Cyber-sleuth John Jorgensen gave the Sarasota city commissioners hopeful news Monday afternoon. While the criminal investigations into the city’s Information Technology Department continue, Jorgensen is hoping to put the computer systems back together.
It’s a tale of the straw that broke the camel’s back. A tip in October 2011 from former State Sen. Bob Johnson was the straw. He said senior city management was deleting emails. Jorgensen’s firm, Sylint, was hired in November to investigate.
“The back” came in January, when Jorgensen reported that more than 16,000 emails had been deleted from city computers. City commissioners called the FBI and the Florida Department of Law Enforcement, because some of the emails involved an investigation by the federal Department Housing and Urban Development.
These initial findings resulted in a power shift in City Hall, departure of senior officials, and investigation by state and federal agencies. The city manager resigned in February, and the IT department was reassigned from the City Manager’s Office to the Office of the City Clerk and Auditor. Sylint continued examining the city’s computer systems, finding obsolete software, insufficient hardware, untrained IT staff, and insecure systems.
The email software – Microsoft Exchange – “had not been updated for years,” Jorgensen said Monday. “To blithely run the update package could bring the entire system down.”
Under Sylint’s supervision, city IT staffers are bringing the system up-to-date.
“The actual functioning of email was not well understood by the IT department,” said Jorgensen. “Now we have people trained in the Exchange system, and should have the Exchange archive manager working within the next month.”
With the effort in full damage-control mode, Jorgensen strongly suggested the city begin to prepare for a cyber-attack. He pointed to Lake County, where organized hackers last month attacked the sheriff’s office and made off with “almost 60 gigabytes of data.” They then posted it on the Internet.
“That included ongoing cases and other sensitive data,” said Jorgensen. “It behooves all city and county governments to review their security posture.”
“We’ve been working diligently to put cyber-security in place for the city,” he said. “Rather than (spend time to) find lost emails, I suggest we address these security problems to keep the system up and running.”
Meanwhile, the FBI, Florida Department of Law Enforcement and the federal Department of Housing and Urban Development continue to investigate if and how confidential emails might have been accessed by unauthorized people.
Additionally, 124 people have applied so far for the job of former Sarasota City IT Director Craig Chance. A review panel of IT directors from Sarasota County, St. Petersburg and Sarasota Memorial Hospital, plus Frank Duran with L3 Communications and Jorgensen, will trim the list of applicants and recommend a replacement for Chance.
While the hardware and software issues can be understood in light of organizational inertia, the erasure of emails is different. That is the subject of state and federal investigation.
Mayor Suzanne Atwell asked Jorgensen whether the criminal investigations had turned up a smoking gun.
“I met with law enforcement last week. They’re finishing up their interviews,” he said. “I know they’ve opened up some different directions.”