Terry Childs, the San Francisco network administrator who refused to hand over passwords to his boss, was guilty of one felony count of denying computer services, a jury found Tuesday.
As jury members reiterated the verdict, one by one, to judge Judge Teri Jackson, Childs sat motionless before the judge, his head slumping slightly at times.
Childs now faces a maximum of five years in prison after jurors determined that he had violated California’s computer crime law by refusing to hand over passwords to the city’s FiberWAN to Richard Robinson, the chief operations officer for the city’s Department of Technology and Information Services (DTIS).
Although the city’s network continued to run, San Francisco went 12 days without administrative control of the FiberWAN, and that constituted a denial of service — illegal under state law.
Childs’ lawyers had argued that he was a buttoned-down, security-obsessed administrator who believed he was simply doing his job.
Jurors didn’t buy that argument. “Being able to administer the FiberWAN services themselves is a service,” said Jason Chilton, one of the jurors, in an interview after the verdict was announced.
Jurors had sympathy for Childs, however, who was put in a difficult position by his employer, according to Chilton — a network engineer himself. “If the city were on trial, then it would probably be guilty of a lot of stuff too,” he said. “It would have never reached this point if the city had effective management and policies.”
“There was definitely some mismanagement, but the city wasn’t on trial,” said Amy Heine, another juror, who works as a photo manager for Williams-Sonoma.
“The city was denied access to the network,” she said. “He knew the steps he was taking were creating a perfect storm.”
One of the reasons it was so expensive for the City to recover control of its network is because Childs had set routers to store configuration information in memory instead of on their hard drives, so any disruption of power would have wiped out this information. This made it very difficult for the city to reset the routers and recover administrative control of the network without reconfiguring the entire system.
“He was paranoid and acted recklessly,” Heine said. “The things he did just didn’t make sense for somebody who was so technical.”
San Francisco spent about US$900,000 cleaning up the mess caused by Childs’ actions, according to Assistant District Attorney Conrad Del Rosario.
Sentencing is set for June 14, he said.
Childs could be released immediately or face another year in prison before parole, depending on his sentence. He has been held in San Francisco county jail since his July 12 arrest on a $5 million bond.
Valerio Romano, one of Childs’ attorneys, says his client intends to appeal the decision.
Prosecutors argued that Childs was more concerned with job security than network security, and that he kept the network tightly locked down in order to make himself indispensable.
“This was nothing more than his attempt to become an indispensable employee,” Del Rosario said last week in closing arguments. “You suspend me; the FiberWAN goes down.”
But after the verdict, Childs’ Attorney Richard Shikman said that the city could have resolved the dispute without resorting to criminal charges. “I think this case called for prosecutorial restraint,” he said. “Cooler minds could have prevailed.”