DA Admits Error In Exposing SF Passwords

Childs, described by prosecutors as "the only system administrator" for San Francisco's wide area network (WAN) which links interdepartmental computers, was arrested July 12 and charged with four felony counts of computer network tampering and a fifth count of causing associated damages over $200,000. Superior Court judge Lucy McCabe last Wednesday denied the jailed Department of Technology (DOT) employee's motion to be released on his own recognizance or to have his $5 million bail setting reduced.

"Yes, there should have been better coordination between our department and the Department of Technology," DA spokeswoman Erica Derryck said, according to San Francisco Chronicle columnists Phillip Matier and Andrew Ross. "But at the end of the day, these pass codes are going to have to be changed as part of undoing a situation."

The list, entered as "Exhibit A" in prosecutor Conrad Del Rosario's opposition to Childs' bail motion, appears to map the specific City-maintained IP subnets associated with 137 VPN group usernames and passwords for various San Francisco departments, offices and commissions.

"Obviously it was not something we wanted in the public record," said Ron Vinson, deputy chief of the DOT, which manages the VPN.

The VPN codes are not the same as the network device passwords Childs is alleged to have withheld from DOT supervisors and police, the situation that led to his arrest. The device passwords, which Childs gave to San Francisco Mayor Gavin Newsom in a secretly-arranged jailhouse meeting last Monday, were needed to access configurations for five core Cisco-built devices at the heart of the City's FiberWAN network.

Prosecutors "rushed back to court Friday" to correct the mistake, according to Matier and Ross, though some media outlets, including ChannelWeb, possess the original opposition filing.

Next: Network Brought Down For First Time?