📋
Extraído del Informe Consolidado

Esta investigación fue publicada originalmente como parte de un informe consolidado más amplio que contiene múltiples investigaciones. Consulte el PDF consolidado para ver el documento completo.

Shasta County Grand Jury • 2008-2009

City of Redding Information Technology

15 pages
View PDF View Full Original

Findings 5 findings

F1 Page 42
Hardware/software: The AS400 computer system was introduced in 1988 and depends to a large degree on a programming language called RPG (Report Program Generator). RPG was first released in 1959 and was created for punch-card machines. City staff estimates that software to replace RPG would cost millions of dollars plus the cost of the new hardware that would be needed. City staff reports that, while so me of their equipment and s oftware may be old, they are acco mplishing their mission. However, two of the RPG-trained city programmers are due to retire in 2009, creating a void that the Grand Jury thinks will be very difficult to fill. The city’s personal co mputers run Windows 2000, XP or Vista operatin g systems. The city uses software programs for firewall protection and for prevention of unauthorized access from outside the city’s system. However, there is no pr oactive software installed on the city’ s computers that controls access to unauthorized or malicious Internet sites. Furthermore, the city’s computer system does not use filters that would inhibit access to Internet sites that may c ontain either malicious software or inappropriate content. In addition, there is no “t ime out” program on city computers that would blank the screens and lock the keyboards when the computers are idle, as when employees are away at lunch; thus the computers are left vulnerable to unauthorized access.
F2 Page 42
Policy: The City of Redding has regulated computer use since 1998, wh en a Redding Cit y Manager’s policy (CM 98-1) was created. The original CM 98-1 Policy prohibited transmission of non- city related information on city computers. After city employees misused the city’s computers in 2007, instead of reigning in personal use of city computers, the city revised and appa rently weakened CM 98- 1 by now allowing transmission of personal matters on city computers. Originally the policy stated: All software, data, reports, messages and information stored on local and network resources are the property of the City. Therefore, no data shall be removed or transmitted via e-mail or any method of electronic file transfer to any other agency or person unless it is for the sole purpose of completing City business. On April 14, 2008, after the misconduct became public, CM 98-1 was revised to read: All software, data, reports, messages and information stored on local and network resources are the property of the Cit y. Therefore, no data relating to t he conduct of City business (italics added) shall be removed or transmitted via e-mail or any method of electronic file transfer to any other agency or person unless I.T. is for the sole purpose of completing City business. Research into the polic y of other governmental agencies revealed that Shasta County, the Shasta County Superior Court, t he County of Los Angeles and several state agenci es prohibit u se of their computers for personal reasons. The 2008 re vision of C M 98-1 also banned “Excessive use f or personal matter s unrelated to City business,” but the term “excessive” is not defined in the policy. The Grand Jury also finds that the current computer use policy includes complicated language such as the following: All electronic communications to, from, between or among any City officials or employees by use of an electronic co mmunication system to facilitate any business of the City, where it is neither nece ssary nor intended that the info rmational content of the communication be preserved for future City use or refere nce, may be deleted from the City’ s computer system without preserving the informational content of the communication or any portion thereof, unless (1) a law expressly requires such communication to be kept; or (2) preservation of th e communication is necessary or convenient to the discharge of the public officer’ s or employee’s duties and the communication was made or retained for the purpos e of preserving this informational content for future City use or reference. In 2008, city department managers were directed to discuss with staff the city’ s policies on co mputer use. Later in the year the city manager decided that CM 98-1 should be converted to a personnel policy, and in October the policy entitled, “Policy Regarding Use of Computers and Management of Electronic Records” was added to the Personnel Policies and Procedures Manual. City management also decided that all employees should be reminded annuall y of several i mportant policies. On October 19, 2008, the personnel director sent th e co mputer use policy t o all city employees. The employees were directed to read th e policy, sign an acknowledgment form and return the form to the personnel department by November 15, 2008. However, as of February 24, 2009, more than 100 employees still had not returned the acknowledgment.
F3 Page 43
Personal use of computers by city personnel: The misconduct that occurred within city hall in 2007 included transmission of thousan ds of personal e-mails that perpetuated relationships and that were often sexually explicit. As a result of the misconduct four city employees resigned, two received suspensions, and two received written reprimands. Two of the employees investigated were quoted as saying “…putting the ha mmer down on all of the se e-mails would be the best thing,” and “I am confident that city officials would be stunned if they were to investigate the level of personal use of computers which occurs on a dail y basis citywide.” One employee expressed shock “about the city’s lackadaisical attitude on inappropriate e-mail usage.” 43 During its investigation the Grand Jury found t hat most of the city employees interviewed could not define specifically what is meant by “excessive” in the city’s computer use policy and think that the y are allowed minimal personal use of city com puters. Some employees consider online shopping and reading non-work-related e-mail as acceptable personal uses of the city’s computers.
F4 Page 44
System administration: The City of Redding does not audit e-mail messages of city employees and does not archive or store e-mail messages for more than several weeks. Most employees have Internet access from their city computer. City supervisors do not monitor Internet usage, and there is no system to prevent employees from viewing inappropriate sites. The common games that come installed on a typical computer are not removed from city computers before they are placed into service. City staff estimated an archiving sy stem for e-mail storage would cost approxim ately $50,000. Staff ha s considered Internet tracking software and barriers to unauthorized sites, but they think that the costs of the equipment are prohibitive.
F5 Page 44
Security/redundancy: The city’ s primary central computer systems are located in a room at city hall deep within a complex of offices not accessed by the public and an ancillary computer room is off a main hallway. When the Grand Jury visited city hall, however, the primary computer room was not locked, and there appeared to be minimal access control; on the ot her hand, the ancillar y room was locked and unmarked. There is a similar but smaller computer room at the Redding Police Department. This room is locked, and no unauthorized entry is allowed. All three computer rooms are individually climate-controlled and equipped with special fire suppression equipment. The city’s computers contain a large amount of data relating to the city’s residents and to the operation of the city. The data from the computer is backed up daily on tape which is delivered to the Redding Police Department for sa fekeeping. The tapes ar e stored within a locked c ontainer in the locked computer room. However, there are no computers at the police station capable of running the city’s operations. City staff indi cated that, if a catastrophi c failure were to occur at city hall, replacement computers would be requested from outside the city and that it could take several day s before the city could access its data. City I.T. staff are currently working with the local emergency dispatch and communication center (SHASCOM) on a redundant computer system that would provide continuity in the event of a disaster. If commercial power is lost, city hall can be powered by an on-site emergency generator. The computer room at city hall is equipped with a battery uninterrupted power supply (UPS) that keeps the computer system operational until t he emergency generator c an provide power. This generator is fueled by a natural gas line supplied by Pacific Gas and Electric. The computer room at the police station also is equipped with a battery UPS, and an on-site emergency backup diesel-fueled generator is available.

Recommendations 11