Computer audit criticizes former employees’ use

Goofing off at work isn’t a crime, but it cost $250,000 in Watseka
January 29, 2016
Health Department Investigation: Audit Finds Pornography, Misuse Of Money
January 29, 2016
Show all

Written by Will Brumleve

WATSEKA — Ex-employees of the now-dissolved Ford-Iroquois Public Health Department spent an estimated 2,700 hours per year using their work computers for personal business, amounting to more than $81,000 per year in wasted taxpayer money, a forensic computer expert told the Iroquois County Board.

Andrew Garrett of Decatur-based Garrett Discovery said the estimated number of hours spent by employees on personal business — including searching dating and classified ad sites, posting to their personal Facebook pages and selling merchandise for their personal businesses — was based on a conservative estimate of 30 seconds spent on each website.

The $81,000 figure, meanwhile, was based on “a modest” $30 an hour paid to the average employee, including salary and all benefits, Garrett said.

The report presented to the board also showed that some employees used anti-forensic software in a possible attempt to delete their web histories.

At the request of former Iroquois County Board Chairman Rod Copas, the board approved last December spending up to $5,650 to have Garrett examine 18 computers used by ex-employees of the health department, which was dissolved in July 2014. Those 18 were in addition to five that were already examined, free of charge to the county, for evidence of misuse and fraud.

Among Garrett’s findings:

— Employees visited Facebook 33,745 times; visited non-work web-based email services 1,754 times; backed up their personal iPhones to their computers eight times; visited dating and chat rooms 444 times; and visited classified ad sites such as eBay, Amazon and Craigslist 27,699 times.

— Using what is called “incognito” or “safe” browsing, the users of the 17 computers from which data was extracted chose to hide their Web history for 196,561 websites visited, Garrett said. However, he was able to recover “the history that was previously hidden.”

— Evidence of “file-wiping utilities” was found on some computers, which, in some cases, destroyed Garrett’s ability to link a specific file to the user of a computer. “An estimated 30 percent of the usage could not be tied to a specific user due to the use of file-wiping utilities and deletion of files,” Garrett’s report said.

— He found evidence of employees using their work computers to run “their own personal business.” For example, Garrett said, at least one employee was used a work computer to promote products and services to county employees for mythirtyone.com. “We found evidence of at least one employee running a personal business at work — selling products at work, delivering those products at work, shipping those products at work,” Garrett told the board. “There’s a substantial amount of that.”

Thousands of emails, too

More than 100,000 emails were also recovered — all of which were provided to County Board Chairman Kyle Anderson, but not the news media. At Garrett’s suggestion, the board will review those emails to determine whether they were work-related.

Depending on what is found, the board could ask State’s Attorney Jim Devine — or a special prosecutor — to criminally charge some former health department employees, Anderson said.

In his report, Garrett said some emails were related to “contracting issues that were the subject of great concern by board members based on discussions I had with (them).” Those emails discussed the health department’s proposed expansion of its home health care program into Indiana and a contract the health department arranged with a company owned by the husband of one of its employees for the installation of solar panels on the agency’s offices, Garrett’s report said.

After his initial examination last year of five computers used by health department managers, Garrett delivered a preliminary report to the board last November that revealed that three former health department officials used their work computers for “personal use and gain and possibly illegal and unethical activities” at least 70 percent of the time they were on them.

Willing to testify

Garrett encouraged the board to adopt a “strict Internet usage policy” for Iroquois County’s employees. Such a policy would prohibit employees from visiting sites such as Facebook, dating sites, eBay or Craigslist, he said.

“We suggest each employee sign agreements (saying) that if inappropriate (computer) use is found within an audit, the employee is subject to termination,” Garrett said. “We also suggest routine audits of users’ Internet activity by use of auditing software. … The state of Illinois uses it on all of their employees.”

Garrett said that once auditing software is installed, local staff could be trained to review audit reports, or the county could instead hire a “competent forensic examiner” to review the reports each month, either on or off site. The cost would be “a couple of hundred bucks a month,” Garrett said.

“It can be done with little to no impact on the computer, and with no downtime,” Garrett noted.

Meanwhile, Garrett said the report he delivered to the board would be acceptable as evidence in a criminal trial. Garrett said his firm provides testimony in about 50 to 100 court cases per month, and has personally testified in about 145.

Garrett said he has been deemed an expert witness in federal court and multiple state courts. Since Jan. 1, 2015, Garrett’s firm has processed 254 hard drives for court purposes, he added.

Leave a Reply

Your email address will not be published. Required fields are marked *