The head of the state’s new government accountability office in recent days ordered the seizure of a computer from the state’s elections enforcement agency — a move that a top election enforcement official calls a “major security breach” because the computer might “contain sensitive and confidential investigatory data.”
The episode reawakens a controversy over Gov. Dannel P. Malloy‘s creation three years ago (with approval by the Democrat-controlled legislature) of the Office of Governmental Accountability. The OGA absorbed nine watchdog agencies under an administrative structure headed by a gubernatorial appointee.
The OGA’s creation was protested by representatives of the three main watchdogs that previously had operated independently of the governor’s office — the Freedom of Information Commission, the Office of State Ethics and the State Elections Enforcement Commission (SEEC). Their representatives, and Republican legislators, argued that the governor should have no authority over agencies whose job involves being watchdogs over him and members of his administration.
Malloy administration officials dismissed those claims, saying that the OGA would save money by consolidating “back-office” operations, and would not interfere in, or conflict with, the watchdog agencies’ operations.
But now such a conflict is being alleged. The controversy is laid out in communications among state officials — emails and a letter — that were obtained by The Courant under the Freedom of Information Act. According to those documents, here’s what happened:
Shelby J. Brown, executive administrator for the governmental accountability office, ordered one or more of her staff employees to enter the State Elections Enforcement Commission office Tuesday and remove a computer from the desk of a former SEEC employee. The reason, she told the SEEC afterward, was that the device was found to contain 17 commercial movies and software for viewing them.The employee had left the SEEC last year to take a job outside government service, but now has reapplied to the agency and has been in the process of being rehired by the SEEC’s executive director, Michael Brandi.
No information is available yet as to who downloaded the movies or when it happened.
“During a routine post-employment process, we discovered an unusual number of very large files” on the computer, Brown wrote to Brandi on Tuesday. “Taking a closer look, we learned that those files were seventeen commercial movies and a software application for viewing the movies. None of which appear to be relevant to the performance of his job.”Brown named the former employee in the letter — and sent copies of it to the state Auditors of Public Accounts, the state comptroller and a top personnel official at the Department of Administrative Services.
Brandi responded sharply later Tuesday. In an email to an OGA subordinate who Brown recommended that he contact, Brandi wrote that the computer was confiscated “without my knowledge and consent,” and that he, as the head of a law enforcement agency, was responsible for its custody and security.
Brandi wrote: “I understand the HR issue based upon Ms. Brown’s correspondence of March 3, 2015, however, that unit may also contain sensitive and confidential investigatory data which are privileged and belong to SEEC.” He said he had received no request for “permission to remove this property from SEEC offices and this activity constitutes a major security breach.”
Brandi asked that “the unit be returned to my office immediately so that I can secure it under lock and key pending any investigation. As I am sure you are aware, the unauthorized access to the unit and improper removal from SEEC offices has already created a chain of custody and spoliation of evidence problem for any investigation or legal action contemplated” by the SEEC on a potential enforcement matter.
“If you are not in possession of the equipment, please inform me immediately so that I can contact the State Police and report it as stolen property as I am required to do under law.”
Brandi also emailed Anthony Castagno, chairman of the SEEC, saying: “There are many issues I have with the OGA in the manner in which they are handling this situation, notably that they have no conclusive proof of any wrongdoing, just allegations. Also, when did they access [the former employee’s] computer in his office without anyone at SEEC knowing?”
Brown responded, still later on Tuesday: “Michael – Under my direction, my staff took possession of the computer in question, as I notified you that we are obligated to do. The computer has been preserved under lock and key. We intend to retain it as such until we receive further direction from the State Auditors who have been copied on the letter. If you need to expedite their process, please feel free to contact either of the auditors addressed in the carbon copy section of my letter. – Shelby.”
Sources said that after further back-and-forth, it was agreed Thursday that the computer would be turned over to the office of the state’s top prosecutor, Chief State’s Attorney Kevin Kane. Kane confirmed Friday that “we are holding it in the interest of preserving the chain of custody.”Late Friday, Brown offered a detailed explanation for her actions in an email to The Courant. She said that under the 2011 law that established the OGA, the superagency provides “human resources … and associated information technology services” to the watchdog agencies that now are its “divisions.”
She said that ordinarily her office “does not get involved in information technology” inside the SEEC. “However,” she said, “we do provide support to them upon request. It was a request for support that resulted in the current case.”
On Dec. 24, an information technology analyst at the SEEC asked for help from Brown’s office “with imaging the computers of three employees who had separated from the division.” She sent a copy of the “Help Desk ticket” to The Courant.
Brown said that her office considered this “to be a routine post-employment action” and performed the requested work. During that process, “the unusual files were found on the computer of an information technology employee who had separated from Elections Enforcement in September 2014. We discovered the unauthorized files on January 13, 2015; no action was taken at that time.”
She added that the computer in question “was located by my staff in an unlocked (open) office accessible to anyone who entered the office suite. So far as I can determine, the computer has been in that unsecured location for the several months between the employee’s separation and [Brown’s office’s] retrieval of it. It is not discernible whether the computer has been accessed in that period of time.
“If the Executive Director of SEEC suspected that the computer ‘may also contain sensitive and confidential investigatory data which are privileged and belong to SEEC’, why would he not have taken measures to lock the computer away before now? Why would ‘sensitive and confidential investigatory data’ reside on the hard drive of a computer not assigned to someone in the investigatory process? State IT policy and best practice direct that employees not store data on the local hard drive of a computer when a network drive is available, although SEEC’s practice may be different.”
She said that “contrary to his report, Mr. Brandi was notified that the computer appeared to contain extensive unauthorized material.” She said her office “has an obligation to advise him in making sound business decisions, as he considers staffing his division and using the resources allocated to his division. I would hope that he would be interested in knowing the extent of any potential misuse of state property, and that he would view any misuse as a relevant consideration in evaluating a former employee’s wish to return to State employment. I would also hope that he would seek to collaborate with his human resources business partners.”
The OGA has not achieved significant cost savings so far — not, at least, in the context of a $20 million-plus annual state budget. What it has produced is continual conflict over the powers of the executive administrator. The office’s first administrator, David Guay, fought against the efforts of the Governmental Accountability Commission — an oversight board that includes representatives of each of the nine watchdog agencies — to evaluate his performance.
He left the job more than a year ago, and was replaced in January 2014 by Brown, who had been an administrator within the state’s higher education agency. She was ranked first of five finalists by the Governmental Accountability Commission, which screened and interviewed candidates and sent the names to the governor. Malloy could have appointed any of the five and chose Brown for the $124,000-a-year job.
South Windsor Police Chief Matthew Reed was the second-ranked finalist on the list.
Documents show that Brown’s relations with the Governmental Accountability Commission have sometimes been difficult.
Castagno, the chairman of the SEEC, also serves as chairman of the Government Accountability Commission. Reached by The Courant, Castagno said, “Now that the appropriate state authorities have become involved, I am looking forward to a resolution.”
Copyright © 2015, Hartford Courant
