Eevo Theme
   [ Main Page ][ First New  ]

Network Admin Gone Wild
Security ]
Posted by Krux on Tuesday July 22, 2008 @ 09:29am
>>reply ][ rating +0  ]

Computer engineer keeping quiet on lockout

The San Francisco computer engineer charged with masterminding a cyber-coup of the city's network is being paid as he sits in jail, refusing to allow other administrators to get into the system that controls e-mails, law enforcement records and payroll documents, authorities said Tuesday.

Terry Childs, 43, of Pittsburg, who earns a six-figure salary with the city Technology Department, appeared in court Tuesday on four felony counts of computer tampering before being returned to his jail cell. He is being held in lieu of $5 million bail, an amount his lawyer called "crazy."

According to prosecutors, Childs, who has a 25-year-old criminal record in Kansas for aggravated robbery, locked out all other administrators from the city's computer system after they started asking questions about a run-in he had with his agency's head of security.

Mayor Gavin Newsom described Childs as a formerly well-liked employee who "got a bit maniacal."

Childs was part of the team that built FiberWAN (wide area network) , the backbone of the city's computer network, said Ron Vinson, chief administrative officer for the Technology Department. The system stores about 60 percent of all city government data.

By the time Childs was done with his alleged criminal deeds, he had created a password that gave him exclusive access to that data, prosecutors said.

When police asked him to divulge the password, Childs first gave a bogus code and then refused to provide the correct one even under the threat of arrest, authorities said.

Childs' bosses ordered him to leave work July 9 for alleged insubordination, but they continue to pay his $127,735-a-year salary. Vinson insisted that was standard procedure, even for a city employee accused of four felonies.

A hearing to determine whether Childs will be placed on unpaid leave has yet to be scheduled but could be held as early as Thursday, Vinson said.

On Tuesday, Childs appeared calm as he stood next to deputy public defender Mark Jacobs at a brief hearing in San Francisco Superior Court. Childs spoke only once, when he agreed to appear again in court Thursday. From jail, he declined a request for an interview.

Outside court, Jacobs suggested the case against Childs was overblown and the result of a misunderstanding, and called the $5 million bail "crazy."

"I don't think he's a threat," Jacobs said. "He didn't kill anybody, and murderers usually get a $1 million bail, so you do the math. Someone out there is really scared of something, and I don't know what that is."

Erica Derryck, a spokeswoman for District Attorney Kamala Harris, said that "there seems to be a threat to public safety, and bail was set accordingly." She did not elaborate on what that threat was.

Officials have said they feared that Childs may have enabled a third party to gain access to the computer system by telephone or other electronic device and order the destruction of hundreds of thousands of sensitive documents. However, they have found no evidence of such a device in searches of his home and car.

Newsom said Tuesday that Childs' actions prevented administrators from making changes to the city's computer network, so if the system were to crash, workers could not undertake repairs or upgrades.

"There's nothing to be alarmed about, save the inability to get into the system and tweak the system," Newsom said. "Nothing dramatic has changed in terms of our ability to govern the city."

He said the city has brought in experts from Cisco Systems to try to break back into the network. If the city has to rebuild the network from scratch, Newsom said, it could take up to eight weeks at an uncertain cost. Childs could be liable for the damages.

The mayor said that until recently, Childs was highly regarded in the Technology Department. Now, he said, Childs is a "rogue employee that got a bit maniacal."

"He was very good at what he did, and sometimes that goes to people's heads," Newsom said, "and we think that's what this is about."

According to authorities, Childs had been becoming more and more protective of the system he worked on in recent months.

He was hired five years ago, even after telling officials on a job application that he had a felony conviction. According to court records in Kansas, Childs was convicted of aggravated robbery and aggravated burglary stemming from charges filed in 1982. He was on probation or parole until 1987, records show.

On June 20, authorities said, Childs started taking photographs of the Technology Department's new head of security after she began an audit of who had password access to the system. The woman became frightened by Childs' behavior and locked herself in an office, authorities said.

His supervisors' concern grew when it became clear that Childs had not only given himself exclusive access to the system, but had created a way to spy on his bosses' e-mails related to his conduct, authorities said.


<< Sorting facts from fiction in the terry childs case
Security ]
Posted by Krux on Tuesday August 5, 2008 @ 02:03pm
>>reply ][ rating +1  ]

A good follow up article on Terry Childs and what happened:

Sorting facts from fiction in the terry childs case

"Any sufficiently advanced technology is indistinguishable from magic." -- Arthur C.


<< Re: Sorting facts from fiction in the terry childs case
Security ]
Posted by Stealth on Wednesday August 6, 2008 @ 06:16am
>>reply ][ rating +0  ]

A good follow up article on Terry Childs and what happened:

Sorting facts from fiction in the terry childs case

Good article. Interesting technical notes. I hadn't know about the router config issues or the other stuff past the mayor thing.. I lost track of following the case.

It's a shame they blew up on with him with all the drama.. but then again, it's a government, not surprised. This is what happens when no tech people try to make cases and glame up a bunch of press.

- stealth -
You should never underestimate the predictability of stupidity. - Bullet Tooth Tony


<< Re: Network Admin Gone Wild
Security ]
Posted by Krux on Wednesday July 23, 2008 @ 05:41pm
>>reply ][ rating +0  ]

From my boss:

This has turned into an international spectacle. It's doubtful the media is reporting the full story or knows the full story. Anecdotally, I've heard the request for a reduction in bail was denied.

How they are going to prosecute this case is beyond me since the network seems to have remained operational, the exclusive administrative privilege seems to have been in place for months, and his management was aware of the situation. Yes, if your chain of command asks you for the password, the only correct answer is to say yes and provide them. However, his management should have never allowed the situation to reach the state where only one person had the keys to the kingdom, they probably could have handled this much more diplomatically, and finally, I'm failing to see how this could result in a criminal charges that can be successfully prosecuted.

Somehow I doubt the first sentence in the article is an accurate quote.


S.F. mayor gets keys to city's computer

(07-22) 18:11 PDT SAN FRANCISCO -- "The first thing I want you to know, Mr. Mayor, is that when you walk out of this room, you will have the computer codes."

Those words - delivered to Mayor Gavin Newsom by imprisoned city computer tech Terry Childs in a small, fourth-floor room at city jail Monday - signaled the beginning of the end of the weeklong standoff in which San Francisco officials found themselves in the embarrassing position of being locked out of their own computer system.

Childs - whom some have described as a friendly, hard worker at the city Technology Department, and others have labeled an over-the-top control freak - has been sitting in jail since July 13 on $5 million bail, after being arrested for reconfiguring key passwords in the city's computer system.

A team of code crackers brought in from Cisco Systems had been working around the clock to try to decipher Childs' codes, but with only marginal success.

"It wasn't cheap and I just couldn't see us keep spending that kind of money," Newsom said.

Then, out of the blue, Childs' lawyer, Erin Crane, called the mayor's office Monday afternoon, offering a jailhouse meeting.

Childs, according to the lawyer, was ready to give up the codes - but only to the mayor, who had gone out of his way in his public comments not to portray Childs as some sort of monster.

Newsom didn't hesitate. Without asking the city attorney for an opinion or giving a heads up to police or the district attorney, he was at the Hall of Justice in half an hour.

With Crane by his side, Childs told Newsom about the computer system he'd set up and how all the current problems sprang from a series of misunderstandings.

Crane didn't let him go on for too long, and Childs got to the business at hand, asking for a pen.

He then wrote out a very long computer code.

"This better be right," Newsom said.

"It is," Childs assured him, but asked the mayor to deliver it in person to the Cisco specialists - not to the city's computer brass.

Newsom took the code to the city computer center and gave it to a Cisco techie, who found that it didn't work - prompting a call-back to Crane.

"He said you would be calling and you would be upset," the lawyer said. "He forgot to give you the protocols to go along with the code" - and she read the accompanying computer prompters to the mayor over the phone.

By Tuesday morning, the system was back in the hands of the city.


"When life gives you lemons, you run into a school with a gun and grenades and start shooting people..." -- rb


<< Re: Network Admin Gone Wild
Security ]
Posted by MadArab on Thursday July 24, 2008 @ 04:43am
>>reply ][ rating +0  ]

Lets start selling "Free Terry" shirts!!


<< Re: Network Admin Gone Wild
Security ]
Posted by voltaic on Wednesday July 23, 2008 @ 09:23pm
>>reply ][ rating +0  ]

How they are going to prosecute this case is beyond me since the network seems to have remained operational, the exclusive administrative privilege seems to have been in place for months, and his management was aware of the situation. Yes, if your chain of command asks you for the password, the only correct answer is to say yes and provide them. However, his management should have never allowed the situation to reach the state where only one person had the keys to the kingdom, they probably could have handled this much more diplomatically, and finally, I'm failing to see how this could result in a criminal charges that can be successfully prosecuted.

Google "california computer law". CA Penal Code 502.c.2 and 502.c.5 read:
502. (a) It is the intent of the Legislature in enacting this section to expand the degree of protection afforded to individuals, businesses, and governmental agencies from tampering, interference, damage, and unauthorized access to lawfully created computer data and computer systems.

(c) Except as provided in subdivision (h), any person who commits any of the following acts is guilty of a public offense:

(2) Knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.


the above would apply to his accessing other peoples' emails; and subsection:
(5) Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network.

would apply to the internal "administrative DoS" (for lack of a better term). These two actions both have the following penalty per count, and if I was a prosecutor I'd make each instance of the city's authorized request for the passwords/protocols a distinct charge:
(d) (1) Any person who violates any of the provisions of paragraph (1), (2), (4), or (5) of subdivision (c) is punishable by a fine not exceeding ten thousand dollars ($10,000), or by imprisonment in the state prison for 16 months, or two or three years, or by both that fine and imprisonment, or by a fine not exceeding five thousand dollars ($5,000), or by imprisonment in a county jail not exceeding one year, or by both that fine and imprisonment.

Incidentally, that paragraph (h) exception will definitely not apply in this case:
(h) (1) Subdivision (c) does not apply to punish any acts which are committed by a person within the scope of his or her lawful employment. For purposes of this section, a person acts within the scope of his or her employment when he or she performs acts which are reasonably necessary to the performance of his or her work assignment.

And so let's look at legislative intent on sentencing:
(k) In determining the terms and conditions applicable to a person convicted of a violation of this section the court shall consider the following:

(1) The court shall consider prohibitions on access to and use of computers.

(2) Except as otherwise required by law, the court shall consider alternate sentencing, including community service, if the defendant shows remorse and recognition of the wrongdoing, and an inclination not to repeat the offense.


Hmm, yeah his entire act pretty much was a prohibition on access and he's not so much with the remorse, so homeboy's hating life come sentencing. Naturally there are all kinds of civil codes violated as well, but the above is just the criminal part.

Well, this is by far the least painful (and cheapest) thing I've done
for a broad. ha ha ha... it only goes down hill from here... -stealth


<< Re: Network Admin Gone Wild
Security ]
Posted by Stealth on Wednesday August 6, 2008 @ 06:09am
>>reply ][ rating +1  ]

But do you think he deserves/deserved a harder sentence then a drug dealer? A murder? Those guys get less bail and are out sooner. It seems that computer crimes always seem to bring about crazy high sentencing times, fines, etc. To me, it seems over rated.

He had access to their mail by the nature of their job, the same way I do as a mail server administrator. You cross into different laws when you read the mail without reason, but in my case, even that is covered under monitoring, as long as I don't target one individual for no reason.

The DoS.. sure.. that one might fit. But it was way blown up.

- stealth -
"[Sigh] - I hate you Kenny" -- Cartman


<< Re: Network Admin Gone Wild
Security ]
Posted by voltaic on Wednesday August 6, 2008 @ 01:14pm
>>reply ][ rating +0  ]

No, I agree that laws concerning sentencing are a bunch of BS in many cases. Look at marijuana laws as well. That said, this guy is a self-important computer asshole who is a criminal and should be fairly tried and pay whatever penalty is laid out.

Well, this is by far the least painful (and cheapest) thing I've done
for a broad. ha ha ha... it only goes down hill from here... -stealth


<< Re: Network Admin Gone Wild
Security ]
Posted by Stealth on Thursday August 7, 2008 @ 09:20am
>>reply ][ rating +0  ]

No, I agree that laws concerning sentencing are a bunch of BS in many cases. Look at marijuana laws as well. That said, this guy is a self-important computer asshole who is a criminal and should be fairly tried and pay whatever penalty is laid out.

i think a far trail might be hard, when you get down to the tech details. If you pull all the other works away and he's the only guy that can admin, then why blame him if he's the only guy with the password? And there's a lot of tech facts that might make a difference in the sentencing..

- stealth -
"[Sigh] - I hate you Kenny" -- Cartman


<< Re: Network Admin Gone Wild
Security ]
Posted by voltaic on Thursday August 7, 2008 @ 06:39pm
>>reply ][ rating +0  ]

i think a far trail might be hard, when you get down to the tech details. If you pull all the other works away and he's the only guy that can admin, then why blame him if he's the only guy with the password? And there's a lot of tech facts that might make a difference in the sentencing..

I suspect he's going to hide behind tech details as his defense. Note that him having the only password wasn't the issue; his refusal to surrender it to his employer (who is also a government entity) was in violation of the law. I don't think it will take a CCIE to decode that technical fact.

Well, this is by far the least painful (and cheapest) thing I've done
for a broad. ha ha ha... it only goes down hill from here... -stealth


<< Re: Network Admin Gone Wild
Security ]
Posted by Stealth on Friday August 8, 2008 @ 05:04pm
>>reply ][ rating +0  ]

i think a far trail might be hard, when you get down to the tech details. If you pull all the other works away and he's the only guy that can admin, then why blame him if he's the only guy with the password? And there's a lot of tech facts that might make a difference in the sentencing..

I suspect he's going to hide behind tech details as his defense. Note that him having the only password wasn't the issue; his refusal to surrender it to his employer (who is also a government entity) was in violation of the law. I don't think it will take a CCIE to decode that technical fact.

there's a few SA's here that I wouldn't submit the passwords to systems for.. they aren't competent enough to figure out how to work the system.

But, alas, you are correct.. that will be his downfall.

- stealth -
"Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo!" --Mr. The Plague,


<< Re: Network Admin Gone Wild
Security ]
Posted by voltaic on Friday August 8, 2008 @ 11:59pm
>>reply ][ rating +0  ]

there's a few SA's here that I wouldn't submit the passwords to systems for.. they aren't competent enough to figure out how to work the system.

Of course not when it's just some other douchebag. But if it's your boss, well think again. The funny part is that if it weren't a government entity, he'd probably be fired but not in jail.

Well, this is by far the least painful (and cheapest) thing I've done
for a broad. ha ha ha... it only goes down hill from here... -stealth


<< Re: Network Admin Gone Wild
Security ]
Posted by Stealth on Monday August 11, 2008 @ 04:22am
>>reply ][ rating +0  ]

there's a few SA's here that I wouldn't submit the passwords to systems for.. they aren't competent enough to figure out how to work the system.

Of course not when it's just some other douchebag. But if it's your boss, well think again. The funny part is that if it weren't a government entity, he'd probably be fired but not in jail.

That's a very true statement. Interesting point.

- stealth -
"What has two thumbs and doesn't give a crap?" - Dr Bob Kelso, thats who


   [ Main Page ][ First New  ]