Legal Commentary

DA in SF Makes City Passwords Public

By TChris

Readers who have computer security expertise might be able to shed some light on whether it was smart of the San Francisco District Attorney's office to make public "150 usernames and passwords used by various departments to connect to the city's virtual private network" (VPN).

The passwords were filed this week as Exhibit A in a court document arguing against a reduction in $5 million bail in the case of Terry Childs, who is accused of holding the city's network hostage by refusing to give up administrative networking passwords. Childs was arrested July 12 on charges of computer tampering and is being held in the county jail.

While "city prosecutors do seem to think that they are sensitive," the disclosure seems difficult to reconcile with claims that the City is making against Childs. [more ...]

The passwords, discovered on Childs' computer, pose an "imminent threat" to the city's computer network, according to the court filing. Childs could use the names and passwords to "impersonate any of the legitimate users in the City by using their password to gain access to the system," the motion against the bail reduction states.

The passwords are used for logging into the City's VPN, and they require a second password to access the network. Childs had the passwords because he was the City's network administrator.

Rather than arguing against a bail reduction for a man who allegedly committed a nonviolent crime, the City ought to change the passwords, especially now that it made the "phase one" passwords a matter of public record.

To change the passwords, the city will have to reconfigure the VPN software running on every PC that connects remotely, which it has not yet done, the source said. Some of the passwords would benefit from a change because they are identical to the VPN log-in name or extremely easy to guess.

It would have been easy for the District Attorney's office to file the passwords under seal, thus keeping them out of the public record, accompanied by a motion asking the judge to keep them under seal. It's difficult to believe that motion wouldn't have been granted.

Full post as published by TalkLeft on July 26, 2008 (boomark / email).