How many of you do background checks on your IT employees?

The city was wrong.

Rich,
He did not have explicit permission to do as he pleased. I certainly hope you do not think that because you may have the keys to an office, you can do as you please with it.

To begin with, the City was wrong to have hired him. The City was wrong to have vested so much control in the hands of a convicted felon. And when Childs changed all the user IDs and passwords, he did indeed take control of the network.

I cannot see how you can disagree with any of that. His changed User IDs and passwords were technically City property. Someone who refuses to hand over City property is a thief, even if that property is intellectual property. He abused his privileges and it is growingly apparent he acted with malice.
Scott

It was Terry Childs' job to

It was Terry Childs' job to change the password on the routers. He was the network administrator. Changing passwords periodically is a "best practice" recommended throughout the computer, network and information security industry. It is also a practice included in the security policy framework which DTIS Deputy Director Rich Robinson has stated should be used as the starting point for the City's information security policy. Childs would have been remiss had he not been changing passwords. He claims that he did so every two months. Clearly, in continuing to follow best practices he was not "taking control" of the network but rather continuing the control he had had for some time.

He absolutely did have explicit permission from the City to take the action of changing passwords in the routers - in fact, he was being paid to do so.

The issue of the password itself is largely irrelevant because all Cisco routers can be easily reset by anyone with physical access - and a password can not prevent the resetting of the router. The City had the option all along, to simply walk over and reset the routers and have full administrative control of them. The routers would then need to be reconfigured. The City chose not to do so because, by their own admission, they were ignorant of how to configure the routers for the network which they had designed (actually former city Network Architect Archie Lee) five years prior.

The two persons, DTIS Deputy Director Rich Robinson (no relation) and the newly appointed Network Security Manager Jeana Pieralde, who pressured Terry for the password did not meet the minimum qualifications set by the City itself to manage the network. Terry Childs did meet the requirements set by the City. It was the opinion of the qualified administrator of the network, that those persons who were not qualified to administer the network posed a threat to the system. By setting the minimum qualifications for the position, it would appear that the City shared that opinion - that persons who did not meet the qualifications were not suited to the position of administering the network.

Terry Childs took no action which prevented the City from administering the network: he did not quit his job; the network remained functional and despite claims by City officials that he had rendered it insecure it remained secure throughout the ordeal. While he remained employed to administer the network, the city had one person, and apparently only one person who was qualified and capable of administering the network. At no time did Terry Childs take any action that changed that situation which had existed for years. It was Rich Robinson who reassigned and suspended Terry Childs on July 9th, 2008 who removed the sole person qualified to administer the network which belongs to the City and County of San Francisco, not to Rich Robinson. Rich Robinson was not acting in the City's best interests but rather he jeopardized a critical system by removing the sole employee who met the minimum qualifications set by the city to manage the network.

Terry Childs did not refuse to disclose the passwords to the City, rather he refused to disclose the passwords to Rich Robinson and Jeana Pieralde - neither of whom "own" the network, neither of whom met the minimum qualifications set by the City for administering the network. Terry Childs voluntarily gave the passwords to the Mayor (his "ultimate boss" as Terry described him).

Neither abuse of privileges nor malice on Terry's part is required in this scenario. What is required is a series of absolute failures on the part of DTIS management: in failing to adopt a security policy (which internal and external (tax-payer funded!) audits and reviews have been recommending repeatedly since at least 1996); in failing to adhere to established industry best practices; in failing to replace former city Network Architect Archie Lee in a timely fashion; in laying off every employee other than Terry Childs who met the City's minimum qualifications to manage the network and who could have reconfigured the routers ; and in failing to address the situation when Terry Childs filed informal and subsequently formal complaints about DTIS management in early June of 2008.

Perhaps Rich Robinson and Jeana Pieralde, in their ignorance of the network, didn't know what questions to ask of Terry specifically to elicit answers which would allow them to gain control of the routers (remember that even after Terry gave the password to the Mayor, Cisco engineers were unable to figure out how or where to use the password without further information from Terry.) If they asked the wrong questions and Terry gave correct answers to their wrong questions, is that criminal?

Does California Penal Code subsection 502 (cited in the only charges against Terry) which relates specifically to "Unauthorized access to computers, computer systems and computer data" have any relevance in a situation where the employee was authorized to set passwords and then may or may not have truthfully answered questions which may or may not have actually been the correct questions to gain both the password -- and -- procedure, instructions, knowledge needed to gain administrative control of the routers?

Can an employee be jailed for failing to educate an employer on how to do the employee's job???

Is a government employee who is qualified and assigned to manage a network, (as an example lets say a network controlling nuclear missile launch systems) a criminal if the employee refuses to turn over control of that network to persons whom he knows are not qualified to run that network?

That is not his decision to make....

If his superiors instruct him to give them the information, he is expected to follow orders and give the information. To do otherwise is insubordinate at best and criminal (surprise!) at worst.

Wrong is wrong. Trying to justify an action, or set of actions because the person thinks his superiors are idiots is not justification for criminal action. Quite simply, it is not his decision to make.
Scott

Re: That is not his decision to make....

Scott,
You're batting .000 on this one - give it over, get your facts straight and while you're at it take a few classes in workplace ethics.

There are many situations that REQUIRE insubordination to serve the real owners - uncovering fraud, dangerous incompetence or other inappropriate actions that leave the organization open to serious loss or risk. It is unfortunate that such service is almost always rewarded with firing or worse, but by your standards anyone could ignore ill advised or illegal actions with the "I was only following orders" defense.

You should know by now the situation was far murkier than originally portrayed and the City has clearly lied about a number of basic facts in the case. Was Terry right to refuse to hand over passwords except to the mayor? I certainly don't have enough evidence to say for sure, but given the keystone cop routine he was put through I'd say the chances are good that he was correct. Following established policies and procedures is ALWAYS the correct choice, although it is apparently no protection from imprisonment.

He was a CONVICTED FELON...

and as such, should NEVER HAVE BEEN HIRED. And "workplace ethics" do not include the activities he engaged in.

No manager will agree with you. Neither will anyone in authority.
Scott

"he should never have been

"he should never have been hired" is no grounds for arrest...

He should never have been...

If the city's application for employment asked specifically if he had ever been convicted of a felony, and he either answered "no" or didn't answer, then he was guilty of falsifying his application. That is, by itself, grounds for termination.

I know that if he had falsified a federal job application, he could have been subject to criminal prosecution. I don't know if California or the City of San Francisco have similar statutes.