Geauga County Commissioners approved last week paying a digital solutions provider $26,000 to evaluate the security of the county’s IT infrastructure.
County Auditor Frank Gliha made the request at the commissioners’ Nov. 14 meeting, weeks after the county’s chief technology officer, who worked under Gliha, was arrested for allegedly embezzling more than $250,000.
Al Vontorcik, who was named interim director of information technology following Steve Decatur’s Oct. 26 arrest, said Pittsburgh-based Black Box Corporation would look at the county’s network infrastructure, including switches, routers and network appliances, and identify problems or determine whether any of it has outlived its lifespan.
Commissioner Tim Lennon appeared unhappy with additional expenditures, asking Gliha, rhetorically, if the $26,000 was “just another log on the fire.”
Gliha also reported the county finally would be moving to a new security firewall system, which officials have been waiting to install for two years.
“I’m not here to scold anybody or open up any Pandora’s boxes, but the reality is, you’re an IT specialist there also. How is it that this was missed?” Commissioner Ralph Spidalieri asked Vontorcik.
“Every time we tried to work on it, Steve (Decatur) would grab it, he’d do a little bit, do a little bit, have us mount it, but it was never hooked up,” Vontorcik replied.
“I get it, we’re all in a position right now where our trust was violated big time with this whole thing, but to be honest with you, it’s a real slap in our face because we paid for it (new firewall system),” Spidalieri said. “We put these financials out every Tuesday morning and we sign these things in trust, to find out that there’s basically servers running with a fan blowing on them.”
Gliha defended his department, explaining the computer room has been overheated for years and the department has done a great job trying to get control of it.
Lennon also expressed frustration with a lack of accountability regarding the security of the county’s computer systems.
“At some point, the buck stops somewhere and I don’t know who was . . . I guess Steve Decatur? Is he the one where the buck stops as far as making sure this level of security and our computer systems are up to snuff? We’re trusting him?” asked Lennon.
Lennon also commented on the general organization and cleanliness of the computer room under Decatur’s leadership, noting there is a difference between being cheap and being frugal.
“We are not a cheap county,” Lennon said. “We are a very well-established county and I think at the end of the day, the dollars we’re investing should be related to that.”
He accepted the state of the room was partly a condition of its location in the Opera House, an old building in need of repairs — a point on which Gliha was in agreement.
Spidalieri asked Gliha why, if he feels the building he has authority over is in such bad shape, he was “high-fiving” county Treasurer Chris Hitchcock at a recent facilities meeting over their mutual desire to not move into new facilities.
“Well, just for the record, I’ve said right along that I’m really happy you’re doing the feasibility study,” Gliha replied. “I think once you get the feasibility study done, you’re going to be able to come up with a better decision.”
Another concern Spidalieri voiced was the inefficiency of spending money on equipment that sat unused for two years — and could now be outdated or could have been bought at a much lower price than it was when originally bought.
“We’ve been buffaloed, I guess, including yourself,” he told Gliha.
Gliha said the revelation of Decatur’s alleged theft was a “sock in the stomach,” but the department now has a remedy and the county’s information is secure.
Vontorcik agreed, telling the commissioners there is no procedure for cleaning up after a problem like the one they are facing.
Commissioner Walter “Skip” Claypool wanted clarity on whether new procedures were being put in place to prevent something similar from happening in the future, and whether the security of the system would work independent of people.
“The procedure, the process needs to be in place to ensure that people are honest in the process,” Claypool said.
Vontorcik told him the department has already made changes to the way it’s doing business in that regard.
“I appreciate that you really stepped up and have really engaged in the middle of this thing,” Spidalieri told Vontorcik. “Ultimately, we’re responsible for a lot.”
Box Fan Cooling County’s Servers
Earlier, at a Nov. 9 meeting of the county’s Automatic Data Processing board, Geauga County Prosecutor Jim Flaiz had noted Black Box already was being paid $15,000 to perform an audit of the county’s network when the firewall issue was discovered, increasing the company’s fee to more than $26,000.
“Apparently, our firewall was not as great as advertised,” said Flaiz, an ADP board member, on Nov. 9. He added the board was addressing more “urgent issues” when the firewall problem came to light and Black Box was called in.
Black Box personnel came to the county the end of October for the audit, Flaiz explained, and, when the firewall issue was found, worked to take care of it with county employees Tom Huff, IT manager at the Geauga County Court of Common Pleas, Allen Keener, senior systems administrator at the ADP Department of Information Technology, and Vontorcik.
Black Box discovered the firewall tends to overheat, causing failure, so a box fan was being used to keep it cool, Flaiz said.
Also, the county didn’t have a password for the firewall and, while dealing with that problem, the company found there were other gaps in the system. For instance, some sites could be accessed without login verification, Flaiz said.
“The current firewall was done in 2013. It was four years out of network safety compliance,” Huff said at the Nov. 9 meeting.
“It’s horrifically embarrassing, but Al and Allen, and Black Box took care of it,” Flaiz said.
After an executive session, the ADP board moved to compensate Keener and Vontorcik for the many hours they worked to solve the computer problems and authorized additional compensation, if required.
The board also voted to authorize them to use purchase orders up to $5,000 to buy items needed for the IT systems.
“We don’t want (the ADP board) to meet every time we need to buy something,” Huff said.
Lennon asked if it would be possible to recoup the funds Decatur allegedly embezzled.
Geauga County Administrator Dave Lair said it might be possible to track the funds, but it would take a miracle to get them back.
“Miracle is a good word,” Flaiz said.
