Response Form Grand Jury Report Title: Mendocino County Policy 22 – Who Has Access?*

Policy 22 is obsolete and requires updating and formal adoption by the BOS. The Board of Supervisors disagrees with F1. The policy is adequate for its stated purpose which relates to the procurement of information services equipment and information. The Board of Supervisors does agree with the need to develop a formal policy that clarifies and updates current procedures for access to county employee email accounts.

The current Unlimited Mailbox software does not adequately allow for super-user segregation of certain sensitive email accounts; e.g. Sheriff, DA, County Counsel, Board of Supervisors, Grand Jury. The Board of Supervisors disagrees with F2. The Board of Supervisors is not aware of any information that indicates that current procedures allow for unwarranted access to employee email accounts. As explained in the CEO response, only the Information Services (IS) Division Manager and two IS Network Systems Analysts, acting in the capacity of Archive Mail Auditor are allowed access to all archived email. The typical application of this access is to fulfill Public Records Act and litigation related requests pursuant to requests that have been submitted through County Counsel or the Executive Office. As further explained in the CEO response, limited access to individual email accounts may be granted to managers, typically in cases of absence due to vacation or illness, but also for management purposes related to termination or investigation. In such instances, the manager must request approval for access to the emails of a specific employee from the IS Division Manager.

The limitations of the County email software that allows unrestricted super-user to employee email by County management puts the County as risk for violating the protected nature of some communications, lends itself to abuse by County management, and exposes the County to unnecessary liability. The Board of Supervisors disagrees with F3. As explained in F2, only the IS Division Manager and two IS Network Systems Managers, in their capacity as Archive Mail Auditors, have unrestricted access to all archived email. The opportunity to violate policy and procedure does exist, just as it does within other departments where employees have access to confidential information, but the Board of Supervisors agrees with the CEO's response that current procedures minimize the risk of inappropriate access.

The current bargaining ground rule that allows employee access to the County's email system for the purposes of bargaining is in direct conflict with provisions of Policy 22, which does not permit email use for non-county business. The Board of Supervisors disagrees entirely with F4. As explained in the CEO's response, there are no "current bargaining ground rules", employee access to the County email system for purposes of bargaining is not in conflict with Policy 22, and bargaining is considered county business. In practice, the BOS is doubtful that "bargaining", as such, is conducted by county employees using county email. However, it is a convenience for employee bargaining groups to be able to use the county email system to provide communications of a general nature, including bargaining updates, to their members who are county employees.