📋
Extracted from Consolidated Report
This investigation was originally published as part of a larger consolidated report containing multiple investigations. View the consolidated PDF for the complete document.
Shasta County Grand Jury
• 2008-2009
City of Redding Information Technology
⚠️ Translation Notice: This content has been automatically translated. The original English text is the official version. Translation may contain errors.
⚠️ Este contenido ha sido traducido automáticamente. El texto original en inglés es la versión oficial. La traducción puede contener errores.
Findings 5 findings
F1
Page 42
Hardware/software: The AS400 computer system was introduced in 1988 and depends to a large degree on a programming language called RPG (Report Program Generator). RPG was first released in 1959 and was created for punch-card machines. City staff estimates that software to replace RPG would cost millions of dollars plus the cost of the new hardware that would be needed. City staff reports that, while so me of their equipment and s oftware may be old, they are acco mplishing their mission. However, two of the RPG-trained city programmers are due to retire in 2009, creating a void that the Grand Jury thinks will be very difficult to fill. The city’s personal co mputers run Windows 2000, XP or Vista operatin g systems. The city uses software programs for firewall protection and for prevention of unauthorized access from outside the city’s system. However, there is no pr oactive software installed on the city’ s computers that controls access to unauthorized or malicious Internet sites. Furthermore, the city’s computer system does not use filters that would inhibit access to Internet sites that may c ontain either malicious software or inappropriate content. In addition, there is no “t ime out” program on city computers that would blank the screens and lock the keyboards when the computers are idle, as when employees are away at lunch; thus the computers are left vulnerable to unauthorized access.
F2
Page 42
Policy: The City of Redding has regulated computer use since 1998, wh en a Redding Cit y Manager’s policy (CM 98-1) was created. The original CM 98-1 Policy prohibited transmission of non- city related information on city computers. After city employees misused the city’s computers in 2007, instead of reigning in personal use of city computers, the city revised and appa rently weakened CM 98- 1 by now allowing transmission of personal matters on city computers. Originally the policy stated: All software, data, reports, messages and information stored on local and network resources are the property of the City. Therefore, no data shall be removed or transmitted via e-mail or any method of electronic file transfer to any other agency or person unless it is for the sole purpose of completing City business. On April 14, 2008, after the misconduct became public, CM 98-1 was revised to read: All software, data, reports, messages and information stored on local and network resources are the property of the Cit y. Therefore, no data relating to t he conduct of City business (italics added) shall be removed or transmitted via e-mail or any method of electronic file transfer to any other agency or person unless I.T. is for the sole purpose of completing City business. Research into the polic y of other governmental agencies revealed that Shasta County, the Shasta County Superior Court, t he County of Los Angeles and several state agenci es prohibit u se of their computers for personal reasons. The 2008 re vision of C M 98-1 also banned “Excessive use f or personal matter s unrelated to City business,” but the term “excessive” is not defined in the policy. The Grand Jury also finds that the current computer use policy includes complicated language such as the following: All electronic communications to, from, between or among any City officials or employees by use of an electronic co mmunication system to facilitate any business of the City, where it is neither nece ssary nor intended that the info rmational content of the communication be preserved for future City use or refere nce, may be deleted from the City’ s computer system without preserving the informational content of the communication or any portion thereof, unless (1) a law expressly requires such communication to be kept; or (2) preservation of th e communication is necessary or convenient to the discharge of the public officer’ s or employee’s duties and the communication was made or retained for the purpos e of preserving this informational content for future City use or reference. In 2008, city department managers were directed to discuss with staff the city’ s policies on co mputer use. Later in the year the city manager decided that CM 98-1 should be converted to a personnel policy, and in October the policy entitled, “Policy Regarding Use of Computers and Management of Electronic Records” was added to the Personnel Policies and Procedures Manual. City management also decided that all employees should be reminded annuall y of several i mportant policies. On October 19, 2008, the personnel director sent th e co mputer use policy t o all city employees. The employees were directed to read th e policy, sign an acknowledgment form and return the form to the personnel department by November 15, 2008. However, as of February 24, 2009, more than 100 employees still had not returned the acknowledgment.
F3
Page 43
Personal use of computers by city personnel: The misconduct that occurred within city hall in 2007 included transmission of thousan ds of personal e-mails that perpetuated relationships and that were often sexually explicit. As a result of the misconduct four city employees resigned, two received suspensions, and two received written reprimands. Two of the employees investigated were quoted as saying “…putting the ha mmer down on all of the se e-mails would be the best thing,” and “I am confident that city officials would be stunned if they were to investigate the level of personal use of computers which occurs on a dail y basis citywide.” One employee expressed shock “about the city’s lackadaisical attitude on inappropriate e-mail usage.” 43 During its investigation the Grand Jury found t hat most of the city employees interviewed could not define specifically what is meant by “excessive” in the city’s computer use policy and think that the y are allowed minimal personal use of city com puters. Some employees consider online shopping and reading non-work-related e-mail as acceptable personal uses of the city’s computers.
F4
Page 44
System administration: The City of Redding does not audit e-mail messages of city employees and does not archive or store e-mail messages for more than several weeks. Most employees have Internet access from their city computer. City supervisors do not monitor Internet usage, and there is no system to prevent employees from viewing inappropriate sites. The common games that come installed on a typical computer are not removed from city computers before they are placed into service. City staff estimated an archiving sy stem for e-mail storage would cost approxim ately $50,000. Staff ha s considered Internet tracking software and barriers to unauthorized sites, but they think that the costs of the equipment are prohibitive.
F5
Page 44
Security/redundancy: The city’ s primary central computer systems are located in a room at city hall deep within a complex of offices not accessed by the public and an ancillary computer room is off a main hallway. When the Grand Jury visited city hall, however, the primary computer room was not locked, and there appeared to be minimal access control; on the ot her hand, the ancillar y room was locked and unmarked. There is a similar but smaller computer room at the Redding Police Department. This room is locked, and no unauthorized entry is allowed. All three computer rooms are individually climate-controlled and equipped with special fire suppression equipment. The city’s computers contain a large amount of data relating to the city’s residents and to the operation of the city. The data from the computer is backed up daily on tape which is delivered to the Redding Police Department for sa fekeeping. The tapes ar e stored within a locked c ontainer in the locked computer room. However, there are no computers at the police station capable of running the city’s operations. City staff indi cated that, if a catastrophi c failure were to occur at city hall, replacement computers would be requested from outside the city and that it could take several day s before the city could access its data. City I.T. staff are currently working with the local emergency dispatch and communication center (SHASCOM) on a redundant computer system that would provide continuity in the event of a disaster. If commercial power is lost, city hall can be powered by an on-site emergency generator. The computer room at city hall is equipped with a battery uninterrupted power supply (UPS) that keeps the computer system operational until t he emergency generator c an provide power. This generator is fueled by a natural gas line supplied by Pacific Gas and Electric. The computer room at the police station also is equipped with a battery UPS, and an on-site emergency backup diesel-fueled generator is available.
Recommendations 11
-
R1Page 41The Grand Jury recommends that the City of Redding modify its computer usage policy to prohibit personal use of city computers and to require random audits of e-mail. 44
-
R2Page 41The Grand Jury recommends that the City of Redding restrict access to inappropriate Internet sites and monitor city employee Internet activity.
-
R3Page 41The Grand J ury recommends that the City of Re dding institute automatic “time-outs” o n city personal computers. “Time-outs” either blank the screen or invoke a screen saver and lock the keyboard when the computer is not in use for a specific period of time.
-
R4Page 41The Grand Jury recommends that the City of Redding archive all e- mail traffic for a period of at least 12 months in order to monitor the appropriateness of e-mail.
-
R5Page 41The Grand Jury recommends that the City of Redding begin now either to phase-out or to replace software that is dependent upon the RPG programming language.
-
R6Page 41The Grand Jury recommends that the City of Redding simplify and make more specific its policy on computer usage.
-
R7Page 41The Grand Jury recommends that the city hall computer room remain locked at all times to prevent unauthorized access.
-
R8Page 41The Grand Jury recommends that the generator at city hall be fueled by either propane or diesel fuel to provide continuity during an emergency if natural gas lines are disrupted.
-
R9Page 41The Grand Jury recommends that the City of Redding establish a tracking sy stem to document which employees have read and agreed to abide by the computer policy.
-
R10Page 41The Grand Jury recommends that the City of Redding remove games from personal computers before placing them into service.
-
R11Page 41The Grand Jur y recommends that the City of Redding reprioritize its I.T. bu dget to pay for the previous recommendations, possibly taking from funds allocated for overtime, consulting services, or office equipment maintenance/repair. Responses Required: The City of Redding City Council as to Recommendations 1 through 11. Method of Inquiry: The Grand Jury interviewed: City of Redding City Manager City of Redding Support Services Director City of Redding Personnel Director 45 City of Redding Chief of Police Redding Police Department captain City of Redding technology manager Shasta County Chief Technology Officer City of Redding information technology supervisor City of Redding management analyst II City of Redding building inspector The Grand Jury reviewed: City of Redding policies for use of computers and management of electronic records, employee conduct and honesty and discipline Redding Police Department policies relating to use of the police radio, police officer minimum performance standards, and harassment in the workplace Shasta County policy on electronic assets and in formation security, pre-login warning to all employees signing on t o their computers, and an acknowledgment form regarding e-mail and Internet access monitoring An agreement for the operation of the Integrated Public Safety System (IPPS) An IPPS security clearance signature form A document titled, “Preparation of a Plan for Upgrade and Expansion of Mobile Digital Data” dated Dec. 2, 2008 City of Redding form titled, “City of Redding Receipt for Personnel Policies” City of Redding Internal Communication relating to personnel policies dated Feb. 24, 2009 City of Redding budget for the Infor mation Technology Division of the Support Servi ces Department A list of Cit y of Redding personnel who had not acknowledged receipt of policies, dat ed February 24, 2009 Numerous documents prepared by a private investigator relating to City of Redding employee misconduct and misuse of city computer systems in 2007 Three Redding Record Searchlight articles dated Sept. 14, 2007 and May 4, 2008 46 California Department of Transportation Dir ector’s Policy 17R, Information Technology and computer network and Internet access guidelines California Highway Patrol network security and administration policy, Chapter 2 of Highway Patrol Manual 40.4 and form CHP 101, appropriate use of automated information and systems statement Los Angeles County Board of Supervisors policies 6.105 and 6.101, Internet usage policy and policy on the use of county information technology resources; and an employee agreement for acceptable use and confidentiality of Los Angeles County’s information technology assets Two Shasta County Superior Court memoranda relating to e-mail and Internet use California Office of Information Security and Privacy Protection website, www.oispp.ca.gov California State Administrative Manual, www.sam.dgs.ca.gov SANS Institute Web site, www.sans.org Municipal Information Systems Association of California Web site, www.misac.org California Counties Information Services Directors Association Web site, www.ccisda.org 47 48 49 50 51 52 53 54 55
Agency Responses 2
Government agencies' official responses to this report's findings and recommendations. Click on a response to see the structured breakdown.