Posted 9/07/18 (Fri)
By Traci Papineau
Described as a limited and contained breach by City Attorney Liz Pendlay, most of Tioga’s commissioner meeting Sept. 4, centered on discussion of the recently discovered dissemination of Social Security and bank account numbers of employees in emails to city commissioners by Auditor Abby Salinas.
About a dozen current and former employees attended the meeting. Several who addressed the commission from the podium described the city’s efforts to rectify the error as too little too late.
“Shame on all of you,” Police Dispatcher Kelli Haider scolded the commissioners, for failing to recognize the risky procedure sooner.
Pendlay and Salinas explained the information has been distributed monthly in this fashion for years, as a part of a payroll report, predating Salinas’ arrival.
Mayor Drake McClelland verified that even monthly hard copy packets he received as a new commissioner years ago included Social Security numbers. McClelland said he recently burned those old packets, which previously had been secured in his home.
Pendlay informed the audience that all commissioners were instructed to immediately delete all electronic and hard copies of past monthly packets.
She added that the emails are accessed by commissioners on an internal government server with firewalls and other security measures.
Monique Lopez, former Tioga police officer acquitted of theft, addressed the commission in a lengthy appeal citing numerous infractions against policies in the employee handbook and calling for disciplinary action against Salinas.
“This did not happen accidentally,” Lopez said. “You should have known that this was private information,” she said, specifically to Salinas.
“I am a victim of this,” Lopez continued, having been accused of transferring money from a police department fund to her own bank account. She acquitted earlier this year, but lost her job once under investigation.
Former Police Chief Larry Maize and former Resource Officer Neil Rudnik approached the podium in support of Lopez, suggesting this security breach could be the source of accusations against her.
“I think she should be reinstated,” said Rudnik.
Municipal Judge Monica Sundhagen emotionally addressed the commission reporting she has been a victim of identity theft, fighting the problem since 2016.
“I truly am a victim of this,” said Sundhagen, “This has affected me for life.”
Pendlay encouraged Sundhagen and any other employee who suspect they have been a victim of identity theft currently and in recent years, to contact the Tioga police department to report the crime so it can be investigated.
Others spoke, either from the podium or from the audience, expressing dissatisfaction about the city’s failure to protect their information.
Pendlay and Salinas reported that corrective actions were taken immediately once the situation was brought to their attention by Commissioner Tim Sundhagen.
Besides having all commissioners destroy any electronic and paper copies, future informational packets sent to commissioners prior to meetings will not include the sensitive personal information.
An Aug. 22 letter went out first to current employees, and later, to past employees, outlining the discovery and steps taken to correct the breach.
Pendlay and Commissioner Heather Weflen both expressed that since the practice to include the confidential information in monthly commissioner reports has been a long standing practice, disciplinary action Salinas is not warranted.
“I don’t want anyone to think I take this lightly,” said Salinas, who explained that many common practices of the city prior to her arrival have been changed because they were incorrect.
Salinas was instructed to contact their payroll software program representative to make sure employee Social Security numbers no longer appear on pay stubs.
“To be fair to everybody, I don’t know that we can say with a degree of certainty that it’s not possible that there could be or has been a breach,” said Commissioner Sundhagen.
Pendlay interjected that no cases have been reported at this time.
A suggestion brought forward by Haider and others is for the city to pay for a yearly subscription to an identity theft protection program such as LifeLock for up to 10 years.
“It’s time to do something for your employees to show your support,” said Judge Sundhagen.
“We will think about it individually and we will bring it to the next meeting,” Commissioner Sundhagen added later, “Don’t let us forget about it.”
A special meeting scheduled Friday was set to determine what further action will be undertaken.
An update given on the recent break in and ransacking of city hall offices was given at the last Tioga city commission meeting.
The investigation has been concluded and Salinas reported that nothing had been taken.
Commissioner Sundhagen said that the lines of communication are broken between City Hall and the police department, which became evident in the wake of the break in. Most commissioners and the court employees were not immediately notified or called in to check their offices to see if anything was taken.
Pendlay suggested a communication protocol be established to be used in future incidents.
Judge Sundhagen expressed concern that no one other than her and the Clerk of Court should have access to her chambers. She questioned the commission on who has keys and how they are stored and protected.
Questions asked during discussing the break in revealed a lack of security cameras in city hall. Despite Pendlay’s warning to not publicly discuss security measures in place or not in place, concerns were expressed by commissioners and Judge Sundhagen for a need to assess and discuss increased security in the building.
Pendlay reported that a discussion of security protocols is protected and not to be discussed publicly to protect the city.
During Friday’s special meeting, commissioners intend to go into executive session to discuss security at city hall.