $1.5M fine? This just adds to the farce.
I'm sure the head of the IMF will get a fair trial.
He has already been convicted (by the media) and is in jail. ... now all we need to do is to get most of Wall Street in jail.
They have been tried in the media but not put in jail.
Mr. Childs clashed with the new Security Manager on the subject of authentication and control, which led to poor formal review.
Sorting out fact from fiction in the Terry Childs case
An IT guy on a power trip acted like a prick and that resulted in serious consequences. Let's see what the slashdot community thinks. ;)
This might as well be a story about getting arrested for living in mom's basement.
he's paying the price for embarrassing the powerful?
"If still these truths be held to be
Self evident."
-Edna St. Vincent Millay
yes, withhold passwords on a network resulting in no measurable loss, get 20yrs of income as fine. Damage and destroy an ecosystem causing loss of animal life and depressing an entire area economically; get fines that amount to about 7~mos of income. That's called justice.
If you think imaginary property and real property are the same, when does your house become public domain?
You are missing the point, next time, he, or any other sysadmin, when he faces the termination letter, he/she will follow the law to the letter. Which could mean that he could "forget" to inform you about some tricky passwords, terminals, systems, etc., and when YOUR system crashes, you could blame only YOURSELF, not the already terminated sysadmin that gave you "all the passwords", and who did not try to protect the public. You understand me? The difference between protecting yourself and the public? If not, go find this article about the hacked PSN hundreds of millions of stolen accounts.
The solution to that is to:
a) have more than one admin with access to passwords
b) not to act like a jerk to the admins you currently have
c) put a firm stop to people who try and take complete control of a system "for its own good"
Make no mistake, the City of SF is responsible for their own issues.
Still, Childs was just plain stupid. He should have:
a) not admitted to having passwords, since he could have easily said that he forgot them since he no longer works there
b) failing that, immediately given any and all passwords up
c) written a letter to the city or a newspaper, if he wanted to complain about the city, like any other citizen, instead of trying to be a martyr.
$1.5m is a little steep, I was leaning more towards a month or two in jail for being a dumbass, which would be time served. It annoys me when certain admins feel that they are freedom fighters when operating their boxes, makes them incredibly annoying to work with.
The punishment for not doing your job or doing it wrong by violating procedures or otherwise is getting fired. He was fired, that's plenty of punishment.
Anything else they are adding on top of it is a violation of his 8th amendment protections, any competent lawyer should get these extra penalties overturned.
HTML is obsolete. It's time for a new, simpler and richer markup language.
It annoys me when certain admins feel that they are freedom fighters when operating their boxes, makes them incredibly annoying to work with.
That's ok, you're equally annoying to work with because you don't take security seriously enough. There are some other people that I know of that didn't take security serious enough, who was that? Oh yeah, the security folk at Boston Logan International.
And how about this guy from last month:
http://www.geek.com/articles/news/man-wrongly-accused-of-child-porn-learns-to-password-protect-wifi-the-hard-way-20110426/
I bet he takes network security a lot more seriously now. Sysadmins that take security seriously are important because most other people aren't, except the malicious hackers.
Oh bullshit. He was part of the incompetence . At what point do we admit that Mr. Childs was just as irresponsible for neglecting to create an appropriate backup and contingency plan for outages, disaster recovery, etc. that allowed for someone else to get access to the passwords?
Where I'm sitting, any sysadmin with half a brain knows that a single point of failure is a no-no. Let's not pretend he was some white knight, if there were no adequate plans for password access in place, then he's just as incompetent as his managers were. Only difference is, he was incompetent, and broke the law in the process, by refusing to turn over the password to his management chain when he was reassigned and holding the network he was "protecting" hostage.
Part of the problem is that the level of Security or a System is inverse to its level of Accessibility.
The more people can access systems and the more they can do with them, the less secure they can become.
The trick is finding the balance people are willing to live with (short of unplugging the computer, which makes it REAL secure BTW), and finding ways to mitigate/lessen the threat left by vectors where you find yourself.
I think the real problem is that too many non-security people don't view Computer Security as a serious issue, and too many security people view it as the major issue. This means when they both sit down at a table and try to find the balance point, neither side is happy and both sides feel the other one doesn't understand where they are coming from (which is often true).
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.