Cyber Security Investigation Ends At City Hall

An investigation paid for by Sarasota taxpayers has turned up no wrongdoing, and a deputy city manager's kid playing computer games for hours on end. Plus it went over budget.

The investigation began more than a year ago to look into why emails were missing from the city's server and email systems, with the suspicion that public records were intentionally deleted, and emails with sensitive employee data were breached.

Cyber security forensics firm The Sylint Group found that City Hall had an archive and server system in horrendous shape, but not to the extent of it being criminal.

Here are some of the new key points that the investigation found, according to a report by special counsel Steven Teppler:

• The IT Department didn't properly defend the computer systems for protecting information covered by the Health Information Portability and Accountabiliy Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH). In other words, electronic data kept for health records, were succeptable to a data breach. This has been corrected.
• Sensitive personal data exempt from the Florida Public Records Act was vulnerable to a data breach or a hack, but it appears that no city employee or contractor provided that exempt information, and no violations were made regarding the Public Records Act, HIPAA or HITECH.

What happened in all of this was that years and thousands of dollars worth of updates, patches and upgrades to the email Exchange server and other email related systems were not made, and caused the system to not properly archive deleted emails and sent emails, according to the final Sylint report. Additionally, "retired" computers and hardware were re-used to further complicate the issue, according to the Sylint report.

Sylint CEO John Jorgensen told the Commission that computer games were played or operating on Deputy Marlon Brown's computers for 12-20 hours a day, making the computer susceptable to a malware attack, Herald-Tribune reporter Jessie Van Berkel reported on Twitter.

It turns out, that the "computer games were deputy's son, who was waiting for his dad to finish meetings," City Manager Tom Barwin said, according to a Berkel tweet.

Computer games operating with out-of-date JavaScript can cause problems and are susceptable attacks, so much that Apple temporarily blocked an older version of JavaScript on all its computers earlier this year until an update was resolved.

The actual investigation cost the city $159,437, about $35,000 more than the approved $124,965 purchase order, according to a spreadsheet prepared by retired Sarasota Finance Director Chris Lyons. The.

The report states that the cost ought to be $542,939.72, but some of the costs can be debated.

Still, the costs appear to be much more than the $159,000. Add in legal fees, and that tacks on another $72,434, according to the report.

The report tacks on another $257,632.56 for paying the severance of City Manager Robert Bartolotta and Information Technology Director Chance Craig and the authorized absence of Sandra Coleman. However, Coleman was on family leave, unrelated to the investigation, according to city records. Also, while Bartolotta was dismissed during the initial investigation, Mayor Suzanne Atwell claimed that the reason she asked Bartolotta to resign was because some commissioners, city employees and members of the community refused to work with Bartolotta due to his gruff approach. Bartolotta for his part, was cleared of any wrongdoing in the report.

In any matter, the investigation helped prompt Bartolotta's exit, which means the report adds the search and relocation for a new city manager and IT Director, adding another $53,435.