Slashdot Mirror

← Back to Stories (view on slashdot.org)

Withhold Passwords From Your Employer, Go To Jail?

Posted by Unknown on from the bad-plan-with-expected-results dept.

ericgoldman writes "Terry Childs was a network engineer in San Francisco, and he was the only employee with passwords to the network. After he was fired, he withheld the passwords from his former employer, preventing his employer from controlling its own network. Recently, a California appeals court upheld his conviction for violating California's computer crime law, including a 4 year jail sentence and $1.5 million of restitution. The ruling (PDF) provides a good cautionary tale for anyone who thinks they can gain leverage over their employer or increase job security by controlling key passwords."

3 of 599 comments (clear)

  1. Back when I admined systems ... by PPH · · Score: 5, Interesting

    ... passwords were in a sealed envelope in my desk drawer, locked. That way, if I got hit by a bus, the boss could break into the desk and hand envelope over to my replacement.

    When I left, I handed him the key to my desk and said, "You know where they are."

    --
    Have gnu, will travel.
  2. Re:Passwords are property of the employer by EdIII · · Score: 5, Interesting

    I think that is a very dangerous precedent for intellectual property though.

    It's most assuredly very different than walking out with the physical hardware. It still exists. It's still in the hands of the owners. The challenge is that the device is storing a piece of information that only that single person is aware of. For whatever reason.

    Your viewpoint is dangerous because it's easily possible to forget that shared secret between you and the devices. Trust me. Very easy to do. I've done it. I've been asked about passwords long after I stopped working for someone. Since I make it a point to write them down securely and not remember them, it was no surprise that I didn't. I shredded/deleted the documents too, so there was no way to retrieve them.

    I don't think forgetting or refusing should ever be criminalized since in many cases you cannot truly tell which one it is. Why should I go to prison because I can't remember something that they were too stupid to have written down by policy while I was working there, and too stupid to ask about it during the exit interview or when the contract was done?

    This case was different. He admitted to not only setting it, but doing it for a specific purpose. Focus on that and don't start messing up understanding of intellectual property in such a dangerous way.

    Please. You won't like the world that gets created with those ideas. Not one bit.

  3. Re:Passwords are property of the employer by erroneus · · Score: 5, Interesting

    Oh... and it did NOT shut down the city. Go back and read the original story. What it did was leave the city management in a situation they didn't know how to handle... and still don't. They wanted it easy, didn't get it and they got angry and abused their powers to seek retribution.

    I said it previously and I'll say it again. If this guy died instead of being fired, they would face the EXACT same problem but without the recourse of being able to persecute. But I hold that in either situation, the response should be the same. Setting about the task or regaining control over the systems.