You are here: Home » In this week's e-newsletter » Network admin gets jail time — for doing his job?

Network admin gets jail time — for doing his job?

April 28, 2010 By Sam Narisi 113 Comments

A former network admin is facing up to five years in prison. His crime? According to him, it was refusing to hand over passwords to folks who weren’t authorized to use them.

Terry Childs worked as a network administrator for the city of San Francisco. In 2008, he blocked access to critical parts of the city’s the network and refused to turn over the passwords to city officials. He was arrested, and revealed the passwords only after spending several days in jail.

In the meantime, employees were unable to access police records, payroll data and other information.

After the incident, it was discovered that Childs had several criminal convictions before San Fransisco hired him — including counts of robbery and theft. According to the city, Childs was disgruntled because he found out his job was in jeopardy and was trying to make himself indispensable to the city’s IT department.

But the admin painted a different picture of the situation: He was simply doing his job by protecting the network.

He claimed he was first asked for the passwords in a meeting that included a police representative, a Human Resources staffer and some unseen engineers on a telephone conference call. He refused, on the grounds that some of the folks present weren’t authorized to access the network, according to an InfoWorld interview.

In addition, he was afraid the passwords might be shared with other members of management or outside contractors.

In other words, Childs claimed he was simply following the best practices for a network administrator.

However, a jury didn’t see it that way. On April 28, Childs was found guilty of a felony charge of denying access to a computer system, the San Fransisco Chronicle reports. He faces a maximum prison of five years, though he’s expected to spend, at most, a few months in jail before parole. Sentencing is scheduled for June.

What’s your take on the story? Was Childs a disgruntled admin who held his employer hostage, or was he simply doing his civic duty in refusing to broadcast passcodes that would give a group of people access to the network he maintained?

Leave your thoughts in the comments section below.

Filed Under: In this week's e-newsletter, IT Security Tagged With: , , ,

Make Smarter Tech Decisions

Get the latest IT news, trends, and insights - delivered weekly.

Privacy Policy

Related Posts

Newer Comments →
  • Joseph

    Your article does not provide enough information to allow an informed opinion about his actions. Is it correct to refuse to divulge passwords when unidentified parties are on a conference call? In most cases I would say absolutely, writing the password on a slip of paper and handing it to an authorized system owner would be one way to satisfy that concern.

    When you provide more information and background about what lead up to the meeting, informed readers can give you informed opinions.

  • Ted

    If he was the only network admin with the access to the passwords than his boss should be fired. What would have happend if he got hit by a bus instead of simply refusing to disclose the passwords?
    The whole thing sounds fishy to me.

  • David

    This can’t be the whole story. Refusing to broadcast the passwords in a conference call alone is justified. Surely someone with the correct authorization could have been given the required passwords privately? Also, in the spirit of ‘best practices’, wasn’t there anyone else with some if not all of the passwords needed, or was this truly a one-man show?

  • Alex

    In the end it is the property of the owner, tax payer (City of SF) or stock holders etc.. If the situation is that bad and you cannot convince your manager of the gravity of the situation and the ramifications, then it is time to leave and find employment where standards and practices are followed. I blame him for not handing over the passwords and then walking out. Again, it’s not his network, it is the City of SF, his employer.

  • Frank

    If you leave out the little details of “blocked access to critical parts of the network” and “employees were unable to access payroll data, police records, and other information”, then yes he was doing his job. With those details it seems more like blackmail.

  • Greg

    If an Administrator did not have official signed documentation by the managers for the people that requested the access, then Terry Childs did the appropriate action by not allowing access for those users.

    People always seem to find work arounds for filling out access request forms as a waste of time; however it is an important document especially when the Business is audited; what about the folks requesting access did they follow the process? Terry did the appropriate action by denying access; it maybe possible the people complaining the most shouldn’t of had access it in the first place!

  • Daveonator

    If what is reported here is the unaltered truth, claiming that he cut off access (as it is stated it sounds on purpose and he knew what he was doing) then the guy is unethical and deserves what he gets.

    The fact that he cut off critical communications from the network here is the real issue. He’s trying to justify a password policy as the real reason why he couldn’t provide the password, but in essence he was acting as a virus himself. An infection – if you will – that deserves to have himself a little alone time in a prison cell to think about the root of the situation (maliciously denying business required access).

  • Justin W

    I can’t help believing there is more to the story than what is printed.

    It sounds like city government needs to look at its password and access policies. If Childs arbitrarily decided to lock everything down, he was at fault. He should have sent his plan up through the appropriate administrative channels for review and approval before implementing it. Assuming Childs was following established city procedure, he was doing his job by limiting access to sensitive information.

    Giving out passwords over the phone is a bad idea. Giving passwords out via conference call is an even worse idea. If he would have released the passwords and someone would have compromised their computer system then he would have been blamed for providing the passwords. This may be one of those situations where you can’t win.

    Administrators sometimes have trouble comprehending concepts such as data security and information control.

  • JFK

    What exactly is the purpose of passwords then ?

    Putting Admins behing bars for doing their jobs ?

    Extremely counterproductive to say the least… Unless you happen to be a lawyer or judge.

  • briguy

    Only in San Francisco can they come up with a junk charge like that. There is no law that states you can’t deny access to a computer system. Especially if securing the network is part of that persons job description. There really isn’t enough information in this article to make an accurate assumption but ASSUMING that San Francisco is like every other employer in the world there probably was not any really qualified individual for Mr. Childs to turn the passwords over to. Assuming that, he was essentially doing his job since he was technically still employed by them. He should have opted to only give administrative passwords (excluding his username) to one person with written approval of that person releasing him of all liability for damage to networks caused by improper use of the passwords. At that point he also should have turned in his immediate resignation.

    This would have given the city the ability to manage the network and make password changes to any systems that they needed, he wouldn’t have to worry about liability if they mess anything up and he’s retained his dignity by doing the right thing.

    Sounds like SF bullpinned him and forced his hand. This whole situation could have been handled with much better ethics on everyone’s part.

    <<>>

  • Anon

    It was never the administrators (Childs) job to determine who has and who doesn’t have access. That up to the bodies that create and set policy. It was only his job to enforce the policy. And without the full details of said policy, I can presume that it didn’t give him sole and complete control over the network. Childs was simply trying to get away with not having to comply with the request to relinquish the passwords in a foolish attempt to save his job.

  • Phyllis Buckelew

    We are not allowed to give our passwords to anyone where I work. However, I believe the IT department should release requested information on a need to know basis — this means COO, President of company, but absolutely not to mear representatives or staff members. I am the Human Resources Manager for my company and trust me when I say our IT department would not give me access to another employees password or to any computer files that I did not need to access. They certainly would not release the information to an H R Staffer. What is wrong with the City of San Francisco? Don’t they have anything better to do than put someone in jail for following company policy? Surely, they have a policy against releasing such information. If not, they should have.

  • http://www.gta-az.com James Solesky

    Without knowing some additional information, I don’t believe that it’s possible to give an opinion one way or the other. For instance… what does the security policy for the City of San Francisco require its IT personnel to enforce as it pertains to passwords? Was he acting on his own initiative and/or interpretation of best practices? Was he following procedures as set forth in the security policy? Did he consult with the IT Director for guidance? It seems to me that the details surrounding the whole incident, or series of incidents, were given to the jury at the trial but not the readers of this article. Without that data, the opinions of those readers are not valid.

  • MET

    Not enough info here to make a decision. If you’re going to ask this kind of question, you need to provide full context including the reasons and explanations for the requests not just the denial

  • http://ITManagerDaily Charlie

    It could go either way, depending on how you value this employee. Protecting a network from unauthorized use is a staple of a network admin’s job. Even if the folks attending that meeting were allowed to know those passwords shouting them to an open mike is not the preferred delivery method. There has to be some accountability with the password distribution. He could have sent them via email which would enable him to include a privacy statement, as well he would copy his superiors to ensure someone in charge is aware of what has transpired. The fact he didn’t do that could mean he is just inept at his job, or, he in fact is using this as an opportunity to bolster his value, OR, he is holding the company hostage. I’m not sure how you would ever know for sure. Based on the information you provided in the article, I think the jury may have been swayed by prior acts.

  • Joe Mandigo

    I believe it was a little of both. I agree with not giving passwords to a group of people, but he could have and should have contacted the managers of these accounts and give them access. THis way he would be doing both his job and what was requested of him in a professional manner. Also the fact that not being proactive caused work stoppage. It is to keep the data flow going while maintaining security.
    The city handled in unprofessionally to ask for password openly in a meeting and should be put into account also.

  • die spamer

    He should have said NO in the meeting, but explained why and then told the folks who wanted it that they would have to talk to his supervisor.

    He then should have immediately doc’d the situation, called/e-mailed his supervisor (with the notes), cc’ing everyon in the meeting. This would have gotten it totally off of his plate.

    Either his supervisor would agree or they’d disagree and he would then give the folks his supervisor had put in WRITING the passwds.

    Unfortunately the bottom the line is CYA while trying to do the correct thing.

    I think stupidity/inexperieince/reallyWantingToBeIndispencible makes him guilty :/

  • Craig

    When he blocked access to parts of the City’s network, assuming that is not part of his normal, approved, work activities, he commited a crime. When he refused to broadcast passwords to unauthorized people he was following policy (let’s assume the City has such appropriate policies). But he should have stated at that time why he would not tell them and they in turn should have brought in the appropriate person to get the passwords from him.

    Given that it all started with him as a bad actor I do not think anyone should feel sorry for him. Do the crime, then do the time.

  • Ike

    Give the guy a break, he was simply following the best practices for a network administrator.

  • http://ITManagerDaily Carolyn

    I would have done the same thing had it been me. I would have agreed to give it only to the authorized personal after ending the conference call so that no one else got the passwords.

  • http://ITManagerDaily Carolyn

    I would have done the same thing had it been me. I would have agreed to give them up only to the authorized personal after ending the conference call. Not putting them out to just anyone!

  • http://www.marcstevens.net Dooglio

    So who were his victims then? Who did he harm by withholding the passwords? How many people died or lost their property? In other words, the prosecution failed to show Corpus Delicti. Sound like justice was not served.

    http://marcstevens.net/component/content/article/52-standing-cross-reference.html

  • TFC-SD

    The admin should have asked for the request in writing and countered with his written warnings that management’s actions were a bad idea (CYA). If management further insisted, he should have handed the passwords over. If he was truly disgruntled, giving management what they want is the safest and fastest way to punish them for being idiots. If management then gave out the passwords unwisely and the system was compromised, then the admin would be able to say I told you so and have lots of job security cleaning up managements actions. The problem is, most IT is on salary so the admin would likely spend days on his time, so management would not be sufficiently punished for their actions. Maybe in the CYA he should have a clause for OT if the admin was right and management was wrong.

  • Charles Dillard

    If his supervisor instructed him to let these people know the passwords, then he is guilty. It’s that simple.

  • Aaron

    Given that the prosecutors in the case entered into evidence a list of one hundred fifty usernames and passwords for the city’s networking infrastructure, thus placing that extremely sensitive information on the public record, I have a very hard time thinking Childs was wrong in his estimation of the security issues around divulging the passwords to begin with.

    On the other hand, I’m not impressed with his action in unilaterally changing the credentials on the city’s networking infrastructure in the first place, something in which he presumably circumvented or ignored whatever policy exists for password management. That’s the sort of thing which makes me suspect that Childs really did find out he was going to be laid off (something which, as a network administrator responsible for the communications systems used by the city’s personnel department, he’d likely be in a position to hear about ahead of time) and decide to arrange himself some additional job security.

    Or, to put it another way:

    “Was Childs a disgruntled admin who held his employer hostage, or was he simply doing his civic duty in refusing to broadcast passcodes that would give a group of people access to the network he maintained?”

    As far as I can tell — both!

  • DavidG

    The defense correctly described poor procedures on the city’s part in all of this– but the city was not in court, the network administrator was on trial. The only way Terry Childs could have had a fair trial with a jury of his peers would be if the jury was other network administrators.

    In this case, the jury found the prosecution’s characterizations of the defendant as being disgruntled and positioning himself to be indispensable to be the most credible. Only another network administrator would understand the isolated responsibility of the defendant’s position.

    Earlier this year, I was hard-pressed by one of my executive users for the administrator password necessary to install an application on her notebook computer for some last-minute crisis situation of hers. She was away from the facility, it was late at night and without the application installed she could not conduct an important meeting. Balancing all the factors at hand, I told her the administrator password so she could perform the installation. Then I immediately changed the administrator password so that she what worked on her notebook computer that night no longer provided access or control over the network I administrate.

    Network security remains the upmost priority.

  • http://www.adsubmission.net Jerry

    Now every network in the world is unsecure. If their IT Admin has to give over Passwords to any one in his organization just for asking…

    What Happens when the Banking industry gets screwed becuase some Scared IT GURU is influenced to give over passwords to just anyone in his organization..

    I sugest: There should be a three man/woman team to handle passwords in an organization each one responcible for them as if they were top secret military documents and only disclosed when two or more are present and agree that those in need are authorized.

    But in the above case, I would have to say he was doing his job. Its his employers job to implement policy was he following company policy, was he indeed the sole person responcible.. if so it was poor planning on his employers part.

    But oh well.. Glad I am not an IT person..

    I was always under the assumption that even a CEO could not get his companies Passwords unless he was authorized in advance in some way..

  • OkSysAdmn

    He should’ve provided the password(s) to the appropriate personnel but NOT on a conference call!

  • George Hayden

    A password is like a key to a door.
    If my employer gives me a key, or multiple keys, to doors that are owned by the employer and then later asks me to give those keys to someone else, I must give the keys to whomever the employer wants me to give them to.

    I might disagree with the employer. I might worry that things will be stolen as the result of my actions. However, I have no right to refuse my employers wish. The employer may be doing something stupid or reckless but unless the action is illegal, I am required to do it.

    Refusal could be grounds for dismissal and perhaps grounds for legal action against me for harming the public or the business. It is very possible that the person should do some time for his crime.

  • Michael Anderson

    Clearly he was *NOT* “just doing his job”. So long as at least one of the people making the request was authorized, he had no grounds for refusal to give the passwords.

    Example: If I am in a meeting with my boss (who is authorized to have those passwords – and in fact, it is my boss who ultimately has the right to determine who is authorized and who is not) – and my boss requests the passwords from me in front of some people who would not be authorized were they making the request on their own, I would still be required to give them to my boss. I would probably point out to my boss that unauthorized persons were present – in case it was an oversight on his part – however, if he still insisted that I give them to him, I would be obligated to do so.

    In that situation, the ‘risk’ falls on his shoulders for insisting that I reveal the passwords in front of unauthorized people. My job is ultimately to do what my boss instructs me to do, in that situation.

  • Brad Crook

    Terry Childs was wrong.

    His job is to protect the network from UNauthorized access. It is not his network and he does not have authority to determine who is authorized and unauthorized. It is clear that he was not told to block access. Also refusing a direct request to allow access again is criminal.

    If his superiors told him to allow access to the entire world he should do it. He should advise them that it would be a colossal mistake but he still has to do it.

  • May Hansen

    Guilty!!! He could have provided the passwords in private to the proper personnel. He chose to not provide them to anyone under any circumstance meaning it was job protection and not system security.

  • http://nowebsites truc

    As an Admin for my company, I store all passwords and other critical/sensitive information in a binder that is stored in a fireproof safe with very limited access. Those that have access have no idea what that binder is but understand why it is there and when it should be used.

    AS far as the IT guy not giving out the passwords, IMO I would not have given them out either. I would have done a better job at making sure that what was being requested of me was on a higher level, and not dealing with a bunch of people, just those that needed it.

    I think that there is more to this story than what is being told. As an IT guy for many years, I have learned to never trust upper management, for they will burn you for their own personal gains, and even a laugh.

  • Ed Key

    There was no “civic duty” involved in withholding the passwords. Eric was an administrator of the network, not a city official. If he wanted that kind of responsibility, he should have either run for office or been appointed by a publicly elected official. The guidelines for the process are very clear, just as they are for the proper spelling of “San Francisco”. Unfortunately, many in the tech community forget the standards of conduct (and spelling) that existed before there was silicon.

  • William

    Obviously holding SF hostage. I read more details on this story, and being a network admin, he had the city’s routers running from running config and never saved the configs to the NVRAM. If anyone had attempted to access the physical device for a password reset, the config was gone on reboot. This was a house of cards he built and holding a city hostage. TFTP and some startup configs would have reloaded the the running config, but never revealed the password. Its a very secure network. Agreed. But if your boss asked for the keys to the kingdom and you don’t relinquish, expect to be on the sidewalk. The logic is flawed that he’s protecting something that he obviously isnt going to have any control over. :-(

  • Katherine

    There is a difference between best practice security, and holding data hostage. While he may not have been comfortable providing the information to a mixed audience, I see no reason not to provide that information to individual company officials after the meeting.

  • Jim B

    If you ask me, it should not be up to the network admin to decide who is or is not privy to passwords, this is at the discretion of management. There should be policies in place to control who gets access to confidential information on the network so that it’s not left to be decided by the net admin. The network admin’s role here is to adhere to and enforce the policy, but not to make the policy. If there was no policy in place, he was still in the wrong to make the decision on his own, there needs to be upper management involved in the decision.

  • http://www.berkshiresbest.com Albert Lewis

    Not pointed out here is that Childs *changed all the passwords, then refused to give them up. Smells like sabotage to me.

  • mike

    Good old America for you… apathy is encouraged and vigilance is punished. Gotta love that.

  • Morgan

    Seriously? If it had not been for the previous previous history one could believe his claim. The fact that this guy committed, was charged with AND found guilty of Robbery and Theft leaves his credibility in the gutter.

  • D Zimmerman

    Terry’s manager appears to be missing in action here? The manager should have been able to give authorization to release passwords as appropriate. If Terry disobeyed his/her direct supervision then Terry desirves what Terry gets but otherwise this is a complete lack of leadership.

  • Sean from Chicago

    Not sure I buy his story. People that already had access should have had access. If somoene new wanted access there should have been a process to get it. This story doesn’t seem properly flushed out.

  • almost I.T.

    i think he was doing his job as an I.T. admin, after all it’s his responsability as to who would be authorized to get other users passwords, he should have asked for a signed doc giving him the ok to release those passwords to back himself up in case those passwords were let out later on.

  • Guy

    I dont think he actually blocked access to anything. I may be wrong, but I read several times that there was not outtages for any service nor any denial of networked resources. You might check the facts before publishing the story next time. But of course, maybe I’m wrong. There are so many versions of this story that its hard to distinguish the facts from the BS.

  • Richard

    I wonder -

    Did he have a chance to say the he would turn them over to some single person, clearly above him in the management chain, if directed to in writing? Childs would write a memo clearly stating that he considered exposing the passwords more widely to be inappropriate but was transferring that decision, under orders, to his boss. Once Childs had that signed document, he had more than met his obligations.

    That person could then decide who to share them with.

  • http://www.survivalistboards.com/ Kevin

    If your boss ask your for the password to the network, you give it to him. After all, he/she signs your pay check.

  • Stefanie

    What i want to know is why don’t they show his face??? Why?

  • http://none Cirdecus

    I think it was a poor management decision to ask the network admin to shout out passwords in the middle of an unsecured conference call with no security or approval in place. Auditors for a corporation would have a field day with that.

    As someone who is responsible for the result, the network admin would be instinctually distraught at giving those passwords out.

    In the end, it was poor management that made a stupid decision. In the business world, those managers are held accountable by third party auditors, but in the city, they’re obviously not held accountable at all.

    The network administrator made the mistake of dealing with the situation in the worst way. He should’ve written a formal protest to the management request and put it on file in HR and with the city. If anything would’ve happened to the network as a result of the stupid management team, he would not be held responsible.

    Point of the matter: If your boss asks you to do something that contradicts your job duties, you need to ultimately do it, but be sure to shout your objection to all ears that are listening.

  • http://paws.cbu.ca Cecil

    My Take,

    This would appear to be a situation of the punishment being fitted to the intention not the crime. This guy, based upon his past, has questionable actions, however, if he is actually operating within the code and protocol of his position the guilty verdict is not appropriate. The flip of this would be a free pass for all keepers of the network gate to hand over access to whomever wants it as they would not want to violate the precedent of the law.

    You don’t have to like a person to find them innocent. If after any trial a juror states “I went with an innocent verdict even though the defendant most likely committed the crime but the prosecution failed to prove so,” the legal system has worked.

    Regards,

    Cecil

  • Raanan

    Guilty. A more logical approach would have been for him to immediately notify his superiors and notify them of the requests to obtain credentials. Regardless of his individual role, there is a superior with even more authority than him, and if this is not clear than they need to make sure they have clearly defined roles that state who are the custodians of the network, who are second in command, and so on, and a way in which communication can travel between the parties.

Newer Comments →