The Carmel Pine Cone's first story of the week

Previous Home Next

Mayor: IT investigation found big problems


Published: Nov. 29, 2013

CITY EMPLOYEES received pay raises without authorization, provided privileged information to outsiders, kept encrypted files on their work computers, downloaded and used software designed to elude computer forensics and engaged in other questionable activities, Carmel Mayor Jason Burnett and councilman Ken Talmage said this week.

The details emerged as a thorough investigation into the city’s 20-year-old computer systems and their use “is largely complete,” Burnett said.

Their comments were the first real steps the city has taken to explain the disciplinary measures taken in recent months against numerous municipal employees that has caused a lot of uncertainty and upset among the public.

But Burnett said the actions, and the secrecy surrounding them, were necessary.

“Seeing the information that we’ve seen, if we were not taking action, that would have been a real problem,” he said. Since state law gives employees extensive privacy protection, and because the investigations were ongoing, it wasn’t possible to offer an explanation earlier, he added.

Neither Burnett nor Talmage would discuss any of the employees who have been placed on paid administrative leave during the past year: IT manager Steve McInchak, whose home was searched by police under the eye of CPD Chief Mike Calhoun and administrative services director Susan Paul in June; his assistant, Rose Franzen; and administrative coordinators Margi Perotti and Leslie Fenton, who worked in the planning and building department until they were placed on leave at the end of October.

“The overall finding was the city’s computer system was not protected or secure,” Talmage said. “We’re not going to talk about people.”

In the wake of those suspensions, as well as the firings of building official John Hanson and children’s library employee Linda Macdonald, and the disappearance of former deputy city clerk Molly Laughlin from city hall, city officials have been tight-lipped for months.

Burnett said it was because they had to be, but with the investigation coming to a close, more can be said about what was found.

“It’s the city council’s and my job to communicate with the community, and I realize we need to do a better job doing that. We have an ongoing investigation that’s now wrapping up, so we’re able to say more today than we were a few days or a few months ago,” he said. “We have intentionally held off until we could be at a stage where we could have this conversation.”

Talmage provided some examples of the sorts of problems the investigation revealed.

“There were encrypted files found on the city’s computer system, anti-forensic software was found on the city’s system that erases where you’ve been on the system, and there was information turned over to non-city employees without authorization,” he said.

Furthermore, “there is a specific process for all pay raises, and there was a series of pay raises that did not follow that process and were done without management or employees’ signatures, and with a rubber stamp.”

“Those are examples,” he said. “There are weak internal controls.”

Burnett said he could conceive of no reason for the encrypted files, which were shielded at a level high enough to prompt the city to ask the FBI for help uncovering them.

“I can’t understand why there would be a legitimate reason for that,” he said.

Not only are the systems old, they don’t work with each other, so the systems used in finance and accounting don’t communicate with those used by the planning department, for instance. That so many different systems are used by the city explains why the investigation has taken so long and cost so much money, and generated a lot of paperwork, according to Talmage. “For one situation, we have a pile that’s 800 pages thick,” Burnett said.

Investigations cost plenty

Since he was hired by the city in February, forensic computer investigator Mark Alcock has been working on the case against McInchak — which has yet to be submitted to the Monterey County District Attorney’s Office — and other incidents, as well as IT services. He was paid $10,958 in May, $32,026 in June, $21,780.54 in August and $60,346 in September, for a total of $125,110.54.

Other investigators, including Richard Lee Investigations and RSC Investigations & Consulting LLC, appear on the October check register, for $3,121.88 and $4,777, respectively, though it’s unknown whether they are investigating employees or other targets. (Questions to that effect went unanswered Wednesday.)

“I made a commitment to communicate as much as possible about what’s going on at city hall. There were more limitations on what we could say a few months ago than there are now, and I anticipate there will be more we can say in a month,” Burnett said.

He also said city administrator Jason Stilwell, who has been overseeing the investigations and suspensions, “is doing the job that we want him to be doing.”

“And I think we’re doing the job that the community wants us to do, but if people disagree with that, hang that on me,” he said. “If we saw what we’ve seen and we didn’t take action, that would be a problem.”