How one network engineer locked San Francisco out of its own network

In July 2008, the city of San Francisco discovered that only one employee could run the network linking its government departments, and he would not share the passwords.^[1][2] This case file covers how a single network engineer ended up holding the city's network to himself, what the standoff cost, and the one control that would have made it impossible.

What happened

How it worked

There was no break-in and no malware. The city had allowed one person to become the only holder of the administrator passwords for critical network equipment.^[1][2] As long as Childs kept those to himself, no one else could log in to change settings, fix faults or even confirm how the network was built.

Childs argued he was protecting the network. His defense said he may have been paranoid about keeping it safe, but that the network itself had never been at risk, and he maintained that his supervisor was not qualified to have the passwords.^[1][2] Prosecutors painted a different picture, describing him as a man who could not be managed.^[1]

Either way, the city's problem was structural. When a single person controls every key, the organization's access depends on that person's goodwill, health and availability. A resignation, an accident or a dispute can all produce the same lockout.

What it cost

On April 27, 2010, after a week of deliberation, a jury convicted Childs of felony denial of computer access, a charge that carried up to 5 years in prison.^[2] On August 6, 2010, a judge sentenced him to 4 years in state prison. He had already spent 755 days in county jail, which counted toward the term.^[1]

The city said it spent about $900,000 regaining control of its network, and a restitution hearing was scheduled after sentencing.^[1] The case also cost time and trust: officials spent days unable to manage a network that ran core public services, and the trial became a nationwide argument about who really owns a system, the person who built it or the organization that paid for it.

The missing control

The missing control: no single person with sole admin control. The city let one engineer become the only holder of the administrator passwords for its core network, with no copy held anywhere else.

If the passwords had been stored in a sealed, access-logged vault, with at least one other trusted person able to open it, Childs's refusal would have been an HR problem, not a citywide crisis. Managers could have changed the passwords the same day. A standing rule that no system may depend on one person would also have flagged the danger nearly 2 years earlier, when he first refused to share them on that conference call.^[2]

What to do in your business

• Find your single points of failure. List the systems where only one person knows the admin password: website, email, domain name, router, bank portal, payroll. Each one is a risk.
• Store master passwords in a shared vault. Use a business password manager or a sealed envelope in a safe, so an owner or second trusted person can always get in.
• Keep the business as the account owner. Domain names, cloud accounts and software licenses should be registered to the company and a company email, not to a staff member's personal address.
• Treat a refusal as a red flag. If anyone, including a contractor, resists sharing access or documenting how things work, deal with it right away rather than waiting for a crisis.
• Plan for departures. Have a written checklist for when an IT person or contractor leaves: collect passwords, change them, and confirm you can log in to everything.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.