| [ Main Page ][ First New ] |
Posted by Krux
on Tuesday July 22, 2008 @ 09:29am|
Posted by Krux
on Tuesday August 5, 2008 @ 02:03pm >> [ reply ][ rating +1 ] A good follow up article on Terry Childs and what happened: Sorting facts from fiction in the terry childs case "Any sufficiently advanced technology is indistinguishable from magic." -- Arthur C. |
|
Posted by Stealth
on Wednesday August 6, 2008 @ 06:16am >> [ reply ][ rating +0 ] A good follow up article on Terry Childs and what happened: Sorting facts from fiction in the terry childs case Good article. Interesting technical notes. I hadn't know about the router config issues or the other stuff past the mayor thing.. I lost track of following the case. It's a shame they blew up on with him with all the drama.. but then again, it's a government, not surprised. This is what happens when no tech people try to make cases and glame up a bunch of press. |
|
Posted by Krux
on Wednesday July 23, 2008 @ 05:41pm >> [ reply ][ rating +0 ] From my boss: This has turned into an international spectacle. It's doubtful the media is reporting the full story or knows the full story. Anecdotally, I've heard the request for a reduction in bail was denied. How they are going to prosecute this case is beyond me since the network seems to have remained operational, the exclusive administrative privilege seems to have been in place for months, and his management was aware of the situation. Yes, if your chain of command asks you for the password, the only correct answer is to say yes and provide them. However, his management should have never allowed the situation to reach the state where only one person had the keys to the kingdom, they probably could have handled this much more diplomatically, and finally, I'm failing to see how this could result in a criminal charges that can be successfully prosecuted. Somehow I doubt the first sentence in the article is an accurate quote. S.F. mayor gets keys to city's computer (07-22) 18:11 PDT SAN FRANCISCO -- "The first thing I want you to know, Mr. Mayor, is that when you walk out of this room, you will have the computer codes." Those words - delivered to Mayor Gavin Newsom by imprisoned city computer tech Terry Childs in a small, fourth-floor room at city jail Monday - signaled the beginning of the end of the weeklong standoff in which San Francisco officials found themselves in the embarrassing position of being locked out of their own computer system. Childs - whom some have described as a friendly, hard worker at the city Technology Department, and others have labeled an over-the-top control freak - has been sitting in jail since July 13 on $5 million bail, after being arrested for reconfiguring key passwords in the city's computer system. A team of code crackers brought in from Cisco Systems had been working around the clock to try to decipher Childs' codes, but with only marginal success. "It wasn't cheap and I just couldn't see us keep spending that kind of money," Newsom said. Then, out of the blue, Childs' lawyer, Erin Crane, called the mayor's office Monday afternoon, offering a jailhouse meeting. Childs, according to the lawyer, was ready to give up the codes - but only to the mayor, who had gone out of his way in his public comments not to portray Childs as some sort of monster. Newsom didn't hesitate. Without asking the city attorney for an opinion or giving a heads up to police or the district attorney, he was at the Hall of Justice in half an hour. With Crane by his side, Childs told Newsom about the computer system he'd set up and how all the current problems sprang from a series of misunderstandings. Crane didn't let him go on for too long, and Childs got to the business at hand, asking for a pen. He then wrote out a very long computer code. "This better be right," Newsom said. "It is," Childs assured him, but asked the mayor to deliver it in person to the Cisco specialists - not to the city's computer brass. Newsom took the code to the city computer center and gave it to a Cisco techie, who found that it didn't work - prompting a call-back to Crane. "He said you would be calling and you would be upset," the lawyer said. "He forgot to give you the protocols to go along with the code" - and she read the accompanying computer prompters to the mayor over the phone. By Tuesday morning, the system was back in the hands of the city. "When life gives you lemons, you run into a school with a gun and grenades and start shooting people..." -- rb |
|
|
|
Posted by voltaic
on Wednesday July 23, 2008 @ 09:23pm >> [ reply ][ rating +0 ] How they are going to prosecute this case is beyond me since the network seems to have remained operational, the exclusive administrative privilege seems to have been in place for months, and his management was aware of the situation. Yes, if your chain of command asks you for the password, the only correct answer is to say yes and provide them. However, his management should have never allowed the situation to reach the state where only one person had the keys to the kingdom, they probably could have handled this much more diplomatically, and finally, I'm failing to see how this could result in a criminal charges that can be successfully prosecuted. Google "california computer law". CA Penal Code 502.c.2 and 502.c.5 read: 502. (a) It is the intent of the Legislature in enacting this section to expand the degree of protection afforded to individuals, businesses, and governmental agencies from tampering, interference, damage, and unauthorized access to lawfully created computer data and computer systems. (c) Except as provided in subdivision (h), any person who commits any of the following acts is guilty of a public offense: (2) Knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network. the above would apply to his accessing other peoples' emails; and subsection: (5) Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network. would apply to the internal "administrative DoS" (for lack of a better term). These two actions both have the following penalty per count, and if I was a prosecutor I'd make each instance of the city's authorized request for the passwords/protocols a distinct charge: (d) (1) Any person who violates any of the provisions of paragraph (1), (2), (4), or (5) of subdivision (c) is punishable by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in the state prison for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment. Incidentally, that paragraph (h) exception will definitely not apply in this case: (h) (1) Subdivision (c) does not apply to punish any acts which are committed by a person within the scope of his or her lawful employment. For purposes of this section, a person acts within the scope of his or her employment when he or she performs acts which are reasonably necessary to the performance of his or her work assignment. And so let's look at legislative intent on sentencing: (k) In determining the terms and conditions applicable to a person convicted of a violation of this section the court shall consider the following: (1) The court shall consider prohibitions on access to and use of computers. (2) Except as otherwise required by law, the court shall consider alternate sentencing, including community service, if the defendant shows remorse and recognition of the wrongdoing, and an inclination not to repeat the offense. Hmm, yeah his entire act pretty much was a prohibition on access and he's not so much with the remorse, so homeboy's hating life come sentencing. Naturally there are all kinds of civil codes violated as well, but the above is just the criminal part. Well, this is by far the least painful (and cheapest) thing I've done for a broad. ha ha ha... it only goes down hill from here... -stealth |
|
Posted by Stealth
on Wednesday August 6, 2008 @ 06:09am >> [ reply ][ rating +1 ] But do you think he deserves/deserved a harder sentence then a drug dealer? A murder? Those guys get less bail and are out sooner. It seems that computer crimes always seem to bring about crazy high sentencing times, fines, etc. To me, it seems over rated. He had access to their mail by the nature of their job, the same way I do as a mail server administrator. You cross into different laws when you read the mail without reason, but in my case, even that is covered under monitoring, as long as I don't target one individual for no reason. The DoS.. sure.. that one might fit. But it was way blown up. |
|
Posted by voltaic
on Wednesday August 6, 2008 @ 01:14pm >> [ reply ][ rating +0 ] No, I agree that laws concerning sentencing are a bunch of BS in many cases. Look at marijuana laws as well. That said, this guy is a self-important computer asshole who is a criminal and should be fairly tried and pay whatever penalty is laid out. Well, this is by far the least painful (and cheapest) thing I've done for a broad. ha ha ha... it only goes down hill from here... -stealth |
|
Posted by Stealth
on Thursday August 7, 2008 @ 09:20am >> [ reply ][ rating +0 ] No, I agree that laws concerning sentencing are a bunch of BS in many cases. Look at marijuana laws as well. That said, this guy is a self-important computer asshole who is a criminal and should be fairly tried and pay whatever penalty is laid out. i think a far trail might be hard, when you get down to the tech details. If you pull all the other works away and he's the only guy that can admin, then why blame him if he's the only guy with the password? And there's a lot of tech facts that might make a difference in the sentencing.. |
|
Posted by voltaic
on Thursday August 7, 2008 @ 06:39pm >> [ reply ][ rating +0 ] i think a far trail might be hard, when you get down to the tech details. If you pull all the other works away and he's the only guy that can admin, then why blame him if he's the only guy with the password? And there's a lot of tech facts that might make a difference in the sentencing.. I suspect he's going to hide behind tech details as his defense. Note that him having the only password wasn't the issue; his refusal to surrender it to his employer (who is also a government entity) was in violation of the law. I don't think it will take a CCIE to decode that technical fact. Well, this is by far the least painful (and cheapest) thing I've done for a broad. ha ha ha... it only goes down hill from here... -stealth |
|
Posted by Stealth
on Friday August 8, 2008 @ 05:04pm >> [ reply ][ rating +0 ] i think a far trail might be hard, when you get down to the tech details. If you pull all the other works away and he's the only guy that can admin, then why blame him if he's the only guy with the password? And there's a lot of tech facts that might make a difference in the sentencing.. I suspect he's going to hide behind tech details as his defense. Note that him having the only password wasn't the issue; his refusal to surrender it to his employer (who is also a government entity) was in violation of the law. I don't think it will take a CCIE to decode that technical fact. there's a few SA's here that I wouldn't submit the passwords to systems for.. they aren't competent enough to figure out how to work the system. But, alas, you are correct.. that will be his downfall. - stealth - "Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo!" --Mr. The Plague, |
|
Posted by voltaic
on Friday August 8, 2008 @ 11:59pm >> [ reply ][ rating +0 ] there's a few SA's here that I wouldn't submit the passwords to systems for.. they aren't competent enough to figure out how to work the system. Of course not when it's just some other douchebag. But if it's your boss, well think again. The funny part is that if it weren't a government entity, he'd probably be fired but not in jail. Well, this is by far the least painful (and cheapest) thing I've done for a broad. ha ha ha... it only goes down hill from here... -stealth |
|
Posted by Stealth
on Monday August 11, 2008 @ 04:22am >> [ reply ][ rating +0 ] there's a few SA's here that I wouldn't submit the passwords to systems for.. they aren't competent enough to figure out how to work the system. Of course not when it's just some other douchebag. But if it's your boss, well think again. The funny part is that if it weren't a government entity, he'd probably be fired but not in jail. That's a very true statement. Interesting point. |