Bill Detwiler explains why San Francisco administrator's refusal to turn over network passwords amounted to "hijacking" and, why the experience reminds IT employees that they don't "own" their employer's network.
A few TechRepublic members have taken me to task for using the case of Terry Childs as the introduction for the IT Dojo video, "Five ways to keep your own IT staff from stealing company secrets". Some disagreed with my description of Childs' actions as "hijacking" and others complained that I inaccurately suggested Childs' stole and corrupted data or compromised the city of San Francisco's FiberWAN. I would normally reply to each criticism within the original post's discussion thread, but I believe this situation creates a perfect opportunity to explain why I still believe "hijacking" correctly defines Childs' actions and why it's important to remember that we don't "own" our employer's network.
Holding passwords hostage amounts to "hijacking"
If you read through the stories linked to below, you'll discover that there are conflicting accounts of how dangerous or illegal Childs' actions were. For example, the City of San Francisco claimed that Childs' possession of VPN group names and passwords was evidence that Childs was a threat to the city network. InforWorld's Paul Venezia argued against the city's claim, writing that "the [city's] portrayal of the VPN information suggested that Childs should not have had this documentation, even though he was the city's lead network admin and apparently had to maintain these lists as part of his job".
One fact however, does not appear to be in dispute. Both before and after his arrest, Childs refused to turnover the usernames and passwords for many of city's FiberWAN network devices to officials from San Francisco DTIS (the city's IT organization). After his arrest, Childs said he would only turn the information over to San Francisco Mayor Gavin Newsom, and he eventually did so.
I contend that Childs' act of holding the group names and passwords from their legitimate owners (senior DTIS officials) amounts to seizing the network by threat of force—one definition of the word "hijack". At this point, it doesn't appear that any city data was actually destroyed or stolen, but neither of those occurrences is required for Childs' actions to be called hijacking. At no point in the IT Dojo video did I say Childs stole or destroyed data or even brought down San Francisco's FiberWAN. I used the situation to illustrate why IT organizations should follow adequate security practices—even with their own employees.
But the argument over my describing Childs' actions as "hijacking" is a purely semantic dispute. The real crux of this situation lies with Childs' decision to not hand over the network passwords when asked and the consequences of those actions—deserved or not.
IT employees don't "own" their employer's network
From what I've read, Childs was an experienced CCIE who either single-handedly built or lead the building of San Francisco's FiberWAN—a fiber network designed to connect the city's many different networks. According to Venezia:
"Following the completion of the FiberWAN, Childs looked upon his creation as art — so much so that he applied and was granted a copyright for the network design as technical artistry. Skeptical of his colleagues' abilities, Childs became the sole administrator of the FiberWAN, and the only person with the passwords to the routers and switches that comprised the network."
From Venezia's writings and other accounts, it's clear that Childs felt a sense of "ownership" toward San Francisco's FiberWAN. Unfortunately, Childs overlooked a fundamental truth of working for someone else—be it a private corporation or government agency. Very rarely, if ever, does an IT employee "own" the hardware, software, or network they support for their employer.
I understand those who sympathize with Childs' current situation. But, the City of San Francisco paid for the equipment to build the FiberWAN. The city paid Childs to design, build, and administer the network. The City of San Francisco "owns" the FiberWAN and can thus manage it as they see fit—including locking out Childs.
In refusing to surrender the passwords to his DTIS superiors, Childs was at the very least guilty of insubordination and possibly violating California criminal statutes on unauthorized access to a computer. Now, Childs may be exonerated of any criminal charges in the end but, was his defiance worth going to jail over? Only Childs can answer that.
It's true that public protest and personal sacrifice can bring about necessary and dramatic social change. But, let's be honest. San Francisco's FiberWAN may an amazing creation but, Childs' refusal to hand over the passwords was not a strike against a great social evil.
What happens with Childs's case remains to be seen. Regardless, all IT professionals should heed his experience and remember that there's a difference between what individuals think is "right" and what the laws defines as "legal".
More information about San Francisco's case against Terry Childs:
- S.F. officials locked out of computer network
- San Francisco hunts for mystery device on city network
- Sorting out fact from fiction in the Terry Childs case
- San Francisco IT worker arrested in hijacking of city network
- San Francisco Held Cyber-Hostage? Disgruntled Techies Have Wreaked Worse Havoc
- Experts Say Lax Security Allowed San Francisco Network Hijacking, Admin Offers Passwords
- Why San Francisco's network admin went rogue