Nothing happens in a vacuum. So it may be worth asking what IT professionals can learn from Terry Childs.

The case, you'll recall, started back in July 2008, when Childs, then 43 and a longtime city employee, refused to hand over the passwords to the city's fiber optic network after his bosses requested them. Childs, who had helped build the network, had been making weird threats and acting strangely -- e.g., barring anyone but himself from administrative access.

Police carted Childs off to jail, where he was at first charged with data tampering and held on $5 million bail. There, he continued to refuse to give up the passwords to the city and county system. It took a jailhouse visit from San Francisco Mayor Gavin Newsom for Childs to relinquish the codes.

City officials said they spent hundreds of thousands of dollars attempting to retrieve the passwords, including paying hefty fees to security experts from network supplier Cisco Systems Inc. (Nasdaq: CSCO).

Childs's bail was never lowered, especially once a prior criminal record came to light, which included jail time spent for aggravated burglary and robbery with use of a knife.

Fast forward: Despite the many charges bandied about by lawyers, citizens, and interested observers, the jury this week found Childs guilty of just one felony count for denying computer access to the service he was entrusted to provide to the city.

Childs, who has already served 21 months of a possible five-year term, may even be released once sentencing takes place June 14.

Surely a case of this scale holds some lessons for anyone working in enterprise IT. Let's take a look at just a few of them:

Don't brook petty tyrants. There are some who claim that Terry Childs was a victim of poor management, an IT working stiff simply trying to do the best job he could. At least one of the real jurors in the case, along with someone representing himself as a juror on Slashdot, say the city had inadequate security policies. Whatever the truth, it's clear that somehow the organization supported the rise of Childs as a single point of human failure and threat.

"I think the biggest lesson for enterprises in this affair is the danger of allowing employees of any sort, not just IT staffers, to establish personal fiefdoms," states Charles King, principal analyst of Pund-IT Inc. , in an email today. "I believe that many if not most people have stories of co-workers who operated as if their corner of the office operated by different rules than the rest of the organization. Though Childs is certainly an extreme case, the problems he was allowed to create and the criminal results qualify as a great example of poor business practices gone disastrously bad."

Know your people. Terry Childs had plenty of time to behave bizarrely enough to prompt an investigation, with a clear track record for being temperamental to the point of criminality. Someone wasn't minding the HR store.

Watch for warning signs of IT trouble. Apparently, there was evidence that Childs was rocketing toward a confrontation with his management. But somehow, action was deferred until the situation had reached critical mass. As ThinkerNetter Ira Winkler noted last year, it's not uncommon for troubled people in IT to show signs of odd behavior far enough in advance for management to act.

Indeed, the power-driven IT maverick is a recognizable archetype, according to Mary E. Shacklett of Transworld Data. "As a technical discipline, IT has struggled for years to 'keep a balance' between not offending employees with highly specialized technical knowledge that no one else on staff knows. These employees understand their leverage and often are unwilling to share their knowledge with others. Like Terry Childs, they end up in positions where they can, not only contribute to, but threaten the functions of entire organizations. The issue is so difficult that it is now on the audit lists for most IT organizations under the topic of 'risk management.' "

Get your security act together, and set policies to keep it together. When the Childs case emerged, some observers, including ThinkerNetter Paul Doyle, viewed it as a security problem -- the "insider threat." It was a wakeup call for IT managers everywhere to focus on security inside as well as outside the firm.

Don't rely on vendors to manage IT problems. When Childs refused the network passwords, the city was helpless. It turned, not to other trusted workers in house, but to Cisco, which charged hundreds of thousands of dollars to hack out access. Sure, this was a sensible and understandable strategy; but in retrospect, it should not have been necessary. If the city had set up adequate policies and procedures, network access wouldn't have wound up in the hands of one person.

These aren't the only lessons from this case. Others will continue to play out. At least one industry observer thinks we may even find out there was more to the story. "The real story here is not being talked about," writes analyst Greg Schulz of the Server and StorageIO Group, in an email. "I’m more interested in the story behind the story, which is, What was Terry so concerned about, and why couldn’t the city enlist some resources to bypass the security?"

— Mary Jander, ThinkerNet Editor, Internet Evolution

This blog is part of Internet Evolution's IT Clan, which addresses the continuing impact of the Internet on enterprise networks, applications, and management. Register here to join the IT Clan's conversation, and you just might win something unspeakably cool.