Unbelievable—Terry Childs Found Guilty

Post Reply New Topic

In a turn of events that makes one question the US Justice System, Terry Childs was found guilty http://www.ktvu.com/news/23283217/detail.html.

Terry Childs was a IT expert for the city of San Fransisco. He was the only person on staff that had a complete understanding of the network system that he had designed. In fact, he was on call 24/7 for support on the network. After some time of this, it appears that he began to develop a premadonna complex, and may well have been insubordinate. He was subsequently terminated. However, he was charged with refusing to provide the passwords to his supervisor in front of a number of persons unknown to him. This is despite the fact that his contract stated that the passwords may only be divulged to the mayor. In addition, the California Counties “Best Policies” for the Countywide Information Security Program (http://www.sfgov.org/site/uploadedfiles/dtis/coit/Policies_Forms/CCISDA_security.pdf pg. 34) states that passwords should not be divulged to one's boss.

I cannot imagine that San Fransisco has Network Administrators of any degree of competence now...

Prima Donna
n.

1. The leading woman soloist in an opera company.
2. A temperamental, conceited person

[Italian : prima, feminine of primo, first + donna, lady.]

(sorry, but pre-madonna was like biting into a lemon )

WOW that is so sad.... I hope he stays safe in prison. may god somehow get him out early.

But if he was no longer an employee of the state, then he should have given up those passwords. He had no right to hold onto them. Isn't a liability to have a former employee with access to confidential information; he should have given those passwords up so they could be changed.

I stand chastised.

Sounds like the right hand doesn't know what the left had is doing to either butt cheek... Pretty sad. I'm in school for CIS, and this is the kind of thing we hear about...

He did disclose the passwords to the mayor. His contract specified that only person he could disclose the passwords to was the mayor. They attempted to have him disclose the passwords to other city employees (his supervisor, if I remember correctly) with other unknown people in attendance.

If this was not the procedure the city desired, they should have negotiated a contract amendment with Childs.

oh, goodness, I hope I wasn't that harsh, dear.

Merle

No, actually, I am ashamed that I let such an obvious error through my internal spellchecker. Perhaps it is time for an upgrade...

In a company network, there should be a computer admin, eg a Network Manager who has admin powers to the network and can amend login details of employees who have just resigned/sacked.

I know from my experience as a former programmer who was made redundant in 1992. While I was given my notice in the Manager's office, my project manager had meanwhile logged me out of the office network.

No employees should be required to disclose his/her passwords to anybody!

They should have asked the mayor to ask Childs and relay the password. That should have worked.

Waste of resources. The passwords should have been in a sealed envelope in the Mayor's safe the whole time. All this crap for nothing. The guy should not have been jailed or convicted. this is the city's fault, pure and simple.

Sounds like they were out to 'get him' (yeah, I know how paranoid that sounds...). As others have said, why not just ask the mayor to get the passwords? Or can the mayor delegate responsibility to other people?

They finally did get the mayor to talk to him alone in person in order to transfer the passwords. However, that was after they had him incarcerated. Literally, the mayor made a secret visit to his cell. They said that this was evidence that he was holding the city's network "ransom".

It seems to be a matter of not seeing the forest for the trees.

While best practices certainly dictate not sharing passwords, the simple fact of the matter is that the network did not belong to Childs, and the network was placed at risk, because there was no employee of the owner of the network with the capacity to exercise control over it.

Suppose, for a moment, that Childs had died. Who, then, would have been in a position to exercise control? Now, granted, the City bears a significant responsibility for failing to put into place appropriate frameworks, but the fact of the matter is that having ceased to be an employee, Childs failed to return as asset (control of the network) belonging to his former employer when required to do so.

When two rules come into conflict, then they must be reconciled in a fashion that protects them both. The answer here would be to turn over the passwords, and for the city to then entrust the access control to other employees. Childs approach failed to recognize his former employer's ownership interest.

THIS.

I'm that guy, in a large multinational corp, not a city though. I'm the only one who has the whole picture. Sure we have documentation, but sooo much can't be put down on paper.

All my passwords and accounts are stored in an encrypted database. They were printed out on a secure printer, sealed in an envelope with a tamper-proof seal, envelope placed in a large cardboard shipping envelope, and that was placed in a safe with the Big Boss, with a note on the envelope: for so-and-so eyes only.