Withhold Passwords From Your Employer, Go To Jail?

ericgoldman writes "Terry Childs was a network engineer in San Francisco, and he was the only employee with passwords to the network. After he was fired, he withheld the passwords from his former employer, preventing his employer from controlling its own network. Recently, a California appeals court upheld his conviction for violating California's computer crime law, including a 4 year jail sentence and $1.5 million of restitution. The ruling (PDF) provides a good cautionary tale for anyone who thinks they can gain leverage over their employer or increase job security by controlling key passwords."

Comments

Passwords are property of the employer

[ackthpt]

I don't care if you made them up, they are the property of your employer.

Now the stupid thing here is Terry doesn't just engage in "burning bridges", but does it with himself standing in the middle. I can't feel pity for this fool.

Re:Passwords are property of the employer

[Anonymous Coward]

So passwords are property now? Fine. You have used my password for a while now. Pay up or go to jail.

Re:Passwords are property of the employer

[Livius]

It's no different than physically walking out with the hardware.

In fact, I think it already falls under some form of trespass.

Re:Passwords are property of the employer

[s.petry]

While funny, the issue is not with a personal password. These are passwords for infrastructure. It's kind of like working for a trucking company and taking the truck keys with you when you quit, except that it sounds like this was a pretty big ass truck (thinking in $$).

Could the company get a new set of passwords? Sure, same as the truck company could get a new set of keys made. But while they were waiting to access their property they lost money at a minimum. Since they were not _your_ trucks or devices you have no right to refuse to give them their keys back.

Re:Passwords are property of the employer

[noh8rz10]

It's kind of like working for a trucking company and taking the truck keys with you when you quit, except that it sounds like this was a pretty big ass truck (thinking in $$).

it basically shut down the city of san francisco for at least two weeks. they held the guy in jail, but he refused to divulge. the mayor even went to the jail to ask him personally. he deserves prison.

Re:Passwords are property of the employer

[hawk]

As an attorney, I could easily see prosecuting these under traditional property crimes, as well: a password is a type of property, and taking it could be larceny, for example.

Such laws certainly make the prosecution easier (to the dismay of my criminal law partner)

hawk, esq.

Re:Passwords are property of the employer

[Frosty Piss]

I don't care if you made them up, they are the property of your employer.

Now the stupid thing here is Terry doesn't just engage in "burning bridges", but does it with himself standing in the middle. I can't feel pity for this fool.

It's interesting that this seems to be the prevailing opinion now. But when this all went down, Terry Childs was the Slashdot Poster Child. Why have opinions changed?

Re:Passwords are property of the employer

[Anonymous Coward]

A password is not property, it's information. If my employer or ex-employer wants access to my accounts they can reset my password. I'll never divulge it to them.

Re:Passwords are property of the employer

[s.petry]

I agree with you completely.

Re:Passwords are property of the employer

[JDAustin]

Buts its not your accounts we're talking about here. It's account belonging to the employer that you were hired to manage.

Re:Passwords are property of the employer

[PlusFiveTroll]

Well, first a bunch of time has passed giving people time to think. It's not an 'unfolding story' either, all the details are out there. And lastly, 5 years is time for many slashdotters to get older/grow up. It's easy to make a weird judgement on property when you're young and don't have any, but all of a sudden you're 30 and you have a house, car, and a well paying job you tend to look at things differently.

Re:Passwords are property of the employer

[Anonymous Coward]

""cautionary tale for anyone who thinks they can gain leverage over their employer or increase job security by controlling key passwords.""

and not the complete idiots of the company for leaving there passwords with one person, and not having a way to access by way of a default password. his lawyer must have been an idiot as well if he didn't make that argument.

Re:Passwords are property of the employer

[Anonymous Coward]

It's worse than that. He threw all of the spare keys into the ocean and then took the keys. The problem isn't that he wasn't saying his password, but that he had modified the system so that only his password worked, which was the malicious action. If it had been some oversight on the part of the employer that they fired the only employee without asking that such password be divulged or a second admin account be created he wouldn't have that obligation communicate his password.

Re:Passwords are property of the employer

[ShanghaiBill]

It's interesting that this seems to be the prevailing opinion now. But when this all went down, Terry Childs was the Slashdot Poster Child. Why have opinions changed?

I think that the main reason opinions changed was because when the story was first reported, the journalists got almost every fact wrong.

Re:Passwords are property of the employer

[Anonymous Coward]

Buts its not your accounts we're talking about here. It's account belonging to the employer that you were hired to manage.

If it's the employers account then it's their responsibility to get access to again. What if the guy died from a heart attack? It's not like he's embezzling funds, he's simply withholding information from an ex-employer.

I've refused to give employers passwords before. In one case I refused because:

A) I already provided it in documentation when I left.
B) They owed me back pay for work.
C) They were jerks.

Re:Passwords are property of the employer

[Anonymous Coward]

A password is not property, and in fact a properly engineered security design, you'll never find the password in the permanent memory of the system, it has no presence and as such is not a "thing" beyond a reasonable doubt thus Taking it can't be larceny. To use it without authorization to do so may be trespass. Using a password it to remove all other passwords to access a system and then refusing to divulge it borders on conversion, but not beyond a reasonable doubt on those facts along (you'd also have to show that the system was used beyond any possibly reasonable scope of the employment, such as after the fire date) , but both offences, trespass, and conversion, are in relation to the computer system the password gives access to, rather than the password per se.

Re:Passwords are property of the employer

[Anonymous Coward]

He went a step further and rigged the trucks to explode (erase all data on the network) if they were started without his own key, even if they managed to recover and use one of those spare keys.

Re:Passwords are property of the employer

[Anonymous Coward]

Couple of observations.

1: Taken to it's logical conclusion, the right to own the knowledge in someone Else's head is tantamount to slavery. Please do not attempt to extend property rights in this direction; teachers owning the knowledge in students heads is perverse usury; is demonstrably destructive to the progress of society and technology and you know it.

2: It has been ruled time and time again, it's the Employers sole responsibility and privilege to define, audit, move, add, change, and revoke security systems access; an employer the size of San Francisco has no excuse to strictly control such. There is no implicit lawful requirement for computer users to retain Login information during or after termination of employment unless the employer writes a contract and even then, it's a civil requirement. There's a perfectly plausible reason for an employee to destroy such information; namely to exonerate oneself from the use of such logins against the company after their termination by other individuals within the company (E.G. Other Techs hacking your logins and going payroll fishing from a vpn with it). Even while employed, There's a fine line between will-full destruction of property and incompetence.

3: Quoting the law:
"(5)Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network."

That's what he was found guilty under. What systems administrator or programmer would do business in the state of California with such a vague law? Be Incompetent, Fuck up, have a vengeful boss, go to jail. That's what this case is really about; the ability of state officials to fail to routinely document and confirm systems access by employee's whom make 100k+ a year who's job responsibility is to configure and maintain tens of millions of dollars of mission critical gear to toss your ass in jail on the flimsiest of reasons because they don't want to be bothered with kindergarten simple shit.

Even if he really was a malicious, self-serving, rent-seeking prick, being convicted under that law is complete and total bullshit.

Re:Passwords are property of the employer

[UnknownSoldier]

Exactly.

Passwords are like keys. As an employee you are authorized to use the keys even though they are not your property.

Holding them for ransom is not the way to get "the man" to change.

Re: Passwords are property of the employer

[Anonymous Coward]

I agree, and would even go further to say become republicans as they mature.

Re:Passwords are property of the employer

[mrchaotica]

Holy shit, that was 5 years ago! Great, now you've made me feel old...

Re:Passwords are property of the employer

[Zemran]

They may be entitled to the passwords but for me to tell them the passwords or to listen them asking for them is work and I no longer work for them. They should have implemented a policy at the time (during my employment) whereby such things were recorded.

Re:Passwords are property of the employer

[Anonymous Coward]

And lastly, 5 years is time for many slashdotters to get older/grow up.

A silly explanation.

It's easy to make a weird judgement on property when you're young and don't have any

But it's always easy to do when it's someone else's property. Again, this explanation is insufficient and is simply an attack on those who disagree.

I actually do agree that this guy is an asshole, though.

Re:Passwords are property of the employer

[Zemran]

Not in anyway similar. If you take the keys to their trucks you are stealing but if you stop work there is no theft involved. If you want me to talk to you then that is work and I no longer work for you. You should have implemented a better system when I was employed for you. To take this into the real world, what would have happened if he had been killed in a traffic accident? The same procedure that would go into place in such an event should also work during a dismissal. If you do not have such a procedure do not blame the guy that you just sacked as that would make as much sense as blaming a dead guy. It is your fault.

Re:Passwords are property of the employer

[Anonymous Coward]

What if he claimed he forgot?

Re:Passwords are property of the employer

[MightyMartian]

I dare you to take the keys to your boss's car and when confronted by legal proceedings, use the likely lack of policy saying "You must turn in your employer's keys" as your big argument for your behavior.

Re:Passwords are property of the employer

[Cramer]

Except he didn't take the keys to a truck, he took the keys to all the trucks. One truck... easy enough to deal with. Thousands of trucks that people are currently driving... not quite so easy to recover.

Re:Passwords are property of the employer

[Anonymous Coward]

IIRC he was following policy and had agreed to give them to the Mayor, but they took him to court anyway.

Re:Passwords are property of the employer

[immaterial]

IIRC, Childs modified the system and changed the passwords in order to intentionally lock out the other sysadmins. This case was more like installing your own lock into the truck before quitting.

Re:Passwords are property of the employer

[Anonymous Coward]

Terry Childs didn't want to give the passwords to a new manager whom, he felt, was not technically competent.

He was, in other words, defending his work from being destroyed.

He did this by insisting on transferring these tokens of authority, visibly, to someone in authority.

For a few seconds, exposed to everyone's view was the underbelly of San Francisco IT, where promotion was more a question of gender and orientation than it was a question of technical competence - a foretaste of Silicon Valley's modern preference for suspiciously and perpetually single young men and women, perhaps.

Then the lid slammed shut and it was back to business as usual, as everyone closed ranks against the nerds.

San Francisco reminds me more of Chicago, these days, than it does of The City By The Bay.

Re:Passwords are property of the employer

[FlyHelicopters]

You can say that all you want, but the courts disagree, and since they have the guys with the guns behind them, you probably should defer to their opinion. Or don't, but if you were in Terry's shoes and tried to make that argument, they will throw you in jail too.

Now Terry is looking at real prison time and a really big fine that will see him lose all his assets and make it really hard to find work in IT when he gets out. I hope he thinks it was worth it because his life will be very different in the future.

Re:Passwords are property of the employer

[Mr. Slippery]

I dare you to take the keys to your boss's car

Keys are not passwords. Keys are physical objects. Passwords are knowledge. Physical objects can be property. Knowledge can not. (The misnomer "intellectual property" not withstanding.)

It is standard practice for an employer to issue bits of its physical property to employees for the employee's use during the term of employment. They remain the employer's property, however, and therefore one the employer ends the loan of property it must be returned. An employer does not own an employee's mind, however.

If it was just a matter of "tell us the passwords that we forgot to have you tell us while you worked for us", this case would be bullshit. *But*, the court's finding is that Childs went far beyond that, modifying city-owned hardware and software in a manner outside the scope of his legitimate work. If Childs hadn't done that, there were password recovery methods and special admin ports that would have allowed the city to regain control of their network without him.

Re:Passwords are property of the employer

[Cramer]

In any sane enterprise, it never would have gotten to such a point. The wack-job would've been fired long before he took the entire infrastructure hostage. (which was the case long before his termination.) He's a nut, pure and simple; everyone who's had more than 5s to look at the case knew exactly where this was going. The only thing that bugs me is the fact that the managers who allowed this mess to grow aren't even mentioned, much less held accountable for it.

Re:Passwords are property of the employer

[Anonymous Psychopath]

Not in anyway similar. If you take the keys to their trucks you are stealing but if you stop work there is no theft involved. If you want me to talk to you then that is work and I no longer work for you. You should have implemented a better system when I was employed for you. To take this into the real world, what would have happened if he had been killed in a traffic accident? The same procedure that would go into place in such an event should also work during a dismissal. If you do not have such a procedure do not blame the guy that you just sacked as that would make as much sense as blaming a dead guy. It is your fault.

That's an incredibly simplistic and incorrect understanding of intellectual property and work ownership. What you do for your employer while you work for them belongs to them, unless you have a specific agreement stating otherwise. Just because you don't work there anymore doesn't relieve you of your obligation to give them back their property, which in this case was the command and control of their own network infrastructure.

But good luck with that.

Re:Passwords are property of the employer

[Anonymous Coward]

Keys are a physical item with a defined owner.

Re:Passwords are property of the employer

[Anonymous Psychopath]

I don't care if you made them up, they are the property of your employer.

Now the stupid thing here is Terry doesn't just engage in "burning bridges", but does it with himself standing in the middle. I can't feel pity for this fool.

It's interesting that this seems to be the prevailing opinion now. But when this all went down, Terry Childs was the Slashdot Poster Child. Why have opinions changed?

At the time people bought into Terry's argument that he was Don Quixote, saving the incompetent management from themselves. Admins good! PHBs bad! But then he was forced to hand over the passwords and San Francisco did not revert to the stone age as their entire electronic infrastructure melted down around them, as he expected. So Terry was wrong, and now he's just an asshole with a god complex doing time.

P.S. He was an asshole with a god complex back then, too. Now he's just better understood.

Re:Passwords are property of the employer

[dbIII]

it basically shut down the city of san francisco for at least two weeks

Excuse me?

they held the guy in jail, but he refused to divulge

You missed the bit where nobody came to ask him until the Mayor's photo opportunity.

Re:Passwords are property of the employer

[Dahamma]

No, seriously, YOUR argument is bullshit. Why? Because never once in that entire rant did you address any of the *specifics* of the actual case.

In the end Childs KNOWINGLY AND WITHOUT PERMISSION *changed* the passwords on a bunch of computers and then refused to give the owners of those devices (the city of San Francisco) those passwords. If for some bizarre and horrible reason by normal operational procedure he was just the only person who knew these passwords, was fired, and said "fuck you", that would be one thing, and I'd agree with you. But he intentionally locked down the systems and refused to unlock them - both before and after he was fired. He even claimed that the reason was because "he didn't trust his supervisors with them". That's pretty much a textbook application of the law, and could probably be extended to extortion if they wanted...

Re:Passwords are property of the employer

[Luthair]

As a non-lawyer this seems odd to me given a password is transient knowledge and not a thing a single one person can possess. To me, a more apt analogy might be an employer trying to force a former employee to write down any thoughts they might have had related to their former position.

I can't recall the details of this case and honestly don't really care, but the city ought to have a had a policy about shared passwords from the start not only to avoid this situation but also scenarios where the sole password holder dies, is abducted by aliens, etc.

Re:Passwords are property of the employer

[Anonymous Coward]

Except you did not pay the driver and wont issue a com check for his fuel to make him quit.

Re:Passwords are property of the employer

[dbIII]

People found out he had been in jail previously for something else so they assumed he did not deserve any sort of justice - automaticly guilty of something even though it took a LOT of fishing to find a crime to match.
People could not find enough empathy to put themselves in his shoes going down for a petty workplace squabble - he no longer looked like them but instead something they saw as a less than human outlaw.

It's a side effect of demonising people for lazy "law and order" politics.

Re:Passwords are property of the employer

[EdIII]

I disagree. It's dangerous to give a blanket statement that all the work belongs to them by default.

What work?

I've been in several situations in which I participated on other projects outside of work which used not a single work resource. It's too damn easy to claim you did it while on site or using work property.

That's why it went all the way to the board one time when I steadfastly refused to sign any agreement with them since the language was so overwhelmingly vague and if I patented a coffee napkin idea at home it was theirs. Nothing happened since I they could not afford to let me go at all.

I would prefer that nothing is decided in anyone's favor by default and must be proved in a court of law (no arbitration).

A non-compete agreement does not work for me as an independent contractor. Unless you pay me extremely well i'm not going to lock myself out of an entire market.

Ohh, and I guess that since I only work in Open Source it's kind of a moot point. It's rather funny when I explain that they don't actually own anything I make for them at all, and I don't either :)

Re:Passwords are property of the employer

[BrookHarty]

It's kind of like working for a trucking company and taking the truck keys with you when you quit, except that it sounds like this was a pretty big ass truck (thinking in $$).

No its not.

Its not like keys to a truck, its like leaving keys in the ignition, the manager has to walk to the truck to get them.

Aka, he sends junior techs out to reset the passwords...

The employer never lost access, just easy access, but he never was denied access.

Re:Passwords are property of the employer

[Tiger4]

It wasn't his work to defend. It belonged to his employer. Work for hire, and the guy that hired him told him what to do. That same person could have entirely destroyed the work, told him to rebuild it, then destroyed it again, over and over. As long as Childs is being paid his agreed and legal rate, it is entirely the employer's option to do so. Pride in his work, or more likely self-righteous pride in himself, does not properly enter into this at all.

His only defense at all is "preventing public waste" which is subjective as hell and probably not his call anyway, certainly not after the judge ruled against him.

Re:Passwords are property of the employer

[BrookHarty]

it basically shut down the city of san francisco for at least two weeks. they held the guy in jail, but he refused to divulge. the mayor even went to the jail to ask him personally. he deserves prison.

No he didnt. The city could have sent smart hand techs the same day to reset passwords.

He didn't shut down anything, he was fired and walked off the job. The manager should have just did a password reset on the hardware.

Access was never denied.

Re:Passwords are property of the employer

[schnell]

...a password is transient knowledge and not a thing a single one person can possess. To me, a more apt analogy might be an employer trying to force a former employee to write down any thoughts they might have had related to their former position.

Huh? It's more like if you had a safe containing your money and paid one of your employees to maintain the safe and its contents, and he refused to tell you the combination of the safe.

[Karma suicide coming]

Reading about this whole Terry Childs thing on Slashdot has always amazed me. For what seemed like years, whenever this topic came up every post was flooded with "zOMG Terry Childs was justified because the mayor didn't know how to secure his servers!!!!" rhetoric. It seemed to make no sense except for geeks rooting for a fellow geek, regardless of what the real issues at stake were. Same goes for the teeming Slashbot hordes who insisted for months and months on Hans Reiser's innocence and how he was FRAMED, I TELL YOU. Or the people who previously would have condemned Kim Dotcom as a fraudster and spammer but who lionized him because the copyright police came after him. And frankly the same goes for the "zOMG Julian Assange was FRAMED by the CIA and the NSA because the MPAA owns Sweden or whatever" crowd. Occam's razor folks - if the US government wants to get their hands on somebody, they do what they tried to do to Edward Snowden, i.e. attempt to extradite them, not somehow make up fake rape charges in a separate country that doesn't even really like the US anyway.

Look, it's hardly a unique failing or blindness - most humans exhibit bad confirmation bias and cognitive dissonance. But I just find it disappointing to find such prevalence of this behavior in a group that prides itself on its capacity for critical thinking.

Re:Passwords are property of the employer

[BrookHarty]

It's no different than physically walking out with the hardware.

Bullshit.

The hardware sat in the racks the entire time. Any tech could walk up and reset the passwords.
The manager should have sent out his techs to reset passwords and then put a password policy in place.

Bad management, but the employee didn't STEAL anything.

Re:Passwords are property of the employer

[BrookHarty]

First thing you do is change the passwords when someone is fired. They just had to drive to the datacenter to do it. They never were denied access.

Re:Passwords are property of the employer

[EdIII]

A password is not property and it cannot be "taken" as if it were a physical object. It merely represents a shared secret between one or more parties and a backend system that attempts to authenticate access.

To say theft is wildly inaccurate and illogical.

If the employee is the only one in possession of the shared secret and refuses to divulge that information to a party that does have physical ownership over the devices being protected I have a very hard time understanding how it's theft.

Those responsible parties should have maintained access at all times. In this case, he had established that password while gainfully employed by them, and was perfectly in his rights (work policies outlining what they are) to establish the password. If no policy was in place for him to print it out, hand it to his superiors, and let them secure it, then some accountability rests with the management.

Once he was let go I see no difference between "I don't remember" and "I don't wish to say". I've quit before and was asked on many occasions if I remembered passwords, specifics of certain processes, etc. My answer was simple, "I don't work for you anymore and this conversation is not appropriate". I never set any passwords to restrict access higher up than me. I also made sure that all of the passwords were known by my superior.

Did he specifically set a password in a premeditated fashion to prevent proper operation of the networks? In this case, he did and then admitted that he did . That's what the legal focus should be on. Not theft or some intellectual property mangled interpretation bullshit. Those arguments are quite frankly extremely detrimental to our overall freedom at this point. We need to swing that pendulum over the other way with a more sophisticated understanding of what is actually going on.

I don't have a problem that he is going to prison for about a year. What I have a problem is that he is going to prison for not divulging a shared secret that should have never been set by policy, and one he is not obligated to reveal once terminated.

Put him in prison for willful property damage or some other infraction designed to punish somebody by damaging property past a certain extent. Not theft.

The vast majority of these cases, especially these so called intellectual property cases, need to be decided in civil court, not criminal.

Re:Passwords are property of the employer

[noh8rz10]

I don't know where you're from, but I live in sf and I remember what a big deal this was.

Re:Passwords are property of the employer

[icebike]

I think if you go back and read stories of the day, he THOUGHT he was doing the right thing, he wasn't trying to extort anything.
The city wanted to start doing stupid/illegal things with their network, and he decided not to let them. I don't remember the
details, but he was basically just going about his job, doing the right thing, but forgot they weren't HIS computers.

Re:Passwords are property of the employer

[icebike]

You Lie.
He programmed no boobie traps. He simply withheld passwords.

Re:Passwords are property of the employer

[Anonymous Psychopath]

I disagree. It's dangerous to give a blanket statement that all the work belongs to them by default.

What work?

I've been in several situations in which I participated on other projects outside of work which used not a single work resource. It's too damn easy to claim you did it while on site or using work property.

That's why it went all the way to the board one time when I steadfastly refused to sign any agreement with them since the language was so overwhelmingly vague and if I patented a coffee napkin idea at home it was theirs. Nothing happened since I they could not afford to let me go at all.

I would prefer that nothing is decided in anyone's favor by default and must be proved in a court of law (no arbitration).

A non-compete agreement does not work for me as an independent contractor. Unless you pay me extremely well i'm not going to lock myself out of an entire market.

Ohh, and I guess that since I only work in Open Source it's kind of a moot point. It's rather funny when I explain that they don't actually own anything I make for them at all, and I don't either :)

What I said is what you do for your employer, in the context of this discussion around Terry Childs. Configuring routers and assigning administrative access controls to them is definitely not a personal project, even though Terry acted like it was. He even attempted to copyright his configurations.

Point taken on personal projects, and everyone I've worked for has been fine with the ones I've worked on, including my own meager and forgettable contributions to FOSS.

Re:Passwords are property of the employer

[RR]

It's interesting that this seems to be the prevailing opinion now. But when this all went down, Terry Childs was the Slashdot Poster Child. Why have opinions changed?

More of the relevant facts have been made public. It turns out that Childs wasn't the overzealous network administrator that he was made out to be, but he was a sociopathic, somewhat psychotic criminal who carved a mini-empire for himself out of wires and electricity. He was even denying appropriate requests for service, just because of his own personal hangups.

On the other hand, my opinion of the City and County of San Francisco has not been improved, either. The situation should not have been allowed to turn into full-on criminal prosecution. Even Jason Chilton, the famous Juror #4 who is also a network engineer, thought the criminal charges should have been dropped. Successive mayors have used the position to grant kickbacks to various friends, yet the IT department was being downsized and Childs was left with no job security and nobody overseeing his work. At the same time, District Attorney (now California Attorney General) Kamala Harris was facing accusations of being soft on murder, so she apparently took the Childs case as a gift from heaven to demonstrate her toughness on technology crime. When Childs did surrender the passwords, and she immediately put them into the public record as evidence, that was just amazing work. Amazing for the wrong reasons.

So, my opinion of Childs deteriorated, and my opinion of San Francisco did not improve.

Re:Passwords are property of the employer

[EdIII]

I still feel the same way I did when I read it the first time.

Passwords are not property. They're information and they protect access to property. That's all they do.

Setting a password to deliberately restrict access and gain leverage is not theft. It's insubordinate and grounds for termination. If damage occurs since personnel are not able to access systems then it is property damage, defamation of character, tortuous interference with contracts, etc. A plethora of other ways to punish someone or seek remediation.

He never had any kind of ownership claim over the devices he was administrating and was at all times operating under the employ of those that do.

He willfully set passwords to restrict access to everyone. Not just below him, but above him as well.

When being terminated he did not hand over everything he knew and had. That goes both ways too. His work should only have had a reasonable time period to ask him everything, and most assuredly should have had policies in place to know it all anyways.

Afterwards, his work should have had ZERO recourse.

However, his biggest mistake, was in letting his ego run rampant and delude him into thinking that the entire network was his to protect and he was the rightful guardian and no one was going to take it away from him.

That was what hung him. He fully admitted that he set the passwords and never even attempted to write them down or hand them over during his exit interview. It was premeditated and willful, which is why he should be punished.

This had nothing to do with intellectual property and everything to do with his behavior before, during, and after termination by the city.

Re:Passwords are property of the employer

[Dahamma]

How do you change the passwords when he changed them without anyone's knowledge BEFORE he was fired and wouldn't provide them?

Re:Passwords are property of the employer

[Anonymous Coward]

it basically shut down the city of san francisco for at least two weeks

I remember that. The BART stopped running, the metro stopped running, the traffic signals were out, the police had to stop policing, you couln't pay your traffic tickets, you couldn't renew your drivers licence. Fires raged out of control because of the lack of fireman. I think it cost the city close to a billion dollars just for this one guy. Lex Luthor took over as crime boss and extored money out of everyone. Meteors rained firey death on all San Francicicans. A plague of frogs of biblical preportions visited the city. Fuck.. then there were the locusts. Fucking locusts! Yeah, fuck that Childs guy!

Oh no, wait. I don't remember that because none of it happened at all! The city ran like normal like nothing happened.

Now I know why the mood has changed here at slashdot. The only people up are idiots who don't know what happened, and enjoy making things up.

Re:Passwords are property of the employer

[nurb432]

Right, if you take something your company owns its theft.

Re:Passwords are property of the employer

[EdIII]

I think that is a very dangerous precedent for intellectual property though.

It's most assuredly very different than walking out with the physical hardware. It still exists. It's still in the hands of the owners. The challenge is that the device is storing a piece of information that only that single person is aware of. For whatever reason.

Your viewpoint is dangerous because it's easily possible to forget that shared secret between you and the devices. Trust me. Very easy to do. I've done it. I've been asked about passwords long after I stopped working for someone. Since I make it a point to write them down securely and not remember them, it was no surprise that I didn't. I shredded/deleted the documents too, so there was no way to retrieve them.

I don't think forgetting or refusing should ever be criminalized since in many cases you cannot truly tell which one it is. Why should I go to prison because I can't remember something that they were too stupid to have written down by policy while I was working there, and too stupid to ask about it during the exit interview or when the contract was done?

This case was different. He admitted to not only setting it, but doing it for a specific purpose. Focus on that and don't start messing up understanding of intellectual property in such a dangerous way.

Please. You won't like the world that gets created with those ideas. Not one bit.

Re:Passwords are property of the employer

[Dahamma]

That's idiotic. It had nothing to do with HIPAA (what the heck is HIIPA?), but it did have to do with systems like employee pensions and 911 service. Your BOSS, and then (eventually) the mayor (you boss's boss's boss's boss) asks you to turn over the passwords and you refuse, you deserve what you get.

So to answer your question, yes, I'd obviously hand over the passwords in those cases. But in this case you have no clue about what actually happened, which was he changed the passwords *without* permission and refused to provide them, which is pretty much extortion.

Re:Passwords are property of the employer

[RR]

Admins good! PHBs bad! But then he was forced to hand over the passwords and San Francisco did not revert to the stone age as their entire electronic infrastructure melted down around them, as he expected. So Terry was wrong, and now he's just an asshole with a god complex doing time.

To be fair, the PHBs of San Francisco were bad. Using the case to build up political capital for the District Attorney's office, publishing those contested passwords as evidence in the public record, laying off IT personnel left and right.

San Francisco did not melt down because Cisco stepped up and fixed things. It helped that the FiberWAN was OMG PUBLIC SAFETY so the City gave Cisco a blank check to do whatever they needed to get it back on track. Which was like $900,000 over a couple weeks.

Re:Passwords are property of the employer

[tlhIngan]

Reading about this whole Terry Childs thing on Slashdot has always amazed me. For what seemed like years, whenever this topic came up every post was flooded with "zOMG Terry Childs was justified because the mayor didn't know how to secure his servers!!!!" rhetoric. It seemed to make no sense except for geeks rooting for a fellow geek, regardless of what the real issues at stake were. Same goes for the teeming Slashbot hordes who insisted for months and months on Hans Reiser's innocence and how he was FRAMED, I TELL YOU. Or the people who previously would have condemned Kim Dotcom as a fraudster and spammer but who lionized him because the copyright police came after him. And frankly the same goes for the "zOMG Julian Assange was FRAMED by the CIA and the NSA because the MPAA owns Sweden or whatever" crowd. Occam's razor folks - if the US government wants to get their hands on somebody, they do what they tried to do to Edward Snowden, i.e. attempt to extradite them, not somehow make up fake rape charges in a separate country that doesn't even really like the US anyway.

I suspect it's because we "tech geeks" as a group tend to self-identify and tend to think of us as "smarter than the rest of them". Except of course, we're not. Sure we know our ways around everything technological, but I'm sure there's plenty that don't know law (try getting the three sides of IP law straight - a lot of /. flamewars erupt from confusing patents with copyright and trademarks). Or medicine. Or any other thing, really.

It's not unique to geeks either - I'm sure your local doctor's group or lawyer's group also think they as a whole are so much smarter than the rest of the world. Except of course, they're not - they know their field really well, but enter another field (try helping a doctor or lawyer with computer problems?) and boy are they clueless.

It's the same with geeks.

And unfortunately, sometimes this plays out badly - we think we know "the system" better than everyone, but then get slapped and made a fool of (see Hans Reiser, Terry Childs - ZOMG they know how to work the system!). Of course, all that happens is the prosecution takes advantage of this and easily paints a negative image on the person before the trial even begins. Of course, they were probably guilty, but damn, we didn't have to make it easier for them. (See Aaron Schwartz on how NOT to behave - you can be "on the right side" but if you act in ways the general public knowingly disproves of, you get vilified in the court of public opinion and make a prosecutor's job REALLY easy.).

Some advice - learn etiquette and how "the proles" want you to behave (if that means having to wear a suit and dressing up, so be it), Even though everyone shouldn't "judge a book by its cover" guess what? Juries and prosecutors do. Don't make their life simpler by making it easy to paint you as an outcast who believes they're above social norms. And especially don't act smarter than the group, because you'll just come along and sound like a smartass instead.

Re: Passwords are property of the employer

[Anonymous Coward]

Bull shit he didn't booby trap it. The network was configured to run from RAM at his design and he was the only person with the configuration. Power to any site will go out and that site will be down until the "hero" comes to save the day.

What Childs did was completely inexcusable. He intentionally set it up in a way to make hoim important.

Re:Passwords are property of the employer

[Anonymous Coward]

Crap, and I'm still at the same dead end IT support job, over 30 and don't even own a house yet.

Re:Passwords are property of the employer

[Lodlaiden]

Was debating on modding (up)...

Very simple response to the whole thing. You had 1 guy that was in charge of knowing ALL the passwords AND the ability to reset/change them AND you fired him? Whether or not the guy KNOWS the passwords by heart (and I don't even know my WiFi password by heart), my contract ends with you the day you fire me. If you want to hire me back as a contractor at a 1k/day rate, I will gladly find and open the password spreadsheet. Or you can pay the helpdesk guy to search my desktop and my fileshares.

If you do not have the technical foresight to have a plan in case I get hit by a bus then you deserve to live with the consequences of me disappearing off the face of the earth, even if it's at your own doing. Especially if it's your doing.

On the actual specifics of this one case, Terry probably was committing carreer suicide by not ensuring he left the place on good terms. You don't jerk with the CITY you live in. You might be able to pull that crap with some small companies, but throwing both fingers high in the sky at the entire CITY is asking for some rebuttal.

Re: Passwords are property of the employer

[Anonymous Coward]

In a city of techies like SF (where I live), it is absolutely unforgivable to allow a system design allowing for single authority. The city was negligent for ever letting it get this far. Compelling someone to grant you access? Okay. Requiring the password? Sorry, that's their identity (and ass) on the line. Until he has a clearly recorded transfer of responsibility, he shouldn't relinquish his password. Additionally, if his password is related to his personal passwords, releasing the password may constitute a legitimate risk to his privacy and fifth amendment rights.

That said, Childs is an idiot, and he handled this poorly. He *should* have offered to change his credentials for a consulting fee (returning engineer post termination) to close the book on it.

But computer fraud and abuse? Please... What a joke. A bunch of idiots wasted weeks puffing their chests out at each other and the city utterly failed to learn from a teachable moment. Audit your fucking system designs and don't allow for single credential systems, ever. Given the way they drive around here, your admin stands a good chance of getting hit by a bus.

Don't risk it. Have plans for unavailability, termination, and death.

Re:Passwords are property of the employer

[sumdumass]

My understanding is that reseting the passwords resulted in default config files which made it impracticle to do becsuse there was no know copies of the working configs.

To stick with the truck analogy, after they got the keys, they needed to rebuild the motors to return to normal.

Re:Passwords are property of the employer

[jfalcon]

Actually, he went one step further. The way you do a password reset to infrastructure hardware is to bring the hardware down to a single user mode by powercycling and connecting into the console port. But he configured the network in such a way that there was no non-volatile configuration saved and that the act of power cycling would wipe out the configuration of the network thereby making that piece of the network failed until it could be reconfigured which on a network as large as San Francisco would be quite a challenge.

He went to far to believe that he was irreplaceable and the fact that his own supervisors let themselves be put in that situation are almost as culpable.

Re:Passwords are property of the employer

[jfalcon]

No, that's not true either. The junior admins likely only had access to the switch infrastructure or maybe pieces that were not part of the core network. But from what I recall, he was the only one who had access to the core network infrastructure and ran it in a memory-resident condition without a configuration saved to the NVRAM for "security purposes".

Re:Passwords are property of the employer

[jfalcon]

Wrong - it wasn't that simple.

http://www.courts.ca.gov/opinions/documents/A129583.PDF

In December 2007, the city‟s Human Services Agency (HSA) experienced a
power outage. When power was restored, its computers could not connect to
FiberWAN—the configurations of its CE device had been erased because they had been
saved to VRAM. Childs reloaded the configurations and got the system reconnected.
When the HSA information security officer learned that the CE configurations had been
stored in VRAM, he protested to Childs that this was unacceptable. Citing security
concerns, Childs explained that he wanted to prevent a physical connection to the CE that
would allow someone to obtain the configurations using the password recovery feature.
He suggested disabling the password recovery feature instead; the information security
officer agreed. Tong also agreed to this solution, as it would address a concern about
hacking into the HSA‟s CE device. Soon, Childs disabled the password recovery feature
on all CE devices citywide, and there were no backup configurations on any of the city‟s
CE devices. As the password recovery feature could not be disabled on core PE devices,
Childs erased their configurations that had been stored on NVRAM.

Re:Passwords are property of the employer

[Anonymous Coward]

They shutdown the whole federal gov and they will on vacation, though. The punishments are increasingly becoming devilish, more like the ones meted out by the mob boss.

Re:Passwords are property of the employer

[Anonymous Coward]

Because the first time Slashdot carried the story, the presented facts were different. Of course since I wasn't there personally I cannot really judge which version is closest to the truth, but having seen similar stories pass by, the story generally smells like a) he's being punished out of proportion to what he actually did and b) history is being rewritten. But there is no way to ever be sure.

Re:Passwords are property of the employer

[Linzer]

he was basically just going about his job, doing the right thing, but forgot they weren't HIS computers.

Isn't that the most unprofessional thing a sysadmin can do? Doesn't everyone in the business know that that is precisely the behavior that gets you in trouble?

Re:Passwords are property of the employer

[Anonymous Coward]

>But I just find it disappointing to find such prevalence of this behavior in a group that prides itself on its capacity for critical thinking.

That was the old slashdot.

Re:Passwords are property of the employer

[Anonymous Coward]

Thanks for this. I was certain this wasn't a case of someone going to jail for withholding information from a former employee, but someone who created the situation.

To that regard I recently hear a talk from a multi-million dollar (profit per year!!) startup which was started by 3 guys. One of the guys was freaking out about something relatively minor, and offered to buy out one of the other partners, who happened to be the tech guy.

He said, you know what. If you can tell me any single password we use in our infrastructure right now, I will give you my third.

Their relationship apparently recovered when they made their first $100k month.

Re:Passwords are property of the employer

[Anonymous Coward]

The story has lost quite a bit of detail over time.

Back in the days, it was reported that that the consultants didn't dare do a password reset because IF he had configured it that way (remember they couldn't get in to check), the config would be lost.

So, basically the consultants weren't smart enough to find the most remote router that only routes traffic for a single small office, with a very basic config, and reset that password first. So if it was actually the case, only a single office would be offline, and setting up a new config wouldn't take long.

Re:Passwords are property of the employer

[gnasher719]

They may be entitled to the passwords but for me to tell them the passwords or to listen them asking for them is work and I no longer work for them. They should have implemented a policy at the time (during my employment) whereby such things were recorded.

So you took one of the cars in the company's car pool and used it permanently for your personal use. You refuse to give it to employees who need it, and anyone you had no right to take it for yourself in the first place. The company asks you to return it. You refuse. You get fired, the company asks you to return it.

Now you say that refuse to return the car because returning the car is work and you have been fired, so you don't work for them anymore?

Re:Passwords are property of the employer

[Architect_sasyr]

Of course the problem with this whole bullshit line is - what happens when the UPS' die.

So *if* they had power cycled and lost the device they were configuring there is a serious dereliction of duty there, or at least gross incompetency from the engineer who configured the devices. They would have known and could have started getting him back to reset passwords or w/e. Instead, there was a huge song and dance because, apparently, at no time was anyone with political power willing to turn to the nearest 6 year old and ask what they thought should be done.

Re:Passwords are property of the employer

[AmiMoJo]

You need to be careful, if it was your job to document passwords and you shredded the only copies you could be sued for negligence. Criminal charges don't make sense though unless there was some criminal intent.

Re:Passwords are property of the employer

[Anonymous Coward]

That certainly would explain why they hit him with 4 years jail when taking the keys to the entire carpark of a trucking company would probably only get you a fine or a minimum term. It's amazing how nowadays adding "on a computer" to a crime basically allows the interested parties to at least double the severity of the punishment. Or how adding that to a non-crime suddenly makes it one.

Re:Passwords are property of the employer

[bickerdyke]

Then - at last when you're already in jail - the proper thing to do would have been to hand the passowrd over to the judge along with a letter explaining the illegal stuff that's going to happen and ask the judge (or if he sees neccessary: a court) to decide on the legal status. That's what the judical system is for and cleans you of the idea that you're extorting someone

Re:Passwords are property of the employer

[EdIII]

I could only be sued for negligence if I did not make sure that the owner possessed an updated copy at all times, and that I had not made reasonable attempts to do so.

That is why I always have typed out all the details for whatever I did into a set of notes. I made it a point on temporary projects (even configuring a router for somebody) that I turned it over to them, explained what it was, and that they should change the passwords after I left.

If a contract was involved I turned over all my notes at the end, and have always deleted/shredded anything I had ASAP. It's been a long running policy with me that I learned very early on. If anybody did ever sue me they would have a nightmare of a time cross examining past clients and companies that would attest that is exactly how I acted with them as well.

Although I've been tempted, I never attempted access to a system again, even to see if they did change the password. Not any of my business after the fact.

IMO, that's the biggest mistake some people make. Once a job is done, for good or bad, just walk away completely and let it go. Terry had a God complex and could not let his little empire slip away from him. No empire is worth taking a dick up the ass for in prison.

Re:Passwords are property of the employer

[Anonymous Coward]

Occam's razor folks

That's a no no. That's a sharp thing. Mama said /aspies cannot play with sharp things because they might hurt themselves.

Re:Passwords are property of the employer

[Anonymous Coward]

What if the key was his fingerprint? Would he have to go back and open the system up for them? Or could he negotiate a consulting deal with them, or what? I don't think it would be ok to force anyone to put their finger anywhere.

Re: Passwords are property of the employer

[dbIII]

That said, Childs is an idiot, and he handled this poorly. He *should* have offered to change his credentials for a consulting fee (returning engineer post termination) to close the book on it.

That was never an option - it was go directly to jail do not collect $200, no negotiation at all until the Mayor turned up for a photo op.

Re:Passwords are property of the employer

[Anonymous Coward]

Priding yourself for your capacity for critical thinking is entirely different to actually utilising that capacity, a fact demonstrated with alarming regularity here.

Re:Passwords are property of the employer

[Courageous]

Your root the devices, which takes a competent networking person (these devices were networking devices), albeit it's disruptive if the network isn't designed just right.

Re:Passwords are property of the employer

[Courageous]

Yeah. If an employee of mine "refused to hand over the password" to a system for which I had fiscal responsibility, I suspect he'd be terminated so fast not even security would let him empty out his cube.

Re:Passwords are property of the employer

[MadKeithV]

my contract ends with you the day you fire me.

The contract doesn't magically disappear into thin air - it ends under the termination terms of the contract. Those are almost certain to state that you are required to return all property, physical or intellectual, that belongs to your employer and you were granted access to for the purpose of performing your role. The passwords are quite obviously important intellectual property of the employer. The "getting hit by a bus" case is irrelevant in this particular case (even though correct planning for it would have prevented Terry Childs from holding the passwords hostage) - Terry Childs wasn't killed and didn't disappear off the face of the earth, he was fired and was still required to follow the termination terms of his contract.

Re:Passwords are property of the employer

[Anonymous Coward]

I don't think forgetting or refusing should ever be criminalized since in many cases you cannot truly tell which one it is.

Sure you can, you say what's the password? If they say I don't remember they don't remember if they say fuck you they're refusing.

Re: Passwords are property of the employer

[Anonymous Coward]

You become a Republican as your ability to use logic and critical thinking decreases. Maturing or actual age has little to nothing to do with it.

Re:Passwords are property of the employer

[alex67500]

So in other words he's a bit of a second Snowden, really? Why didn't he blow the whistle?

Re:Passwords are property of the employer

[Anonymous Coward]

  they do what they tried to do to Edward Snowden, i.e. attempt to extradite them, not somehow make up fake rape charges in a separate country that doesn't even really like the US anyway.

Yeah, but that didn't work and fooled nobody. This time they're trying legit and that's not working either. Next time it'll be a black bag or a sniper shot and a big fat denial of knowledge about the whole thing.

Re:Passwords are property of the employer

[gl4ss]

well that he could do that was bad enough. that they had nobody who could just change the password while having physical access was bad I suppose too(I really don't them to have had encrypted disks).

but expecting him to do an inch of work after being fired is kinda wicked too ;).

Re:Passwords are property of the employer

[Anonymous Brave Guy]

If you want me to talk to you then that is work and I no longer work for you.

True enough, but it would be surprising if the standard employment contract he signed up to didn't include a clause that says he has to give everything that belongs to the employer back at the end of his employment. IME, that kind of clause usually specifically covers both physical property and knowledge/electronic data, too.

You should have implemented a better system when I was employed for you.

This whole thing appears to have started when someone else with responsibilities for security/oversight was brought in, and she was investigating how the systems had been set up.

To take this into the real world, what would have happened if he had been killed in a traffic accident?

If he had been doing his job properly, the person he had set up as a stand-by to raise the bus number would have taken over. The fact that he hadn't made any such arrangement is in itself damning evidence against him.

Re:Passwords are property of the employer

[Anonymous Coward]

Are you Mr.T?
"I pity the fool"...

Re: Passwords are property of the employer

[Anonymous Coward]

Passwords! Yesterdays technology. I use biometrics. WAIT OH NO NOT MY EYES.

Re:Passwords are property of the employer

[Anonymous Coward]

3: Quoting the law:
"(5)Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network."

That's what he was found guilty under. What systems administrator or programmer would do business in the state of California with such a vague law?

I don't see what's vague about this law.

Be Incompetent, Fuck up, have a vengeful boss, go to jail.

If you fuck up due to incompetence, you clearly did not knowingly cause it. If you know what you do, you're by definition not incompetent.

Re:Passwords are property of the employer

[Monoman]

Shut down the system? Hardly.

You might consider doing a quick /. search and catch up: http://yro.slashdot.org/index2.pl?fhfilter=terry+childs

Re:Passwords are property of the employer

[erroneus]

I want to believe you on this, but there are some realities in this which are being overlooked. Each device is 'vulnerable' to physical access. You could say this was by design. If Childs had died instead of being fired, how would they have handled this differently? What they would do if he had died is exactly what they should have done when he was fired.

There are some realities about IT which some people are unwilling to face. First and foremost of this is that IT should be considered to be an area in which matters of trust and of character are of the highest levels of importants due in no small part by the sensitive nature of the data which is being managed by IT people. It is also recognized that corruption is not so much a problem of character than of opportunity. All of these factors must be managed. But somehow, the business and government worlds want to treat IT people as if they were service workers (not that there's anything wrong with service workers) who are somehow inferior to the leadership. That there are dozens and dozens of people out there willing and capable of performing the acts of IT work does not change the need for trust and good character.

At the end of the day, these leaders fell prey to their own hubris and ignorance. This is not the first time anyone has ever had to deal with this situation. It will not be the last time. What's different about this case are the powers of the people involved and how those powers were abused.

Re:Passwords are property of the employer

[erroneus]

That's bullshit. When you leave a hotel room, they don't care that you returned the key to the room. They change the lock anyway. And when you move out of an apartment or a house, the same thing should occur. Changing the locks is normal practice. It requires work. It seems to me they were more willing to prosecute than to pay for work to be done.

Re:Passwords are property of the employer

[Anonymous Coward]

Except that this is more of installing a new lock into the car of your boss and keeping the keys of that for yourself. Sure, the keys for the new lock have never been the property of the boss. Do you really think this means that you are not required to give him the keys to his car?

Or imagine you're giving your car to a car workshop to get new locks installed, and then the car workshop refuses to give you the new keys because the contract was only about new locks, but doesn't explicitly mention the keys. Would you really say the car workshop has the right to do that because, after all, the keys were never your property?

Re:Passwords are property of the employer

[erroneus]

Oh... and it did NOT shut down the city. Go back and read the original story. What it did was leave the city management in a situation they didn't know how to handle... and still don't. They wanted it easy, didn't get it and they got angry and abused their powers to seek retribution.

I said it previously and I'll say it again. If this guy died instead of being fired, they would face the EXACT same problem but without the recourse of being able to persecute. But I hold that in either situation, the response should be the same. Setting about the task or regaining control over the systems.

Re:Passwords are property of the employer

[expatriot]

whatever your interpretation of the law is, he is in jail. I think that is a good outcome. He did not say he forgot, he made damands and threatened people.
His crime, and the adoration of him by slashdoters as some kind of IP hero, only makes it more likely that others copying this will also be imprisoned. In the absense of some illegal activity on the part of the owners of the equipment which should be handled as a whistle blower, I am glad to see this happen.
This is the real Atlas Shrugged, some loopy IT worker makes trouble and is sent to jail by the people who actually have the power.

Re:Passwords are property of the employer

[PhilHibbs]

We aren't a hegemony. We are not the borg collective. We are all individuals (except for him at the back). Maybe the debate at the time was dominated by the more anarchic, individulalistic types, and now that time has passed, they are all too busy championing Snowden and Assange. Not that I'm saying that the cases are in anyway similar.

Re:Passwords are property of the employer

[Anonymous Coward]

He did not refuse to hand over the passwords. He refused to tell them to an (according to the agreed-upon security policy) unauthorized person over an unauthorized channel (speakerphone).

The reason why many people defend Terry Childs is that he was in a similar kind of predicament that we knowingly or unknowingly enter quite regularly: To hold secrets which could land us in very hot water, yet nobody else appreciates the seriousness of the situation. Situations like this: "Just give me the root password already, my nephew says he needs it" followed by "Our production server is down. You're fired. We're suing you for damages due to gross negligence." or "You refuse to give us the password to company property? You're fired. We're suing you for the cost of setting everything up from scratch." As the Terry Childs case shows, not even an official security policy can protect an admin from the whims of higher-ups. Besides, even if the admin follows all the rules and is never asked to reveal a password or other secret, he's still going to be the prime suspect if anything goes wrong: IT is pervasive. Admins have unbelievable power factually, but very few rights to exercise that power, so any perceived possibility that the admin may have abused his power is a rope around the admin's neck. Admins are excellent scape-goat material, particularly if they don't abuse their power to collect enough dirt on their higher-ups to cut a deal.

Re:Passwords are property of the employer

[mysidia]

What if the key was his fingerprint? Would he have to go back and open the system up for them? Or could he negotiate a consulting deal with them, or what?

What he is required to do is turn in his access to the employer. So that the employer has access, and he no longer does.

If he designed the system so that his fingerprint is required to authorize that action, then that is what he has to provide.

If not: the employer can hire their own consultants to "drill the lock" or defeat his security mechanism, and then pursue recourse against him for the cost.

If he builds in a self-destruct mechanism or other measure to cause damage, in the event of the employer breaking through security --- then it may be considered sabotage, and he is responsible for that as well.

Re:Passwords are property of the employer

[dbIII]

Was your bus late? It wasn't was it?
Exactly what sort of impact was there that "shut down the city" and how does it compare with something real like the last major earth tremor?

Re:Passwords are property of the employer

[Anonymous Coward]

The major difference is he didnt walk off with the set of keys only the knowledge in his head.

Re:Passwords are property of the employer

[dbIII]

They weren't the computers owned by the guy giving him the order either.
Most of this bullshit was due to people getting shafted in underhanded office politics leaving no clear chain of command. His boss was replaced in some sort of stunt involving removing her computers hard drive at night - all very messy as you'd know if you had read anything at all about this case.

Re:Passwords are property of the employer

[mysidia]

While funny, the issue is not with a personal password. These are passwords for infrastructure. It's kind of like working for a trucking company and taking the truck keys with you when you quit, except that it sounds like this was a pretty big ass truck

It's more like: You're the lead mechanic supervisor for the trucking company. The engine compartment/hood of all the trucks are kept sealed with a combination lock and a unique combination; to prevent tampering by the driver, and ensure only company approved mechanics have access.

Originally; as supervisor and designer of the truck fleet, you have the master combination that opens them all, you also shared the master combination with a few senior truck mechanics in the past, and all the truck mechanics have the combinations to some trucks.

A few of the mechanics screw up, so as supervisor, you have the master combination and all the lock combinations changed, so you have to open up the hood, before any mechanic can work on any truck.

You get paranoid about the possibility of a trucker breaking the lock open, and letting in one of those sleazy third party mechanics; so you implement a manufacturer feature that will cause the entire engine assembly to fall apart, if the locking mechanism is brute-forced.

Only a decent mechanic could piece back together the engine, with many hundreds of hours of work.

Eventually; some of the senior mechanics, who see themselves as your "equal" get more and more pissed, about not having the master combination anymore to see what's going on or do their job more efficiently.

3 or 4 of them finally go to your boss, explain how they are being impaired, and their boss agrees with them. Makes a decision to change your role in the company from trucking maintenance supervisor, to truck driver; orders you to turn over the secret master combinations.

You refuse, claiming the top 4 trucking maintenance workers are unqualified, and might break things.

You get fired, and wonder why.

Re:Passwords are property of the employer

[squiggleslash]

As far as Terry Childs go, I think it's more that a lot of people have forgotten what actually happened, but vaguely remember there was something reasonable - or perhaps a better term would be "not evil" - about his actions. From memory, the timeline went something like this:

1. Childs was fired
2. Former boss demands Childs email him passwords (or something like that.)
3. Childs explains he's not sure Boss is right person to receive password and in any case emailing (or whatever method it was) is insecure.
4. San Francisco government throws a fit (not unreasonably.)
5. Childs makes it clear he's totally willing to give password as long as it's in person (ie not over insecure link) and it's to a person clearly authorized to have it.
6. SF sees this, not unreasonably, as stalling and being pissy for the sake of being pissy
7. Finally, Mayor steps in, agrees to meet Childs personally, and gets password.

Was Childs right? Hell no. In that situation you say something like "Ah, email's a little secure, I'll be over in five minutes, can you also make sure that ${new sysadmin} is there too?" if you really, really, really, want to be bureaucraticly correct about it. But, still, geeks saw someone trying to play by the rules, and of course, government is government and is always bad, so...

Reiser: yeah, geeks routing for a geek. Never did understand it. Particularly as anyone who's seen "Columbo" knew this was a text book "murder by someone who thinks he's smarter than a disheveled detective" case...

Assange: nothing to do with geeks, I think it's just a bunch of suspicious co-incidences coupled with incidents of government over-reach that tickles the conspiracy theorist in all of us.

Kim Dotcom: yep, pretty much got it in one. The guy's an obvious asshole, but as long as he's on the MPAA's shitlist he'll have a massive fanbase here at the dot.

Re:Passwords are property of the employer

[Anonymous Coward]

And lastly, 5 years is time for many slashdotters to get older/grow up.

Not the ones who were born yesterday.

Re:Passwords are property of the employer

[isorox]

it basically shut down the city of san francisco for at least two weeks ... he deserves prison.

So you're saying that congress should be sent to prison?

Re:Passwords are property of the employer

[fatphil]

> when this all went down, Terry Childs was the Slashdot Poster Child

I just looked at all the old stories, and couldn't see a single post by on any of them that I'd made. It's impossible to accurately remember what I thought back then, as I'll just project my current views onto my former self. It would be interesting to see if anyone who has expressed a strong opinion historically has now changed tack.

Personally, I think he gives those who work in the same industry as me a bad name. He probably has fantasies about being Simon Travaglia.

Re:Passwords are property of the employer

[isorox]

Holy shit, that was 5 years ago! Great, now you've made me feel old...

A few days ago I saw a post from someone that said their first bookmark was google. That made me feel ancient.

Re:Passwords are property of the employer

[fa2k]

While funny, the issue is not with a personal password. These are passwords for infrastructure. It's kind of like working for a trucking company and taking the truck keys with you when you quit, except that it sounds like this was a pretty big ass truck (thinking in $$).

Stop it , PLEASE! This is the "copyright infringement is not stealing" debate over again, except slashdot is on the other side now for some reason. Taking a key to some equipment is theft, taking a password is not, even though the consequences are the same. It's not the same thing legally, and we're talking about a matter of law, not about what happens to the company.

What he did when he reconfigured the systems to only accept his password may have been sabotage or vandalism, but please don't call it theft. The analogy *does* break down. For example, the police can search your house and person and confirm that you don't have the key; they can't search your brain.

(I had even moderated, and undoing it now, just couldn't stand all the theft analogies)

Re:Passwords are property of the employer

[kilodelta]

Had they never heard of a password safe, one with a MASTER password? Granted it's a security hole but at least they wouldn't be completely in the dark.

Re:Passwords are property of the employer

[fa2k]

Sorry to reply to mysefl, but..

Additionally, the analogy doesn't add anything. We all know how a password works and what happens if you don't have it. All we get from comparing it to a physical key is a legal inaccuracy

Re:Passwords are property of the employer

[AmiMoJo]

There is evidence that the charges against Assange are bullshit, and the US government did in fact try something similar with Snowden early on by trying to make out his girlfriend was some kind of undesirable. We actually know that is Standard Operating Procedure thanks to previous leaks of internal CIA manuals.

I agree with your general point, but there is such a thing as being too sceptical and making no effort to find out about things you have dismissed as paranoid ranting early on.

Re:Passwords are property of the employer

[sunderland56]

A password is not property, and in fact a properly engineered security design, you'll never find the password in the permanent memory of the system, it has no presence and as such is not a "thing" beyond a reasonable doubt thus Taking it can't be larceny.

Freedom is not a "thing", but people get awfully darned upset when you take it away.

Re: Passwords are property of the employer

[sunderland56]

it is absolutely unforgivable to allow a system design allowing for single authority.

Every OS I can think of - Windows, Linux, MacOS, Solaris and every descendent of Unix - has a single root account, with a single root password, which can change every other password on the system. The tablet/phone OSes (iOS and Android) are similar but worse - they give administration privileges to the one and only *user* account, with an optional-and-rarely-set password, and completely block the ability to log in as root.

Got any examples of a system design that does NOT allow for a single authority?

Re:Passwords are property of the employer

[Anonymous Coward]

I guess it's incorrect in the US judging by this case, I don't know however, because I don't know the details.

But in many countries, such as here in the UK, it's the responsibility of the employer to get any information they need from you before your employment contract is up. If they fail to do so, in, say, your 1 month notice period, then that's their problem. If they want to get information from you about their network whether it's passwords or anything else past that point then you have every right to charge that as contractual work.

What actually happened in this case? Did they attempt to get the information off him whilst he was still an employee and he refused? If so then I'm on the side of the authorities. If however they ceased his employment and then phoned him in his personal time asking to give them information which they should've done during work time then I'm entirely on his side.

Employers shouldn't (and thankfully, in countries with sane employment laws, don't) have the right to pester you in your personal time unless you've explicitly agreed to that in your contract. Otherwise it's out of hours, off the clock and should be classed as separate paid work.

Perhaps it's different in the US because you have hire and fire at will laws so that technically someone could leave immediately and there is no notice period but that just highlights one of the many reasons why such employment laws can be problematic. But it's actually stupid not to make it an obligation on the company to gather that information whilst the person is still employed because:

a) Employment may cease as a result of death, in which case you're fucked because you waited too long

b) You should be changing your passwords as soon if not before termination has ceased as a fundamental security practice anyway

For what it's worth I've been in a similar situation myself though, and perhaps somewhat coincidentally it was during the years I worked in public sector for a local authority too. During my time there I'd been given the task of figuring out the old PABX system that no one knew how to use. When I'd handed in my notice I specifically e-mailed my boss to arrange a time with me to handle password handover etc. (I didn't want to e-mail them or write them down because it's insecure) and he repeatedly failed to arrange that. I got a phone call about 18 months later when they finally decided they needed to do a bunch of reconfiguration and I told them I'd come in and give them the details and answer any questions but would charge a minimum half-day contract rate as that was my going rate. FWIW I did take legal advice as well before responding and in my case, in the UK, I was told this was a perfectly legal (and not even unusual) thing to do.

I've left all my other employers on good terms (the reason I left that one on bad terms was precisely because I was sick of carrying everyone and dealing with the sort of ineptitude that stopped them getting what they needed from me before I left) so I've always been willing (and have explicitly offered) to answer any questions they want, but they've also been reasonable enough also to try and avoid pestering me outside my employment with them.

Really though, removing the burden from the employer to get everything they need off an employee before termination of employment is basically just legalisation of incompetence. As I say, there are a million reasons employers should do that anyway, regardless of the ethics, morals, or legalities involved.

Maybe this guy's case is different, maybe he refused to hand that information over even when he was an employee and in which case he got what he deserved, but if not then this ruling is frankly fucked up. You should not be beholden to an incompetent employer outside of any employment period other than as an optional thing on your behalf as a show of goodwill.

Re:Passwords are property of the employer

[FictionPimp]

When I left my last job, I changed all passwords on the system. Each team member that would be taking a responsibility from me got their own unique password. I then set every system they needed access to to that password.

So they knew if they were logging in to a system that was now under their control, the password would be X. That also encouraged them to change the passwords asap so I wouldn't know them.

Lastly, I changed all root passwords to randomly generated 14 character passwords and provided that list to my boss to do with as he pleased.

This way my 'passwords' were not known (just in case I accidentally had password reuse in my personal life) and their new passwords were consistent and in their possession before I left on my last day.

Re:Passwords are property of the employer

[Anonymous Coward]

1) It didn't' shut down' anything. The systems kept working normally.

2) He was asked by his boss to hand over the passwords. This is a violation of the rules, which state you NEVER give your passwords to someone else, even your boss.

3) He was asked to hand over his passwords over the phone. This is another violation of the rules, as phone lines are not secure. In fact, it was during a conference call, and he didn't know who else was listening.

4) The Mayor is not authorized to ask for the passwords, so Childs could not give them to him.

Re:Passwords are property of the employer

[Anonymous Coward]

what's your problem with my statements? he extorted the city by derailing the IT and refusing to give the password. note he carefully designed the whole IT system so only he would have the single key.

Absolutely. Whenever I leave a client or employer they are provided with all the necessary documentation, source code if appropriate, and any accounts and passwords created or used by the system. I never email the accounts and passwords; they are either stored in the organization's existing password locker (application or physical storage) or hand-written in block lettering on paper and hand-delivered to my manager.

Re:Passwords are property of the employer

[Anonymous Coward]

The city wanted to start doing stupid/illegal things with their network, and he decided not to let them.

That was never Child's call to make as a consultant. At most he could have requested the person to whom he was turning over the accounts and passwords sign a document stating that the accounts and passwords upon transfer were now under the exclusive control of the for the City of San Fransico. Period. Full stop.

Re:Passwords are property of the employer

[Anonymous Coward]

he had modified the system so that only his password worked, which was the malicious action

Um, that's how passwords work- only a person with the password can access the device.

What he had actually done is ensure that the routers could not have the passwords recovered from them remotely.

http://www.cio.com.au/article/255165/sorting_facts_terry_childs_case/?pp=3
"The documents filed by the city in opposition to Childs' bail reduction contained many vague references and claims of nefarious actions. But to those with experience in network administration, these activities seem like common practice.
For example, the documents portrayed the fact that Childs had configured some number of routers to disable password recovery as a subversive action, when it's common to use that function to secure routers and switches that cannot be physically secured."

The people who set up his arrest warrant were, well... stupid - "One statement made in the original affidavit for Childs' arrest warrant claimed that Childs' pager went off after he had surrendered it to DTIS officials, and that the page was "sent from one of the routers on the network."". Yes- they thought that network routers could send pages. it was most likely from some network monitoring software, common for administrator to use.

Re:Passwords are property of the employer

[seeker_1us]

His contract said he could release the passwords to one person. Other people in the organization demanded the passwords after he left. He refused and they arrested him. When the one person to whom his contract allowed him to release his passwords asked, he gave it to him. For this, he was sent to prison.

Re:Passwords are property of the employer

[Anonymous Coward]

Synechdoche

Re:Passwords are property of the employer

[Oligonicella]

Excellent. Pedantry is the sure sign of knowing your logic is bad.

Re: Passwords are property of the employer

[Anonymous Coward]

The only other option was to store the config and password on each device, thus allowing ANYONE to recover it. It's common practice to do what he did.

Re:Passwords are property of the employer

[Anne_Nonymous]

>> The only people up are idiots who don't know what happened, and enjoy making things up.

If you are going to quote Abraham Lincoln at least try to get the quote right.

Re:Passwords are property of the employer

[Lodlaiden]

I come from at a place where if you were an IT professional and either party (You or Management) determined you weren't going to work there anymore, you were done. Accounts were locked. No more database, fileshare, email access. We had a DBA attempt to leave under good terms with 2 week notice and all. 30 mins later his acct was locked, management supervision while he cleaned his desk, then escorted out. Nevermind he'd done his hard time (4+years) fixing/maintaining/enhancing the database/server structure. No one asks for passwords or what the combination to ther server room was.

I'm not saying what Terry did was right/wrong, but if they didn't have procedures/process in place, then it's there own fault a cocky sys admin grabbed them by the cohones.
On a separate note, would you really re-grant sysadmin access to someone that wasn't "pleasant" about handing over the keys?

Re:Passwords are property of the employer

[Anonymous Coward]

Pull out the hard drive, rewrite /etc/shadow with new passwords, put it back in, call it a day.

Re: Passwords are property of the employer

[Archwyrm]

Yes, please.

Re:Passwords are property of the employer

[DroolTwist]

While funny, the issue is not with a personal password. These are passwords for infrastructure. It's kind of like working for a trucking company and taking the truck keys with you when you quit, except that it sounds like this was a pretty big ass truck (thinking in $$).

Could the company get a new set of passwords? Sure, same as the truck company could get a new set of keys made. But while they were waiting to access their property they lost money at a minimum. Since they were not _your_ trucks or devices you have no right to refuse to give them their keys back.

I agree with you that what he did was wrong. The person(s) that allowed this to happen are just as much at fault, IMHO. Maybe he was high enough up to where it was easier to get away with, but I just find it astonishing that there was no system in place requiring all passwords to be kept in a centralized area (sealed envelope in a safe, one on-site and one off-site for disaster recovery purposes) with upper management having access to it in the event he left/was fired. DR exercises would have ensured that the passwords matched what was stored.

No one person should ever have that much control over a mission critical system.

Re: Passwords are property of the employer

[Anonymous Coward]

AD users&computers, find the administrator, rightclick copy, rightclick paste. Set password. Checks, balanced.

Re:Passwords are property of the employer

[Arker]

Changing the passwords on the routers was part of his job. Handing the passwords over to the wrong person in violation of his contract would have gotten him screwed just as hard.

Re:Passwords are property of the employer

[wonkey_monkey]

Reiser: yeah, geeks routing for a geek.

Is that Freudian? I can't decide...

Re:Passwords are property of the employer

[canadian_right]

Childs was in the wrong, and should have handed over the passwords, but as is often the case in the "land of the free" the punishment was grossly disproportionate to the crime. In most of the rest of the western world this would have been a civil case: a judge would have ordered him to hand over the passwords, and given him a small fine for being a doofus. On refusing to hand over the fines he would been sent to jail until he handed them over, and be given a contempt of court fine,.

Only in a country that prides itself on "three strikes", "zero tolerance", and jails more people than any other country (both per capita and raw number in jail) could any person in the justice system think his punishment was reasonable.

Re:Passwords are property of the employer

[Bengie]

If the network policy was to NEVER give access to people who should not have access, then he was only following policy.

The issue at hand is they were asking him to do stuff that could have landed him in jail if he was still employed with them. So why should it be any different that he was no longer employed?

Example: If you were security guard that had the responsibility to only give access to a building, people who should have access, then you get fired, then afterwards, asked to give access to the building people who should not have access.

Re:Passwords are property of the employer

[Xeno man]

Wow, it's like you're going out of your way to be wrong. San Francisco's systems were so well set up and secured from anyone screwing around with them that they operated just fine without intervention with anyone. They feared that they couldn't fix anything if it was shut down but nothing broke. He refused to divulge the passwords to just anyone and the only person he would give them to was the mayor. Only when the mayor finally showed up to see him did they get the passwords. Also once they were back into the system did things start fucking up.

Re: Passwords are property of the employer

[Anonymous Coward]

IF YOU DON'T PROGRAM OUR GUI to be SO FRIENDLY it has ROUNDED CORNERS, WE'LL THROW YOU IN JAIL FOR COMPUTER ABUSE AND fraud! /s :-(

aaaaahhh

Re:Passwords are property of the employer

[Art Challenor]

The keys are physical entities and should not have been taken.

Did someone ask for the passwords BEFORE he left the job? If not, then I don't think that he should have the responsiblity to be an unpaid consultant AFTER he leaves. Asking him to provide the passwords, without paying for him as a consultant seems to me rather like asking someone to update a document, provide information on how to run a particular program/machine/process, etc. after they've left.

Providing them before you leave is, the professional thing to do, but if, for example, your employeer fires you and escorts you out the building without the sense can courtesy to at least try and benefit from your knowledge and experience then I think coming back and asking you questions ANY questions after the fact is unreasonable.

Re:Passwords are property of the employer

[Bengie]

This is also what I remembered from the many stories a long while back. Not to say it's correct, but it was repeated many times and sounds like any normal policy.

Re:Passwords are property of the employer

[Anonymous Coward]

Wait, so if they ever experienced a power outage ther network devices would boot up not knowing what to do? Who in their right mind would do that?

Re:Passwords are property of the employer

[MBGMorden]

What you're describing sounds like one of those crazy scenario's that Asimov describe as to why AI's eventually kill their masters. The point being that the AI lacks common sense and is just rigidly following some instruction that they've extrapolated into something it was never meant to be.

Except that he's not a fucking robot. He's a person that is supposed to know better. Your employer owns the network. In the case of the security guard, they own the building. Anyone that they say should have access should have access. Its not your place to hold your employer's property hostage out of some twisted sense of right and wrong.

Re:Passwords are property of the employer

[Bengie]

So if your last job was being an accountant with access to bank accounts, you left, then later your ex-boss contacts you and tell you to give the account information to the janitors. You see no problem with this?

Hi, I'm your ex-boss. I want you to give secret information to people who should not have that information. Just trust me, nothing fishy going on here.

Re:Passwords are property of the employer

[HeckRuler]

Unprofessional ? UNPROFESSIONAL?
Listen here kid, being a professional means that you tell the boss to go suck eggs when he orders you to do something stupid. Being a professional at a critical job means you finish your shift and await your replacement, even when they fired you earlier in the day. Because someone has to do the job. Being a professional means you refuse to sign off on the untested software because the plane might crash and people will die. Being a professional means you don't let the bosses idiot son steer the boat, because he's incompetent and would steer it into shore.

Being a professional means you're not just there for the paycheck to be a yes-man to your superior. You're there, in part, to do a good job. Because doing a bad job will get people killed and/or cost millions.

People like to throw the "unprofessional" term about when people don't have the right cut of dress, or speak with the proper tone, but if you want to play hardball with professionalism, you need to realize that it's more important than shmoozing with the boss and climbing that corporate ladder.

Re:Passwords are property of the employer

[Anonymous Coward]

I like it, reading these posts let's me know how crazy my supposed peers are.

Anyone that doesn't know locking down all the network appliances and swallowing the password when you get fired is a childish and stupid move that at minimum will keep you from getting any new employment or land you in jail... is an idiot.

FYI if you think he was right then you are not my peer you are the douche that I have to clean up behind and who will be asking me "Would you like fries with that?" next week.

Re:Passwords are property of the employer

[BringsApples]

I was thinking about death, just as you were. I also know that I was once 'the Linux guy' where I worked, and ended up being in charge of all of the Linux servers. Some of the clients needed the servers to serve mail, and some wanted web; they were few and far between. However I set up the servers and users and passwords. That was years ago. I have since quit that job, and I have no idea what the passwords are (can't remember). What if that company called me, requesting those passwords? I wonder what the law says about time limits on this bizarre law. I mean, after all, I now work for myself, doing IT work for locals. What if one of my clients 'fire' me but then realize that they need me for the big boss' email password?

Also, I wonder if they have to pay you for your time, as you give them the passwords. As in, if I have to spend time driving over to their site, or even sending them an email with the password(s), I'm using my time, and as far as I know, should be able to charge my standard rate for work done. As a free American, I also have the right to raise my rate at will. Could I suddenly charge $500/hr with a minimum of 5 hours? That would be how I would play it.

Re:Passwords are property of the employer

[mjwalshe]

Even personal projects are risky if they are at all related to your work - employment law starts from the position that your employer owns your work if its related to your day job. Its how employment law (in the US and UK) descends from the original masters and servants act. The USA might (strangely) be slightly more liberal but could you afford to fight your employer in the courts.

Re: Passwords are property of the employer

[Bill, Shooter of Bul]

SELinux can do that.

Re:Passwords are property of the employer

[HeckRuler]

Yeah, I don't get this movement on Slashdot. There appears to be a group of people here who are doing their best to demonize the guy.
I mean, there are a lot of different ways you can take this story:
Rogue Sysadmin takes city hostage.
Incopetent boss imprisons worker after refusing to endanger system.
Incompetnent sysadmin does something stupid enough to make the news.
Tyrannical owners set precidence that they own your thoughts.

I'm not entirely sure why slashdot would be on the side of demonizing the guy. I mean, some of us here are bosses, managers, and that sort. Those types want ultimate power in their orders. "We own you". They don't want their underlings to be professionals that countermand their order and do the right things. (Because it's massivly embarrasing, and it's hard to make that sort of call). I imagine some people here WANT sysadmins to be professionals and don't like Terry Childs simply because he got on the news and the whole thing looks like an embarrasment to their profession. Those people are falling for media spin.

Here's how I see it:

Listen, there's this sterotypical clusterfuck where an asshole non-tech boss establishes an antagonistic relationship with the lead technical guy. Push comes to shove and the boss fires the guy with his replacement standing right there in the room. The technical guy knows the replacement is the incompetent bootlicking friend of the boss. Yeah, so they don't get the keys to the system before firing him. I mentioned they're incompetent ,right? They call him up asking for the keys and the guy laughs in their face. So they call the cops and throw him in jail. Yeah, go figure. The technical guy's then like "ok fine, I'll give the keys to YOUR boss".
Then they sue him for the two weeks that took. The system ran fine in the meantime. Ah, but it made the news, and now it's a thing. After the trial, he's sentanced to FOUR YEARS and $1.9 million in fines.

Lesson: Sysadmins are no longer professionals. If the boss tells you to drive the network off a cliff sending the city's utilities into ruin, you do so.

Re:Passwords are property of the employer

[Anonymous Coward]

You forgot Kevin Mitnick and Aaron Swartz.

Re:Passwords are property of the employer

[Anonymous Coward]

Just wait some day you'll be looking back at the modern equivalent of replacing your 8-track with a cassette followed by the dvd.

I was watching a thing with Steve Wozniak the other day and he was talking about making breakout for atari and I was thinking... Holy crap I remember when that came out it was so much cooler than pong.

Do you still feel old?

Re: Passwords are property of the employer

[rhazz]

But computer fraud and abuse? Please... What a joke.

The article seems to center on the password thing, but from the court statement quoted it is implied that he engineered the single-authority situation as well as booby-trapped the system:

"...he knowingly prevented the city from being able to use its own computer system for a period of time, deliberately configured that system so that no one else could access it, set it up so that anyone other than him attempting to enter it would erase the data stored in it, and made the network more vulnerable to external attack by the filing of an unauthorized copyright application".

Maybe one could argue that the erasure of data was a security precaution, but the whole story reeks of a disgruntled employee with god complex.

Re:Passwords are property of the employer

[Archangel Michael]

He properly secured the network infrastructure against malicious attack at the nodes. Imagine that.

Re: Passwords are property of the employer

[0racle]

sudo if you don't feel like doing anything particularly involved.

Oh and

every descendent of Unix - has a single root account

Root is disabled in OS X by default, you have to use sudo to enable it. SELinux can remove the godly nature of root and Trusted Solaris does something similar. With Windows, you simply create users as members of the correct administrative groups.

Re:Passwords are property of the employer

[Anonymous Psychopath]

So if your last job was being an accountant with access to bank accounts, you left, then later your ex-boss contacts you and tell you to give the account information to the janitors. You see no problem with this?

Hi, I'm your ex-boss. I want you to give secret information to people who should not have that information. Just trust me, nothing fishy going on here.

Is that the best horrible analogy you could come up with?

Re: Passwords are property of the employer

[jedidiah]

> Got any examples of a system design that does NOT allow for a single authority?

This is a management issue. Not a technology issue. There never should have been a single password known only by a single person.

Even with the examples you've given, there are still technological means to insure that you aren't SOL if you lose the root password.

You're only vulnerable if you decide to make yourself vulnerable.

Re:Passwords are property of the employer

[HeckRuler]

Yeah, that's cool.
The part where you throw him in jail afterwards until he hand them over seems a little much. Kind of an abuse of power that I didn't even know you had.
Sentencing him to 4 years in jail and a million dollar fine after the fact seems ludicrous.

Re:Passwords are property of the employer

[Anonymous Coward]

It would be a lot funnier to change the password to an obscenity and then when they ask ...give it to them.
"Give me the password or you are going to jail!"
"F*** OFF"
then watch the who's on first style hilarity ensue.

Re:Passwords are property of the employer

[Anonymous Coward]

What I do is write the password on a piece of paper and inform them to place the (root, administrator, super user, etc.) password in a locked location (preferably via dual custody) location. I then send a confirmation CYA email stating they have taken custody of the password. If the password needs to change, rinse and repeat.

If a company came back to me about passwords, I would tell them to look in dual custody lockup, and present my CYA email, if needed.

Re:Passwords are property of the employer

[Cederic]

Once a job is done, for good or bad, just walk away completely and let it go. Terry had a God complex and could not let his little empire slip away from him

Divulging the passwords to unauthorised people would be a criminal act in itself.

He didn't try and access the system. He merely refused to break the law and enable unauthorised individuals to access secure systems.

That's what fucks me off about this entire case. Childs may or may not be an arrogant cock with a god complex, but I just haven't heard anything that suggests he's done anything actually wrong here.

Re: Passwords are property of the employer

[jbolden]

Many capabilities systems like mainframes have this. Oracle's security model has this: SYSOPER, SYS, SYSTEM, SYSDBA. So System doesn't have SYSDBA privileges. Object privileges and system privileges can be broken apart.

Generally of course high power users can grant themselves more privileges but often 2 or more accounts are needed to access those accounts.

So for example X might have the SYS password but not have the password for an OS level account that can log on as SYS.
Y has an account that can log on as SYS but doesn't have the password for SYS
So that way X and Y can't do anything individually.

Re:Passwords are property of the employer

[Bite The Pillow]

People know which side they are on before the first sentence is done, and frequently before the headline. All the pesky details, at best they support your side. At worst, you think the source is biased, ignorant, or wrong, and facts make you cling more firmly.
With an inflammatory nick, people are predisposed to finding fault with my posts. I get specific users who just have to disagree, and positive moderation. I conclude that the smart people just don't wade in when someone is clearly wrong. A quick snipe with a single fact is easier to digest than a manifesto on the many ways someone is wrong.
There wil be people leaving and joining, and the noobs will have to learn this lesson again:
You learn the most when you assume you are wrong, and consider the opposing argument honestly. Or even try arguing that side and find fault with your own. We are stuck until the internet finds a solution to that.

Re:Passwords are property of the employer

[Anonymous Coward]

No. Your characterization of the facts are completely wrong. Its quite simple... idky no one understands what happened. As sometimes occurs in any organization that has turnover, Childs had become the only one left still working there that had admin access to the network. He did NOT sabotage anything. He was fired. A few days later, the City demanded the passwords. See the problem? THEY FIRED HIM. THEN, WHEN IT WAS TOO LATE TO DO SO, THEY DEMANDED THE PASSWORDS. Personally, I also would have summarily told the City to PAY ME, BITCH and otherwise to go fuck itself. But hopefully I could afford a better attorney... Childs really got shafted, as though he were an intelligence agency whistleblower or something. I'm quite surprised they didn't pin some child porn on him, but maybe that would have been just a little too ironic.

Re:Passwords are property of the employer

[jedidiah]

Details matter.

It doesn't matter if it's computing, or ethics, or the law.

Ignoring the details is a sure sign that your morals are bad.

Re:Passwords are property of the employer

[Anonymous Coward]

And he made himself quite unemployable in the future... Very very stupid.

Re:Passwords are property of the employer

[g0bshiTe]

I think another larger question is why was he the only one with those passwords?

It would seem to me there would be some oversight and at least a second person that had access to those passwords.

In a dev shop there should be no rockstars.

Re:Passwords are property of the employer

[Anonymous Coward]

You've never actually seen a router before, have you?

Re:Passwords are property of the employer

[RealGene]

What I said is what you do for your employer, in the context of this discussion around Terry Childs. Configuring routers and assigning administrative access controls to them is definitely not a personal project, even though Terry acted like it was. He even attempted to copyright his configurations.

Agreed. This is "work product". It belongs to the employer. Scribbles on a post-it that are relevant to what the employer is paying you to do is work product.
It's not yours.

Re:Passwords are property of the employer

[g0bshiTe]

Bad analogy. How you can you take keys to a truck someone is currently driving? Means you have the spare set and they still have a key.

I do get where you were going with the analogy though.

Re: Passwords are property of the employer

[Anonymous Coward]

...except that NOT what he did.

Common practices portrayed as nefarious.
The documents filed by the city in opposition to Childs' bail reduction contained many vague references and claims of nefarious actions. But to those with experience in network administration, these activities seem like common practice.

For example, the documents portrayed the fact that Childs had configured some number of routers to disable password recovery as a subversive action, when it's common to use that function to secure routers and switches that cannot be physically secured.
- http://www.cio.com.au/article/255165/sorting_facts_terry_childs_case/?pp=3

Re:Passwords are property of the employer

[Minwee]

Who in their right mind would do that?

Ordinarily it takes a municipal government to screw things up to that level.

Re:Passwords are property of the employer

[Anonymous Coward]

Your employer owns the network. In the case of the security guard, they own the building. Anyone that they say should have access should have access.

True. But there are rules as to exactly WHO gets to assign access, and HOW they assign access. Not just anybody above you on the corporate ladder (so to speak) can order you to give access. There are rules to follow. One of those rules is 'never give anyone your password, even your boss'. So when Terry's boss asked for the passwords, guess what?- He said 'no'. Another rule is 'never discuss passwords over the phone'. Terry was asked for his passwords (you guessed it) over the phone, so he was doubly correct in refusing. (Triply, as it was a conference call, and he didn't know for sure who was on it.)

And, of course, you are ignoring the fact that he was no longer employed by them, and they didn't have the right to order him to do anything anyway.

Re:Passwords are property of the employer

[kwbauer]

Most employers in the US "pay up" on a bi-weekly basis.

Re:Passwords are property of the employer

[mordenkhai]

Replying to fix incorrect mod.

Re:Passwords are property of the employer

[kwbauer]

A) says that you did not, in that one case you cited, actually refuse to give the password.

Re: Passwords are property of the employer

[catfood]

OS/370.

Re:Passwords are property of the employer

[ffflala]

What you do for your employer while you work for them belongs to them, unless you have a specific agreement stating otherwise.

While this is close, it's inaccurate in an important (albeit minor, in the context of this discussion) way. The term used here is "work for hire," which means that the copyright to an original creation is owned not by the most direct creator, but by the employer.

Under US copyright law, there are two instances in which work for hire applies. First is the fork I believe you're thinking of: if the work is within the regular scope of one's employment. This is an important distinction; it means that if you're working as an animator for the Simpsons, and spend some of your work time writing a program (that has nothing to do with animating the Simpsons), you own the copyright to that program, not your employers. While there will always be billable hours for lawyers to argue over what is within the scope of anyone's employment,no written agreement stating otherwise is required for an employee to own the copyright to something unrelated to work that he/she creates while on the job.

The second fork of work for hire applies to contractors, rather than regular employees. Under this, the work has to fit one of 9 categories, AND there has to be a signed, written agreement (can't be oral) explicitly stating that the work in question is work-for-hire. Point is the written agreement applies only to contractors not employees, and it has to explicitly state that the work is work for hire, not the other way around.

http://www.copyright.gov/help/faq/faq-definitions.html

Re:Passwords are property of the employer

[Anonymous Coward]

Being a professional means you're not just there for the paycheck to be a yes-man to your superior. You're there, in part, to do a good job. Because doing a bad job will get people killed and/or cost millions.

People like to throw the "unprofessional" term about when people don't have the right cut of dress, or speak with the proper tone, but if you want to play hardball with professionalism, you need to realize that it's more important than shmoozing with the boss and climbing that corporate ladder.

Obviously, you don't work in Sales.

Re:Passwords are property of the employer

[Anonymous Coward]

i agree totally.

giving root to the unqualified person is a mistake.

that being said, my boss had my root passwords in an envelope in his disaster recovery safe.
knowing if it was opened, i was dead, fired, or asked if it was okay to open it and told who was going to use use it for what exactly.
And the password would be changed after the envelope was opened for any reason.

So the password was known by 1 senior admin, an secondary root account(s) used by my jr.(s) and the envelope.

worked fine for anybody i worked for.

And I had lunch one day with the admin, that had to take over when the sr admin was hit by a bus during lunch break.
running machines without a password are a pain, not a crisis.

Nasdaq crashed and the world didn't end.

If Skynet hits a blue screen, we all live !

All hail the white hat BOFH's of the world.

99% of the world is not smart enough to be root, why should they have my password ?

Re:Passwords are property of the employer

[Anonymous Coward]

It's more like if you had a safe containing your money and paid one of your employees to maintain the safe and its contents, and he refused to tell you the combination of the safe ... because he knew from past experience that you cannot be trusted to handle the safe which is NOT YOURS but belongs to the public, and Terry knew the meaning of that, and because he caught the lady PHB in question stealing stuff from the office and had it on tape and confronted her and then she threw a tantrum and then framed him in a display of power

Some old fuck (your UID) comes along after 3 years and changes all the facts and gives a big intellectual yarn. But damn, it doesn't change the facts. Of course, the public, even here at slashdot, won't be bothered to look up all the details, but one thing is certain - a jail term and a million dollar fine for thinking about the good of your city's network - to prevent it from falling into the control of someone you videotaping stealing important data from office - isn't a fair result at all. He should at worst have been warned and fired. At best, he should have been given a lawyer to sue the lady PHB whom he caught on tape stealing stuff from locked drawers late at night.

Facts dont care for slashdot UIDs. Sadly, American courts these days don't seem to care for facts either.

Explains a lot of the fine variety of messes your country gets into every passing month - as a society, you don't value or protect your techies with integrity - Be it Snowden, Musk (Texas law bans Tesla sales), Terry Childs or the NASA budget. This is exactly how USA falls apart - slowly, painfully, one bad legal judgement at a time.

What's my worry, it's time for BRICS to rise and shine globally.

Re:Passwords are property of the employer

[Dahamma]

When those passwords are for systems related to employee benefits, pensions, and the 911 services of a city with 700,000 residents and all you have to do is write down a few words to your boss but refuse, yeah, that's jail-worthy.

Re:Passwords are property of the employer

[firewrought]

it basically shut down the city of san francisco for at least two weeks. they held the guy in jail, but he refused to divulge. the mayor even went to the jail to ask him personally. he deserves prison.

Your understanding misses the essentials. Ultimately, Childs was too ideological/paranoid/stubborn for his own good; however, the city's prosecution of him was malicious and unnecessary. The jury had to convict based on legal specifics, but judge and jury alike felt that this was an unfortunate usage of the system.

Re:Passwords are property of the employer

[e3m4n]

Obviously, you don't work in Sales.

given that this is slashdot and not linkedIN or MyTwitFace I would take that as a given

Re:Passwords are property of the employer

[Anonymous Coward]

A) says that you did not, in that one case you cited, actually refuse to give the password.

A) says I did give it to them and they lost it because they're incompetent morons. It would have been fun if they took me to court to have a subpoena show they were at fault.

Re: Passwords are property of the employer

[Anonymous Coward]

Posting as AC as I may have information about this direct case.

I've been running/building networks for a living since the late 90s. The practices described to me regarding this case are not standard. When you have this large of an environment, one should have centralized access control managed through some independent AAA. Perhaps this is backended to the tac_plus or other process, or a RADIUS server. These can be part an AD setup or not. The practice of disabling password recovery is not standard, even in large telecommunication carriers equipment. You can see evidence of this from configurations scraped off devices in the secondary market. I know of at least one person who collects and shares them.

This is a case of failure at multiple levels, both someone whose ego clearly got the best of them and management that didn't realize they built a scenario that had this type of a single point of failure. The configurations should be backed up and archived of all network devices, the same as backing up any other systems within your network. If I failed to backup the Netware, WFW, NT or other servers I would be similarly negligent in my job. One person should never hold the master keys as they may die unexpectedly or have something else happen.

There's lot of blame to go around here, and everyone screwed up in the execution phase, both before during and after he was let go from the city. I know many tech people who don't take change well, or understand when it's time to stop/move on. It should never get this bad. If your job has these problems/issues, you need to stop what you're doing at $dayjob and work on documenting things before they get out of hand. Some slack should be given to startups and other places, but you eventually need to get things together otherwise it will end poorly.

Re:Passwords are property of the employer

[Anonymous Coward]

You are so wrong on so many levels.

Around here, getting fired gets you an armed escort out the door, never to touch your computer again, never mind "hang around for your replacement"

If the boss wants to fuck something up, it is his call, it is up to you to document his decision. In the case of loss of life, a quick call to the police and let the courts sort it out.

Re:Passwords are property of the employer

[Anonymous Coward]

No one seems to realize exactly why he withheld the passwords.

I've worked in IT before when there was a major dispute between the lead IT admin and the guy that was going to replace him. The guy that was going to replace him had a certificate from ITT Tech and had never actually run a server before (except as far as hosting a Quake server from his own computer). He had been grandstanding and impressing his dad and the other higher ups (dad was a higher up, and how he got the job) with his knowledge of computers, and talking about how he was going to fix all their problems.

The lead IT admin ended up fired because he wouldn't just hand over the keys. He basically made them sign something that said he wasn't responsible for the system Two days later he gets a call about how his replacement tried to install Windows on the server and thought it would be a good idea to clear up some space by formatting a bunch of drives. He then copied said drives onto the offsite backup. Company loses the contents of their servers and backups overnight, which would go on to cost them millions. Guess who they want to come back and clean up the mess?

Shit, imagine letting a 20 year old that 'just graduated' from ITT tech into your server room with all your logins/passwords, with their intent to be to 'free up some space' and 'install Windows.'

Re:Passwords are property of the employer

[e3m4n]

password recovery on cisco routers is a relatively simple process involving only a few minutes of outage. I should find it hard to believe the city of SF was using any other brand. That would be like buying everything made in china and complain that american laborers are out of work... oh wait, we do that.

Re:Passwords are property of the employer

[HeckRuler]

Around here, getting fired gets you an armed escort out the door, never to touch your computer again, never mind "hang around for your replacement"

That was my father's position. He kept the light on at the power utility company. He couldn't just up and leave as it would send a chunk of the midwest into darkness. The boss that would have theoretically fired him simply couldn't do his job. Now, critical things like hospitals and and server farms have generator backups, but it'd still be millions of dollars of loss. My job? I'm a code-monkey. Not critical at all. No one really cares when I show up at my desk. The software I write? Critical as all fucking get out. I code OBOGS, the avionics that let's fighter pilots breath.

If the boss wants to fuck something up, it is his call, it is up to you to document his decision.

Right, that's how it works "Around there". It's ok not to be a professional. A lot of very important people just simply aren't. And the cops aren't going to do anything when you complain that your boss wants to release life-critical software without testing it.

Re:Passwords are property of the employer

[HeckRuler]

for systems related to

Ah, what glorious weasel words.

That's similar to how they got to charge Kevin Mitnick with the construction cost of the building that housed the server he compromised. But go ahead, trump it up. Terry Childs impacted systems that were related to national defense too, I'm pretty sure some national guard reserve wouldn't get a phone call if it all fell down. Yeah man, he practically invited Russia to invade us. TRAITOR!

Now... Did any of those services shut down? Were any even interrupted? What, exactly, was the impact of two weeks without access to the routers of SanFan FiberWAN?
You know, other than pissing away a shit-ton of money on lawyers and getting egg of their face from the media.

Re:Passwords are property of the employer

[cusco]

Remember why he did that? The other admins wanted to do stupid and/or illegal things with the system, and when he complained he was brushed off. He felt that since they were going to drive the truck into a crowd a new lock was the best option.

This is one of the best runs of 'car' analogies I've ever seen.

Re: Passwords are property of the employer

[Darinbob]

SF isn't really techie though. Most of the techies there commute south, leaving behind a rich financial sector and a lot of artists. The city got in this mess because like most cities they don't really understand how things work below street level and leave those details to others.

Re:Passwords are property of the employer

[Anonymous Coward]

Was that comment wilfully ignorant or just stupid? There's no precedent here.

If you steal intellectual property from your employer, you're gonna face criminal charges, and that shouldn't be surprising to you. This is, in fact, worse than most IP thefts - usually when an outgoing employee steals IP, the employer still has copies. In this case, Terry hasn't just stolen the IP - he's engaged in a long-term subsersive plan to ensure that his employer lost access to the IP.

Re:Passwords are property of the employer

[Darinbob]

Yes but once you're fired for telling the boss that he's an idiot then you are no longer a professional at the old job and the person you're insulting is now the ex-boss. Time to turn over the keys and the company car and company phone.

Also it's highly unprofessional to keep the entire network locked up by a single person. What if the password holder gets hit by a bus?

Re:Passwords are property of the employer

[dnavid]

3: Quoting the law: "(5)Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network."

That's what he was found guilty under. What systems administrator or programmer would do business in the state of California with such a vague law? Be Incompetent, Fuck up, have a vengeful boss, go to jail. That's what this case is really about; the ability of state officials to fail to routinely document and confirm systems access by employee's whom make 100k+ a year who's job responsibility is to configure and maintain tens of millions of dollars of mission critical gear to toss your ass in jail on the flimsiest of reasons because they don't want to be bothered with kindergarten simple shit.

Even if he really was a malicious, self-serving, rent-seeking prick, being convicted under that law is complete and total bullshit.

Wrong.

Section h of the same statute states:

(h)(1)Subdivision (c) does not apply to punish any acts which are committed by a person within the scope of his or her lawful employment. For purposes of this section, a person acts within the scope of his or her employment when he or she performs acts which are reasonably necessary to the performance of his or her work assignment.

Furthermore, h(2):

(2)Paragraph (3) of subdivision (c) does not apply to penalize any acts committed by a person acting outside of his or her lawful employment, provided that the employee's activities do not cause an injury, as defined in paragraph (8) of subdivision (b), to the employer or another, or provided that the value of supplies or computer services, as defined in paragraph (4) of subdivision (b), which are used does not exceed an accumulated total of one hundred dollars ($100).

In other words, the law says you cannot be prosecuted if your conduct was something you reasonably had to do to do your job, but the act of doing so caused damage or denial of service. Childs claimed this as an affirmative defense, but the court ruled that a) deleting everyone else's passwords except his own, and b) changing his passwords so no one would know them, and c) deliberately changing the router settings so their configurations would not survive a reboot in defiance of best practices, and d) refusing to give anyone else access even when ordered to do so by his superiors did not count as "acts which are reasonably necessary to the performance of his or her work assignment."

Moreover, the law says even if you do something that *isn't* part of your job description and cause any of the damages specified in the law, you still have to create a minimum level of damage to be criminally liable. It cannot be a trivial level of damage that cannot be quantified.

That's what this case is really about; the ability of state officials to fail to routinely document and confirm systems access by employee's whom make 100k+ a year who's job responsibility is to configure and maintain tens of millions of dollars of mission critical gear to toss your ass in jail on the flimsiest of reasons because they don't want to be bothered with kindergarten simple shit.

Court documents show that as soon as his access revocations were detected, people began to try to address the situation but Childs consistently refused to return control. In fact, he dodged meetings intended to resolve the situation before it reached the level of criminal prosecution several times. And he admitted such in court. Childs admitted in court that he *actively* prevented DTIS from gaining administrative access to their systems because he felt none of them were qualified to have administrative access.

Who would want to work under such a law's governance? I wish everyone had to, so I would have to deal with far less prima donnas and dipshits.

Re: Passwords are property of the employer

[Anonymous Coward]

Professional means being paid for the work, nothing more, nothing less.

Re: Passwords are property of the employer

[Anonymous Coward]

This is not the news site for you. If you don't get Azimov you don't get slashdot - may I suggest Disney news?

Re:Passwords are property of the employer

[Cramer]

(wireless key. I've often wondered what happens if I chuck the key out the window as I'm driving along.)

Re:Passwords are property of the employer

[hobarrera]

Of course the mayor didn't know how to secure his servers. That's exactly the reason why he hired Childs! :P

Re:Passwords are property of the employer

[david_thornley]

If Childs had died, San Francisco would have been SOL. This wasn't by city policy, which apparently required passwords to be documented. If Childs had followed policy and kept a hardcopy of the passwords, no problem.

Not that the city officials seem to have enforced this policy, or shown other signs of competence, but Childs should have conformed to policy. Since he didn't as an employee, he left with an outstanding obligation.

Re:Passwords are property of the employer

[Anonymous Coward]

"Now I know why the mood has changed here at slashdot. The only people up are idiots who don't know what happened, and enjoy making things up."

Gee, and I thought it was because Dice bought out Slashdot and sold control of the website to the NSA and In-Q-Tel. I feel much better knowing it isn't the government behind the rash of stupidity, disinformation and blatant lies that Slashdot seems to be comprised of these days.

The mood has changed here because all the people that realize that Slashdot has been compromised have left . Hell, I don't even bother logging in anymore. Posters like Cold Fjord are obviously shills, yet most of the articles he submits still make it to the front page...nobody is meta-moderating anymore because beating a dead horse is an exercise in futility and most people know that those article will make it to the front page regardless.

The only reason I come to Slashdot anymore is so I can keep up with what "they" want us to believe.

Re:Passwords are property of the employer

[robbyb20]

I would agree with this if it was a sale/transfer from one company to the next but it wasnt. This is like if someone gets kicked out of a house, they need to relinquish their keys, especially if they are the only ones that have it. THEN, they can change the locks and doors after they gain entry back in.

Re:Passwords are property of the employer

[airdweller]

"His contract said he could release the passwords to one person. Other people in the organization demanded the passwords after he left. He refused and they arrested him. When the one person to whom his contract allowed him to release his passwords asked, he gave it to him. For this, he was sent to prison."

Perhaps you should read this - http://www.courts.ca.gov/opinions/documents/A129583.PDF

Re:Passwords are property of the employer

[Anonymous Coward]

Bullshit, if they fire him he no longer has to work for them. If they asked him for the passwords before firing him, then there would be a point. But once he is no longer employed he no longer has to speak with them. Anything else is slavery and should be challenged under the 13th amendment. It is not his fault if his employers are too stupid to have appropriate protocols in place.

Re:Passwords are property of the employer

[Anonymous Coward]

whatever your interpretation of the law is, he is in jail. I think that is a good outcome

If he is in jail for the wrong reason, that is a bad outcome. It sets the precedent that you or I could be put in jail for the wrong reason. Being put in jail for the wrong reason is not justice, no matter how much you, or I, or Childs deserves to be in prison for the right reason.

Re: Passwords are property of the employer

[sunderland56]

There never should have been a single password known only by a single person.

But that was my point; with most operating systems, there is no way of preventing that.

So you have some nice management scheme where passwords are all known by all sysadmins, and recorded in a large red binder in the boss' office. So one day Joe goes rogue, and (a) changes the root password to something only he knows; and (b) removes any administration privilege from every other account. Both your management scheme *and* your technology scheme are now screwed.

Re:Passwords are property of the employer

[Anonymous Coward]

You do not want to claim passwords as property.

You really don't. Any passwords from another company are their property. Any non-work passwords are the property of the real people. It becomes their property on your server.

Say you reset a password. You've now destroyed property. By the same logic used in this case, you've potentially opened yourself up to damages up to the cost of the system. Actually, potentially worse than in this case, as there was no degradation in service, where there might be if someone can't log in.

Additionally, they can demand access to the passwords in the same way demanded here.

Re:Passwords are property of the employer

[farble1670]

If you do not have the technical foresight to have a plan in case I get hit by a bus then you deserve to live with the consequences of me disappearing off the face of the earth, even if it's at your own doing. Especially if it's your doing.

thank god this isn't how the law works. perps don't walk because the victim "deserves to live w/ the consequences".

Re:Passwords are property of the employer

[farble1670]

I've quit before and was asked on many occasions if I remembered passwords, specifics of certain processes, etc. My answer was simple, "I don't work for you anymore and this conversation is not appropriate".

and you are perfectly within your rights doing so. but anyway, that's great information for future employers. you should always recount that little anecdote when interviewed.

whenever i've quit a position, i make sure everyone knows my personal contact information if they need anything from me. i do that because i'm not a dick. oddly enough, i'd actually get some pleasure from helping my ex-colleagues in a time of need.

that being the case, i've never been bothered by an ex-employer or ex-colleague. i'm sure it could happen, but basically people are decent and know to reserve that offer for help from me for when and if they really, really need it.

Re:Passwords are property of the employer

[EdIII]

The answer to that is simple:

1) I don't work for you anymore and I don't have access to that information in way at all.

OR

2) I gave all of that information to you during my exit interview.

OR

3) Are you on fucking crack sir?

Re:Passwords are property of the employer

[EdIII]

Which is why I'm not employed. Employment law does not cover independent contractors in that way. They take me to court they will have a heck of a hard time passing the tests to show that I am in fact an employee.

I simply can't be employed like that. For one, I would have to enjoy the massive suck that is corporate life. No thank you. I would rather repeatedly hit my penis with a rusty hammer.

Also, I work with open source. I make it clear that everything I work on is not owned by them, or me, or anyone really. Since everything I work on is covered by some sort of open source license, it's nearly impossible for them to claim ownership anyways.

With how I work it's just not something that is going to happen with me. Why on Earth would I put myself in that position? How can you reuse code when you are always trying to figure out who the heck owns it?

Re:Passwords are property of the employer

[EdIII]

It's only good if he's in jail for the right reasons. I also think you are not reading what I said at all.

He is not an IP hero simply because he has absolutely no argument at all. This has nothing to do with IP. Nothing.

Bringing IP into the conversation is what's tragic here. It's actually very tragic that people think he was put in jail over that issue when he could be put in jail for quite a bit else.

We don't want this kind of precedent at all.

Re:Passwords are property of the employer

[EdIII]

I think you misunderstood me.

The conversation is not appropriate because it implies that I would be in possession of passwords and that is not right. Also not appropriate because there is always liability. It's amazing how litigious we have become.

The actual conversations were quite a bit more diplomatic, but essentially came down to the same points. No, I don't have your passwords written down anywhere. No, I can't comment on any of that. There was only a single instance in which the relationship ended badly and I had to be curt in my responses. Let's just say there was already plenty of lawsuits going around and I was already being contacted by multiple law firms to be questioned and supply data. Thankfully, I protected myself well.

Do I want to help them? Sure.

What I need though is to cover my ass legally at all times. Especially, when most of my work involves large databases and information systems with access to sensitive information. Too much possibility for damage and for me to get the blame.

It's really sad that I can't just be a nice guy like you would want to.

As for recounting that in an interview, that's a good thing. It shows that I am highly professional and will protect their business data at all times. Some jackass won't have a chance trying some social engineering on me to get access to sensitive data and systems.

Re:Passwords are property of the employer

[EdIII]

Childs was in the wrong, but it's extremely important to understand exactly what he was wrong for

If he had written down all of the passwords, and had taken notes (like I do), then he would have that information securely available at all times to his superiors. His superiors should have had a policy in place that sensitive information like that was managed by two people at an appropriate level. Even if they have no fucking clue what a Cisco TFZ9000 was, they would at least be able to tell somebody, "Oh.. yeah... here it is".

They should have never asked after he was fired, and should have had absolutely no legal recourse whatsoever, civilly or criminally.

What Childs did wrong was that he set the passwords with the intention of not informing a single soul. He flat out admitted that his intention was to restrict access to only himself at all times.

He further screwed himself at the point he was terminated. Regardless of how he felt about his superiors and that they would destroy the system, scare children, bruise fruit, etc. he should have had the maturity to hand everything over at that point.

That was always his deal. Everyone else was a moron and a danger to society but him. He refused to give the passwords while employed .

If Childs had written down everything the day he was terminated and turned it in during the exit interview his response in court and to the judge could have been, "Your honor I most certainly did hand over documents with everything they needed to know. I have no idea why they keep asking you to demand this information from me. I don't have it"

The only issue I have here is why he is going to jail. Not that he is going to jail.

As far as disproportionate goes, he might serve 9 months. Considering that the systems he managed were crucial infrastructure to SF, and the damage was extensive, with a lot more damage possible to the tax payers, 9 months is appropriate. Yes, I know that is a long time in jail.

Re:Passwords are property of the employer

[EdIII]

When he was terminated he had a supervisor.

By definition, this person was authorized to receive security information. Even if they were so massively incompetent they belonged in a Dilbert cartoon.

Your argument that he was in acting to be in compliance with the law is factually false. There was somebody at all times he could turn it over to.

He would be absolutely correct if he had continually refused to give security credentials to someone he knew was not authorized. However, he always had access to someone that met that criteria.

Always.

If, by some sort of strange fucking deal, he never had the opportunity to give over the information to this authorized person, he could have given it to the judge.

That's what the judge is there for. "Your honor, I can't responsibly give this information to them. Only Joe Blow is known to me to be authorized and he is not here. I would prefer to write them down and place them in the custody of the court and you can decide".

Had he done that... his ass would have been covered 7 ways till Sunday.

Re:Passwords are property of the employer

[muridae]

They could have been older and just didn't use browser bookmarks. I tended to remember site names, because the few that I needed on a regular basis were easy to remember. If it was hard to remember, I wrote it down because jumping between different browsers and surviving updates to netscape was tough. Or remember the chain of links of how I got there.

Though I feel like a young'in on the internet when I hear people reminiscing about gopher

Re:Passwords are property of the employer

[EdIII]

This is precisely the danger here. Morons walking around thinking passwords are intellectual property in the first place.

Secondly, thinking you can steal intellectual property at all. It's not possible.

You deserve the kind of world you will get when you let intellectual property become so perverted, that it will become a tool of control.

It was meant to be a tool to encourage contributions towards the Public Domain of all knowledge and expressions to enable us to keep building upon the work of our ancestors.

Thinking for one second that you can exist the way you do without their hard work is hubris. Thinking for one second that you can own your own ideas and pass them down as property is a recipe for fucking disaster. Imagine if you had to pay royalties for the fucking wheel? A car would cost 9 million dollars.

Intellectual Property is nothing more than a temporary set of tools in the form of legal entitlements. Any infringement upon them is for the civil courts. Criminally, if it passes certain tests. Those being mass infringement, and specifically the idea you profited from it.

Keep telling yourself it's theft. One day you will find yourself labeled a thief, without even knowing it.

Re:Passwords are property of the employer

[Anonymous Coward]

I wonder what would have happened if he just claimed ignorance, that he forgot the passwords.

Re:Passwords are property of the employer

[Lodlaiden]

There is a big difference between someone holding up a store, and firing an employee. If I willing discard a tool (sorry fellow IT professionals; we're tools) before I secure a replacement, then I have to live with that decision.

Manadatory Car Analogy: You don't get pissed off and cut the spark plug wires because you got shocked. You go get new spark wires. Preferably before you remove the old ones.

Re:Passwords are property of the employer

[mjwalshe]

if your a contractor is not your work "for hire" so you have even less rights

Re:Passwords are property of the employer

[MBGMorden]

And, of course, you are ignoring the fact that he was no longer employed by them, and they didn't have the right to order him to do anything anyway.

Two separate courts have already ruled otherwise.

Re:Passwords are property of the employer

[hawk]

Announcing that it isn't property doesn't change seven hundred years of Common Law, anymore than the mantra that "perjury isn't impeachable" changed the law in the 90s (in fact, 7 of the 10 impeachable offenses that Blackstone listed were forms of perjury, and 3 or 4 federal judges were impeached for various perjury in the 80s).

The computer is tangible personal property, and withholding/controlling the password exercises dominion and control ofter that chattel.

This has long been recognized. For example, "trespass vi et armis" is an civil (might also be criminal; I haven't worried about it in decades) doctrine governing trespass without physically being on the land, the classic example being the percussion from an explosion on the next land causing damage.

It is certainly *easier* to prosecute under newer specific laws, but claiming that the current laws *cannot* be used is just plain wrong.

hawk, esq.

Re:Passwords are property of the employer

[DarthVain]

Sadly true. I think I am surrounded by unprofessionals some days. Everyone is falling over themselves to agree and try to implement every horrible idea proposed by management, who at this point think they can do no wrong. Trying to "work" a terrible idea is sometimes just not going to suffice.

I seem to be either the only competent (which I doubt), or honest person to express that the idea or methodology being proposed is a colossal terrible, horrible mistake that will cause all sorts of problems for us in the future. Truly there is usually several ways to solve any problem, but some are intrinsically the correct way, and others the wrong way. People look at me funny in meetings when I say"no" like it is some sort of revelation, and I am afraid at this point I am becoming the negative Nancy who always says "no" (because no one else does). I have little doubt that this hasn't hurt my career.

For example: A LARGE enterprise system being proposed (implemented now I presume), will have users supposedly securely log on. Download a file. Fill out the file. Upload the file. Email the file to a local office. The local office will then "process", I assume using automated tools, those files and their contents into a database, which I also assume is centralized, but I could be wrong. When I heard this, I shook my head and said this is a terrible idea. When I asked why they don't just have people submit their information directly online into a DB rather than messing about with all this file processing garbage, I was looked at strangely and asked what difference does it make, and when I tried to explain all the duplication and points of failure, and inefficiency of the file based system (not to mention the storage and organization of thousands upon thousands of files, every single year) they didn't seem all that interested in any of it. I mean I thought this isn't something you have to be a total expert in, but something that is relatively obvious to even a layperson. However I suspect the blinders go on and common sense go out the window when trying to say yes fast enough to move up the corporate ladder.

Re: Passwords are property of the employer

[Anonymous Coward]

A better analogy would be if he withheld the passwords for a lot of password operated trucks.

Passwords != Keys

Re:Passwords are property of the employer

[Anonymous Coward]

Thanks for a reasonable and concise description.

The funny thing about San Francisco is that the city is basically run by a small cabal of elected officials and their friends and employees, and the public makes very little effort to hold anybody accountable. I got out because I was sick of the rampant corruption and apathy there; from city hall to SFPD to the public transit systems - people don't take pride in their work, there's just this gross miasma of evil that hangs about SF like the fog that sweeps in at night.

Nice place to visit, but living there is just stupid. I've never met and seen so many junkies in my life. Everywhere you go, running the public transit system, on the streets, everywhere. It's a nasty and grotesque little dirty city of no significance whatsoever.

Re: Passwords are property of the employer

[Anonymous Coward]

One ring to bind them all. One less viewing of "The Lord of the Rings" trilogy and this guy might have been a free man...

Re:Passwords are property of the employer

[Anonymous Coward]

Considering who his employer was - the City and County of San Francisco - he was almost guaranteed to end up in a high profile brouhaha. He had to be a moron to think he would prevail, as he basically held the city for ransom.

Re:Passwords are property of the employer

[EdIII]

It's actually the opposite. I always have a contract, and that contract covers exactly what you are talking about.

If I was an independent contractor, and like many having no contract, then you would be correct. It would fall under whatever laws exist. With a contract, I specify hours, rates, confidentiality, overages, intellectual property, arbitration, travel costs, etc. You name it, it's there.

The only thing I need be concerned with is contract law that would prevent me, or make unenforceable, a particular clause in my contract. To my knowledge, I don't have that problem.

At this point in my life I don't touch *anything* without a contract.

Re:Passwords are property of the employer

[Anonymous Coward]

Wear a suit ?!

I could never bear the shame.

Re:Passwords are property of the employer

[Anonymous Coward]

Your reading comprehension is abysmal. I wasn't talking about how things should be, but how they are. My point was that there's no precedent, as you claim - the treatment of Terry was far from novel.

You can live in a magic fairy world where IP isn't considered property and the taking of it is never considered theft. The rest of us live in the real world, however much we think it needs changing.

Re:Passwords are property of the employer

[Anonymous Coward]

My friend was able to pull that one off because his employer had him acquire the hardware and never paid him for it.. He had email proof that he was to be reimbursed and proof he never was.. so when they threatened to fire him he reminded them and informed them that until he was paid the hardware was technically on loan

Re: Passwords are property of the employer

[Anonymous Coward]

Charging to change the a password that doesn't belong to you is akin to extortion.

Re:Passwords are property of the employer

[Lanboy]

Actually he set it up so that they could not in fact reset the passwords without permanently deleting the configurations, in some case they would permanently lose configuration if they were powered down, He put his own padlocks on the trucks, and booby trapped some of them to have the engines burn up if they messed with the locks.

Re:Passwords are property of the employer

[cfeagans]

I agree he was probably wrong to withhold the passwords. Unethical.

But what I don't understand is why he just didn't say, "sure, the password is pRisonLove69. What? It didn't work? Well that's what I set it as..."

Could they then jail him for faulty memory?

Re:Passwords are property of the employer

[EdIII]

It's you that lives in the fairy tale. IP IS NOT PROPERTY DESPITE ITS NAME.

The only part of it that can be remotely considered property, and is routinely in contracts and the courts, ARE THE LEGAL ENTITLEMENTS THEMSELVES.

How can you steal legal entitlements? You can't dumbass. If I recall correctly the only way that you can try is by hanging a recording artist out the penthouse window and demanding that he sign documents transferring ownership of the IP to somebody else.

What you grossly misconstrue as theft is INFRINGEMENT. I wonder why they choose to use that word? Golly gee willickers Batman... why? Theft and stealing could be used, and has been used in legal language for centuries... .so why infringement? Hmmmm. Why, why why?

It's because THERE IS NO FUCKING THEFT. Infringement is a specific word that indicates something legal was broken.

In this case what was broken was specific legal entitlements allowing you control over the IP. Now how can you do that if you don't still possess it? Ohh that's right.... because you are still in possession of it.

For fuck's sake. Just a modicum of logic shows that theft is precluded by the very definitions of IP law itself!!!

I'm not talking about a fairy tale world here asshole. This is the real world. Show me one fucking court case that has been brought where it actually says theft. They don't do that because the judge would laugh his/her ass off. That's why they need to use the CORRECT legal language in the courts, which is infringement upon the legal entitlements of the copyright holder. Not a coincidence.

The dangerous precedent here is for people to be walking around stupid, like yourself, buying into this perverted understanding of IP law. It only hurts yourself, myself, and the entire world when you do it.

Put the asshole in jail for what he did, but don't for one second start thinking passwords are property which can be stolen. They can't. They aren't physical.

If you want to put him jail for "stealing" a password then you better damn well prove he broke into the safe and stole a piece of paper with passwords written down on them....

Re: Passwords are property of the employer

[tolkienfan]

Analogy, I do not think you know what it means.

Re:Passwords are property of the employer

[Anonymous Coward]

"Or the people who previously would have condemned Kim Dotcom as a fraudster and spammer but who lionized him because the copyright police came after him."

He IS a fraudster and spammer.

The issue is that law enforcement not just stepped over the line of legality in going after him, they may as well have rolled a half dozen panzer brigades into Austria while they were at it, it was that blatent.

The good guys, by definition have to follow the rules. If they don't: they're no longer the good guys, just another buch of thugs in uniform.

IE: The Kim Dotcom saga isn't about Kim Dotcom

It's about the integrity and non-corruptability of the legal process. I'm glad that he had enough money to defend himself and caused several judges to take a much closer look at what happened - and grow big enough stones to tell the Police that they majorly fucked up(*)(**). The fact of HOW he made that money is something I'm acutely uneasy about as does the fact that NZ's settlement laws appear to have been majorly abused by politicians(***) in order to give him residency (someone with his past convictions wouldn't have been allowed into the country at ALL under most circumstances).

(*) NZ courts have a nasty habit of going along with whatever the police say even when the evidence is flimsy at best. This has resulted in a significant number of high profile convictions being overturned in Courts of Appeal with particularly harsh words about the cops involved.

(**) The original search warrant was overly broad (illegal) and issued by an overly credulous minor district judge on the flimsiest of evidence (reviews show it shoudlnt' have been issued), but the police managed to go so far past what the warrant authorised they they may as wlel have been wiping their asses with it.

(***) For all the claims that NZ is corruption-free, it DOES have a payola problem at high levels - and its definitions of corruption are extremely narrow (bribery i the only thing illegal) compared with the OECD's definition. As a result, New Zealand is a hotbed of cronyism amongst other things.

In summary: Yes I'd like to see Kim D go down for something illegal - but I want to see him go down via LEGAL methods. Breaking the rules to bring in a bad guy not only risks putting the bad guy back on the street but also risks innocent people being scapegoated for personal reasons via the same rulebreaking. There must be severe punishment for those who are charged with upholding the law, should they deliberatly overstep their authority.

Re:Passwords are property of the employer

[Anonymous Coward]

Yeah, trying to withhold passwords is the sucker's way of keeping job security.

Now, if you REALLY want to make yourself invaluable, you must obfuscate your code.

Re:Passwords are property of the employer

[Anonymous Coward]

I don't think forgetting or refusing should ever be criminalized since in many cases you cannot truly tell which one it is.

Sure you can, you say what's the password? If they say I don't remember they don't remember if they say fuck you they're refusing.

Ok, YOU are stupid enough to say "fuck you" because you refuse. Someone with an IQ above their belt size, however, would be sharp enough to realize that if they instead say "I don't remember" (even though they do), the questioner will not be able to tell if they truly cannot remember, or if they are merely refusing to divulge what they know.

Re:Passwords are property of the employer

[Reziac]

Well, here's the questions that came into my head:

How is a password, generated for your employer, any different from any other work-for-hire?

How is a password, generated to inconvenience your employer, any different from any other sabotage?

Discuss.

Re:Passwords are property of the employer

[FreedomFirstThenPeac]

Then he forgot the passwords. Ooops.

Re:Passwords are property of the employer

[WillAffleckUW]

How does Childs "know" the person trying to get him to email the passwords "is" his employer?

FTF is the only verifiable way.

Social engineering for password theft after job changes is a major threat risk.

Re:Passwords are property of the employer

[squiggleslash]

He doesn't, but he does know that the City of San Francisco needs the passwords, and if he'd forgotten, the person contacting him would have been reminding him in the process.

So, like I said, if he'd chosen not to be a dick about it, the right approach would have been to say "Sure! I'll be over there in five minutes, meet you at City Hall", rather than "No, because I don't know for sure you are authorized and I'm going to argue about this until the MAYOR meets me in person."

Re:Passwords are property of the employer

[TemporalBeing]

I'm not saying what Terry did was right/wrong, but if they didn't have procedures/process in place, then it's there own fault a cocky sys admin grabbed them by the cohones.

Agreed. They should have at least asked for the password prior to firing him.

On a separate note, would you really re-grant sysadmin access to someone that wasn't "pleasant" about handing over the keys?

On a 1-day contract that is explicit about being for the sole purpose of providing the password(s) to another employee so that employee can then access and change the password? Yes, but no $1k/day - probably $100/hr, and only keep them around long enough to get and verify the passwords. Perhaps 1-2 hours per day for several days as needed by the other employee, but no - they would not be allowed to touch any equipment. If they needed to touch type for the password, a separate (controlled) system would be provided for them to do so into "notepad" (or equivalent).

Re: Passwords are property of the employer

[TemporalBeing]

it is absolutely unforgivable to allow a system design allowing for single authority.

Every OS I can think of - Windows, Linux, MacOS, Solaris and every descendent of Unix - has a single root account, with a single root password, which can change every other password on the system. The tablet/phone OSes (iOS and Android) are similar but worse - they give administration privileges to the one and only *user* account, with an optional-and-rarely-set password, and completely block the ability to log in as root.

Got any examples of a system design that does NOT allow for a single authority?

When you get into routers, etc the OS quite quickly comes down to 1 user - the root user. If you're lucky, it'll recognize several but then it'll usually authenticate against another source (e.g. LDAP, AD, Kerberos, etc). You're basically thinking of user-facing devices (e.g. PCs) and servers, not the backend infrastructure that connects it all.

Re:Passwords are property of the employer

[Courageous]

> The part where you throw him in jail afterwards until he hand them over seems a little much.

As a bit of an aside, if you get to the end of a legal proceeding in the united states, and a judge thence ORDERS you to a specific course of action, if you directly defy this judge and say that you will not comply, they have the legal right--and have been known to exercise their legal right--to throw you in jail indefinitely until you comply. While this may seem outrageous at first blush, I don't really think we can have any kind of effective society at all in a world where the law has no power.

Re:Passwords are property of the employer

[HeckRuler]

Oh, sure sure, that's a judges order. Law of the land and all that.

And if I can convince a judge to order you to shove your head up your ass, I expect you to spend a lot of time in jail limbering up. It's just that the whole "convince a judge" bit is supposed to be difficult. They're really not supposed to just flippantly order people about. They're supposed to have reasons for such things.

Let me expand the original post:
The part where you can convince a judge to order him to tell you the passwords seems a bit much. Kind of an abuse of power. Seems like a civil affair over property and all that. Having a court order in short notice and then throwing him in jail in less than a week doesn't seem like a power that the typical employer normally has. I didn't even know the judge was in your pocket.

Seems fine with me.

[dukeblue219]

I don't have a problem with this. The company may have been dumb to put this much power in one person's hands, and perhaps they got what they had coming in someone's eyes, but it doesn't excuse this behavior. If I had the only key to the server room and got fired but didn't turn in the key, I would expect retribution of some form, especially if the office had a steel door that took weeks to break down.

Re:Seems fine with me.

[Jah-Wren Ryel]

If I had the only key to the server room and got fired but didn't turn in the key, I would expect retribution of some form, especially if the office had a steel door that took weeks to break down.

What kind of idiot budgets for a server room with a steel door that takes weeks to break down but doesn't include a duplicate key for the security office to hold? Why isn't that idiot the one in jail? What if you lost the key, would you still be OK with being sent to jail for not returning it?

Re:Seems fine with me.

[Livius]

What kind of idiot

Management.

Re:Seems fine with me.

[Delarth799]

Intentionally withholding the key is different from losing the key because when you lose it then you let your employer know right away. Although the analogy used wasn't the greatest either because in this case the city was unable to use the network for a period of time, not just manage it. In this case it would more like he cut off connection to the server room and constructed a barricade inside to keep people out.

Re:Seems fine with me.

[MrEricSir]

"The company" in this case was San Francisco city hall. Local governments aren't exactly known for their IT prowess.

Re:Seems fine with me.

[Anonymous Coward]

This is subtly different. In my eyes, once the employee has been fired, they are really under no obligation to help their now ex-employer with much of anything. Of course, having a password in your head and a key in your pocket are different things, the company has the burden of due diligence to be sure you turn in the key, security badge, whatever before you walk out the door. If they don't have a password, that's their own fault. The key and lock equivalent would be I get home, having just been fired, and all the keys, security badges, whatever I have should (morally and legally) be shredded, burned, or otherwise destroyed.

HOWEVER, this isn't a case of due diligence. This guy went to great lengths to not only ensure no one else had access, but actually booby trap the system. That in and of itself should be grounds for firing and criminal charges. The only difference here is that they didn't find out what he had done until after he was fired, which doesn't change the fact that he was committing a crime in the first place.

Re:Seems fine with me.

[Anonymous Coward]

Do you not understand that a metaphor is being employed here? Namely, likening a physical object to its computerized equivalent? Or are you being obtuse on purpose?

Re:Seems fine with me.

[The Grim Reefer]

If I had the only key to the server room and got fired but didn't turn in the key, I would expect retribution of some form, especially if the office had a steel door that took weeks to break down.

What kind of idiot budgets for a server room with a steel door that takes weeks to break down but doesn't include a duplicate key for the security office to hold? Why isn't that idiot the one in jail? What if you lost the key, would you still be OK with being sent to jail for not returning it?

But that's different from with Terry Childs did. He didn't accidentally lose the key. He let everyone know that he still had it and wouldn't return it. Normally I wouldn't side with the company as readily as in this case. They should have never had him (or anyone) be the sole gatekeeper. But Mr. Childs chose to be a complete ass, and probably got exactly what he deserved.

Re:Seems fine with me.

[JDAustin]

We''re not talking about a company (where the idiots are weeded out), we're talking about a local government (where the idiots are promoted; especially if they are related to a politico).

Re:Seems fine with me.

[InfiniteLoopCounter]

Have to agree with the senitment here. The company is at fault because he could have gone under a bus or something and there would be no way to recover the data.

He should have claimed amnesia.

Re:Seems fine with me.

[ArchieBunker]

Are you 12 years old or just an idiot?

Re:Seems fine with me.

[Anonymous Coward]

What company would that have been? You mean the city of San Francisco, his former employer?

His old bosses were clueless. I think he got confused when thinking about the need to keep his old bosses from f*cking up the system, with f&cking up the system by withholding the infrastructure keys. The reason for the huge bill to reset passwords was proof of his former bosses incompetence.

Re:Seems fine with me.

[Anonymous Coward]

If he had died, he wouldn't be able to go to jail, now would he?

But he didn't die. He was arrested. The mayor of the city personally asked him for the password (because it was a city network), and he still refused.

The city also didn't set him up as the only person with a password (he did that himself), allow him to lock out everyone else (he did that himself)), set the system to erase all data if he wasn't the one logging into it (he did that himself), or authorize him to file a copyright application that made the system more vulnerable to attack (? Okay, that one is kind of a head-scratcher, and yet, he did that himself).

The city's only fault is that they didn't think they needed to micro-manage the guy that was supposed to be working for them, not against them.

Re:Seems fine with me.

[Belial6]

Except when this story was originally reported, the city COULD use the network. They chose not to, claiming that they thought he might have compromised the system in other ways. As well as it being originally reported that Terry Childs continually offered to divulge the password to the individual and in the way that the cities security policy dictated. The city refused to follow their own procedure, and insisted that he violate the city's security policies by divulging the passwords to an unauthorized individual over the phone, which was also unauthorized.

Unless new facts have come to light that contradicted what was reported when it happened, Terry Childs has been sent to jail as an innocent man because he didn't realize that the law is a joke and works at the whim of those in power.

Re:Seems fine with me.

[Chuck Chunder]

What kind of idiot budgets for a server room with a steel door that takes weeks to break down

That room sounds pretty secure, the perfect place to put the spare keys for safekeeping.

Re:Seems fine with me.

[Belial6]

When this went down, it was not reported that he refused to turn over the passwords. He refused to hand over the password to unauthorized individuals and in unauthorized ways.

Re:Seems fine with me.

[Anonymous Coward]

The mayor of the city personally asked him for the password (because it was a city network), and he still refused.

Whoops. He actually did give the passwords to the mayor. Serves me right for not checking my info first. I also found out that he claimed copyright ownership for the entire network under his own name even though it was part of his job (and he volunteered to do the work).

Re:Seems fine with me.

[Anonymous Coward]

Do you not understand that a metaphor is being employed here?

A cherry-picked metaphor doesn't add any value to the discussion because the fact that it was cherry-picked presupposes the result. All he did was point out that the metaphor was bullshit because it was biased.

Re:Seems fine with me.

[Dahamma]

Seriously, have ANY of you actually followed this case at ALL?

He changed the passwords and then wouldn't tell anyone what they were because he claimed he "didn't trust anyone else with them". It's more like changing the lock on the door without your company's approval, and having the only key. It's a pretty clear cut case of either someone with a god complex or someone trying to extort the city of SF to keep his job.

Re:Seems fine with me.

[masmullin]

I don't have a problem with this. The company may have been dumb to put this much power in one person's hands, and perhaps they got what they had coming in someone's eyes, but it doesn't excuse this behavior. If I had the only key to the server room and got fired but didn't turn in the key, I would expect retribution of some form, especially if the office had a steel door that took weeks to break down.

See, the thing is, it's not a key. It's a part of your body that unlocks the computer system. Specifically, the "key" is a series of electrical pulses in your head. Those electrical pulses belong to you because they are inside you.

To follow your analogy... the problem here is that the "key" in question belongs to YOU not the city. Why the city was ok with letting the server room be locked with YOUR key is a sign of their stupidity, but their stupidity shouldn't be YOUR problem. If you hyjacked their system so that none of THEIR keys worked properly... that's a completely separate issue to discuss.

Why is it YOUR key and not theirs? Because the key is actually a part of your brain, and a government or an employer cannot claim eminent domain over the contents of your brain, as the slippery slope induced is just barbaric beyond imagining.

When the city fired him, he took HIS key and went home.

Re:Seems fine with me.

[Anonymous Coward]

The one in jail was the IT manager, and was given the responsibility to come up with IT practices.

He chose to ensure he was the only one with the passwords.

So; you are right - the one that came up with that plan is now in jail.

Re:Seems fine with me.

[Cramer]

Actually, they continued to use the network just fine despite the sole password holder being in jail.

The big point was, they were unable to have anyone else manage the network: had something broken, it would've stayed broken; any changes needed could not be done. To make matters more interesting, there was no known documentation for the network; some devices had password recovery disabled (they'll reboot cleanly, but you won't get into them without erasure), and other devices had no startup config (they won't reboot)... good luck guessing which is which -- guess wrong and you have a router with no config and no knowledge of how to reconfigure it. He did this intentionally to prevent people he saw as completely incompetent (i.e. everyone) from messing with his baby. He genuinely thought by withholding the password(s), they would "see the error of their ways" and give him his job back.

Re: Seems fine with me.

[Anonymous Coward]

Except they did plan for multiple keys, and Childs changed the locks after the vault was built then refused to hand his employer a copy of the new key.

Re:Seems fine with me.

[Anonymous Coward]

Excepting that from the sound of it, he was the one employed to maintain and suitably manage this information. If he did not have a succession plan, or fallback for failure of his memory, or loss of him as an agent of the employer, he doubly failed to do his job...

Re:Seems fine with me.

[radarskiy]

A duplicate key is irrelevant if someone takes it upon themselves to change the lock and not tell anyone... such as in this case.

Re:Seems fine with me.

[whois]

You would expect retribution for not turning in a key? How silly. I would agree if you decided to install your own lock but if you're just holding a key the company gave you, it's their responsibility to hold on to another copy.

The entire story, no matter what you think about the person, is a ludicrous example of bad network maintenance. If they had proper config backups they don't need the password, just reboot the routers/switches/whatever and reload the config with a new password. Don't like downtime from a person leaving and taking the only copy of the passwords with him? Use TACACS or any other AAA login scheme to handle users.

In fact, not using AAA is negligence in itself. Without it you don't have an audit trail of changes made on the network so you're just guessing who made changes.

You could argue, probably correctly, that these things were his responsibility, but that would mean that the city was leaving the entire network administration and maintenance in one persons hands, no backup person or trainee to handle continuity if the network engineer dies suddenly. Nobody to take over for them if they go on vacation. That points to management negligence.

Finally, their abuse of city resources to put this guy in prison for 5 years as a CYA is really reprehensible. They never had an outage. It's pretty sad when everyone involved in a non-violent, non-criminal action can't sit down at the end of it and apologize, or reach an agreement that doesn't put a person in prison.

Re:Seems fine with me.

[Cramer]

They knew before he was fired. Some of his bosses (at least his immediate boss) were aware of his "process" and went along with it. As I recall, the shit started flowing when a new boss got in the tree somewhere(?), and Childs was moved to a different department where his childishness became overly apparent, and far more than anyone could overlook.

Re:Seems fine with me.

[Anonymous Coward]

According to the article, he would not give the passwords to the authorized individuals because we was afraid the authorized individual would give them to unauthorized individuals.

Re:Seems fine with me.

[RR]

This is subtly different. In my eyes, once the employee has been fired, they are really under no obligation to help their now ex-employer with much of anything. ...snip... The only difference here is that they didn't find out what he had done until after he was fired, which doesn't change the fact that he was committing a crime in the first place.

It was worse than that. He wasn't even actually fired, yet. He was being "reassigned," and he took that as a sign that he should put his contingency plan into effect. He took a bunch of stuff with him and fled to Nevada, and was caught when he came back for some more stuff. To this day, not all of it has been recovered.

Re:Seems fine with me.

[Anonymous Coward]

I wouldn't and retribution should be illegal. If the company asked for the keys before you were fired or while you were being fired then fine, you owe them the keys. However, AFTER they fire you they shouldn't demand you do things for them. You don't work for them anymore and are under no obligation to help out. I'd go further and say you shouldn't help. You don't know if policies changed after you were fired. Maybe the guy asking for the password had his authorization revoked. You wouldn't know that since you no longer worked there.

It's not your fault management didn't ask for documentation on how to reproduce your work before they let you go.

Re:Seems fine with me.

[Anonymous Coward]

No - he refused to hand over the password to individuals *he* considered to be unauthorized, after failing to follow basic network management practice and so creating a situation where *he* was a single point of failure. Which is technical incompetence.

If you can't figure out the problem was one that *he* made for himself, you've no idea what personal responsibility is.

Re:Seems fine with me.

[euroq]

I read the court report (~40 pages) and that was not the information given. He was asked many times outside of the one incident of the conference call at the end to give his manager the passwords. If there was ONLY that one time, that would be different.

Re:Seems fine with me.

[gnasher719]

When this went down, it was not reported that he refused to turn over the passwords. He refused to hand over the password to unauthorized individuals and in unauthorized ways.

He refused to hand over the password to people who were full authorised but in his opinion couldn't be trusted. He refused to hand over the keys in a way that was insecure, but then didn't make any effort to hand over the keys in a secure way, which would have been his duty (because at the time he _was_ employed and _was_ asked by someone who was authorised).

Re:Seems fine with me.

[gnasher719]

This is subtly different. In my eyes, once the employee has been fired, they are really under no obligation to help their now ex-employer with much of anything. Of course, having a password in your head and a key in your pocket are different things, the company has the burden of due diligence to be sure you turn in the key, security badge, whatever before you walk out the door. If they don't have a password, that's their own fault. The key and lock equivalent would be I get home, having just been fired, and all the keys, security badges, whatever I have should (morally and legally) be shredded, burned, or otherwise destroyed.

That argument is idiotic. They asked him to hand over passwords while employed, and he refused. That's an offence worth being fired for. And it causes damage, so he deserved being told to pay the damage and to go to jail for it.

So he refused. What is the company supposed to do? Employ him and pay him money while taking him to court to make him hand over the passwords?

Re:Seems fine with me.

[Anonymous Coward]

By "his manager" do you by chance mean the woman who came up to him one day, introduced herself as "Hello, I'm your new manager" and demanded the password without any proof that she was who she said she was, and not someone attempting social engineering?

In the end, he did give the password to his managers manager ('s manager...), as said manager finally came to him (he couldn't go to the manager because he was in jail).

Re:Seems fine with me.

[Anonymous Coward]

He told it to his manager's manager, the first time he got the chance.

He didn't tell it to his new manager, because his new manager introduced herself as "hi, I'm your new manager. Give me the passwords", without any proof that she was his new manager, and not someone attempting social engineering (where I've worked, new managers have been introduced by their manager, they don't just come in and start giving orders).

He also didn't tell it to the police officers, or on a conference call with no knowledge of who might be listening in at the other end. None of which he was authorized to give the password to in the first place.

Re:Seems fine with me.

[MadKeithV]

If I had the only key to the server room and got fired but didn't turn in the key, I would expect retribution of some form, especially if the office had a steel door that took weeks to break down.

What kind of idiot budgets for a server room with a steel door that takes weeks to break down but doesn't include a duplicate key for the security office to hold? Why isn't that idiot the one in jail? What if you lost the key, would you still be OK with being sent to jail for not returning it?

If you were responsible for the key, and lost the key, you might very well be liable for the damages caused by having lost the key. If it was Terry Childs' responsibility under a reasonable interpretation of the terms of his job contract to ensure continued access to the servers (and it seems that's along the lines of what the courts have now decided) then he was in violation of his employment contract for actually doing so.
It was potentially naive for the employer to trust him with this much power, but it's equally likely they had no technical idea that this was the case. The only other option beyond trusting your highly skilled employees is to have at least two people for every job, and then hope they don't actually collude to cause trouble anyway.

Re:Seems fine with me.

[Registered Coward v2]

Except when this story was originally reported, the city COULD use the network. They chose not to, claiming that they thought he might have compromised the system in other ways. As well as it being originally reported that Terry Childs continually offered to divulge the password to the individual and in the way that the cities security policy dictated. The city refused to follow their own procedure, and insisted that he violate the city's security policies by divulging the passwords to an unauthorized individual over the phone, which was also unauthorized. Unless new facts have come to light that contradicted what was reported when it happened, Terry Childs has been sent to jail as an innocent man because he didn't realize that the law is a joke and works at the whim of those in power.

No, he went to jail because he deliberately setup the system so he was the only one that knew the passwords; and then refused to divulge them. He didn't simply forget his or refuse to violate procedures; he tried to use what he did as leverage and that is what he went to jail for. What he did is no different then any other type of extortion.

Re:Seems fine with me.

[Anonymous Coward]

No, the key is a series of characters. That he keeps a copy of that series encoded in his brain doesn't make that character sequence any more his property than remembering your Slashdot user name makes it my property.

Re:Seems fine with me.

[Anonymous Coward]

both actually, they for setting up the possibility and he for doing it.

Re:Seems fine with me.

[Anonymous Coward]

Wasn't there some issue with the organizational structure of the departments? Something like it wasn't really his manager, but a new one, or from another unit?

Re:Seems fine with me.

[Anonymous Coward]

Ah, yet another case of changing the metaphor to fit the writer's desired outcome. Good on you, everyone loves a hypocrite!

Re:Seems fine with me.

[Anonymous Coward]

Well, it's not the "Local governments" job to be known for their IT prowess. They hire IT professionals who are supposed to have 'IT prowess'. As in, they should be competent. If San Fran's IT was incompetent, it's because Terry Childs was incompetent. Not because Sue in accounting doesn't know how to set up domain policies.

Of course, you can point to other parts of management, because someone should have noticed he was the only one with the passwords. But, how would that conversation go? Terry Childs could make up whatever BS he wants and they have to believe him(since they're not the experts, and he was apparently the most senior member).

All signs point to Terry Childs being incompetent at the very least, and my armchair diagnosis is he's a narcissist who enjoyed fooling the people around him.

Re:Seems fine with me.

[Anonymous Coward]

Did the official security policy allow or forbid him to divulge the password to his manager?

Did a court order that he hand the password to his manager in lieu of said policy?

Re:Seems fine with me.

[Anonymous Coward]

My reply has an additional point of the lady whom he caught stealing on tape and who then took revenge by using her contacts/position to get him fired - http://yro.slashdot.org/comments.pl?sid=4411025&cid=45337775

Re:Seems fine with me.

[Anonymous Coward]

Are you 12 years old or just an idiot?

B-b-but...Why can't I be both?!?

Re:Seems fine with me.

[Anonymous Coward]

Neither is the private sector. Stupidity is universal, it dos not matter the type of organization.

Re:Seems fine with me.

[david_thornley]

I used to think that about companies. I've learned better. There's really not much difference in how idiots are promoted in the public or private sector.

Re:Seems fine with me.

[Anonymous Coward]

What you don't get is how incompetently the City of SF is run.

Not saying he was absolutely right in refusing to hand-over the passwords in an insecure manner to the people who were supposedly authorized. What I'm saying is that the entire thing was atypical of everything SF, so rampantly mismanaged and so incompetently out of control that there is sufficient doubt there to justify his refusals.

IF management had made some simple attempts to properly delegate security, arguably the passwords would have been given up. But the way the City of SF is run is so rampantly corrupt and incompetent, management did what it ALWAYS does. Create an easy scapegoat, and cover their own asses. and that is exactly what happened here.

Child's name is the ONLY name you're hearing; not the names of the managers who it was the responsibility to have a proper system in place.

How, how HOW

[Anonymous Coward]

HOW!(!) is this a surprise to anybody? It's extortion, plain and simple.

Re:How, how HOW

[dukeblue219]

Yep. He didn't even just conveniently "forget" the password after he was fired, but apparently set this all up well in advance to intentionally disrupt their business. Dumb move.

Re:How, how HOW

[Anonymous Coward]

"Oh you know I keep all those in my password vault, and like a responsible person I removed all work files from my personal systems when I left. Sorry can't help you."

Re:How, how HOW

[Anonymous Coward]

That's why I find this a little scary. While he was a colonic asshat, what's to stop another employer going after an ex employee who didn't do anything wrong.

Consider case: employee terminated, so changes all passwords, prepares a working list and hands it to employer. Employer (through malice or incompetence), destroys old list. Employer "forgets" new passwords, calls police on old employee. Old employee goes directly to jail, does not pass Google, does not collect 200 passwords.

Re:How, how HOW

[DarkSoul42]

This is the reason why you sign a discharge/handover document upon leaving a company, even if you are fired "on the spot" :
- to prove that the employer DID notify you of what was subject to non-disclosure
- to prove that the employee DID return any assets (physical or otherwise) he was in charge of
- to prove that the employee DID proceed to skill transfer/handover of technical expertise, or important information (which means : you don't get sued for any software/hardware crash after you left, as long as it was in the handover/transfer scope; because the remaining staff is therefore supposed to be able to deal with it ; supposed being the keyword of course)

If you have such an agreement, which is dated written evidence, then an employer can't pull this on you. If he does and destroys the passwords, well, tough luck, it's all on his head.
If you don't have an agreement like that, then you need to level up in CYA skills, or if your employer refuses to give you one such agreement then you needed a new employer anyway.

Re:How, how HOW

[taustin]

Yep. He didn't even just conveniently "forget" the password after he was fired, but apparently set this all up well in advance to intentionally disrupt their business. Dumb move.

As I recall, the "business" involved included their 911 system, didn't it?

Re:How, how HOW

[Anonymous Coward]

Now you're adding details that aren't in the original. Differences between cases can make or break a defense, and something like actually giving the employer a password list for them to use in your absence is a powerful show of due diligence. That employee is not going to jail.

Here's what actually got the article's asshat sent to jail:
"he knowingly prevented the city from being able to use its own computer system for a period of time, deliberately configured that system so that no one else could access it, set it up so that anyone other than him attempting to enter it would erase the data stored in it, and made the network more vulnerable to external attack by the filing of an unauthorized copyright application"

That goes far beyond an employee (ex- or otherwise) who didn't do anything wrong.

Re:How, how HOW

[Dahamma]

Except you are completely missing what actually happened in the case. Childs changed the passwords intentionally and without anyone else's permission so his coworkers and superiors couldn't use them because he claimed "they couldn't be trusted with them". In fact, they asked him for the passwords BEFORE he was fired and he refused. It basically was simple extortion, and no amount of documents are going to protect him from that.

Besides, what in fact was the city of SF "pulling on him"? They just wanted the passwords to THEIR COMPUTERS, and he had them. He refused. That's entirely on him, and was a totally solvable problem (the mayor of SF actually visited him after he was arrested and asked him for the passwords before he gave any up. If he hadn't finally given up his bizarre god complex and complied he'd probably be on the hook for a MUCH larger financial loss...

Re:How, how HOW

[dbIII]

As you somehow didn't manage to recall, that system worked perfectly during the two weeks before the Mayor's "coming to save the day" stunt.

Re:How, how HOW

[BrookHarty]

HOW!(!) is this a surprise to anybody? It's extortion, plain and simple.

Extortion for what? Money? Sexual favors?

You send junior techs out to reset the password on the server by console. Its that easy.
And then you put a password policy in place and a password keeper that the employee must use.

And fire the manager who didnt know what a password policy was or a console to a server/router.

No wonder he the guy didn't want to turn over a password to a PHB.

Re:How, how HOW

[jfalcon]

Actually, he demanded to see the Mayor after his arrest as he refused to divulge the passwords to his manager or anyone else in the chain before or after arrest.

Re:How, how HOW

[JDG1980]

You send junior techs out to reset the password on the server by console. Its that easy.

The court document says that Childs had disabled the console ports.

Re:How, how HOW

[airdweller]

"As you somehow didn't manage to recall, that system worked perfectly during the two weeks before the Mayor's "coming to save the day" stunt."

As you somehow didn't manage to think of it, what would happen if it didn't "work perfectly" and they needed urgent (as in "NOW") access?

Re:How, how HOW

[taustin]

Other than the delayed maintenance to the power systems and two city departmens that couldn't be connected to the network because of the delay.

You have a funny definition of "perfectly."

Childs belongs in prison.

Exactly right

[Pirulo]

The passwords are like the key to the office. You have to return them.

Re:Exactly right

[Anonymous Coward]

Not until I've been paid in full, you bastards.

Re:Exactly right

[noh8rz10]

this situation is more like, this guy made sure there was only one key to the entire government IT, then took it with him when he left. he shouldn't be surprised that he sits in jail.

Re:Exactly right

[nctritech]

Clearly he needs to re-read most of the Bastard Operator From Hell series.

Re:Exactly right

[formfeed]

The passwords are like the key to the office. You have to return them.

I think they are more like the pin code you would use to let yourself into the building. In which case as a honest employee you would disable your code before leaving the company ... :)

Re:Exactly right

[Pirulo]

Not quite. The guy was as well the pin maker and pin administrator. So disabling your pin would be akin to rendering the door lock unusable.

Re:Exactly right

[formfeed]

So you have a door lock where only the custodian can give out new pins by first typing in his own. And then you fire the custodian.

Re:Exactly right

[dbIII]

Except it's nothing like that at all. What is your motivation for posting this shit about a router password that's only needed if you want to change the configuration and can be bypassed if needed anyway?

Re:Exactly right

[Tiger4]

The process should be the passwords to every system written down, sealed in individual envelopes, then all of them sealed in one large envelope and locked in a safe. the envelope seals are anti-tamper sealed and signed by at least two responsible people, a sysadmin and a manager. As long as nothing changes, all is good. If any of them needs to change, you break the seals and redo those. On the systems themselves, it should take two people to authorize the password change, with notice going out to them and others that the change happened. That is less likely to be implemented, so it becomes the weak point of the system.

At no point should a single person be the only one with all the key passwords. This case is what happens when you let it all fall to one guy.

Re:Exactly right

[BrookHarty]

The passwords are like the key to the office. You have to return them.

No they are not.

Its more like leaving the key in the door, the owner just walks up to the door and turn the knob himself.

Aka, you walk up the server/router and change the password.

Access was never denied, only easy access.

Re:Exactly right

[nbritton]

The passwords are like the key to the office. You have to return them.

This is true only for shared ids, but you never ever return passwords for individual ids because you're the liable party. Say for instance your manager what's to fire you and knows you keep all you ids in the desk, he brakes into the desk and copies the information, then logs into the system with your id and kills the system. Who is liable here? You would be, unless you can prove he stole your id and logged in and killed the system. You have to give them root, but personal ids, fuck no... in fact, make them delete the accounts in front of you.

yes, withholding passwords can, as expected

[rubycodez]

good, justice served. usually I'm on the employee's side of things, but perp committed a crime, it's stealing, sabotage and extortion to do that

Seems obvious enough.

[Anonymous Coward]

When you lose your job as a bus driver, you have to return the ignition keys to the vehicle. Duh.

Another sensationalist headline which suggests a far different story than the one in the actual story.

Re:Seems obvious enough.

[noh8rz10]

When you lose your job as a bus driver, you have to return the ignition keys to the vehicle. Duh.

Another sensationalist headline which suggests a far different story than the one in the actual story.

except that nobody ever loses their job as a bus driver. public unions ftw!

Re:Seems obvious enough.

[dcollins]

"except that nobody ever loses their job as a bus driver. public unions ftw!"

Liar.

Google: "bus driver loses job".
About 1,840,000 results (0.32 seconds)

Re:Seems obvious enough.

[noh8rz10]

I got 30k results. not as common as you suggest. did you use the quotes? that would explain it.

About 29,900 results (0.27 seconds)

Re:Seems obvious enough.

[Anonymous Coward]

Ooo, I can play this game...

Google "dcollins is a wanker" and get 37.5 M results!

Invoice

[Anonymous Coward]

He should have just invoiced them for his time to document them as a contractor at a really ridiculous rate.

Something about Betteridge

[Anonymous Coward]

I've simplified the submission:

Withhold Passwords From Your Employer, Go To Jail?

Yes

Re:Something about Betteridge

[arielCo]

So,

Can any headline which ends in a question mark be answered by the word no?
Umm... no?

Re:Something about Betteridge

[isorox]

I've simplified the submission:

Withhold Passwords From Your Employer, Go To Jail?

Yes

But what about Betteridge's law of headlines?

Re:Something about Betteridge

[Anonymous Coward]

you need to fix it again. the headline seems to imply that "any" password hidden from your employer can send you to jail.

i'd personally go with

Withhold Company Passwords from Your Employer, Go to Jail?

Definitely.

History rewritten

[guruevi]

Terry Childs did not want to divulge the passwords to an entity that didn't have the right to said passwords. There are several other red flags in this case but $1.5M to regain access over some routers? Seems like gross incompetence on various levels.

Re:History rewritten

[Ralph Wiggam]

Terry Childs did not want to divulge the passwords to an entity that didn't have the right to said passwords.

So what's the "real" history here? How could the company not have the right to the passwords?

Re:History rewritten

[Anonymous Coward]

How could the company not have the right to the passwords?

The company DID have the right to the passwords, Childs simply tried to argue that since he "built" the system and all it entailed, it was his personal property.

Which was a fucking stupid argument.

Re:History rewritten

[Fallen Kell]

He was asked to give the passwords over during a meeting with several people who had not signed the appropriate papers for having said access and had not been documented by information/system security for having a right to the passwords. There was also a conference call being held on the phone in the room with unknown persons who would have then also been privy to the password divergence. Terry simple say "no" to diverging the passwords in that location, at that time, in that manner. In his contract, he had a duty to protect the passwords, and he was still an employee at that time. Giving up the passwords in that location at that time would have been a breach of his contract and he could have been fired on the spot for doing so. He was placed in an impossible situation, where they were firing him if he gave them the passwords or didn't give them the passwords. At that time, no one from security had authorize anyone else to have the passwords, and as such, Terry did the only thing he felt was correct, which was to attempt to give them to the only person who was in charge of the system, which was the mayor, who could then give them to whoever he felt like, in whatever manner he thought he should since it was not written in any contract that he had to protect the passwords or be fired for giving them to someone who had not filled out the proper paperwork and been given approval to have them and doing so in a location where only the person who had been authorized to have them would receive them.

Re:History rewritten

[Anonymous Coward]

Basically, the IT policy summed up as the Mayor being the only person authorized to receive the passwords. They arranged the teleconference to provide the passwords, which he was at all times willing to do, and he asked "is there anyone else listening to this conversation?"

When the Mayor confirmed that, yes, others were listening, Terry ended the call (what part of "can't provided passwords to unauthorized people" did they not understand?).

*Technically*, Terry followed the book. The book was written by idiots, but that's not his fault.

It was a stitch-up long before that point, but they proved exactly what he feared - CYA just doesn't matter when it's the government, just like the law doesn't either apparently (which we've seen more and more of since).

Re:History rewritten

[dugancent]

Terry Childs didn't have the right to decide who got the passwords and who didn't. He was no longer an employee.

Re:History rewritten

[MarkvW]

Terry Childs arrogated to himself the right to decide who had the "right" to said passwords. The passwords belong to the PUBLIC, not him. Terry Childs doesn't have the right to make that decision. Terry Childs was a nutcase.

He got overprosecuted, though. That's for sure.

Re:History rewritten

[Anonymous Coward]

Terry Childs didn't have the right to decide who got the passwords and who didn't. He was no longer an employee.

If he's no longer an employee he doesn't have any obligations to his previous employer.

Re:History rewritten

[Anonymous Coward]

Who voted this crap up?

Go read the judgement, it paints a VERY different picture.

Re:History rewritten

[Anonymous Coward]

This! The passwords do indeed belong to the public.

So that we don't have a repeat of this situation, we need to make every member of the public aware of what the passwords are. The public should be able to fully enjoy the passwords paid for by their tax dollars.

Re:History rewritten

[ArchieBunker]

He was getting fired anyhow so why would breach of contract even matter? He was a self entitled neckbeard and dug his own grave. Give out the passwords and wash your hands of it.

Re:History rewritten

[Ralph Wiggam]

Terry simple say "no" to diverging the passwords in that location, at that time, in that manner. In his contract, he had a duty to protect the passwords, and he was still an employee at that time.

And instead of explaining that he would be happy to give the password to an authorized person in an authorized context, he just hung up the phone? That was the worst possible way he could have handled that.

Re:History rewritten

[Anonymous Coward]

What history was re-written? Was it you ignoring this vignette from TFA (boldface added by me)?
"he knowingly prevented the city from being able to use its own computer system for a period of time, deliberately configured that system so that no one else could access it, set it up so that anyone other than him attempting to enter it would erase the data stored in it, and made the network more vulnerable to external attack by the filing of an unauthorized copyright application"

None of that relates to a simple story of not wanting to give up the keys to the system. This is full-blown malicious intent.

Re:History rewritten

[Ralph Wiggam]

He was a self entitled neckbeard and dug his own grave.

The more I read into this, the more that's what it sounds like. Not a big mystery why so many people here are defending him.

Re:History rewritten

[MoFoQ]

His lack of finesse and social skills coupled by the complete (technical) incompetence of those at city hall definitely contributed to his downfall.
If I recall, didn't Kamala Harris put the passwords into public record, thus forcing the city IT department to go around and changing passwords on all devices to prevent from someone from "f*cking sh*t up"?

The funny thing is that the statute (California Penal Code Sec. 502(c)(5)) mentions "disrupts or causes the disruption of computer services or denies or causes the denial of computer services" yet....during this whole fiasco, the network was rock-f-ing-solid (at least until the passwords were put into public record without seal).

Not sure why the attorney didn't bring this point up.
If I was Terry Childs, I'd fire the attorney and then sue the city for breach of contract (oddly, for at least the same amount).

Re:History rewritten

[dugancent]

The passwords are like keys to a company car. They are company property.

Re:History rewritten

[MoFoQ]

read the PDF; seemed like they were trying to cover their asses.

There are plenty of articles and editorials that say otherwise:

http://www.infoworld.com/t/government-use-it/the-terry-childs-case-san-francisco-just-guilty-886
http://www.theregister.co.uk/2008/07/28/sf_rogue_sysadmin_password_mess/
http://www.pcworld.com/article/149159/terry_childs_case.html

Re:History rewritten

[Belial6]

Since I knew that he was offering up the passwords, it seems implausible that no one at the city was aware that he was offering up the passwords.

Re:History rewritten

[bill_mcgonigle]

Now that we know about the BullRun backdoors, maybe they should go back after them for grossly abusive billing.

Re:History rewritten

[Anonymous Coward]

Not one of them refer to the facts of the case, which the judgement sets out much better and again, paints a very different picture.

Re:History rewritten

[MightyMartian]

How many of his defenders would hire him to manage critical systems? If the guy came on to my premises looking for a job, I'd have him escorted odd the premises,

Re:History rewritten

[Ralph Wiggam]

Since I knew that he was offering up the passwords, it seems implausible that no one at the city was aware that he was offering up the passwords.

So they asked him for the passwords, he hung up the phone, and they were supposed to know that he was "offering up the passwords"?

Later, after he was fired and had no reason to care about the minutia of the security policy, he still didn't give up the passwords. That was the illegal part.

Re:History rewritten

[sstrick]

By the time it go to this stage, it was much more then just regaining access over some routers. It was a full audit of the network and all devices to find what other backdoors he might have left.

Re:History rewritten

[dbIII]

Internal rules that were set to fuck him over and send him to jail if he revealed them to the wrong people in the "company". He was backed into a corner, IMHO because he caught the new girl removing the hard drive of the person in charge of network security after hours. Messy office politics combined with legal enforcement powers really sucks. Now some years later it would be interesting looking at what happened to the people involved and see who is shacked up with whom.

Re:History rewritten

[Belial6]

If he handed over the passwords to unauthorized individuals, he could have been legitimately arrested for being an accomplice in computer trespass.

Re:History rewritten

[Ralph Wiggam]

My eyes are rolling so hard I'm surprised they haven't fallen out of my head.

Re:History rewritten

[nbritton]

Terry Childs did not want to divulge the passwords to an entity that didn't have the right to said passwords.

I'm confused, did this knowledge require government security clearance? If he did need clearance, yes we would need to find someone else with clearance to receive the password. It is a violation of law to disclose classified information to individual without clearance... even if they're the boss or even own the place.

Re:History rewritten

[Anonymous Coward]

"Terry Childs arrogated to himself the right to decide who had the "right" to said passwords."

      No he didn't, his contract did and if the management had bothered to read it they would have known instead of having a hissy fit and screwing the man on bogus charges.

Re:History rewritten

[Anonymous Coward]

"He was getting fired anyhow"

        From what I remember he wasn't getting fired, he already was fired and they brought him back. What really was going on was abuse of power from before the arrest to the high bail to the kangaroo court. His bosses proved they weren't qualified to do their jobs just by how much they fucked up. All this really showed is you better have an armed and willing militia behind you if you do anything to challenge the 'intelligence' of management in government or even of the public for letting this go on at all. This guy is going to jail for following his contract that had most likely been illegally terminated by his employer. Since he was terminated he didn't have any reason to listen to his bosses anyway. Fact is his employer blew it for not keeping tabs and verifying the documentation. Let's hear it for crooked government.

Re:History rewritten

[Anonymous Coward]

Not everyone in the company had the rights to the passwords. Example: HR folks weren't allowed to know the password. Legally, according to the papers he signed, he could only turn them over to a few people in specific situations and those things didn't occur when he was asked. If you were an IT admin, would you trust the CEO with the admin password? What are the chances he'd break something rather than fix something?

Re:History rewritten

[Anonymous Coward]

Unauthorized computer access or aiding people in unauthorized computer access is a federal crime. Much worse than a breach of contract.

Re:History rewritten

[Courageous]

The closest thing you have to a structured reality check on this situation is a court of law. The judgment reflects the opinion of the jury, and typically the judge, on the truth of the matter. These people have been engaged to determine that using the best and most fair methods available. None of the press have been so engaged. Since this has now survived a court of appeals, we can safely say, to the degree it is possible to say, that Terry Childs is GUILTY.

Re:History rewritten

[Anonymous Coward]

I'd expect them to rattle around your skull. That way, at least there'd be something in there.

Re:History rewritten

[Anonymous Coward]

Terry Childs arrogated to himself the right to decide who had the "right" to said passwords. The passwords belong to the PUBLIC, not him. Terry Childs doesn't have the right to make that decision. Terry Childs was a nutcase.

Wasn't there something about appropriate access and that kind of thing that he was contractually obligated to maintain? Woiuld he have been legally vulnerable for giving passwords away to just anybody?

Re:History rewritten

[Zontar_Thing_From_Ve]

Terry Childs did not want to divulge the passwords to an entity that didn't have the right to said passwords.

That was his legal excuse for the trial, a variation on the old "I was just following orders!" claim. I'd state that this provided him with what he hoped would be plausible deniability for refusing to cooperate and turn over the passwords, but the court had none of that. I am sure that the real reason he did not turn over the passwords was that he hoped he could be re-hired. He never cooperated with the city in an attempt to force them to re-hire him and he tried to hide behind the rules to justify his actions. He gambled and lost.

Re:History rewritten

[Pav]

I'm surprised so few other posts here remember the actual details. Yes, there were security issues at stake which the aspie geek gave too much importance to, especially considering an angry pointy-haired boss was involved. Someone more socially aware would have made sure there were CYA emails between all the right people before sending the password in the clear as requested, and backing away slowly - it was obvious there was a high chair-throwing probability. The geek was a "play it by the book" aspie, and the boss was a "comply NOW!" type with a poor grasp of technical details... that combination doesn't work.

I've just read another comment about how this story shows up Slashdots bias, and cites Reiser as another example of how the Slashdot community fails. I remember that too - the media was harping about the weird geek with the murdered hot ex-wife who's obviously guilty as hell. Yes, there were a few here who shouted "no, he's innocent!" at their monitors, but the majority here were angry at the abandonment of "innocent until proven guilty". The facts were interesting enough without the media deciding conclusions for their audience.

Re:History rewritten

[guruevi]

If you don't give back the company keys they'll just remake them and change the locks. Any competent admin cleaning up after him would have to do this ANYWAY.

Use the "Politician's Friend"

[Anonymous Coward]

"I don't remember."

Re:Use the "Politician's Friend"

[Tablizer]

"What? 6OFUKYRSLF doesn't work? I'll be damned!"

Re:Use the "Politician's Friend"

[Belial6]

He didn't do that because he was offering the passwords to the city per the city's security policy. He was arrested and prosecuted for not divulging the passwords in violation of the city's security policy. Of course, if he had, he would still have been legally vulnerable.

Lesson

[Anonymous Coward]

Get the passwords first then do the firing....

Re:Never getting a dime can do 4 years

[Grishnakh]

Um, if I remember this case correctly (it's been several years now I think), he DID give them the passwords, but not directly, he insisted on giving them to the city's mayor.

More important knowledge

[Ukab the Great]

There's far more significant knowledge you take with you that you're not legally required to give up (procedures setting stuff up, what vendor bugs to work around, what authentication scheme, whatever). No need to go to jail over passwords when there's plenty of other petards for a former employer to hoist themselves on.

Re:More important knowledge

[Anubis IV]

Yeah, I was just wondering the same thing. I mean, I agree with the others here who believe that employees have a responsibility to hand over passwords when departing, but where does it stop? After all, if we have a responsibility to hand over our memory of that item, why not others? If I'm the only person who knows how to run a system, do I have a legal responsibility to document it fully before I depart, even if I live in a place with at-will employment in which I'm supposed to be able to just get up and walk out at any time? And if I DO have that responsibility, does it go even further? Can I be compelled to document all of the little tips and tricks I used to optimize performance of a system, even if they aren't entirely necessary?

There's clearly a line somewhere along this spectrum, but I'm not certain how you'd define it.

Reset?

[TheRealMindChild]

What system is there no way to reset the passwords? I'm having a hard time thinking of an OS/Embedded device that doesn't have a password reset mechanism or a means to overwrite the previous password with a boot disk

Re:Reset?

[Riceballsan]

Have you never heard of systems that are encrypted? There's no shortage of things that don't give solid means to reset them without loss of data.

Re:Reset?

[akgooseman]

If I recall, the system configs hadn't been saved to non-volatile memory. Reloading the routers as part of a standard Cisco password recovery/reset would have resulted in empty configs. As much as SF city government hated Terry Childs, they apparently loved his network equipment configs.

Re:Reset?

[Fallen Kell]

That is/was actually best practices for a secured network. One of the exploits for gaining access to the network required rebooting the network equipment so that it would load code injected by the attacker either from local/physical access or remote access. By having all the settings wipe, the attacker would trip monitoring sensors (due to the network segment going down) as well as not be able to gain any more information about the network from the device that was breached.

However, usually when this is done, a network backup copy of the config is located somewhere that the admin knows. Terry very well could have had such backup copied, but since the city had already fired him, he felt no obligation to give them any more information than what was already documented (which very well may have been saved in a readme, or disaster recovery document that was available somewhere on the network, but again, he was fired on the spot and thus, should not have had any obligation to tell them where to go looking other then between his cheeks as he walked out the door).

Re:Reset?

[Cramer]

Cisco IOS: no service password-recovery

Recovery at that point is an nvram erasure. (Or, disassemble the device to externally recover the NVRAM -- on systems where it's removable. Or replace the bootrom with a custom one that ignores that setting (i.e. pay Cisco an assload of money) -- where the bootrom is removable.)

And his second trick... not saving a startup-config. Reset the device and it powers back up blank! And you have no documentation on how it was configured.

Re:Reset?

[Anonymous Coward]

a network backup copy of the config is located somewhere that the admin knows. Terry very well could have had such backup copied,

Actually, Childs had the only copies of the configuration, he kept them encrypted, and never provided the config to his employer.

Re:Reset?

[behrooz0az]

Or boot in safe mode and change 'config register' to not load startup config, go to 'config terminal' and load startup config, change the password while you still have the access.
My CCNP is a few years old, but I think I've used the right words.

Re:Reset?

[Cramer]

Disable password-recovery and tell me how far you get. Go ahead. I'll wait...

The ENTIRE point is to prevent someone from gaining unauthorized access to the system. (old platforms don't support this.)

Re:Reset?

[behrooz0az]

Then me getting old isn't just a feeling...

Best practices

[Anonymous Coward]

I'm sorry, but it's really a best practice to NOT have one person "holding all the keys" - EVER. As a consultant, I make sure ALL my clients have copies of everything, along with myself... just in case I get abducted by aliens or something!

Same should go for ANY IT situation.. that I can think of, at least.

Re:Best practices

[BradMajors]

It is a bad practice to give your passwords to non-employees.

Re:Best practices

[Anonymous Coward]

Well let's just give you a damn cookie already.

Re:Best practices

[Anonymous Coward]

I enjoy oatmeal WITHOUT raisins the most.

Next time

[future assassin]

just root the servers, give the passwords back the change them.

Re:Next time

[Anonymous Coward]

Just use better grammar.

I'm waiting for the cautionary tale...

[Anonymous Coward]

...that ends with the NSA contractor refusing to give up the encryption keys to the vault, and us finding out later the NSA somehow managed to get through "unbreakable" crypto...and quickly.

Perhaps then we can all just absorb the true gravity of security these days instead of laughing at the tin-foil hatters still in shock over the wake of Snowden.

Precedent?

[Oceanplexian]

Doesn't this set dangerous precedent?

Plenty of organizations have dozens or hundreds of passwords. Is it really the employee's responsibility to remember each and every password and keep records of them indefinitely after employment? Should I be required by law to produce network diagrams?

Yes, this guy was a douchebag, but he shouldn't have to turn over anything.

Access control policy is the responsibility of the employer. If they fail to set policy or fire employees before it's too late, it's their own damn fault. This is just another example of mismanagement backed by a broken justice system.

Re:Precedent?

[Anonymous Coward]

The part you're overlooking is that the passwords are the property of the company, not the administrator. This isn't really any different than a security guard or janitor keeping the door keys.

Re:Precedent?

[jklovanc]

Is it really the employee's responsibility to remember each and every password and keep records of them indefinitely after employment?

No but it is a requirement to hand them over on the last day of work to one's replacement. This is the same as changing the combination on a bank vault and not telling anyone.

Re:Precedent?

[mrchaotica]

An employee's MEMORIES are not the property of the company!

Re:Precedent?

[Belial6]

And just a janitor with keys, he refused to hand the keys to unauthorized personel, and insisted that he only give them back to people who had authorization to have those keys.

Re:Precedent?

[shentino]

Normally I'd agree with you but he lied during his background check and concealed material information. As far as I'm concerned his entire career with the city is therefore a giant social engineering attack.

Re:Precedent?

[Anonymous Coward]

What if you change the combination lock on a safe at work.

Sure the safe works fantastically (no one can get anything out!!) and the "password" is only in your head, so the workplace doesn't own those!.

The only way to get what is in the safe is A) ask you for the password, or B) destroy the safe.

Tell me; are you now liable for the code that you changed and ensured no one else had before you were fired or should you be able to tell them to fuck off?

Re:Precedent?

[BrookHarty]

You make a good point. When you leave and hand over your laptop and office keys, that's it, you don't give them a password to the laptop, that's it, over, done.

And no, Its not like keys to a truck, its like leaving keys in the ignition, but the manager has to walk up to the truck to get them, not convenient, but you did not deny access. Physical access is still access. Having the password is nice, but doesn't deny access.

And physical access even with a pad lock, you don't have to give them the combination because the lock can be cut. Its standard operating procedure.

BUT, If the password was to an encrypted file with all the financial records, and not even physical access couldn't give access to the owner, then I'd say that was extortion or theft depending on the outcome since you cant get physical access.

Bad policy is INDEED the employers problem, very good point indeed, access was never denied, just easy access.

Amusing how because its "digital" its somehow different, its not.

Re:Precedent?

[Anonymous Coward]

It's not a memory but a fact that is property of the employer. No different than code.

Re:Precedent?

[gnasher719]

An employee's MEMORIES are not the property of the company!

If you set up things so that the company will be damaged if you conveniently forget things, and then you forget things are refuse to tell them, you'll be in trouble. Your memories are not their property, but causing damage is causing damage.

This is also an epic fail on the other side

[gweihir]

Any sane organization of this size has a password policy that ensures critical passwords are recoverable. Any sane organization makes sure to not have a single-person dependency like that.

But Childs really lost context: It was not his network. He had no business trying to enforce anything. The SF IT department may run their networks as stupidly as they chose, and while this may lead to criminal and civil liability on their part, it does not lead to any accountability towards Childs.

Re:This is also an epic fail on the other side

[Belial6]

Of course it does, since he was arrested for not turning the passwords over to UNAUTHORIZED personnel. That most certainly would have created a great deal of legal exposure for him. When this was originally reported, he was offering to hand the passwords over to authorized personnel but the city refused to accept them.

Re:This is also an epic fail on the other side

[Anonymous Coward]

"But Childs really lost context"

        No he didn't, his contract made him responsible. He had every reason to believe he had to handle everything, and the city did everything it could to make sure he was the 'IT' guy. I hope when he sues he breaks the city as this case proves they know they screwed up and are doing everything they can to prevent him from responding in any way. At least, while they're still in office. And everybody wonders why this country is going into the shitter. When this shit can go on in the open and an independent investigation hasn't started over city abusing it's authority let alone Childs.

Re:This is also an epic fail on the other side

[tlambert]

But Childs really lost context: It was not his network. He had no business trying to enforce anything. The SF IT department may run their networks as stupidly as they chose, and while this may lead to criminal and civil liability on their part, it does not lead to any accountability towards Childs.

If he had turned over the passwords on the conference call, and someone in the room full of unauthorized people had used them in an unauthorized manner, instead of 4 years with the possibility of parole, he'd be looking at 20 years in a federal pound-you-in-the-ass prison with no possibility of parole for "aiding people in unauthorized computer access", a federal crime.

It really was a no-win situation, particularly since the city's immediate reaction was to sequester him away from all authorized persons until the mayor could do his grandstanding in front of the press.

Re:This is also an epic fail on the other side

[gweihir]

I doubt that. In the worst case, he could have handed a sealed envelope to his lawyer with the express instruction of handing them over to a representative of the city that is required to keep client secrets secret, like a city lawyer. Then he would have handed over the passwords, but the city lawyer would not have seen them or would have to violates the law in using them. Something quite similar could have done with an independent notary, namely handing over the keys to the notary in a sealed envelope and then telling the city that they could get them there. The same might even have worked with a city police officer. There are countless people that by law have to keep secrets handed to them, absolving Childs from any responsibility if these people were to misuse the secrets.

I am pretty much convinced Childs did not even try to hand the passwords over in a legal fashion.

Re:This is also an epic fail on the other side

[Pav]

Put an aspie into a legal and ethical minefield, add a chair-throwing pointy hair and see what comes out. I'm pretty sure fear retards their thinking ability, possibly even more than the rest of us.

Re:This is also an epic fail on the other side

[gweihir]

I do not dispute that. But he claimed legal reasons not to hand these passwords over and his fundamental mistake was to overlook that he is not a legal expert.

But yes, fear is the mind-killer. In this light, the penalty may be excessive or even completely unjustified. On the plus side, no smart IT contractor will be willing to work for SF in the nearer future, so the damage they did to themselves is pretty big.

Back when I admined systems ...

[PPH]

... passwords were in a sealed envelope in my desk drawer, locked. That way, if I got hit by a bus, the boss could break into the desk and hand envelope over to my replacement.

When I left, I handed him the key to my desk and said, "You know where they are."

Re:Back when I admined systems ...

[Tablizer]

I gave the envelope to the bus driver

Re:Back when I admined systems ...

[jklovanc]

Childs would have destroyed the envelope before leaving as he did not trust anyone with the passwords.

Re:Back when I admined systems ...

[DoofusOfDeath]

When I left my last job (where I had root on a lot of servers), I had my replacement and staff watch my replacement enter the new root passwords (that only he knew), and delete my personal accounts.

I think that's a bit better than the person who's leaving continuing to know a shared secret.

Re:Back when I admined systems ...

[PPH]

They gave me a 60 day WARN notice. By the time my last day came around, the boss still hadn't selected my replacement. He wasn't the brightest bulb in the marquee.

Re:Back when I admined systems ...

[radarskiy]

-1 irrelevant

The story is about someone who took positive action which would subvert any business continuity preparation, regardless of whether his motives were pure or not.

Re:Back when I admined systems ...

[Anonymous Coward]

It was standard practice back were I used to work for armed security to escort you from the building without allowing you even back to your desk the moment you handed notice in.

I dont see how anyone can be expected to do a sane handover policy in that event

Re:Back when I admined systems ...

[PPH]

What would they have done had you been hit by a bus?

A sane turn-over policy has to account for situations where the admin is no longer available to turn over passwords.

Re:Back when I admined systems ...

[PPH]

Maybe. With a procedure in place to record and place passwords into safekeeping upon changing them, any deviation from that policy could be considered intent to damage business processes. Hence the more severe punishment.

Had Childs just been escorted to the door and without such a procedure, he could claim that he forgot the passwords due to stress. Or left his unofficial hard copy behind at work*, placing the burden on his superiors to account for the contents of his desk after his departure.

*Attached to the bottom of a red Swingline stapler.

Re:Back when I admined systems ...

[Anonymous Coward]

There was supposed to be a copy of the root passwords etc kept in a sealed envelope in a locked safe someplace and a copy kept in a similar arrangement off site. I don't know if it was because my duty ended by handing on the envelope to someones PA.

However It made life hell on a new site admin because whilst they may have had the technical chops they lost access to all the business domain specific IT knowledge when the previous admin left. Each site ran a fairly similar but subtly different set of the systems for historic reasons etc.

I thought this was standard

[Riceballsan]

I know long before the terry childs case, I remember my IT teachers explaining that if you took off with passwords etc... to anything they didn't have an account over, the standard response is to hire some rediculously overpriced person who is paid by the hour to gradually break into it, then have the courts foot you the bill. I don't get why this is shocking. The Terry Childs case was a bit of an exception, namely because of his claim that the person who he was under the impression he was supposed to give the information too, was not present. IE childs was not saying he wouldn't give the password unless he was rehired or paid. He was explicitly saying he was going to give the password, but not to the middle manager who was asking him for it. Child's case he could have been screwed either way, giving the admin password to someone who shouldn't have it, makes you liable for the damages they cause... but refusing to give the password, is also a suable offense. If you know who has the rights to the password, and have access, there's no room for debate at all

Re:I thought this was standard

[Anonymous Coward]

How is this Insightful? It is gobbledygook!

Fuck this guy

[stungod]

Seriously, fuck him. Having been on the receiving end of this kind of crap before, I'm fine with this clown going to jail. A public beating wouldn't disappoint me either.

People who set things up so they're the only ones who can make it work need to face the same kinds of penalties for malpractice in other fields. There is nothing that will make me get rid of an employee faster than job security shenanigans.

Exactly Wrong

[Anonymous Coward]

The people who need them should already have them at all times.

Any other way is asking for problems. Even if the problem is simply 'i forgot the password'.

Or hey. Maybe your employer is a moron. And he really really does expect you to know the password for $somedevice you never touched and never used.
But it's 'computer stuff' so you know all that stuff because thats your job. You're the computer guy.... Right?

I sure wouldn't want to be the 'computer guy' for anyplace that will send you to jail just because you forgot a password...
And they won't take 'i forgot' as an answer because not handing it over is a crime worthy of jail.

captcha:unjust

Re:Exactly Wrong

[taustin]

The people who need them should already have them at all times.

Any other way is asking for problems. Even if the problem is simply 'i forgot the password'.

Or hey. Maybe your employer is a moron.

That was, in fact, exactly the situation Childs' boss was trying to rectifiy. Childs knew it, and refused to turn over passwords to his direct supervisor even when told, in person, by the Mayor, that his supervisor was authorized to have them. He also configured the network to not able to to reboot after a power outage that exceeded the UPS time unless he, personally, was there, and refused to make backups of the configuration.

And keep in mind, the network in question included their 911 system.

The asshole belongs in prison. He had multiple chances to avoid it, including after he was charged. He chose prison rather than allow the situation you describe to end.

Re:Exactly Wrong

[Dahamma]

I have already posted the same too many times so no mod points, but this summarizes what happened very clearly.

It's ridiculous how many posts on this topic are so wrong that they don't know what Childs actually did (intentionally change and then not disclose passwords without permission), but they don't even get that it was a municipal (city of SF) computer system, not "some company". For those joining us, RTFA = READ THE FUCKING ARTICLE...

Re:Exactly Wrong

[Anonymous Coward]

I already asked this in another thread, but i'll ask it here also, so maybe someone notices and I'll get interesting answers. What if the key was his fingerprint, and they already fired him before asking him to open up the admin access? I know it would be nice of him to comply. But should he? Would it somehow be his problem to get back there (possibly from another side of the globe) and put his finger down on a reader?

Revenge, the old fashion way

[Anonymous Coward]

You get back at employers the old fashion way, make things overly complicated to the point where they need an army of techs or programmers to figure things out. Make it cost more to replace you than keeping you on the payroll.

Best Practices

[Anonymous Coward]

Yeah, great idea, let one guy have all the control.Everyone involved got what they deserved.

Give them the wrong password

[Cyfun]

Am I the only one wondering why he didn't just give them the wrong password? If it doesn't work, they can't prove he lied about it, he can claim that someone must have tried to change it or hacked into it or something.

Re:Give them the wrong password

[Belial6]

He made the mistake of trying to do the right thing. He kept offering the correct passwords to the personnel that were authorized to accept them. The city refused to follow their own security policy.

Re:Give them the wrong password

[gnasher719]

Am I the only one wondering why he didn't just give them the wrong password? If it doesn't work, they can't prove he lied about it, he can claim that someone must have tried to change it or hacked into it or something.

Oh yes, he can claim that. And they will believe that.

$1.5 million?

[Hamsterdan]

How the heck is he supposed to pay that back?

Re:$1.5 million?

[rlh100]

Over a very long time.

I suspect the fine is so large that he can't profit from a book/movie deal. But that is just my guess.

Re:$1.5 million?

[stewsters]

He's not. It's meant to be retaliation, a life as a slave. It doesn't take 1.5 million dollars to regain access to some routers. I wonder if they used this as an excuse to buy new routers, and charged him for those.

Dear Everyone,

[Anonymous Coward]

If you use a work computer, phone, PDA, or calculator, assume that whatever you do is owned by them.

As for passwords, a smart company would have set up a dual custody (http://www.fdic.gov/regulations/safety/manual/section4-2.html) relationship between multiple sysadmins, rendering the issue moot.

In fact, it's kind of required by standards like PCI-DSS and Sarbanes-Oxley

How Soon We Forget ;-\

[Anonymous Coward]

Nobody, least the writer remembers the exact circumstances of the sorry affair. Yes Terry was a fool, and could also have been accused of being self important.

BUT! This little man, a excellently competent network and systems manager, engineered a city network that in all the time he ran it never had a single serious failure. His two mistakes ware to care too much for his domain so that he never realised as he antagonised his superiors by demonstrating to them repeatedly that they were his technological inferiors, they would be all to keen to be rid of him, no matter what the cost to the city.

Fortunately, when the day came he held firm and refused to give up the keys to these drudges. He was eventually forced by weight of law to give up the keys and do you know since then there have been so many faults and failures of this network one would think it had been either deliberately damaged.

So I say the $1.5 restitution should more rightfully be paid by those same managers.

Hmm! even the CAPTCHA agreed (crucifix)

Half the story

[jklovanc]

He did not just refuse in that one instance. He was then fired and still refused to give the passwords to his duly authorized replacement. Had he felt he was improperly fire a wrongful dismissal suit was in order not withholding passwords.

Re:Half the story

[drinkypoo]

The truth is that all of these routers are vulnerable to a crowbar attack and once you're no longer an employee of a company you should no longer be required to tell them anything except where to mail your last check. This is about slavery, not about passwords, and you're on the wrong side.

Re:Half the story

[dugancent]

No it's about theft. The passwords are company property and he isn't entitled to them.

Re:Half the story

[drinkypoo]

The passwords aren't property at all, and they can change the passwords at will.

Re:Half the story

[Anonymous Coward]

Passwords are keys and they don't belong to him. They are property.

Re:Half the story

[jklovanc]

It is the same as changing the combination on a bank vault and not giving that combination to the company.
this might help you understand.

Nothing to see... move along

[MickLinux]

Gee, you don't think it could simply be a case of newsies swinging techies for fun and profit, do you?

After all, techies are educated, so it would be impossible to spin them, wouldn't it?

Of course, CS Levis wrote that it's easier to spin an educated person, possibly iibecause he listens for the key phrases, makes a rash judgement, and then holds onto it with all the wicked ego he's got... until he hears another key phrase.

Re:Never getting a dime can do 4 years

[Belial6]

Which was what the security policy required of him. He was arrested for not turning the passwords over to unauthorized individuals.

The sentence should have been longer...

[dtjohnson]

Childs was basically attempting to extort expensive employment privileges (job security, work assignments, working hours, co-worker assignments, physical access) from the City of San Francisco by concealing critical information if they didn't cooperate. The sentence for extortion is usually longer than two years so Childs should have gotten a longer sentence. The legal brief is a very sad read when you consider all of the bright people (both legal and technical) who have spent thousands of hours dealing with the machinations of one crooked jerk. The rest of the world must be amazed at the utter waste of talented people who could be employed in more useful activities.

Physical access trumps passwords

[damn_registrars]

If they had physical access to the systems, they should have been able to reset the passwords. Now, if he was intentionally prohibiting them from accessing the systems, after being fired, then he was doing something criminal. If, on the other hand, he was withholding passwords while working there - and being tasked with security for the network - then he did nothing wrong.

Re:Physical access trumps passwords

[shentino]

As far as I'm concerned, any permission he had been given by being hired was procured by fraud since he concealed material information from them during his background check.

Re:Physical access trumps passwords

[Anonymous Psychopath]

If they had physical access to the systems, they should have been able to reset the passwords. Now, if he was intentionally prohibiting them from accessing the systems, after being fired, then he was doing something criminal. If, on the other hand, he was withholding passwords while working there - and being tasked with security for the network - then he did nothing wrong.

Of course they had physical access. To hundreds of individual devices scattered throughout a large city, requiring weeks and hundreds of hours to touch them all. Don't forget you have to power-cycle the devices to do a password recovery, so all that work has to happen during non-critical hours. Terry decided that a poorly written internal security policy document would serve him as a legal shield while he stood on his, arguably, warped principals. Terry was very, very wrong.

Re:Physical access trumps passwords

[benro03]

They had physical access to the *hardware*, not the software running it. Childs disabled the serial ports, which to me proves he was trying to shore up his "job security". Also, he only had the configs running in active memory, not saved on NVRAM like you're supposed to so if there was a power blip *ZAP* that switch is down. That's criminally stupid, the only reason for doing so is to try and prevent Cisco from physically getting into it.

And it is STUPID to disable the serial ports. All you're doing is making the poor tech from Cisco your bitch while he's there trying to do his job. It's petty and mean. One day, he's going to be the guy to save your bacon. Making his life difficult serves no purpose what so ever.

Yes you're making the switches more secure, but secure from what? Terrorists? Look buddy, if they're standing in your data center, your security is blown and they have better targets than the switches. I'd blow the AC and let everything cook.

Sometimes

[Anonymous Coward]

Sometimes someone has hurt you so bad that the situation is no longer about having leverage on that person or company. At that point hurting that other party can become more important than the harm that happens to you. I just hope that for this guy it's worth it. It's crazy it's stupid and it is so very human.

Stupid Terry

[Anonymous Coward]

He should have just told them that he forgot the password.

Thanks To Windows He Earned His Jail Cell In Hell

[Anonymous Coward]

Dano: I got the Perp in sight, charge cocked, finger on the trigger.

Jacko: Hold on there Dano. The Perp is and Ass-whipe for sure but maybe not the type for instant death. He was using the Windows Operating System from Microsoft ... "Micromanagement". Maybe he got confused about "Permissions" and "Rules" and "Profiles" and "Ownership" and things in the Microsoft Micromanagement world mind think.

Dano: Fuck You Jacko. I'm popp'n the Perp with my 45 and sending his rotten body to the morgue. Tag Toe the bastard when I'm done. I'll write up the report. And! Do not cross me!

Jacko: I loves my Dano. How Dat!

Dano: 'Nough said.

QED

Just give the password to your lawyer

[Anonymous Coward]

Much simpler. Let the lawyer figure it out for you.

Cautionary Tale

[Anonymous Coward]

"The ruling (PDF) provides a good cautionary tale for anyone who thinks they can gain leverage over their employer or increase job security by controlling key passwords"

This is more a case of doing it wrong.

Simon Travaglia has shown us numerous times how to do it right.

So what is the /.best practice?

[khb]

I'd say something like a lastpass(tm no doubt) account, on the employer's nickel, so that each and every server could have a secure password (or class of server if its deemed more sensible to have all the servers in a rack or a room have the same password). Then the only thing the "magic envelope" has to be the username and password of the lastpass account.

No doubt folks with the responsibility for hundreds or thousands of servers have some better ideas about "best practice" ... so please share.

This is "scalable" in that admins could share (or not).

The tradeoff between ease of use, security, and ease of transfer to the next responsible party(ies) is not always a trivial one.

Re:So what is the /.best practice?

[mlts]

I've seen some expensive versions of software like lastpass that store the root/Administrator/enable passwords for machines in a database, provides physical protection, allows access to control to groups, etc. For a company with a lot of people it is the way to go.

One software maker had a feature where if a junior admin needed a root password to a box normally not allowed to him/her, the software would allow them to access it (assuming that access was granted beforehand), then senior admins and management were notified... pretty much similar to storing the root password in a sealed desk envelope. I totally forgot what it was called though.

Absolutely Appropriate!

[EzInKy]

This isn't some pseudocrime like copyright infringement, this is an actual theft because it is depriving his employer of their own network.

Wrong thing to withold.

[pla]

Your employer owns their hardware, including the "keys" to get into it.

Childs screwed up by withholding entirely the wrong sort of information. You don't pitch a fit and refuse to give them the passwords - You give them exactly what they've asked for and then watch in glee as they realize they don't have the faintest clue of what to do with those passwords.

Picture a fairly simple small-scale corporate WAN. Three separate subnets. Nothing massive in scale.

Now imagine they "no longer need your services" after three years of uninterrupted service.

Now imagine that you haven't persisted the router configs and they lose power.

Now imagine a non-technical city manager trying to figure out why he can't get to facebook, and demanding passwords from you.

When you stop laughing...

Yes, you can still thoroughly document your infrastructure for your successor, for the (most likely) scenario where you peacefully move on and want to help the poor bastard out. But if you suddenly find yourself "redundant", well, "here you go, all the passwords. Good luck, and I charge $1500/hr as my standard consulting rate".

Re:Wrong thing to withold.

[GeekHillbilly]

I have done exactly that and laughed with Satanic glee as the employers ( a big coal company)proceeded to crash the entire network within 10 minutes.You can imagine how much crow they had to eat (at $5000 flat rate hour with the threat of a mechanic's lien on all computer equipment if they didn't immediately pay up upon completion) when they had to call me back to fix it.Well,the one that fired me got fired ( condition 1 for me to do anything) and yes they had to pay the $25,000 bill( 4 hours 5 minutes it took to restore the system.They never backed up anything.I had the entire system imaged on several very ( my personal property BTW) large hard drives. You don't piss off a hillbilly,especially one who is a computer geek and expect to get away with it.Turned out that my former boss was trying to hide some equipment theifs.Well,he is still sitting in the Eddieville State prison after getting nailed for it.The company filed for bankruptcy a few years later and the Feds nailed them for bankruptcy fraud,thanks to the appearance of a hard drive with papers addressed to the judge with no return address spelling out what they were trying to pull. Revenge is a dish best served cold.And it can be sweet

Re:Wrong thing to withold.

[HeckRuler]

Right, right, and if you're mercenaries cackling over a burning network, that plan works great.

If you are a professional that doesn't want the entire city to fall off the grid, if you actually care about the customers, if you don't want the company to go broke, if you don't WANT the damn thing to burn in fire, then that's a pretty shitty plan, now isn't it?

I have done exactly that and laughed with Satanic glee as the employers ( a big coal company)proceeded to crash the entire network within 10 minutes. ...
The company filed for bankruptcy a few years later ...
Revenge is a dish best served cold.And it can be sweet
--The Geek Hillbilly

Sigh..... remind me why Kentucky is full of poor people and can't attract any business?
No, no.... I know you didn't cause the company to go bankrupt. It's more of a comment on the culture of the place. It's you AND EVERYONE ELSE there that made them go bankrupt.

Re:Wrong thing to withold.

[pla]

If you are a professional that doesn't want the entire city to fall off the grid, if you actually care about the customers, if you don't want the company to go broke, if you don't WANT the damn thing to burn in fire, then that's a pretty shitty plan, now isn't it?

No one (with the possible exception of healthcare workers) actually "cares" about the customers. The most customer-focused CEO on the planet wouldn't piss on a customer dying of thirst in the Sahara if they didn't get paid to pretend they care.

By extension, once a company stops paying me, "professionalism" doesn't count as a magic buzzword that translates into "I'll keep working for you for free". If we parted ways on good terms, it means I'll take a few 30-second phone calls over the next several weeks to help the new guy out, and if they need more extensive help, I'll only charge my normal contracting rate rather than the "fuck you" extortionate one. If, however, they "downsized" me and later discover they really really needed me? Hand me my fiddle and let's go watch Rome burn, preferably with as much looting as possible first.

The Childs case pretty much cinches this - Although we can debate whether or not he legally did the right thing, and whether or not he counted as a BofH in general, he technically did the right thing. You don't give out core router passwords in an open phone-call to an unknown audience, period. And how did they reward him for behaving in a professional manner? TFA makes that much clear.

Re:Wrong thing to withold.

[HeckRuler]

Hey man, that's great for you. You're a worker and you want to get paid. Nothing wrong with that. It's ok not to be a professional. A lot of important, and highly paid, people are not professionals. I guess I'm using the term "professional" in a specific way. I mean, if you get paid for it, whatever it is, you can call yourself a professional. But professionalism means a little more than that. And you're right, the article and ruling make that clear: sysadmins are not being treated as professionals anymore. You're expected to be workers that do as you're told, not professionals who do what's right.

Try this on for size:
"The professional owes a higher duty to a client, often a privilege of confidentiality, as well as a duty not to abandon a genuine client just because he or she may not be able to pay or remunerate the professional. Often the professional is required to put the interest of the client ahead of his own interests."

Re:Wrong thing to withold.

[pla]

Try this on for size:

Interesting how you cited the one criteria (out of seven listed) that amounts to little more than feelgood fluff. Also interesting how the rest of those criteria make a single, clear point, while #4 has two distinct, completely unrelated parts to it.

I feel good about myself for solidly meeting the rest of those criteria. If the second half of #4 counts as the make-or-break test for the word - You can have it. I love what I do, but when I do it for someone else, I do it to get paid. Simple as that.

/ "All true Scotsmen, in addition to coming from Scotland, must actively enjoy holding hands and singing Kumba-ya".

social engineering from hire

[shentino]

After finding out that he concealed material information during a background check, my opinion is that his permission to touch the network at all, even within the scope of his employment duties, was procured fraudulently and his entire CAREER with the city has been one huge social engineering attack, starting when he lied about his criminal history to people who almost certainly would have had ample grounds to decline to have hired him in the first place.

Re:social engineering from hire

[Anonymous Coward]

Yes, you keep saying. Fortunately, you note that it's just your opinion, so shut the fuck up.

It was far more complicated than that

[dbIII]

He was backed into a corner given two bad choices - to break the rules and reveal in front of a crowd of unauthorised people or do it later - then rushed off to jail so that his only chance to do it was later was to the Mayer at a special press event when the Mayor came in to "save the day".
IMHO he was the victim of very petty workplace politics probably backed into that corner just for catching the new girl after hours removing the hard drive of the person that was supposed to be in charge of network security.
The lesson here is just roll over, let them win their petty little game and escape from such a sheltered workshop of baby vipers and get out into the real world. If that evil bunch had not had their own Police department on call but instead had to rely on an independent one under adult supervision we'd never see such a mess. I know Californian politics is supposed to be so fucked up that nothing works, but this arrest and long jail term for a simple workplace dispute shows things are far beyond a joke.

Re:It was far more complicated than that

[Eskarel]

No, he decided that his direct supervisor couldn't be trusted with passwords and he'd only give them to the mayor because he was convinced that he was the only competent person in the entire city. There were no bad choices here there was do what you're required to or act like a self entitled dickhead.

Re:It was far more complicated than that

[bfandreas]

Yeah. The whole thing smacks of lack of adult supervision. He was a bit petty and they completely mishandled the whole situation. If the person who by their rules was authorized to receive the passwords had gone to him then this whole mess wouldn't have erupted into a giant shit volcano. He was by no means being reasonable but so were they.

The lesson you can take away from this is if you have a workplace dispute DO NOT CALL THE COPS or the lawyers. Just sort it out like a grown-up. Also I can't see how sentencing him to 5 years in the slammer is by any means reasonable since the city officials did their best not to resolve this reasonably. They created the financial loss by not sticking by their own rules.

The other lesson you can take away from that is that if you were Terry Childs you could have prepared a writing that said that you were giving out the passwords to an unauthorized person under duress and have the city drones and their lawyers and the cops sign that. That's CYA and that is sufficient.


Goddamit. This whole thing reads like a chapter of The Lord Of The Flies.

Re:It was far more complicated than that

[91degrees]

Right. The obvious thing to do wuld be to say "I'm not going to broadcast this. Give me a private line with your new head of IT and I'll give it to him/her".

I do feel a bit sorry for Childs though. He clearly didn't have a good grasp on normal human interaction, and his supervisor completely failed to take accont of his oddness. And it's not like this sort of person is unheard of in IT.

Extortion vs. Forgetting

[Roger W Moore]

Is it really the employee's responsibility to remember each and every password and keep records of them indefinitely after employment? Should I be required by law to produce network diagrams?

No - if he forgot the passwords then it would be tough luck for the former employer. However what this idiot did was try to extort money before he would divulge the passwords. That's not the same thing.

Router configurations not stored in NVRAM

[rlh100]

Every router's configuration was only loaded into system memory, not NVRAM. The ASCII files the routers were configured from were all encrypted. Terry was very careful to make sure that no one could play with his toys.
There was no way to "root" or hack into the routers. Cisco's best could not do it and they tried.
He ended his temper tantrum by requiring then Mayor Newsom to come down to the jail so Terry could give him the passwords in person.

Re:Router configurations not stored in NVRAM

[Todd Knarr]

True. On the other hand, the city government very quickly after receiving the passwords published them in an open court filing for the entire world to see. Which is about as diametrically opposite good password security policies as I can imagine getting without involving 5 dimensions. And is precisely the reason Terry Childs gave before this all happened as justification for withholding the passwords. This is... not precisely calculated to convince me that Childs was being unreasonable in his concerns and that the city was reasonable and competent.

That their first act after getting the passwords was to trash a network that at least had been operating stably up until that point doesn't count in their favor either. I mean, my first rule when approaching a new system is to carefully access it and look around to see what state it's in, not just slap the reset switches and reboot the world.

Especially not if it's a production system, and doubly especially if, as the city had been so loudly and publicly stating, I had concerns about the state the previous admin had left things in. There's a reason whacking them with a bloody big sledgehammer is considered a... suboptimal way of defusing potentially live bombs.

How will he pay the fine?

[Anonymous Coward]

What happens if someone gets fined $1.5m but isn't worth that much and can't ever pay it back with everything they own?

Withhold your employer's passwords...

[Todd Knarr]

... go to jail. Go directly to jail. Do not pass Go, do not collect $200. Nobody's surprised by this. It's his employer's network, after all, it's their passwords. If they decide to replace you as sysadmin, the only right you have is to insure they and not you are responsible for any problems that ensue (eg. "I will not give you my current password. I will initiate the password change process, enter the current password, and then wait outside the room while my replacement enters his new password. If there are any difficulties, I will assist by re-entering my password and/or unlocking the system until my replacement has successfully changed the password to something not known to me. This is to insure that after the hand-off I no longer have any access to the system.").

And yes, I've done the moral equivalent of that. Not with a root account, obviously, but when leaving a job I would deliberately fail enough login attempts to lock my user account and made sure they had notice of this and I had a paper trail proving they did. I figure that way they don't have to worry about me accessing the systems, and I don't have to worry about being accused of messing with them after I've left (well, I could be accused but I had the evidence to counter the accusation).

"I stole from an idiot" isn't an excuse, it's wors

[raymorris]

> and not the complete idiots of the company for leaving there passwords with one person, and not having a way to access by way of a default password. his lawyer must have been an idiot as well if he didn't make that argument.

"The victim was stupid" isn't an excuse. If it were, we could legally do anything we want to you.

In fact, it's generally considered an aggravating factor to victimize the mentally challenged because we have a duty to look out for those who are defenseless.

It wasn't just the supervisor

[dbIII]

Room full of people on speaker phone. Reveal the password - maybe go to jail too, at least that's what the rules he was trying to follow said.
So how much time did the new girl who was caught removing the hard drive of the computer used by the head of network security get? Zero. Don't go trying to find some justice in this, it's all "might makes right" crap.

Re:It wasn't just the supervisor

[mhotchin]

Then the right response would just be "Give me some paper and a pen, I don't want all these other listeners to know it."

If the super says "Do it anyway", you do, since it's now his decision, not Childs'.

Re:It wasn't just the supervisor

[Neil Boekend]

In some cases it is wise to demand that "do it anyway" in writing.

Re:It wasn't just the supervisor

[Eskarel]

He had a million different opportunities to do the right thing, starting with not changing all the passwords so that no one had access in the first place. He had a god complex and cost the taxpayers significant amount of money because he thought his entire level of management were too incompetent to be trusted with his baby. Fortunately he'll never work again, we don't need more idiots like this.

Re:It wasn't just the supervisor

[Anonymous Coward]

No, you don't "Do it anyway". There are rules that determine who can have access to those passwords, and who cannot. A person who should not have access (according to the rules) cannot over-ride the rules and say 'give em to me anyway'- else what is the point of the rules?!

If a Private is ordered by a General to keep a secret, a Sargent cannot order the Private to reveal that secret, even though the Sargent does outrank the Private.

Re:It wasn't just the supervisor

[dcw3]

If the super says "Do it anyway", you do, since it's now his decision, not Childs'.

As a rule of thumb (I'm not talking about this case), I'll agree. But, there are many cases where you should disobey. I certainly would if my boss directed me to do something illegal, and in some cases, you would still be held legally accountable if you were directed and didn't disobey.

As one of my bosses likes to say. "I'll listen to your complaint, but then I'm going to make a decision, and expect you to shut up and color."

Re:God

[Anonymous Coward]

31 Hallelujah! God bless you all, my brothers and sisters! Holy shit! Amen and hallelujah!

Not theft... Sabotage.

[ThatsNotFunny]

Stop using "theft" analogies. He did not steal anything, he sabotaged the system, and he was the only one with knowledge on how to fix what was done.

the judge know better, based on evidence

[raymorris]

He boo y trapped the system,locked out other authorized users, etc.
The judge or jury would look at that and determine that either :a) he'slying or
b) forgetting wouldn't be a problem if he hadn't set bobby traps etc., and locking out other users was an intentional criminal act.

It's interesting to me how often people say "just claim that [transparent bullshit]. 99% of the time, judges aren't stupid. Their law degree indicates they have above average intelligence, but sometimes people assume judges must be drooling morons.

Granted, occasionally there are rulings that seem pretty dumb, but even those are normally much less dumb than the headlines make them out to be.

Terrible Laws

[iCEBaLM]

This is California Pen. Code, 1 Â 502, subd. (c)(5) of which Terry was found guilty:

(5)Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.

Operate a back hoe and go to jail? Pull the wrong patch cable and go to jail? Tell someone "no, you can't use this computer right now" and go to jail?

This law is ridiculously broad, glad I don't live in California!

Re:Terrible Laws

[Anonymous Coward]

You examples are bullshit. backhoes, accidents and mistakes are not "KNOWINGLY" disrupting services and if you do it knowingly then you damn well do deserve to be going to jail as that is just vandalism or malicious damage.

Re:Terrible Laws

[jfalcon]

He rigged it to go against best practices to prevent other skilled engineers to maintain a critical network. This wasn't by accident. Everything he did was intentional to make him a "critical irreplaceable employee"... no one is irreplaceable.

Re:Terrible Laws

[Anonymous Coward]

"Knowingly and without permission" the law says. If you operate a back hoe or pull the wrong patch cable, then you can't be prosecuted, because you did those things unknowingly. "No, you can't use this computer right now," depends on who you tell it to. You could have higher authorisation, in which case you're well within your rights to tell them to fuck off.

Compare to private industry?

[bradley13]

There are two groups arguing here - I think both may be missing the point.

Group 1: The passwords belong to your employer, turn them over. It's his fault, because he refused.

Group 2: He may have been paranoid, but he was really just following policy: don't give passwords to unauthorized people.

Regardless of which side you are on, ask yourself this: How would this scenario have played out if he worked for a private company? Consider that, in the end, he *did* hand over the passwords to the mayor, i.e., the "big boss". What would a private company have done?

- They wouldn't be claiming $1.5 million in damages - an absurd figure.

- They wouldn't try to prosecute him and throw him in jail. Bitter firings happen, life goes on.

- The *only* likely retribution would be: "don't use us as a reference".

Sending the guy to jail and suing him for more than his net worth? It takes a government to waste resources on that sort of idiotic vengeance.

Re:Compare to private industry?

[Anonymous Coward]

I think you are completely and utterly wrong. A private company, especially a large enterprise most definitely would take the bastard to the cleaners and then some. If anything government and ex government employees are normally the ones that get off light.

Re:Compare to private industry?

[Todd Knarr]

Well, as far as my regular account at work is concerned, if my boss asks for my passwords the rules are perfectly clear: I am in violation of company policies and can be terminated if I give them to him. Of course there's never any need for him to know the passwords to my regular account. The sysadmins can access my files directly without needing the password if there's ever a need for access, and they can forcibly change my password to anything they want (removing my access in the process) if absolutely necessary.

Administrative passwords are a different matter. But there'd never be a need for my boss to ask for them either, because there's a process in place to insure the passwords can be recovered without my needing to be involved. It's there as insurance against something happening to me, and yes it's been through a real-world test (pneumonia run wild, no warning, 5 weeks in ICU with the docs not betting I'd pull through, everybody involved at work had their noses thoroughly rubbed in the fact that these procedures are not just a theoretical exercise). So while my boss might not be violating company policy by asking for shared administrative passwords, he's probably violating several other policies related to administrative access retention and recovery and the corporate governance and compliance committee will be asking him some very pointed questions about that.

Re:Compare to private industry?

[Anonymous Coward]

private companies don't claim 'ridiculous' awards in suits? on what planet?

Re:Compare to private industry?

[Anonymous Coward]

Yep, Terry Childs did wrong. This doesn't mean his prosecution isn't a persecution.

It's a total waste, and if the governor of California had any authority over pardons or commutations, he should just do it, and let the whole nonsense end.

As it stands, Childs can probably make the money back by going on Right-Wing media and being paid to badmouth the incompetence of California Communist Liberals.

Re:Compare to private industry?

[Anonymous Coward]

I would argue that he was protecting the city when he refused to give up secrets (including access to the 911 system) to unauthorized people.

At one point he was ask to give them out in court; which would have immediately put the city as risk because those documents were public.

It went too far though when he wouldn't give them to anyone.

Re:Compare to private industry?

[Anonymous Coward]

I give confidential information to my Insurance carrier, to my bank, to my employer, to the phone company, etc. etc. But they violate their own agreements (of keeping it confidential) all the time, but nothing happens to them. Why should anything happen to this guy?

Re:Compare to private industry?

[Anonymous Coward]

Go read what he actually did instead of opining in a vacuum. He deserved jail, read the rulling.

You really have to try hard to fuck up as badly as Childs and he DID try hard.

This has NOTHING to do with that paranoid gimp protecting the City, he did more harm than any intruder. That was an excuse and it didn't save him from jail.

Re:Compare to private industry?

[AC5398]

What would they have done if a bus had run him over and killed him the day before? Who would have been perceived as being at fault then?

Didn't shut it down

[dutchwhizzman]

The city was functioning, but they couldn't change anything in their infrastructure. It was pretty nasty because from what I understand he locked everything up *after* he got in a conflict, but it wasn't shut down.

More Courts

[b4upoo]

I think this case needs to be appealed in the federal courts. When a person is hired there exists some form of contract with the employer. When an employee is fired that contract ends. So if they told him or implied that he was no longer their employee I see no problem with him not responding in any way, leaving the building and immediately flying to a remote Pacific island leaving no address or way to contact him at all.
                  We do not know the details but was the request for passwords made after he was terminated? Was it made during the termination? Was it made before termination was made in any way? Worse yet what kind of idiots are in charge of this company? What if the man had stroked out and died suddenly? Is there any proof that they asked him to continuously keep them advised of passwords?
                  Maybe this fellow has a suit he can press against the former employer.

Re:More Courts

[elbonia]

All of your questions are answered in the article. Specifically in the actual appeal, http://www.courts.ca.gov/opinions/documents/A129583.PDF

Re:More Courts

[jfalcon]

The requests were made multiple times. Yes, his manager wasn't heavy handed regarding obtaining passwords due to the desire to keep the talent. But the fact is that he designed in backdoors into a critical system and rigged it to where he was the only one who could access the network management. The rest is theatrics which lead to his demise.

Re:More Courts

[jeff4747]

I think this case needs to be appealed in the federal courts.

That would be because you haven't read the article or bothered following the story.

He was asked for the passwords before he was fired. He was being transferred, because he refused multiple valid requests for service. He did not want to be transferred. So he tried to sabotage replacing him. He was fired for that sabotage.

Worse yet what kind of idiots are in charge of this company?

"This company" is the city of San Francisco.

What if the man had stroked out and died suddenly?

Well, if Childs had followed city policy, then it wouldn't have been a problem. Childs was not following policy, in order to extort the city into not transferring him.

Insanity

[Anonymous Coward]

Whoever thought withholding passwords was a good idea is insane to begin with. Why is this presented as a rational choice to be made?

Exactly

[SmallFurryCreature]

These articles show you that a lot of nerds really are totally incapable of dealing with normal society.

If you changed the locks on your employers buildings and refused to hand over the keys, what do you think would happen? So why should digital keys/passwords be any different?

Some dweebs seem to construct fantasy worlds around themselves and since they lack interaction with other people becomes convinced that these fantasy worlds are real. Childs seems to have done so, he believed he was the only one fit to access these systems, that they were his babies and only he could properly care for them.

I am not sure he should go to jail for it. He should however get mandatory treatment, if needed in a padded cell with a lock. If he asks for the keys, tell him you don't think he is capable of properly dealing with it.

Citation needed

[tlambert]

Bull shit he didn't booby trap it. The network was configured to run from RAM at his design and he was the only person with the configuration. Power to any site will go out and that site will be down until the "hero" comes to save the day.

Citation needed

Feel free to cite any reputable news outlet.

Re:Citation needed

[Anonymous Coward]

any reputable news outlet

Bwahahahahahahaha, do those really exist?

Re: Citation needed

[Anonymous Coward]

I am taking this from the course of events of the first fifteen pages of the court ruling. He set the system up to destroy itself if anyone rebooted a router or tried to recover a password. I don't know what you think of that but it is a booby trap in my book. He effectively designed the network to keep himself employed thinking he was irreplaceable.

Re:Citation needed

[jakimfett]

Are actual court documents alright? Here ya go.

You're welcome.

Re: Citation needed

[Minwee]

I don't know what you think of that but it is a booby trap in my book.

Remind me never to hire you to implement network security.

Re: Citation needed

[Anonymous Coward]

::sigh::

http://www.cio.com.au/article/255165/sorting_facts_terry_childs_case/?pp=3

"Common practices portrayed as nefarious.
The documents filed by the city in opposition to Childs' bail reduction contained many vague references and claims of nefarious actions. But to those with experience in network administration, these activities seem like common practice.

For example, the documents portrayed the fact that Childs had configured some number of routers to disable password recovery as a subversive action, when it's common to use that function to secure routers and switches that cannot be physically secured."

Re: Citation needed

[Anonymous Coward]

That isn't network security, that is making a fragile network that is designed to create as much work as possible for one person. What happens if the city services lose power for just a few minutes? The network is fucked because he's the only person who has the info to bring it up. This network is *EASILY* subject to a simple denial of service, all one would have to do is try to do a password reset which reboots the router. BAM, site's offline.

This also makes the entire network subject to one person with no oversight. He can very easily put traffic loggers in place on the router level without any ability for any other admins to audit them. He can maliciously bring down a site and take his sweet time to go and fix it.

The guy intentionally locked out the console ports and made his own computer the only one that could access the routers.

This is in no way, shape, or form security. This is a guy trying to make himself the only person on the planet the way to keep up a network. This is anti-security.

The strongest evidence

[JDG1980]

To me, these two paragraphs from the court document are the most damning evidence against Childs:

Disabling Console Ports. The jury learned that if the console port – the physical means of access to the network on the device itself – is disabled, then the administrator cannot login to the system using what is regarded as the "port of last resort." On July 8 – the day before he was placed on administrative leave – Childs disabled the console ports on all five core devices, preventing the possibility of any password recovery.

Applying Access Controls. Childs also applied access controls to core devices that required that all administrative access had to be achieved by means of one particular computer, even if the access codes were known. He set up these access controls on core devices on the morning of July 9.

It's not just that he did these things – which were highly questionable, but might possibly have had some legitimate justification – but that he did them immediately before being placed on administrative leave, when he knew his employers wanted to relocate or fire him. The timing leaves little doubt of his intent.

Re:The strongest evidence

[ruir]

I remember also reading that he erased the configurations from nvram, leaving them in RAM, to thwart password recovery procedures, making the routers lose all the configurations if turned off.

Forgetting is human

[Anonymous Coward]

Getting arrested for violating a policy that forces you to remember things sets a very dangerous precedent. This here idiot aside, I would much rather force corporations to setup dual key infrastructures, dead man switches etc. than to allow then to claim humans are robots and any failure is prosecutable.

Because people do forget things, and I would say ALL that worked with tech computers forgotten at least ONE password at one time. I for one would rot in password hell if forgetting was a sin.

Re:Passwords are property of the employero

[Redmancometh]

I agree completely..I think it should be prosecuted as a denial of service attack would be...its defacto DOS.

Calling passwords property would lead to a slippery slope I think...

Though to be fair calling *anything* that leads to loss of access a DOS could lead to bad things too...

However this should definitely be at least a civil issue with punative damages...I wouldv even say this SHOULD be a criminal offense

It's tough to protect against inside jobs

[Anonymous Brave Guy]

In a city of techies like SF (where I live), it is absolutely unforgivable to allow a system design allowing for single authority. The city was negligent for ever letting it get this far.

What would you have them do to avoid this problem in the future? Perhaps they could hire someone who is a technical expert with overall responsibility for the department, whose job is to make sure something like this can't happen. Oh, wait...

Requiring the password? Sorry, that's their identity (and ass) on the line.

It's their identity on their employer's systems. If the employer makes a management decision to "compromise" that identity then that is 100% their decision to make, not IT's.

Of course, it also becomes management's responsibility. It's fair for the employee to want written confirmation to record the decision if he disagrees with it. But given that confirmation, the employee doesn't get a vote and has no right to object.

Until he has a clearly recorded transfer of responsibility, he shouldn't relinquish his password.

I think "You're fired" is a pretty clear transfer of responsibility.

Additionally, if his password is related to his personal passwords, releasing the password may constitute a legitimate risk to his privacy and fifth amendment rights.

Seriously? Really? This guy is a high-level IT expert within his organisation, and we're supposed to have sympathy if he not only reuses a password (or something related closely enough to risk the secrecy of another one) but reuses them on completely different systems, when he knows in advance that some are personal and some are professional? Give me a break. Any risk to his own privacy here is entirely self-inflicted, and trying to hide behind legal safeguards created with important and legitimate goals in order to cover your own malice and incompetence is the worst kind of legal wrangling.

Don't risk it. Have plans for unavailability, termination, and death.

That's great, but if the guy who betrayed you is the guy who was responsible for making those plans, there isn't much you can do. At most, you could have hired multiple people to act as mutual checks and balances by auditing the system, but the reality is that even the most high-level IT infrastructure today is still quite simplistic in its security, and unfortunately it remains a pretty easy mark for a skilled inside job.

Of course, if a government department did hire extra people, good enough to maintain proper oversight and audit each other's work in this kind of context but who weren't otherwise needed, many people who didn't understand the reason would be crying foul over wasteful government spending. And they'd have a point, given how rare incidents like this are and how much such people cost.

Re:It's tough to protect against inside jobs

[dbIII]

That's all very good in an ideal workplace, but that SF office was a fetid swamp of office politics and the guys boss had just been shafted leaving no clear chain of command. To me it looked like Childs was asked to break some rules which could have landed him in deep shit, so instead he decided to be silent which may have landed him in deeper shit - still hard to know. Catching the new girl removing the hard drive of the person responsible for network security forced a confrontation and it looks like he had no option to just leave quietly (like the person responsible for network security) and was trapped between two bad choices. The reaction was so utterly over that top that it looks quite primal and makes me wonder if the manager that escalated it to the police and Mayor was sleeping with the new girl that Childs had upset so much. That would explain all the over the top chest beating.

As for most of the comments here - there's so much baggage where Childs is seen as that IT jerk that didn't let them use their iPhone somewhere that most of them have fuckall to do with the topic. One very petty workplace dispute and the guy has done more time than some westerners that were caught fighting on the side of the Taliban.

Re: It's tough to protect against inside jobs

[Anonymous Coward]

two words: internal audit

Re:It's tough to protect against inside jobs

[Anonymous Coward]

"even the most high-level IT infrastructure today is still quite simplistic in its security, and unfortunately it remains a pretty easy mark for a skilled inside job."

It's quite trivial to grant, say, three people, with different passwords, access to the same attributes. If something happens to one of the three people it's quite easy to make a system such that the other two can remove the third person's credentials and grant someone else those credentials.

Re:It's tough to protect against inside jobs

[0racle]

What would you have them do to avoid this problem in the future? Perhaps they could hire someone who is a technical expert with overall responsibility for the department, whose job is to make sure something like this can't happen. Oh, wait...

There are AAA systems with RBAC for a reason. Childs was not the only network admin and there is no reason he should have been the only one with administrative access.

However, SF's failures in this regard still do not absolve Childs colossal dickery. He brought the worst of what can be made to stick on himself.

Re:It's tough to protect against inside jobs

[dowens81625]

I think if I was in his shoes I would have taken this approach.

1. We want the passwords to the network.

2. Okay give me a couple days to gather them in a single document.

3. Hand write the documentation, Type and print a letter of receipt of said credentials including "To the best of my knowledge this is every login password or other key I have any knowledge of as of [Date]" and "Requester has requested these documents, be created, and the transfer of responsibilities and liabilities to themselves all systems of San Fransisco" "As requested I have labored to document the following information" & "Requester accepts full responsibility for requesting the documentation of this information" Hand over the documents after the Requester signs the letter of receipt in front of a notary.

4. Send the City a bill for your time documenting and preparing paperwork, Lawyers time to compose the letter of receipt.

5. Profit.

Re:It's tough to protect against inside jobs

[Archangel Michael]

You're Fired means transfer of authority, you're right. At that moment, Childs should have told SF to pound sand, and walked away. He owes them nothing at that point, including the password. What crime did he commit by not revealing the password?

Re:It's tough to protect against inside jobs

[Anonymous Coward]

It's their identity on their employer's systems. ...

I think "You're fired" is a pretty clear transfer of responsibility.

You're not thinking clearly, yet in doing so, you highlight where the City really fucked up, and where Child's should be on firm legal ground:

Once your employer fires you, THEY ARE NO LONGER YOUR EMPLOYER.

Child's attorney is seriously fucking up by not highlighting this very important fact of the case. The events were as follows: 1) they fired him 2) days pass 3) they order him to give up passwords. After point 1, the City no longer had any right to demand anything, nor did Childs have any responsibility or legal obligation to follow orders from a previous employer.

Re:It's tough to protect against inside jobs

[Anonymous Brave Guy]

He owes them nothing at that point, including the password. What crime did he commit by not revealing the password?

You could read the court proceedings and find out. After all, we have courts to determine the answer to exactly that question without any need for partially informed conjecture on Slashdot.

As for not owing them anything, it would be very surprising if he had no clause in his contract to cover returning property and similar behaviour upon termination, so even if he committed no crime, he's probably on the hook for civil damages if he fails to do that.

Re:It's tough to protect against inside jobs

[Anonymous Brave Guy]

Leaving aside the fact that there could have been material terms in his employment contract that survive termination, it seems he was terminated for insubordination after he refused to cooperate.

Re:It's tough to protect against inside jobs

[Anonymous Coward]

Leaving aside the fact that there could have been material terms in his employment contract that survive termination,

Ok, what? Can you provide an example of such a zombie contract, that has terms that survive the... uh... contract termination?

it seems he was terminated for insubordination after he refused to cooperate.

ok... unicorn contract terms notwithstanding, he was fired because he was an asshole. This is not in dispute. But he didn't sabotage the network. He refused to obey an order from what became a previous employer that was no longer compensating him days after his termination. I don't see where he broke any laws or even behaved unethically. He should have handed them a quote for a consultation fee, but instead he just said "no." He doesn't deserve to be arrested, convicted, his career and life ruined because he refused to give up something in his head for free to a shitty ex-employer.

Re:It's tough to protect against inside jobs

[Anonymous Brave Guy]

Can you provide an example of such a zombie contract, that has terms that survive the... uh... contract termination?

I'm going to give you the benefit of the doubt here and assume you just need to learn about the law and you're not deliberately trolling.

It's perfectly normal that the end of someone's employment does not imply that every term in their contract magically loses effect (and this is true in every jurisdiction I know about).

For example, if the employee has done the work, they're normally still entitled to the pay that goes with it. The employer can't just fire them and then say there's no contract any more so they don't owe them anything.

Likewise, if the employee has been trusted with trade secrets so they can do their job, their obligation to respect that secrecy doesn't end the moment their employment does. If they go out and tell everyone sensitive things about their past employer, they're still on the hook for it.

There is nothing "zombie" about this. It is absolutely routine.

unicorn contract terms notwithstanding, he was fired because he was an asshole. This is not in dispute. But he didn't sabotage the network.

If he was challenged over his security practices, and his response was to set up the devices in the network so no-one else could access them without breaking them (by losing the running configuration), then I think he did sabotage the network.

I don't see where he broke any laws or even behaved unethically.

We've already established that you don't know much about the law. As far as the ethics go, I think if you're responsible for expensive and essential infrastructure and you deliberately lock it up (or refuse to unlock it) before you leave so that your successor can't smoothly take over, you're actively screwing your employer and failing in your basic duty as an employee, and I don't see why you shouldn't be held accountable for that.

He doesn't deserve to be arrested, convicted, his career and life ruined because he refused to give up something in his head for free to a shitty ex-employer.

And as far as I can see, that isn't the reason that he's now suffering those consequences.

Re:It's tough to protect against inside jobs

[DeathToThePatriarchy]

It has been standard in law that any work done with tools (including systems) that belong to an employer belongs to the employer. When you start a job, you should be given a form to sign that you acknowledge that any and all work done for the employer or using the employer's systems belong to the employer and announcing that you have no reasonable expectation of privacy when using the employer's systems. Now, if the City of SF wanted his personal password to systems he owned, supported, and housed, that would be an invasion of property. If you put anything on the systems owned by your employer, they are no longer exclusively yours. Use your own damned server to store your own things. And assume that you must hand over passwords, encryption keys, data on your phone, and any damned thing else you grabbed or created on their systems. Oh, and read the play "The Water Engine" if you think this is something new.

Re:It's tough to protect against inside jobs

[Anonymous Coward]

If he was challenged over his security practices, and his response was to set up the devices in the network so no-one else could access them without breaking them (by losing the running configuration), then I think he did sabotage the network.

Fascinating. But that wasn't the case here. Merely by turnover, Child's was the only person left that had access. There is nothing nepharious about this. He wasn't fired, or suspected that he'd be fired, and took control and locked everyone out... he was simply the last guy left employed that had access. That's all there was to it.

I'm not sure what fascist state you live and work in, but in the United States, the things in your mind are constitutionally protected. No one, not even the government, has a right to demand that you forfeit your constitutional rights to what is in your head and give that up if you choose to remain silent (unless you are a material witness to a capital crime, which isn't the case here). If his access used a physical key card or something that Childs took with him, it would be a different case. As long as what was being demanded of him was only in his head, there is nothing that can legally compel him to comply with the post-termination demands. Check the cases on how fucked the government is when they are trying to recover encryption keys that only a suspect has, and only has in their memory. The case law is pretty clear and one sided... your memory is Constitutionally protected. Period, end of story, that's that... its in case law, it is the law now.

Childs is just another fucking asshole admin, probably mildly autistic, probably a pain in the ass. However, he should be applauded for his loyalty to what he saw as his duty as an admin, which was not to relinquish sensitive access to systems to personel he knew to be not competant to correctly administrate the systems. His actions ironically followed the published policy of the City's IT Department. Had the facts been that an acting supervisor demanded his access to systems be shared with another compentant admin (meaning, rather than demanding HIS pw, he was instructed to give another user his level of access), and Childs had refused, then he might be nearly guilty of what he's been accused. But that's not what happened. He was summarily fired, cast out, for whatever reason, not being well liked during an internal power regime change, probably... and this was an incompetant decision. After the fact... they demanded his passwords and access to his accounts. The law is, in fact, once a user leaves a company or government position, no one else can legally access their email or their accounts on any system. The accounts are disabled, and short of court order, that is that, they stay inactive. The dipshits that fired him at no stage in the sequence of events made any sensible decision, nor was any logical procedure followed. The person that should be held accountable for the City's problems is not Childs, but the moron that fired him before requesting that he grant admin level access to another admin user account. (I'd say that is criminal negligence.) Then Childs could be fired, his accounts disabled by the other admin, etc. But what happened is they fucked up, and Childs refused to relinquish his account password... which was, again, written department policy, and a standard and ordinary and necessary policy industry-wide. He was ALSO no longer employed, and under no legal or personal obligation to even respond to any request from his employer. A court order is the only thing that could compel Child's compliance, and it is not clear that such an order would even be legal (considering Childs' 1st and 5th Amendment rights).

FYI, I have 22years of Systems Administration experience, a CS degree (pretty worthless considering my occupation), and a few years ago I took some extra courses while exploring the idea of going to law school, which included taking 3 semesters of Constitutional Law. In my expert computer administration opi

He was doing it rong!

[Anonymous Coward]

Should have used unmaintainable code and config files like everyone else.

denying a higher level

[Anonymous Coward]

Refusing something to a supervisor / manager can be doable. You are supposed to be able to escalate an issue to the next level(s) if your supervisor(s) may be doing something harmful or illegal. I've actually seen this happen with a multibillion dollar asset, and the top manager, a vice president, got fired after wrongfully trashing a first line supervisor so badly, and spending $2 million on internal investigation (personal vendetta), it also pissed off over 600 highly compensated employees with recorded call-ins. The sr officers *had to* put the vp down.

Comment from Terry Childs

[Anonymous Coward]

Yeah that's going to be a problem. It's gonna be a problem for them. This a clear violation of your rights as a consumer. It's an infringement on your constitutional rights. It's outrageous, egregious, preposterous.

Oh wait, that was Jackie Chiles. Never mind...

Stop buying the bullshit, ericgoldman

[Anonymous Coward]

He was under orders not to divulge the passwords in front of third parties not under the agreements of confidentiality and signed to that effect.

He was then put under order to do so but was only given the VERBAL order to do so, therefore could have been taken for breech of contract and have no recourse.

so stupid...

[Anonymous Coward]

and... if he actually 'did not know them' then what - get jailed indefinitely for no reason whatsoever? This whole country is going downhill fast.

It wasn't repoted as that.

[Anonymous Coward]

There may have been some alarmist rhetoric, but such an event WAS NOT POSSIBLE.

The only option taken was that it was NOT possible to reset the passwords over the network. This is 100% CORRECT security procedure.

If someone has console access, then you're already stuffed, but if you have network access to a "reset root" command with an account that anyone could get the password to, then you have ZERO security.

WRONG yourself.

[Anonymous Coward]

Those documents are the CLAIMS of the accusation.

Re:WRONG yourself.

[jfalcon]

These aren't claims. The lower court and a jury affirmed these are the actions taken nor did Childs ever dispute that he removed the configurations from NVRAM. The appellate court affirmed these findings.

There is nobody above him.

[Anonymous Coward]

He was in charge of those systems. As far as those systems are concerned, NOBODY, NOT EVEN GOD is above him.

Is it merely this authoritarian bullshit is being done by one of the "peons" rather than the executive "masters" that has so many retards butthurt over this?

Another poster put down:

"whatever your interpretation of the law is, he is in jail. I think that is a good outcome"

WHATEVER THE LAW SAYS, he's in jail and this is good.

THAT, RIGHT THERE is the problem.

And I have ABSOLULTEY NO FUCKING IDEA why that sort of absolutist facist bullshit is getting so much play here with Childs. Did he steal everyone's candy or something?

Re:There is nobody above him.

[EdIII]

Uhhhh, there were plenty of people above Childs. Plenty.

The citizens - We pay his salary.
The Mayor
Some department head somewhere in San Francisco or California.

I don't exactly know the organizational structure, but there is ALWAYS somebody above you. Even the President of the United States.

If there is truly nobody above you... then there is damn well somebody right next to you.

Unless you are an army of one. Most people don't conduct business like that.

The problem wasn't the blackmail

[TsuruchiBrian]

The problem was that he tried to blackmail a government. If you try to blackmail a person with limited resources, it might turn out that the cheapest thing for them to do is to give into your demands, especially when the government is only really motivated to get their own money back and not other people's money back. If you try to blackmail someone very rich, you will probably just anger them enough to be willing to lose more money just to see you go down out of spite. You could try to make the blackmail consequences really severe, but chances are that there is a limit to the amount of damage you can really cause. If you try to blackmail a government that can levy taxes to generate revenue, controls the justice system and has a public image to uphold. You are really going to have to do something bigger than hijack some infrastructure passwords. You need to takeover Alcatraz and point some missiles with vx gas at the city.

Re:The problem wasn't the blackmail

[Opportunist]

You just have to make sure that you demand less than what it costs to hire someone to get the password out of you. Because, frankly, if you want a million, be prepared to meet Ivan, who ties funny little knots into your body for a fraction thereof.

Re:The problem wasn't the blackmail

[TsuruchiBrian]

Even if you demand less, people are pretty spiteful. If I try to blackmail a rich person for $100, so that he can avoid losing $1000, he is going to hire ivan for $10,000 just to make sure I never try something like this again.

Three falsities in that short post there.

[Anonymous Coward]

Number 1: "his manager wasn't heavy handed regarding obtaining passwords due to the desire to keep the talent."

No, his manager had been caught taking a HDD out and introduced themselves as "Hi, I'm your new manager! Give me the passwords!".

Number 2: "he designed in backdoors into a critical system"

Nope, it's part of the Cisco iOS parameters: he never had to design a thing, let alone backdoor it.

Number 3: "where he was the only one who could access the network management."

Nope, three named people were on the list of "could request the passwords" and that list required that no other non-named person be able to hear the password. However, they fired him first for not giving the password to a person not on the list and then refused to get the authorized person(s) to him when they jailed him.

You remember wrong.

[Anonymous Coward]

Or, rather, redirected.

This is a security device. A reset node that wasn't supposed to be reset will be given the default which means the segment goes down and the intrusion can be detected easily.

To bypass this, you need

1) Access to the physical device.
2) The correct routing system.

which even an intruder will not have easy access to #2.

what if he died?

[Anonymous Coward]

What a bunch of morons for allowing a single point of failure.

The password is not the issue

[dskoll]

The password is not the real issue here... it's a distraction. The real issue is that Terry Childs apparently deliberately caused a lot of unnecessary expense and hassle to his employer. It doesn't really matter whether he did it by withholding a password or going through the drop ceilings cutting ethernet cables... the net effect was the same.

Re:The password is not the issue

[Opportunist]

The primary problem is that he was ABLE to do that, especially in the light that it is very trivial to keep this problem from arising in the first place.

Not Mr. T

[Anonymous Coward]

I can't feel pity for this fool

You're not Mr. T, are you?

That's not how things work

[sirwired]

First, his "employment contract" went into minutiae on system security? Really? That'd be one strange contract for an individual IT Grunt... a contract w/ a Systems Integrator, sure, but not a front-lines civil servant. I've heard mention of this "contract" before on Slashdot, yet strangely nobody has ever provided a link to it, and news articles about the case are strangely bereft of it also.

In any case, in any employment situation, you don't get to refuse to do something your boss orders you to do unless you are being asked to do something illegal. You might ask to have your butt covered with an e-mail from your boss (as a civil servant it would have been enough to keep him from getting fired), but that's about the limit of your ability to refuse and keep your job.

And why did he decide the Mayor, and only the Mayor, had supreme authority? Was the CIO of the City of SF not good enough? Nope, he doesn't get to make that determination and hold IT assets hostage until he receives what he thinks to be proper authority.

well...

[buddyglass]

The ruling (PDF) provides a good cautionary tale for anyone who thinks they can gain leverage over their employer or increase job security by controlling key passwords.

You can still gain leverage. You just have to be willing to go to jail if your employer calls your bluff, and possibly afterwards even if you successfully extort something from them by withholding the passwords. The trick would be to make sure you retain whatever you managed to extort for when you get out of jail.

what if he died

[Anonymous Coward]

What would have happened if he just suddenly died instead of quitting? I think the employer deserves some fault here to not being prepared.

He's not the only one who made a big mistake

[Opportunist]

Also his superior was not the brightest bulb in the socket. The very FIRST thing you do when you employee gets single handed access to mission critical resources is to ensure you can take it back from him even without his cooperation. With passwords, this is trivially easy. Have him note it down, put the sheet of paper holding it into a sealed envelope. And when it's time to change passwords (according to your password changing strategy), rip the envelope open in front of him so he can verify it has not been tampered with, use the password he noted down and fire him on the spot if it doesn't match.

This is, in a nutshell, a fairly good solution where he won't be able to hold your servers for ransom.

When I got laid off

[Enry]

It was rather sudden and my access was disconnected to all services of my employer. I had a list of passwords, I clearly outlined that while we had processes in place to share passwords with my staff, there's the possibility that I had passwords that nobody else had. They didn't care, so I wiped all of those passwords from my store (aided by the abysmal rollout of the latest SplashID which nuked your password database without warning).

It's called elite panic

[swm]

It's called elite panic, and it's extremely dangerous.

The people in the world with real power--kings and princes, billionaires and CEOs--spend their lives worrying that the people that they took power from, and hold power over, are going to rise up and take that power back. That's how elites get power in the first place: by taking it from others. They naturally assume that everyone else is trying to do the same thing. They also spend their lives making sure this doesn't happen.

As long as the elites feel secure, you don't notice this so much, but when they feel threatened--or worse, humiliated--they panic, and go on a rampage. People go to prison. People die.

It used to be that power came from control of croplands. After the industrial revolution, power came from control of mines and factories. This suited the elites. They could enforce their control with armies and police.

Today, significant power comes from control of computers. But you can't control computers with armies and police. You can control the hardware--lock the server rooms, take the computers off-line--but that doesn't get you what you need. What you need is running systems, and that needs programmers and sys admins. All those people walk out the door every night, and unless they come back in the morning, your hardware is pretty much useless. You don't have control of the computers.

This change crept up on the elites while they weren't watching. (CEOs don't pay attention to computers. That's operations, right? That why I hired a COO, right?) So everything just rolls along from year to year and decade to decade, until a Randal Schwartz or a Terry Childs comes along, and the elites realize that they don't have control, and they panic, and then they crucify the object of their panic.

The Forbes article assumes that Childs withheld passwords in a bid for job security, which is absurd. Slackers and grifters don't face down police officers and go to prison on principle. They hand over the passwords and move on to their next scam.

Many of the Slashdot comments argue that withholding passwords is a kind of office theft, like stealing the keys to the safe. That's a fair analogy for explaining what a password is, but not really on point for the issues raised by this case.

The actual conviction was for disruption/denial of computer services, which is overblown, at best. The city of San Fransisco got control of their computers, with only minor inconvenience and substantially no loss of service.

My guess is that Childs suffers from some variety of asperger's, or paranoia, or obsessive-compulsive, or the like. The proximate reason that he is in prison is that this disorder--whatever it is--caused him to stumble into the maw of the legal system.

The ultimate reason that Childs is in prison is that he was the object of panic--the person in view--when one of the elites looked up and realized that they weren't in control of their computer systems. So they crucified him.

I don't get it

[tom229]

Whatever happened to the right to remain silent? I honestly don't understand how a court can FORCE you to give up information you don't want to give up. This all seems a bit draconian.

I'm a senior sysadmin for a medium sized business and we are constantly employing third parties to audit our systems making sure that we have enough documentation that if I get hit by a bus someone else can come in and hit the ground running. This is pretty standard procedure.

It sounds like the employer fucked up and didn't take their IT seriously (a common problem). Sure this guy was a dick, but 4 years in prison? Give me a break. What is the world coming to?

Re:I don't get it

[wonkey_monkey]

Whatever happened to the right to remain silent?

That's for when the courts want something out of you. In this case it was his employer who wanted something out of him.

It sounds like...

Depends who you listen to. On the one side you've got the blogs and tech reporters, and on the other side you've got the court ruling. Which one of those has scrutinised the case and all the evidence more closely?

Re:I don't get it

[tom229]

True, I don't know the whole story and am just speculating. However, I do feel it is management's responsibility to ensure this sort of thing can't happen. I know Childs was management, but you need checks and balances at all levels. Is Childs an asshole? Yes. Did management fuck up, poorly plan, get egg all over their face, and try to use the courts to clean everything up? Probably. 4 years and 1.5 million still seems excessive.

Re:"I stole from an idiot" isn't an excuse, it's w

[Anonymous Coward]

Not in 'Murica we don't. Your kids are starving? Get a job you loser. There are no jobs? You're not working hard enough. You're mentally challenged? Read a book you idiot. That's the level of compassion we have in 'Murica nowadays. There is no longer such thing as social responsibility or taking care of those less fortunate. Other than that you've been spot on.

Back to the Basics

[Kagato]

The core issue I see is he went at this like some sort of game. It's quite foreseeable that an organization that has a major police force, courts and prosecution would use those resources to get what they want. Give them the rope and you leave town on vacation. If they didn't have the due diligence to ask for something in the exit interview that's on them. It's reasonable to take a vacation and have time to think after a major life event (like getting fired). Once you're out of contact it's reasonable to assume that one cannot be uncooperative if they were unaware their cooperation was being requested. When you get back to town reefer them to your lawyer. There's no reason for one to have any interaction with a gov't official once it hits the fan. Using a lawyer keeps one from taking actions and making statements that would land one in jail.

Nicely misleading headlines

[neminem]

I was all prepared to be outraged at a company that tried to strongarm employees into giving away personal passwords, and then found some pretense to send people that wouldn't agree, to jail. That would be news.

This isn't really news - it wasn't the guy's property, it was his ex-company's. Were his higher-ups retarded for leaving their whole IT at the mercy of a single guy, not making sure anyone else had any idea how to work their stuff, and then firing that guy? Yes. Yes, they were. But that's not really news, either, at least not if you read the daily WTF. Companies act incompetently with regards to their IT all the time.

Re:Nicely misleading headlines

[inotrollyou]

Me, too. I was about to get on my moral high horse, as well. Shame on OP for such a misleading title.

staffing cuts lead to him being the only person do

[Joe_Dragon]

staffing cuts lead to him being the only person doing the network work.

Two way street

[Anonymous Coward]

On one hand, he should have given the passwords because it's their network. On the other hand, corporations use their control over people to leverage what they want all the time, so why should he be any different towards them?

I forgot.

[jsepeta]

Forgetting isn't a crime. Reagan got out of charges of War Criminal behavior (secretly funding a terrorism campaign in El Salvador) by claiming he forgot.

Re:I forgot.

[Anonymous Coward]

>Reagan got out of charges of War Criminal behavior (secretly funding a terrorism campaign in El Salvador) by claiming he forgot.

Yes, but we knew back then that he was already senile so we believed that he forgot. He did it, but he forgot he did it. St. Reagan the Senile...

Businesses need to learn how to kill employees

[cyberfunkr]

Not actually kill them, but get in the mind set of a will; What would I do if Employee X died tonight?

I have a will, so if I die, there are instructions so that life can continue without me; how money is to be handled, where important documents are stored, and the top-level password to the password manager program. The same needs to be always thought of in regards to employees. How would the business carry on if someone was no longer an employee tomorrow; both long term AND short term. (Death, disability, family emergency, quit, kidnapping, blow-to-the-head induced amnesia, etc)

- What duties do they perform and who can we use as a backup?
- What information do they have that we'd need to keep things running?
- If a parasite crawled in their ear and they went rogue, who and how could we isolate them to prevent further damage?

You get the idea.

anti-worker rhetoric

[Anonymous Coward]

"Most employees think they are indispensable to their employers, but in fact, most employees are easily replaced."

Typical that Forbes will find it necessary to include completely unrelated anti-worker rhetoric at the head of their article to ensure the dominance of corporate employers over the population of wage-slaves.

Re:Never getting a dime can do 4 years

[dskoll]

Yes, but see the "Strongest Evidence" post above:

t's not just that he did these things – which were highly questionable, but might possibly have had some legitimate justification – but that he did them immediately before being placed on administrative leave, when he knew his employers wanted to relocate or fire him. The timing leaves little doubt of his intent.

That seems very fishy to me. I think he was trying to cause trouble.

Re:Never getting a dime can do 4 years

[Grishnakh]

Maybe, maybe not. But either way, "they" weren't fucked at all as the anonymous OP above said, since they got the passwords pretty quickly, and years in prison seems ridiculous for something like this where, regardless of his intentions, he didn't withhold the passwords for any long duration, but rather only insisted (it seems, correct me if I'm wrong) on following official policy to the letter (maybe to make things hard for them, but still, it was their policy, not his) and giving the passwords to the Mayor directly, and did so when presented with the opportunity. People have gone to prison for much less time for violent crimes, and this wasn't really a crime, it was a dispute. It should have been handled in Civil court, just like if someone takes your money and refuses to give you what you paid for, the police will refuse to arrest them for theft (even though that's exactly what it is), they'll just tell you to sue them in Civil court.

Loaded gun to child to carry .. password

[MonsterMasher]

The actual story is that he did not feel authorized, legally, to provide them to the person requesting it from him.

That password is not something you give out to some person who will then email it in plain text with complete description as to why it is so important - sorta the same reason you don't give a loaded gun to your 5 year old to carry over to your wife in the next room. A loaded gun with safety off.

But clearly it's get-in-line to kick the guy day.. Oh, and gloss over the very complex security issues that we could be discussing here.

Perhaps later in the comments.

I think the employer is a retard.

[Freeman-Jo]

Let me make it clear, I'm not defending anyone here.
The question I have to raise is, why giving one guy too much control in the first place? Let's look at what if he got hit by a car and die instead? So, is the lawyer or the judge gonna force the password out of him? What if you were that admin and were using a USB keyboard password like ubikey, then reset/format that key after you got fired? This is legitimate. Also, we should look at password seperately from the network infrastructure. The employer should be looking at a way to get infrastructure back not the password. Eg: the judge have force him to create another admin account and give that to the employer instead of having to reveal his own password.

Re:Never getting a dime can do 4 years

[Anonymous Coward]

...which was apparently the agreed upon policy for him disclosing them if asked.

Misleading title

[Anonymous Coward]

Childs didn't just withhold passwords. He reconfigured the network settings to self-destruct on a power failure requiring his direct intervention to restore. He configured settings to self-destruct upon any intrusion. He added his own physical back door servers and modems to the network. He lied to management and HR about having passwords. He systematically excluded co-workers who used to have access to eventually have no access. He modified passwords on the morning of a meeting where he knew they would be requested. He boasted about being unfirable because he had the "keys to the kingdom". He feigned medical ailments and claimed hostile environment to dodge responsibility. He verbally abused authorized personnel for entering server rooms to audit assets. He perjured himself about his criminal history (multimple convictions).

Childs was a grade A asshole, the worst of the worst. This was not system administration, it was systematic abuse of trust to secure his exclusive control of critical City infrastructure and then hold them to ransom. He deserved to be convicted and he deserves to languish in jail.

Re:staffing cuts lead to him being the only person

[Cramer]

The ruling explains there were others working on the project, but a) Childs didn't like sharing -- in his eyes, everyone's a moron, and b) Ybanez, who had been working with him, was moved to a different project for months leaving just Childs to run everything. When brought back to the project, he refused to provide access because he didn't want Ybanez giving the password(s) to anyone else. On top of that, he went full-on-rogue-sysadmin locking down access to only his select PC(s), disabling local access (console), erasing startup configs, disabling password recovery, and keeping the sole set of archived configs encrypted in his own possession. Despite having acknowledged the FiberWAN design as city property, and knowing full well disclosure was forbidden by Homeland Security, the arrogant ass twice submitted the plans for copyright registration -- claiming he didn't know they'd be public documents.

In light of all that, 4 years and 1.5mil$ is not a punishment. This fool should be taken out and shot. We may look at the $646,000 figure for a full audit and think it's excessive, but that ignores the level to which Childs went to be "King of the Mountain"; you cannot trust a single thing in the entire network. Even line of configuration has to be verified. Every single device, wire, screw, and power cord has to be documented and inspected. (who knows what he might have taped under a desk or floor tile or inside a wall.)

My pay rate would increase

[Anonymous Coward]

Sure I'll give you the passwords. But since I'm no longer employed by you, I'm an independent contractor, and my hourly rate is considerably more than my salaried rate. I'll send a contract over tomorrow and once executed I will help you document your security codes.

See, that would fix it all.

Just call in Dabney Coleman...

[GeeDog]

He could have changed those codes in less than an hour.

Backup your PASSWORDS

[Gallomimia]

If you own hardware, and you employ people to watch after that hardware, the onus is on *YOU* the owner/employer to maintain access to that hardware, backups to admin accounts, passwords and so on.
For the three thousand reasons outlined in this body of comments, there's any number of reasons you can lose access to an employee, and if their knowledge of passwords is the fulcrum for your whole business model, well then sonny like the capitalist mantra goes, you deserve to go bankrupt, because you fucked yourself.

Once again, onus to maintain control of your owned hardware, yours. Not the judge, not the admin, not the police, not the gubberment. YOU.

Passwords are intened to keep people out

[teknosapien]

As was stated - The new employee was not that technically savvy,according to Childs - so what would cause more damage, giving the password to a person that probably has no clue as to what they are doing and with root access to all of your systems(remembering that these are 911 systems that at the time were working) - or vetting the person out and ensuring that they understood how the system worked.

As for a private company, My CIO asked for the admin password for our systems, once - I refused based on his qualifications - we passed our SOX security audit.

An important thing to remember that security audits also include social networking - so holding out for the mayor to release the passwords to him, in my estimation was the correct thing to do.

He deserved every bit of the punishment.

[Anonymous Coward]

It's bad enough we have to deal with hackers and cracker and just plain jerks,
but a situation like this gives all of us who work in I.T. a black eye.

"Farffel farffel pippick."
    -- Pippo Popolino in "Casanova's Big Night"

Is that all?

[Anonymous Coward]

That's what this is about? For a second there, I panicked. I thought this was because someone didn't give their boss their Facebook password or something.

Witholding password

[Anonymous Coward]

What if you just plain forgot and didnt write it down?
yes its incompentent.. but thats why some people gets fired.

Oh, suddenly the admininstrators are important.. Paid them!

Keys

[Anonymous Coward]

The password for administrative access is (when combined with the user name) essentially the key for the system. If you worked for a construction company and took the keys to the dump truck when you left, it's just as wrong as taking away the key for the system. There's a side story of why there was only ONE administrator account without dual controls, but that's... another story :)

What passwords?

[WillAffleckUW]

I have no idea what you're talking about.

Oh, and that pic of your mistress? Priceless.

Be a shame if it ended up being mailed to all the news media ...