Get Smart about Business Spending
SF engineer to stand trial in hijacked network
A network administrator will stand trial for allegedly hijacking the network he designed and maintained for the city of San Francisco.
A superior court judge ruled Wednesday that there was enough evidence to hold Terry Childs for trial on four felony charges of tampering with a computer network, denying other authorized users access to the network, and causing more than $200,000 in losses, according to a report in the San Francisco Chronicle. Childs, who has been in custody since July 13, had worked at San Francisco's Department of Telecommunication Information Services for five years. Childs, 44, is being held on $5 million bail and is scheduled to be arraigned on January 13.
Childs is accused of tampering with the city's Fiber Wide Area Network after allegedly being disciplined for poor performance. He was also accused of electronically spying on his supervisors and their attempt to fire him.
Childs allegedly denied other administrators access to the system, which maintains law enforcement, payroll, and jail-booking records. Childs reportedly refused to surrender secret codes that would allow access to the system.
However, after a week in the city's jail, Childs agreed to give the access codes to San Francisco Mayor Gavin Newsom during a secret jail house visit. The meeting reportedly was so secret that the police department and district attorney were not informed of the meeting ahead of time.
Childs' attorney has claimed that there was no destructive intent and that Childs was merely protecting the network from incompetent city officials who were trying to force him out of his job.
"Mr. Childs had good reason to be protective of the password," Erin Crane argued in an unsuccessful attempt to lower his client's bail. "His co-workers and supervisors had in the past maliciously damaged the system themselves, hindered his ability to maintain it...and shown complete indifference to maintaining it themselves...He was the only person in that department capable of running that system."
Steven Musil is the night news editor at CNET News. Before joining CNET News in 2000, Steven spent 10 years at various Bay Area newspapers. E-mail Steven. 
Sounds like a pretty poorly designed system.
It's better then a heart attack or a criminal record.
Then again there maybe more to the story and the EFF needs to get involved.
"Terry, I'm sorry, but your performance hasn't been up to snuff."
He says "does this have anything to do with having to have someone at the left side of that bell curve?" His supervisor says "well...we do have to grade some people poorly as well as well."
"I built and run this city's entire network infrastructure! I work on weekends, and any time anything goes wrong, I am the one who can fix it! And you pay me what? $80,000 a year!"
"I'm not sure I like your attitude, Terry."
"I'm not sure I give a ****. You will not like having me as an enemy either. You will not like having no access to any of the systems I built. You will not like seeing what happens when you treat someone who is absolutely integral to the IT systems of San Francisco like an *******."
The rest is history. Can't really blame him for being hacked off or for taking his revenge. Would have been to his advantage to have done so in a way that didn't land him in jail, but still handed his idiot managers a heap of pain.
I can. He deserves whatever punishment that's given to him. He sounds like a prima dona. If he wasn't happy then he should have just quit. Anyone stupid enough to pull this stunt, couldn't have possibly been qualified for the job.
I can blame him easily. Disrupting communications that affects thousands and possibly millions of people is terrorism, and his refusal to reveal the passwords is extortion. There is no excuse for him using his fear of loss of control of a system to hold a city hostage. You are either young and naive or a possible recruit for terrorist organizations. You are not a person who understands the world we live in today. I mean no harm to anyone, but I will protect myself and my family.
Sadly this is one that wont be solved easily.. Its entierly possable he was 100% in the right to protect a system he had built from the ground up. It was his baby and like any mother protecting a child he sought to protect it.
I perosnnally lean twoards this, if i built something like this I would want to make sure it worked right, especially when others had in the past shown a willfull disreguard to respect the position to maintain and keep secure the systems.
What I find laughable is that no systems failed or had issue being used during this issue. Had he wanted to Disrupt the System he would have caused some failure somewhere.
It is possable as well that he was in the wrong and trying to cause problems and tried to hold the city hostage.. but once your caught like that.. you have little barganing room to "blackmail" and therefore your idea of him being a terrorist goes down the drain like the idea of WMD's in Iraq.
I am also in the belife that he figured out he would be fired and sought to cause some issues for his replacement in configuring and make the transition difficult and when the fan started to get dirty he told the mayor who was the top dog there maybe in his eyes.
I reserve the right to change my opinion pending new facts but, right now it leans mostly towards the dedicated worker who is just tired of some official causing hours to weeks of repair work and headaches because they did not follow established protocol or tried to go around him to get there pet project done.
I also reserve the right to be unreasonable for any reason.
The details here are too fuzzy for me to make an informed decision of what's fair and what isn't. Suffice to say, what isn't unclear is that he probably broke the law to accomplish his goal. That has penalties, regardless of the intent. Funny thing about being a martyr, they almost always end up punished to one extreme or the other. I admire many of them, whereas others were no more than ego driving opportunists.
Let's see how that trial goes!
HX
Where are the city's policies and procedures to protect the administrative passwords of its computer systems?
If Mr. Childs had passed away, the city may very well have had the same problem - except there would not be anyone to blame. In this case the city allowed a single point of failure to develop in its personnel.
[Content edited to remove prohibited spam.]
seriously people, $5,000,000 bail?
did he disrupt the system by not allowing someone else to access it? did the system ever shut down or have a failure during that time? how did they come up with the $200,000 in damages figure?
He should be prosecuted to the fullest extent, made to give up any control he had, and the CITY should be chided as an example of how not to have a contingency plan for failures like this.
Terry should have just left the passwords on his desk and walked out. Better yet, he should've given two weeks notice and coasted the last 2 weeks. If they didn't want documentation before his termination, he's not obligated to supply it after. After he was gone, someone would screw up the network anyway and his boss would be in very hot water. Terry could have moved on with his life and probably worked somewhere that treated him better. Instead, he's going to jail and will probably never work in IT again.
When the head of IT refused to deal with either the manager or the vendor, I walked.
I still have my sanity and my health.
The head of IT became a vice president at the company, and is still making bad decisions.
I won!
- by viatetsuo December 30, 2008 12:32 PM PST
- so let me get this right... only one guy had the access passwords\keys\rights? are you kidding??? It is a necessity to ensure that at least there is a hard copy of all access credentials store in some sort of secure storage with audit-able access control. can you imagine not being able to pay your taxes (or something network based) because there was only one dude who had access to fix the system and he's acting like an ass, or maybe he died? wow... just, wow.
- Like this Reply to this comment
-
-
- by frnkblk January 3, 2009 3:43 PM PST
- I've seen many small and large organizations where security credentials weren't properly backed up and distributed, and where cross-training was limited.
- Like this
-
(24 Comments)If there's anything the IT folk following this story should learn is that their own organizations should improve their password management and cross-training.