July 24th, 2008
Childs rigged crazyquilt private network
The prosecution unveiled more details on the lunacy in San Francisco in court filings that urged the judge to keep rogue network administrator Terry Childs’ bail at $5 million. The Chronicle reports that prosecutors say that Childs had over 1,000 modems secreted around the city, forming his own private network of access points only he could use.
Not only that but those codes he personally gave the mayor? It was first reported that the password didn’t work as advertised and that when Mayor Newsom called back, Childs’ lawyer said there were some additional “protocols” needed to use it. As it turns out, the protocol was this:
On Monday, when Childs supplied three user names and an access code to Newsom, officials learned they could use them to get onto the system only at a computer in a room at the Hall of Justice that even police technology experts were unaware of.
That’s a secret room in the courthouse building that no one knew existed!
Oh and not to mention “booby-trapping” the network “to run off temporary, short-term memory, a power outage - such as turning off the computer for maintenance - would mean full system failure, prosecutors said.”
Look, the question is not whether Terry Childs was off the reservation. I think he clearly was. The deeper issue, is what is going on in management in San Francisco. It seems this came to a head when a new administrator came to town.
According to prosecutors’ court filing, Childs’ actions first came to authorities’ attention the evening of June 20 when the city’s new chief of network security, Jeana Pieralde, conducted an audit of the FiberWAN network housed at One Market Street Plaza.
His bosses were already worried that Childs was being increasingly hostile toward supervisors and had taken over a room and installed a bank of computers, prosecutors said. They didn’t know exactly what he was doing. (Emphasis added.)
Childs was upset that no one had told him of the audit and used his cell phone to photograph Pieralde. Frightened, she locked herself in an office and later reported the incident to police.
A supervisor in the Technology Department, Rich Robinson, also filed a police report about the incident and quoted Childs as saying, “I’m ready for you, Rich.”
Gartner security analyst Avivah Litan told InternetNews:
“You’ve got to lock down privileged users’ activities. You’ve got to monitor them. There isn’t sufficient monitoring of employees,” she added. “Most want to look the other way when it comes to employee activities, whether it’s fraud or malicious activities. They don’t want to admit they have a problem, so they don’t want to work at solving a problem.”
And other local governments say lack of oversight — although perhaps not the apparently total abdication of management responsibility in SF — is not unusual. Computerworld reported this quote:
“Unfortunately, it is not that uncommon to come into a situation where one or two people have created a situation where not only are they the only ones that know what is going on, but they are the only ones that can do anything,” said Lou Michael, director of network and infrastructure services in Virginia’s Arlington County department of technology services.
