Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Networking IT

Accused Rogue Admin Terry Childs Makes His Case 397

angry tapir writes "He's been in jail for seven months now, but former San Francisco network administrator Terry Childs says he's going to keep fighting to prove he's innocent of computer crime charges. Childs was arrested on July 12, charged with disrupting the City of San Francisco's Wide Area Network during a tense standoff with management. Infoworld has also conducted an interview with Childs."
This discussion has been archived. No new comments can be posted.

Accused Rogue Admin Terry Childs Makes His Case

Comments Filter:
  • Equal Protection? (Score:5, Insightful)

    by houstonbofh ( 602064 ) on Wednesday February 18, 2009 @10:45AM (#26901695)
    "He's been in jail for seven months now,...

    I love our entire "Innocent until proven guilty" thing. Unless you are on the wrong side of the celebrity wagon. I bet Paris would be out by now...
  • by PrescriptionWarning ( 932687 ) on Wednesday February 18, 2009 @10:51AM (#26901763)
    or possibly he couldn't make bail because he's not as filthy rich as Paris
  • by Lumpy ( 12016 ) on Wednesday February 18, 2009 @10:55AM (#26901791) Homepage

    It has NEVER been innocent until proven guilty. that fairy tale is simply read to the children to make them smile.

    Every lawyer, and person that has even been exposed to the legal system knows. You're guilty, then you have to fight to prove your innocence.

  • by houstonbofh ( 602064 ) on Wednesday February 18, 2009 @10:59AM (#26901839)
    Kinda the point... "Bail" should be equally difficult for different people.
  • by Anonymous Coward on Wednesday February 18, 2009 @11:06AM (#26901925)

    Not going to comment on Child's innocence or guilt, but I have to wonder whether his lawyer is giving him good advice. I mean, giving an interview to the press which you discuss some case specifics doesn't seem like a very wise thing to do. Even though TFA was just a summary of the interview and did not contain a transcript of it, I'm guessing that the San Francisco prosecutor could subpoena the reporter to turn over a transcript, or recordings and any notes the reporter took to use against Childs.

    Giving an interview to the press really screwed over UK hacker Gary McKinnon, who's currently fighting an extradition order to be brought to the US to face charges breaking in to Pentagon computers. His interview by the BBC shortly after he was arrested basically was a full confession of everything he had done and left no wiggle room to create a case for reasonable doubt. The US prosecutor could base his case just on the BBC article alone and probably get a conviction. Of, McKinnon gave the interview before the US filed charges, I think, so he may have thought he was in the clear when the British authorities didn't file their own charges.

    Anyway, it just not a smart idea to give interviews to the press while facing criminal charges, and I'm surprised his lawyer let him do it.

  • by Dunbal ( 464142 ) on Wednesday February 18, 2009 @11:08AM (#26901945)

    he's going to keep fighting to prove he's innocent of computer crime charges.

          Well, good luck with that...

  • by xouumalperxe ( 815707 ) on Wednesday February 18, 2009 @11:08AM (#26901953)
    I'd say it's more like blowing away the presumption of functional law enforcement where IT is concerned.
  • by internerdj ( 1319281 ) on Wednesday February 18, 2009 @11:10AM (#26901977)
    Giving out the passwords could also lead to jail time. My personal password ties my account to me personally. Apart from all the potential abuses of international trade laws that could happen from my personal email if someone else had access, what if any one of those people put child porn on a rival's computer because they now had the keys? What if it was my computer? These people were willing to not only charge him in court for doing his job but also threw him under the publicity bus too.
  • by madcow_bg ( 969477 ) on Wednesday February 18, 2009 @11:13AM (#26902017)

    but even without those restrictions I'm not going to hand out my password to my
    boss, my boss's boss, or even the CEO of the company.

    I like my job, but preserving it comes pretty damned far behind "my freedom" in order of
    my priorities. Jail vs giving out the keys to the kingdom? "Would you like the portcullis
    up or down when you arrive, Mr. Barbarian?"

    Anyone who chooses prison over a job doesn't count as "principled", they count as an idiot.

    P and GP may be talking about the same thing. If I have assigned the keys to take care of the network, and more importantly am liable both morally and legally (morally is needed because of future employments, who knows), then it is plainly a good idea to keep them secret.

    However, if my boss or my boss' boss or the CEO asks to have them and most importantly signs a paper that request them, by god, just give it to the man. By having the command in writing you are covered in case something wrong happens with those keys.

    If no written order comes, how are they supposed to prove you denied them the request?

  • by Zontar_Thing_From_Ve ( 949321 ) on Wednesday February 18, 2009 @11:18AM (#26902069)

    Can you imagine even half of the network admins in the united states changing the passwords on their routers and shutting them down until Childs is released? Yeah, I can't either.

    I can't either, but probably for different reasons than you.
    1. Such actions could cost employers to lose money and might subject those responsible to criminal charges (quite possibly felony charges) similar to Terry Childs.
    2. Your suggestion fails to take into account that the legal system (judges, lawyers and police) is mostly comprised of people with extremely limited technical knowledge. Do you really want such people deciding whether you might have a point to this protest? I'm thinking "no". Also, the legal system might be seriously unimpressed with such stunts and look to make examples of everyone who engages in this kind of protest simply to keep it from happening again in the future. Remember, back in the 1980s that President Reagan told the air traffic controllers if they went on strike (which was illegal) that he would fire them all. They went on strike and he did fire them. Nobody in the federal government has been on strike since then.
    I read the articles linked to in the main post and I'm still unconvinced that Childs is a "victim". At best he's an idiot for not realizing that the passwords were not his to protect, they were his employer's. At worst he deliberately tried to sabotage the network and is now trying to weasel out of jail time and fines.
    Keep in mind that Childs himself now says it wasn't worth it. It doesn't take a rocket scientist to figure out that when your employers says "Give me the passwords" that you do that. It's not his job as a network admin to worry about what will happen to those passwords.

  • Re:legit modems? (Score:5, Insightful)

    by drinkypoo ( 153816 ) <drink@hyperlogos.org> on Wednesday February 18, 2009 @11:19AM (#26902073) Homepage Journal

    This article gives better reasons for those modems being on the network than previous stories. Doesn't seem so rogue now, does it?

    Did it ever seem rogue to people with actual technical experience?

    What it seemed to me was stupid. If people above you in the chain of command want to break the network and destroy your security, you have to let them. The only recourse you really have is to demand such things in writing and run them all through your boss. The worst they can do in such a situation is fire you. But your job is to do as you are told, and if they tell you to fuck it all up, then you can either quit or capitulate.

    It seems to me like Childs was trying to obey the letter of his job description, without fully considering the ramifications. Certainly he wasn't trying to take over the network - however dumb he might be, I certainly don't believe he's crazy enough to forget about cops and prisons. He surely didn't think that they would be wielded against him for these particular actions, but that was just dumb. Now the city is trying to do everything they can to justify their actions, so they're trotting out bullshit arguments against him (like allegedly holding information he shouldn't, or installing back doors - which frankly are not a bad idea if they are secure back doors. someone 0wns your network, it's nice to be able to get in!)

    Odds are, most of us will never know the truth. The only one who knows the full truth of Childs' intentions is himself, and most people aren't all that in-touch with themselves anyway. However, he's had a lot of time to sit and think about it.

  • Mmmmm... No. (Score:2, Insightful)

    by Concern ( 819622 ) * on Wednesday February 18, 2009 @11:20AM (#26902085) Journal

    I hate to say it, but these stories only reinforce for me that Childs is likely guilty.

    It seems even clearer that he really did keep passwords to himself, and when asked, refused to hand them over to his management.

    Management can ask for them (how can they ever replace a network admin, otherwise?) and they can ask you to hand them over to anyone they say. As Schneier says, they belong to your employer, not you.

    These articles imply that it's not "good practice" to give passwords out. If that's really his defense, it's specious and deceptive. If your boss demands a password, you have to give it, by law. If he demands you give it to another person, or 20 other people, you have to give it, by law.

    If they do something stupid with it, then maybe _they_ end up in jail. If you want, you can even try catching them at it, being a whistle-blower, help them along with that process. But that's _not_ your problem, as an admin.

    I just get the sense of a tense guy who had a personality conflict with his boss (who may have been an ass, or not), and who let his emotions carry him over into criminal conduct. At the most, there are some mistakes in ancillary parts of the charges against him (re. modems), which is unimportant to the main issue.

  • by Anonymous Coward on Wednesday February 18, 2009 @11:21AM (#26902103)
    Nice try, but that analogy/rebuke doesn't really work. Bail is intended to make sure people show up for trial, so it has to be adjusted for the relative impact it will have on the accused.
  • by SirGarlon ( 845873 ) on Wednesday February 18, 2009 @11:23AM (#26902127)

    That there's a network admin somewhere that has giant ethical nuts.

    Only if 100% of what Childs says is true. I'm not so sure I'm ready to believe him -- the circumstances of his confrontation with management suggests there may be layers to this story that aren't making it into the media.

  • by pla ( 258480 ) on Wednesday February 18, 2009 @11:27AM (#26902181) Journal
    Giving out the passwords could also lead to jail time. My personal password ties my account to me personally.

    It sounds like Childs had a pretty good clue about network administration - Meaning that he almost certainly didn't "run as root". He also had decent forewarning (most accounts describe this as ongoing for at least six months) that he could expect some bad mojo down the line, and could have taken appropriate steps to isolate his personal access from his professional access well in advance of the issue coming to a head.

    Now, if I absolutely had to surrender my personal account, I'd simply change the password to "password" first, and ASAP bulk-email everyone in my address list to say that ownership of my account had changed hands and future contact from that account would not come from me.

    Whether or not my employer owns "my" account, they sure as hell don't own my reputation.
  • by yttrstein ( 891553 ) on Wednesday February 18, 2009 @11:32AM (#26902233) Homepage
    As an employer, I'll let you in on something:

    The reason that punishment has been laid so strongly and swiftly down on Childs is directly because of the power of the position he held. He's being made an example in order to make sure that no other network admins get any bright ideas about exposing their feelings of real ownership and territory that every good network engineer has about their responsibilities (and equipment for that matter).

    As an employer, I hope the steps being taken against this man, no matter what his motivations were, are entirely unsuccessful. The world needs fearless and ballsy geeks a lot more than it needs spineless jellyfish who happily do whatever they're told *despite the ethics of it*. There's something deeply disturbing about so many giant brains have willfully given up control of (and responsibility for) their own actions and are all too ready to claim they were "just doing my job".

    Pardon my revulsion, but there are those of us who remember where that sort of outlook takes the species.
  • by HungryHobo ( 1314109 ) on Wednesday February 18, 2009 @11:36AM (#26902287)

    While at the same time I've seen arguments that it's right that the rich and powerful tend to get more when they sue newspapers and radio stations for defamation because they're more valuable people... I mean their reputation is more valuable.

    Lets go the whole hog!
    one rule for the rich, one for the poor!
    The lazy fuckers!
    Probably all criminals anyway!

    Hit someone while drunk driving? well since you're rich you're obviously more valuable to society, lets stack the odds in your favor so you don't go to jail!

    Speeding? well sure if you make more money in the 20 minutes you save getting to work than it costs you to pay for your speeding ticket then that's perfectly fine!
    It just makes economic sense for you to break the law then!

    Crime isn't the same as milk or eggs. It's not a comodity. Fines are supposed to be punishment so if a fine is too small to be noticed by one person or so big as to not fit the crime for another then it's not justice. Fines relative to your wealth make perfect sense in that context.
    If you get to avoid going to jail because of your daddies money then something is seriously messed up with your legal system.

  • by corbettw ( 214229 ) on Wednesday February 18, 2009 @12:00PM (#26902605) Journal

    My understanding of the case is they were asking for the router passwords, both login and enable (root). Not his personal passwords. There was no reason not to do so, the guy is an idiot and should've been fired on the spot. Letting him rot in jail for these past seven months is just overkill, though. They should let him go, it's not like he's likely to work in network security again, anyway.

  • Re:Interview? (Score:4, Insightful)

    by DavidTC ( 10147 ) <slas45dxsvadiv.v ... m ['box' in gap]> on Wednesday February 18, 2009 @12:02PM (#26902619) Homepage

    Can someone even explain what he's charged with and what his specific actions were?

    Refusing to do your job and inform management of passwords is not illegal. (It's pretty strange behavior, but not illegal.)

    The only thing I can glean from reading both links is 'three modems', one of this was a DSL one he didn't set up for testing and whatnot, one of them was to operate his pager, and one of them was to link the city's network in emergencies. None of them even vaguely look like backdoors, but, more important, none of them were used as backdoors to a system he had access to anyway. (You don't install secret backdoors in cabinets in your office.)

    I know Childs can't talk because his lawyers says not to, but there's a fucking document called a 'arrest report' that actually lays out charges against him and the specific actions he took that were in violation of the law. What are they?

    Googling throws a lot of nonsense around, including the fact they've charged him with supposedly planning to use a planned power outage to do something bad, when said power outage wouldn't have affected those system. (And what 'something bad' is very vague.)

    And, also, when the police search his house, they found weapons ammo. This is presumably relevant somehow.

  • by MarkvW ( 1037596 ) on Wednesday February 18, 2009 @12:03PM (#26902637)

    The presumption of innocence really works.

    The presumption of innocence is a rule that applies to criminal trials. All it means (ALL it means) is that the jury cannot convict you unless they find beyond a reasonable doubt that you committed the charged crime. Juries take this very seriously. "Every lawyer" knows that. Juries can be stupid, sometimes, but they very often are stupid on behalf of the defendant. In other words, if they're not sure then they cut the defendant a break. "Every lawyer" who actually does trials knows that, too.

    In the U.S., less than five percent of cases go to trial. That means that less than five percent of people ever test the presumption of innocence. Why? Maybe because they're guilty . . .

    Bail is a different issue. Judges have to assess danger to the community. Sometimes, people who can't make bail rot there before trial. Those people have a remedy, though. They can insist on a speedy trial. Most states have speedy trial rules just for that purpose.

    Mr. Childs probably isn't pushing for a speedy trial because the State probably has a strong case against him and he wants to build an effective defense. Defense takes time and preparation. So, I guess that Mr. Childs is sitting in jail (1) because the judge thinks he's a danger to the community; (2) he can't make bail; and (3) he needs the time to prepare his complicated defense.

    The presumption of innocence is not a fairy tale in the U.S. It is a plain reality.

  • Re:Power struggle. (Score:2, Insightful)

    by hobbit ( 5915 ) on Wednesday February 18, 2009 @12:07PM (#26902699)

    I do, because stealing something doesn't change ownership.

    If, however, I employ you to keep my car keys from me when I'm drunk, and you give them to me anyway, on the basis that I asked you to and I'm your employer, are you doing your job?

    Now, of course, this analogy breaks down because they fired him, so it wasn't his job to withhold passwords from them any more. But the question remains, was it his legal obligation to provide them?

  • by Mr. Droopy Drawers ( 215436 ) on Wednesday February 18, 2009 @12:09PM (#26902735)

    Why should it apply to taxation? Taxes are not a social program. It's designed to pay for government.

    Oh, and bail is refunded if you show up for court.

  • Comment removed (Score:5, Insightful)

    by account_deleted ( 4530225 ) on Wednesday February 18, 2009 @12:26PM (#26902925)
    Comment removed based on user account deletion
  • by Anonymous Coward on Wednesday February 18, 2009 @12:33PM (#26903031)

    The problem, if I may say so, is the fact that the USA have an adversarial legal system: specifically, the prosecutor and the police are not interested in finding out the TRUTH, they are interested in making sure you're found GUILTY, no matter whether you ACTUALLY are or not.

    Change this, and things will change for the better, although it'll also require you to slaughter certain holy cows, like the notion that everyone, from judges to prosecutors to police chiefs, should be elected by the people.

  • By Law? Sources? (Score:5, Insightful)

    by hellfire ( 86129 ) <deviladv.gmail@com> on Wednesday February 18, 2009 @12:36PM (#26903087) Homepage

    What law says "you must hand out a password to your boss when he requests it or you will be prosecuted as a felon"?

    The lawyer in the referenced articles has stated "The response to suspend him was arguably legal. The response to prosecute him is not." That means, if you don't give up a password, you can be suspended or fired, as you could be in any job, but that doesn't mean you can be prosecuted. If you use those passwords for nefarious means after you are fired, then yes you can, but so far the articles don't point to anything Child's did. There have been some wild claims, but InfoWorld has a special report page [infoworld.com] with articles that seem to call into question the accusations that are being leveled at Childs.

  • by Sycraft-fu ( 314770 ) on Wednesday February 18, 2009 @12:45PM (#26903191)

    Courts are. Seems many people on Slashdot misunderstand the whole "Guilty until proven innocent," thing. What that is, is a simple way of stating how burden of proof works in our court system. In US courts, the defense isn't required to prove anything. The defense can present no case at all and the defendant can still go free. The reason is they have no burden. The burden of proof is on the state, the prosecution. They have to prove that the defendant is guilty. So they can't just walk in and say "We accuse the defendant of doing X," and leave it at that. They have to present evidence to prove their case. Thus by design a defendant in court is presumed innocent. Proof of guilt must be offered because a not guilty verdict the the default in absence of proof.

    That's all it means. It is just a simple way of summing up our court system. It is NOT a command to the population at large. Individuals are free to believe what they wish, and use whatever standard for evidence they wish. People aren't required to view everyone as innocent until proven guilty in a court of law. They are welcome o hold opinions as they see fit.

    So please, but the crap with this. If you think the guy is innocent, or wish to reserve judgment until later, that's wonderful. If others don't, that's also fine.

  • Pretty much (Score:4, Insightful)

    by Sycraft-fu ( 314770 ) on Wednesday February 18, 2009 @12:51PM (#26903289)

    People always need to remember you don't own the stuff at work, the company does. Thus it isn't up to you to decide what goes on with it, it is the company's. That means if they wish to make a bad decision, they can. If the owner decides that the root password should be "password" and further that it should be posted on the wall, well that's his decision. You can and should tell him why that's a bad idea but if he says "I don't care, do it," then it over. You can't tell him no, because it isn't your stuff, it's his stuff. You can, of course, quit (and I probably would in that situation), but you can't just refuse and say "It's for your own good."

    Now in the scheme of a large company where you don't deal directly with the owner, it is still the same thing. Whoever their designated representative is, makes the decisions. So if you are given a stupid order you tell your boss it's a bad idea. He says do it anyways you go up to whatever level is appropriate (IT supervisor maybe, CEO maybe) and make your concerns known, but you do your job. If they want to be dumb, they can be dumb. Not your place to tell them they can't, and indeed it can be illegal.

  • Hello from Texas (Score:5, Insightful)

    by jeko ( 179919 ) on Wednesday February 18, 2009 @12:57PM (#26903369)

    It also stems from the fact that we don't lock up innocent people in the western world.

    Thanks. I just sprayed coffee all over my keyboard. Let me try this in a dialect you might understand.

    Son, not only do we lock up innocent people here in the US but, Hell, in Texas we've condemned men to die when their defense attorney didn't even show up in one case, or showed up too drunk to stand straight in another. Up there in Yankeeland, they just caught a judge getting commissions from the prison for sending kids to jail.

    Pound for pound, we lock up more people than the Russkies and the Chicoms COMBINED ever did. What, you think they're all guilty? You think Americans are just that much more sinful than all them godless heathens combined?

  • Re:Mmmmm... No. (Score:4, Insightful)

    by Quothz ( 683368 ) on Wednesday February 18, 2009 @01:12PM (#26903581) Journal

    These articles imply that it's not "good practice" to give passwords out. If that's really his defense, it's specious and deceptive. If your boss demands a password, you have to give it, by law.

    What law? In this case, the State's trying t'use "disrupting computer services", which is a California-specific law. From a look at the text [nsi.org], it looks like you only must give the password to your boss if he or she is "authorized" to have it. I'm assuming the charges are based on:

    (5) Knowingly and without permission ... causes the denial of computer services to an authorized user of a computer, computer system, or computer network.

    The question is whether his bosses were "authorized". If they -aren't-, it's criminal to give them the passwords, under the same section. Tricky. This is a government network in question, so the matter of authorization may not be clear. I have trouble with the scenario in which the police CIO, a military information defense worker, a couple of engineers, and especially a human resources rep would have authorization for administrative control of the city's network without a city policy-level decision being made at the mayoral or legislative level.

    Even in a business environment, the question of authorization can be sticky, and again is best-handled by a top-level policy decision.

    Other states have different laws; check your local listings. There's no universal law I'm aware of that says your boss has the right to any passwords. Quite the opposite, in California; if you give it up to your boss on demand when he shouldn't have it, and hijinks ensue, you could theoretically be prosecuted. I've trouble picturing that actually happening, but it clearly is not the case that you have to hand it over on request.

    As a layman, it looks to me as though Childs was correct in refusing to give out the passwords (although I'm not familiar with any relevant city policies granting authorization, again I'm pretty darned sure the HR guy isn't supposed to have 'em). Giving out incorrect passwords was a bad move, but easily attributed to the pressure of the surprise party.

  • by mkcmkc ( 197982 ) on Wednesday February 18, 2009 @01:26PM (#26903775)

    In the U.S., less than five percent of cases go to trial. That means that less than five percent of people ever test the presumption of innocence. Why? Maybe because they're guilty . . .

    A little research will uncover the answer. Say the police break down your door one early morning, shoot your dog, and cuff you and your family. They have an informant that says you're involved in the meth trade. They take it to the DA, who can see it's bullshit, but DA's are measured in pleas and convictions, so he offers you a plea. You can cop to some minor class-D felony and three months in county. Or you can take it to court and put yourself at the mercy of 12 random citizens and/or a judge. Win or lose, you're out your job, your house, quite possibly your spouse, and your life savings. (Not to mention other details not suitable for this family publication.)

    If you've got any sense at all, you take the plea. Why? Maybe "because you're guilty...".

    That's how the presumption of innocence really works.

  • by Vancorps ( 746090 ) on Wednesday February 18, 2009 @01:26PM (#26903781)

    It doesn't sound like you are involved in network administration if you have such strong opinions about router access which is not something everyone should have access to. There are definitely a few types of devices where it does no good to give higher ups access because the only thing they can do with it is screw it up.

    City managers were clearly screwing up as they should have had to at least two admins and both of the admins would then have the login information available to them. Some random Joe should not be logging into my router anymore than I should be monkeying with a nuclear reactor. If you're not trained on the hardware then you shouldn't be working on it in a production environment.

    Childs' reaction was definitely in the wrong so there is clearly wrong on both sides but his manager clearly wasn't handling security seriously and had no business asking of Childs' what he did. I don't give my boss my personal passwords either nor does anyone in the company get access to personal passwords as there is no need.

  • by Civil_Disobedient ( 261825 ) on Wednesday February 18, 2009 @01:28PM (#26903803)

    I take it you don't have a mortgage.

    Or children.

  • Re:Pretty much (Score:3, Insightful)

    by Vancorps ( 746090 ) on Wednesday February 18, 2009 @01:38PM (#26903929)

    Where do people get this impression that the company owns everything you do?

    This is simply not true by default in the U.S. legal system. It properly does vary a bit from state to state but for the most part things like email are owned by the employee unless specifically stated and agreed upon before employment began.

    When you're in IT some things get gray real fast. For instance, my title is network engineer. I write a lot of my own scripts to automate tasks. That code is mine because the company isn't paying me to write code. Our programmer is of course under different restrictions based on who's equipment he's using. Of course it's further grayed by the fact that we both often use our own equipment on company time because it suits a particular need at the time. The issue is quite muddy then on who's is what as far as coding goes.

    Things like root passwords should be locked in some sort of safe somewhere in case of emergency but personal passwords should never be stored for any reason and they can't require you to give it up although they can certainly change it anyway and impersonate you despite not giving up passwords. In the end its all about principle.

    I half agree with you and half disagree. If a non-technical executive is giving you technical orders then disregarding is often the best policy. The owner of my current company wanted full admin access to all the files on the network. I knew this was inherently dangerous as he in the past has accidentally deleted over 200gigs of content while his computer wasn't behaving at home. Instead I built him a file-server and copied all the data over to it and gave him full access to that so he can't harm production.

    There are situations where you do have to give in but in most situations I've ever been in at least standing your ground does a lot more to change things than just bending over and letting an idiot decide password should be the root password.

  • Re:Pretty much (Score:2, Insightful)

    by The Notorious ASP ( 628859 ) on Wednesday February 18, 2009 @01:45PM (#26904027) Journal
    Except in a public company, the final word isn't work the IT supervisor (or even CEO) - it's with the shareholders.

    The correct answer (and what I have done in the past) is to call internal audit and run it past them. When it bubbles up that not having controls around powerful accounts is going to show up as an exception on your SEC filing the tune will change.

    It is everyone's responsibility, network admin up to CEO, to protect the stakeholders.
  • by pla ( 258480 ) on Wednesday February 18, 2009 @01:51PM (#26904091) Journal
    How do you balance this individual need against an organizations's need for continuity of operations in the event of your death or incapacity to perform work?

    A well-defined procedure already exists to handle that possibility - You write all the root-like passwords on a card, possibly with some level of instructions on where and how to use them, seal it in an envelope signed across the flap, and deposit it in (on of) the company's safe deposit box(es).

    If the "wrong" people have access to that, then a company has much bigger problems than mere network security.

    As that concept applies in this particular instance - It sounds like Childs should never have had sole possession of the router passwords in the first place, so do we blame him or his superiors for that? And as for his "superiors", it sounds like the chain of command here remains very much in question, with only one person involved (other than Childs), his immediate boss, having any clear "right" to those passwords.
  • by jeko ( 179919 ) on Wednesday February 18, 2009 @01:57PM (#26904177)

    ...against plea-bargaining.

    In the U.S., less than five percent of cases go to trial. That means that less than five percent of people ever test the presumption of innocence. Why? Maybe because they're guilty . . .

    Amazing. You just asserted that presumption of innocence is a reality, and in the same breath insinuated all people who go to trial are guilty. If Einstein was right, and genius is the ability to hold two contradictory ideas in your head at the same time, then your mental acuity is astonishing indeed.

    The whole point of plea bargaining is to reduce the number of cases that go to trial. Plea bargaining works because you can't predict the jury's decision with certainty. If you look at the possible outcomes of plea-bargaining, it guarantees innocent men will end up in prison.

    Suppose you're innocent. Suppose you're innocent, but unlucky, and the circumstances make you look guilty. Suppose you're an unpopular minority. Suppose you pray to the wrong god. Suppose you're just ugly. Suppose you just look like "that type." Suppose you don't come from around here. Suppose you've never caught a break in your life. Suppose there are any one of a million reasons why twelve random people off the street could drop you in a hole without any good reason and not lose any sleep over it.

    Suppose you have children. Suppose you have family who depend on you. Suppose The Authorities come to you and tell you, "Boy, you don't push us on this, and we'll let you out in a couple of years. But if you make us go all the way, we'll make sure you don't ever see the light of day again, and when we put you in jail, we'll make sure Bubba is waiting for you with a dress."

    Take a random sample of a thousand innocent men, and sure, some of those men will have the moral courage and fortitude to tell you to go to Hell and take me to trial. Some of those men will lack that courage, and take your bargain out of fear. Most of those men will run a quick and dirty risk/reward calculation in their head, and realize that the best option is to take the deal -- because that's how you arranged it.

    Plea bargaining is a foul and filthy practice that guarantees a miscarriage of Justice in a certain percentage of cases. That's why not every Western nation allows it.

    But your arguments have nothing to do with the facts -- they have to do with your fears. It's terrifying to live in a world where innocent men can routinely go to prison. It's terrifying to live in a world where going to prison means a good chance of rape and brutality. It's terrifying to live in a world where the authorities actually use that threat of rape against you without conscience. It's terrifying to live in a world where any random mouth-breathing high-school-droput with a badge can destroy your life with trumped-up evidence. It's terrifying to live in a world where you can hear cops threaten to club children, where you hear cops threaten to plant fake drug evidence against teenagers, where you see cops shoot prone and begging men in the back...

    It's terrifying to live in a world where simply browsing YouTube can give you video evidence of all of this.

    So, your cognitive dissonance blasts away at full force, and you tell yourself innocent people don't go to jail because anyone who goes to jail is not innocent. You pillow your head on that circular logic, and while you dream you live in a pretty and just world you make it that much harder for the rest of us to fix the problems...
           

  • by Korin43 ( 881732 ) on Wednesday February 18, 2009 @01:58PM (#26904193) Homepage
    You're missing the point. Why does the court have to assume that people are innocent until proven otherwise? Because it makes sense. If the police arrest someone, you should wait until they actual present their case to decide if the person is guilty. Sure, there's no legal requirement for you give people a chance to defend themselves, but if you don't, you're still a douchebag.
  • by DancesWithBlowTorch ( 809750 ) on Wednesday February 18, 2009 @02:06PM (#26904271)

    That's all it means. It is just a simple way of summing up our court system. It is NOT a command to the population at large.

    You are painting a pretty bleak picture of this society. Of course everyone is free to believe whatever they want. But in a civilised society, under the rule of law, we like to let the law rule. That includes giving every man a chance to state their cause in court before judging them. That is indeed a "command to the population at large", although a moral one, not a legislative one.

  • Re:Pretty much (Score:3, Insightful)

    by mrchaotica ( 681592 ) * on Wednesday February 18, 2009 @02:14PM (#26904389)

    If the owner decides that the root password should be "password" and further that it should be posted on the wall, well that's his decision. You can and should tell him why that's a bad idea but if he says "I don't care, do it," then it over. You can't tell him no, because it isn't your stuff, it's his stuff. You can, of course, quit (and I probably would in that situation), but you can't just refuse and say "It's for your own good."

    You know, this is exactly why professions other than IT have professional licensing. For example, a civil engineer could refuse his boss's request to design an unsafe structure. In fact, he's obligated to refuse, because to do otherwise would get him kicked out of the ASCE and sued. Ditto with doctors and lawyers.

    Now, why doesn't IT have something equivalent to this??

  • by Curtman ( 556920 ) * on Wednesday February 18, 2009 @03:12PM (#26905319)
    <insert obligatory whooshing sound here>

    But anyway, I heat my home with natural gas supplied by the government owned distributor, power my devices with power from the government owned electrical utility. Until about 10 years ago I had telephone service from the government telephone company, and bought gas for my car from "Petro Canada", the federal government's own retail gas chain (which they since sold off and privatised). Private hospitals are illegal here, you have to go to the government run free hospital unless you cross the border and have money to burn.

    Maybe we're in a grey area somewhere outside of socialism, but most of us see those policies as being socialist, and most of us support them. If you even mention allowing private hospitals here in a public place you're bound to have a mob of people loudly tell you otherwise.
  • by MightyMartian ( 840721 ) on Wednesday February 18, 2009 @03:48PM (#26905939) Journal

    But more seriously wow. I had only heard about this in passing, and didn't know the details. What is an IT person supposed to do? They hire him to be in charge of the network and then ask him to hand out root passwords to anyone important in the city government. At my job they make us swear on everything holy to not give our passwords or pins to ANYONE and probably would have us shot as a penalty if they could get away with it, but even without those restrictions I'm not going to hand out my password to my boss, my boss's boss, or even the CEO of the company.

    I think a lot of it would depend upon your company's policies. If it's clearly laid out that for you turn over highly sensitive information like root passwords, there has to be some official requests/paperwork/records (which is the way it should be, though I've never worked with such a policy clearly stated), then you're right. However, if you're like a lot of us, without such a formalized process, then it becomes more problematic.

    If my boss (who is co-owner in the business), right now, showed up at my door and demanded the root passwords to our critical VPN and file servers, well, I doubt very much I would have a legal leg to stand on in denying the request. What I would do at that point is ask that a waver been drawn up and signed by both of us with a witness clearly stating my concerns at the release of such information, so if the shit hit the fan, it wouldn't be my ass.

    If my boss were just a manager at some level, then I would pretty much require someone much higher up okayed the request, and again, I would want a waver making my concerns and/or objections known.

    Of course, if the person demanding it is, say, the Mayor, and I was head of the city's IT department, then I doubt very much I would have a legal leg to stand on, and going as far as Childs did is just inviting a legal catastrophe for which I suspect he has only begun to feel the pain from.

    One thing it does drive home, and one thing I am going to discuss with my boss is a clear policy on who, when and how critical security information can be released. It really is for both my benefit and the benefit of my employer.

  • by Toonol ( 1057698 ) on Wednesday February 18, 2009 @03:51PM (#26906011)
    No, they're morons if they're positive he's guilty. Thinking he's guilty is a reasonable conclusion based on what evidence they've seen... so long as they remain open to revising they're view as more is learned.

    People aren't courts of law, and we would not be able to function if we were held to legal standards of proof in all our beliefs and decisions.
  • by rgviza ( 1303161 ) on Wednesday February 18, 2009 @05:21PM (#26907467)

    You mistake the original intent of taxes, with the current use of taxes. It's a common mistake for democrats.

    And bail is not a social program. You got it backwards. Don't worry, we forgive you. Bail is supposed to be set by the potential danger posed to the community by the perp and the severity of the crime. Since this guy isn't likely to get his job back, this is 0 risk. He also didn't do any damage.

    And the fact that bail is refunded when you show up doesn't help you if you can't produce the funds when you need the bail ;)

    This guy is getting screwed by people simply because they are pissed off. It's pretty unprofessional of the prosecutor and judge to set bail that high. You could be a cop charged with murder and get and get a lower bail, like this guy http://www3.signonsandiego.com/stories/2009/feb/06/ca-train-station-shooting-020609/?zIndex=49309 [signonsandiego.com].

    That's also a betrayal of trust. Murderers routinely get $1m bails.

    This guy is getting f**ked.

  • by rantingkitten ( 938138 ) <kittenNO@SPAMmirrorshades.org> on Wednesday February 18, 2009 @05:37PM (#26907705) Homepage

    For the day to day legal BS average people are likely to encounter the situation is just as bad. I doubt the police are going to break down my door and accuse me of running a meth lab, but let's look at something as common as traffic violations.

    Your court date will roll around and you'll plead not guilty. A trial date will be set, meaning you'll have to schedule your life around that, and try to get a lawyer to help. The average person isn't expected to fully understand the law, because it's so nuanced and convoluted, which is why defense attorneys with years of specialized training exist. The average person is expected to fully abide by the law he doesn't understand, though, which may suggest a problem with the system, but nobody will question it during this process.

    On your trial date you'll speak to some self-important prosecutor or solicitor who acts on behalf of the government. He'll treat your minor case like it's the crime of the century. Depending on your demeanor he may offer a deal of some sort, which usually entails you pleading guilty to a somewhat lessor offense. What he probably won't tell you is that if you reject this offer, and make him go through the hassle of an actual trial, he'll push for the maximum possible punishment the law allows, regardless of any circumstances up to that point, because he doesn't want to do more work.

    This is justice in America.

    If you take his deal, you've just pleaded guilty to an offense you may not have even committed, and is probably something so stupid no one should care even if you did do it, but you're intimidated into the plea by his legal jargon and the fact that, as an average Joe, you don't have the time, money, or resources devoted to fighting it. You'll pay a few hundred dollars in fines and be on your way, with an arrest record, a criminal history, and completely out the hundreds you spent for the bond, the fine, the impound, the attorney, and anything else. The state will pat itself on the back for a job well done for cleaning up the mean streets of dangerous scum like you.

    If you don't take his deal you'll be put on trial. For minor offenses you may not even get a jury of twelve average Joes who will sympathize with you; the state has found a loophole and called this an "administrative matter", meaning you'll get tried by a judge, who will claim to be impartial but is on the state's payroll and has a vested interest in making sure things turn out in the state's favor, not to mention his clouded view of every person who appears before him as a criminal.

    The judge will ignore everything you say, and your attorney will be mostly powerless since the time for deal-making is over and all he can do is try to object to the prosection's evidence. There will be little evidence to which he can object, though, since for most minor offenses there aren't any significant witnesses or material bits of evidence. Nothing but the policeman's word and charge on the books, often, and this will be taken as wholly sufficient to pronounce you guilty, whereupon you'll pay a huge fine, face possible jail time, and be in worse shape than you had you just meekly submitted instead of trying to assert your right as an American to a fair and impartial trial.

    If you're very lucky, you may win your case and be pronounced "not guilty". You spent time in jail, have an arrest record, paid a pretty penny to bondsmen and lawyers and impound lots, had to take time off work, stressed the hell out of yourself dealing with this. Thousands of dollars later the state will send you on your way without so much as a "sorry about the trouble".

    This is justice in America.

    Create thousands upon thousands of arbitrary, meaningless laws which serve no public good, which citizens can't keep track of or reasonably comprehend, then leap out from behind the bushes to scream "GOTCHA!" when they may break one, rubbing your hands with glee that you can extract more money from the citizens. Punish them for daring to question the authority of the state. That's justice in America, and when you create laws just for the purpose of turning otherwise normal people into criminals, you cause them to lose all respect for the law.

    I did, long ago.

  • by AK Marc ( 707885 ) on Wednesday February 18, 2009 @09:06PM (#26910863)
    Wow sounds like you're against presumption of innocence (outside of court). Lets hope you're never falsely arrested or framed for child porn. Get off. And have everyone believe you were guilty and only got off because of a technicality, ruining your life for something you didn't even do. And then make a Lifetime movie out of it.

    That happens whether I believe in presumption of innocence or not. So why is my personal belief in that an issue?

    I'm not saying that Childs doesn't have an axe to grind, but to assume he's guilty of maliciously screwing with what he was hired to maintain on circumstantial evidence is weak and unfair.

    Non sequitur. I'm talking about the presumption of innocence. It's a legal instruction, not a moral imperative. I think Childs is not guilty of any crime. He's not been accused of any crime that he had the opportunity to commit. There is no assertion that he accessed the network without permission, nor that he took any action that degraded its performance. The worst thing he did was to say "no" to a former employer. But for Hans Reiser, I thought he was guilty the first time I heard anyting about the case. His statements and actions were aligned with that of a guilty person. There was evidence pointing to him, and little pointing elsewhere. I said so on here multiple times, and people responded with the "you have to presume him innocent." Hell no. He most likely did it, so I can voice my opinion that he's the most likely to have committed the murder (and that it was murder, since she was just "missing" at the time). I don't have to presume innocence. I get to take in all the information available and make a logical determination. It's most likely that Hans did commit murder. The same is true of how I evaluated OJ. He most likely did it. They weren't able to get a guilty verdict like they did with Hans, but I have less than a reasonable doubt that O.J. Simpson committed murder. It doesn't matter that all the information for both OJ and Hans was circumstantial.

    Most cases have almost all the evidence being circumstantial, and circumstantial evidence is more reliable than things like eye witness identification of strangers. Finding the body under your house with your bloody fingerprints all over it, the gun, registered in your name, next to the body with a note that says "I did it" with a photo of you and bloody footprints from the body to the shoes that are on your feet as you sit on the couch typing on Slashdot when the police bust in your door. Oh, and you have gunshot residue on your hands. And you told someone yesterday you were going to kill her that night, with a gun, while wearing your favorite Nikes and leave a picture of you next to her with a note that you did it. And that's all still "just circumstantial." Would you think that person innocent? Or might you think they probably did it?
  • by A nonymous Coward ( 7548 ) on Wednesday February 18, 2009 @09:29PM (#26911077)

    I was not arguing homeless vs rich, only normal vs rich. It is ridiculous that Childs has spent 7 months in jail, no pay, expenses mounting. That is where the discrepancy lies. He is being punished for being neither rich nor stone broke.

He has not acquired a fortune; the fortune has acquired him. -- Bion

Working...