Ex-IT Admin Convicted In San Francisco

A former San Francisco network engineer who refused to hand over computer passwords to the city network after he locked administrators out of it was convicted of a felony Tuesday.

A jury in the San Francisco Superior Court convicted Terry Childs, 45, of felony computer tampering, a crime for which he could face a two-to-five-year prison penalty, according to numerous public reports.

Childs has been in jail since 2008 after the city brought criminal charges against him for withholding passwords to San Francisco's main computer network.

System administrators were unable to access the network, even though city operations continued more or less as usual. After a tense 12-day standoff, Childs finally handed over the passwords to San Francisco Mayor Gavin Newsom from his jail cell.

Supporters characterized the case as a workplace dispute gone wrong, while prosecutors painted Childs as a super-user gone rogue who maliciously aimed to wreak havoc on the city networks. A super user is a colloquial term for network administrators that have the highest security clearing to access to even a company's most secure networks.

In a public interview last year, Childs defended his actions and said they were in line with standard network security practices.

The jury in the case deliberated for three days before handing down the guilty verdict.

One database security expert said the case and Childs' conviction is a wake-up call for companies and organizations that don't properly monitor the activity of super users.

"The issue is that if you are trusted with that type of power, there have to be checks and balances in place -- the concept of 'trust but verify,'" said Phil Neray, vice president of security strategy at Guardium, an IBM Company. Guardium specializes in database security.

He said in this case, Childs was able to change passwords and lock other administrators out of the network before they even knew he was doing it. This would not have happened if the city was monitoring the activity of its system administrators, Neray said.

"They would have created an alert and the security team would have gone in and asked, 'Why did you do this?'" he said.

State, local and the federal governments especially don't have this type of monitoring in place because of budgetary limitations, Neray added.

The federal government is slow to adopt the latest security technologies as well, which also makes them more susceptible to this type of activity, he added.