News
Kentucky punishes workers over porn
Published: May 23, 2004 - 11:06 PM
FRANKFORT, Ky. ? Twenty-three state transportation employees have been fired or forced to resign or retire for using state computers to look at pornography, according to a letter obtained by The Courier-Journal. Twenty other workers were suspended, but the FBI has not concluded its investigation into whether child pornography had been viewed, according to the April 22 letter to state Auditor Crit Luallen from cabinet Inspector General Robert L. Russell.
The actions stem from a state auditor's report last summer which said that cabinet computers were used to view pornography and that European hackers had hijacked a computer server to host a chat room and trade pirated movies, video games, medical textbooks and other material.
In the days following the report, the FBI seized 11 Transportation Cabinet computers believed to have been used to view child pornography.
Russell said in his letter that the state computer system has since been protected through filters, firewalls ? mechanisms that prevent outsiders from connecting with a computer ? and more frequent password changes.
"In conclusion, it is our opinion the Kentucky Transportation Cabinet's computer system is currently in good condition," Russell said in the letter. But he added, "We recognize that security and responsible use are ongoing tasks that require constant attention.
"To date, we have found no evidence that hackers accessed any financial data," the letter said.
The cabinet took the disciplinary action over the past 10 months.
Russell said in the letter that 23 employees have left state government as a result of an investigation. Four were fired, and 19 resigned or retired when confronted with evidence of the improper computer use, the letter said.
Russell said 20 employees were suspended, and punishment of two others has not been determined.
The Courier-Journal obtained a copy of the letter yesterday through a request to Luallen's office under the Kentucky Open Records Act.
Russell did not return a phone message left yesterday at his office. But Doug Hogan, director of communications for Gov. Ernie Fletcher, said a final report on the investigation will be released next week.
"The completion of a final report was delayed until those final two cases were resolved and because Bobby Russell wanted to double-check numbers and facts in all these cases," Hogan said.
Russell's letter did not give the names or positions held by the people who were disciplined. Hogan said late yesterday that Russell won't include names in his final report and that he does not believe the names of employees disciplined in personnel matters are required to be released.
Jeff Derouen, Luallen's director of communications, said the auditor's office has never sought or been supplied with the employees' names. State Personnel Department General Counsel Dan Egbers said that until a change was made this month, databases of his department had not listed disciplinary action against employees.
Former state Auditor Ed Hatchett reported last summer that a routine examination of Internet use on the cabinet's computers showed 212 computers had been used to view thousands of pornographic images during a 24-day period. The 212 computers were located at cabinet headquarters and cabinet offices across the state, Hatchett said.
A government policy adopted in 1996 forbids "knowingly visiting pornographic or illegal sites" on a state computer. A violation can result in dismissal. Intentionally looking at child pornography on a computer is a federal crime.
Gregory Van Tatenhove, U.S. attorney for the Eastern District of Kentucky, declined comment yesterday on the status of the federal investigation.
After the auditor's report was released, Russell said state government had previously suspended employees for minor violations, such as one or two incidents of misuse while on a lunch hour. But he said the state had fired employees for more serious violations.
Russell also said he expected his investigation would likely follow past state practice of allowing an employee to resign or retire rather than be fired.
At the outset of his investigation, Russell said an initial review indicated there were fewer employees intentionally looking at pornography than the number of computers that Hatchett said were used to access such sites.
Since then Russell and his supervisors in the administration of former Gov. Paul Patton and later in Fletcher's administration have declined to comment on the status of the investigation or say how many employees have been disciplined.
Aldona Valicenti, the state's chief information officer during the Patton administration, said she is not surprised that despite the report citing 212 computers, only 45 employees were found to have violated the policy.
"It's not unusual for people to get on a trail and unexpectedly find themselves in a pornographic site. To find a violation and punish someone the act has to be intentional," Valicenti said. "But if they found intentional action by 45 people, that says to me they did a thorough job."
Most of Russell's letter to Luallen outlines steps that have been taken to stop the accessing of pornography and to resolve the security breach that allowed the hackers get to a cabinet computer server. Those steps include installing filters to block pornography as well as installing blocks on particular porn sites. Also, he said actions have been taken that will make it easier to discover and analyze future violations.
To guard against hacking, he said additional firewalls have been installed and a new policy requires frequent password changes.
"We have employed password-checking software on a monthly basis to evaluate and monitor the strength of passwords," Russell said.
Derouen said of Russell's letter, "From the outset this office's concern was that these abuses and problems with the cabinet's computer system be fixed. We're happy the cabinet responded quickly to the initial report and has taken many steps to correct the problems, but we're continuing to monitor them."
In the days following the report, the FBI seized 11 Transportation Cabinet computers believed to have been used to view child pornography.
Russell said in his letter that the state computer system has since been protected through filters, firewalls ? mechanisms that prevent outsiders from connecting with a computer ? and more frequent password changes.
"In conclusion, it is our opinion the Kentucky Transportation Cabinet's computer system is currently in good condition," Russell said in the letter. But he added, "We recognize that security and responsible use are ongoing tasks that require constant attention.
"To date, we have found no evidence that hackers accessed any financial data," the letter said.
The cabinet took the disciplinary action over the past 10 months.
Russell said in the letter that 23 employees have left state government as a result of an investigation. Four were fired, and 19 resigned or retired when confronted with evidence of the improper computer use, the letter said.
Russell said 20 employees were suspended, and punishment of two others has not been determined.
The Courier-Journal obtained a copy of the letter yesterday through a request to Luallen's office under the Kentucky Open Records Act.
Russell did not return a phone message left yesterday at his office. But Doug Hogan, director of communications for Gov. Ernie Fletcher, said a final report on the investigation will be released next week.
"The completion of a final report was delayed until those final two cases were resolved and because Bobby Russell wanted to double-check numbers and facts in all these cases," Hogan said.
Russell's letter did not give the names or positions held by the people who were disciplined. Hogan said late yesterday that Russell won't include names in his final report and that he does not believe the names of employees disciplined in personnel matters are required to be released.
Jeff Derouen, Luallen's director of communications, said the auditor's office has never sought or been supplied with the employees' names. State Personnel Department General Counsel Dan Egbers said that until a change was made this month, databases of his department had not listed disciplinary action against employees.
Former state Auditor Ed Hatchett reported last summer that a routine examination of Internet use on the cabinet's computers showed 212 computers had been used to view thousands of pornographic images during a 24-day period. The 212 computers were located at cabinet headquarters and cabinet offices across the state, Hatchett said.
A government policy adopted in 1996 forbids "knowingly visiting pornographic or illegal sites" on a state computer. A violation can result in dismissal. Intentionally looking at child pornography on a computer is a federal crime.
Gregory Van Tatenhove, U.S. attorney for the Eastern District of Kentucky, declined comment yesterday on the status of the federal investigation.
After the auditor's report was released, Russell said state government had previously suspended employees for minor violations, such as one or two incidents of misuse while on a lunch hour. But he said the state had fired employees for more serious violations.
Russell also said he expected his investigation would likely follow past state practice of allowing an employee to resign or retire rather than be fired.
At the outset of his investigation, Russell said an initial review indicated there were fewer employees intentionally looking at pornography than the number of computers that Hatchett said were used to access such sites.
Since then Russell and his supervisors in the administration of former Gov. Paul Patton and later in Fletcher's administration have declined to comment on the status of the investigation or say how many employees have been disciplined.
Aldona Valicenti, the state's chief information officer during the Patton administration, said she is not surprised that despite the report citing 212 computers, only 45 employees were found to have violated the policy.
"It's not unusual for people to get on a trail and unexpectedly find themselves in a pornographic site. To find a violation and punish someone the act has to be intentional," Valicenti said. "But if they found intentional action by 45 people, that says to me they did a thorough job."
Most of Russell's letter to Luallen outlines steps that have been taken to stop the accessing of pornography and to resolve the security breach that allowed the hackers get to a cabinet computer server. Those steps include installing filters to block pornography as well as installing blocks on particular porn sites. Also, he said actions have been taken that will make it easier to discover and analyze future violations.
To guard against hacking, he said additional firewalls have been installed and a new policy requires frequent password changes.
"We have employed password-checking software on a monthly basis to evaluate and monitor the strength of passwords," Russell said.
Derouen said of Russell's letter, "From the outset this office's concern was that these abuses and problems with the cabinet's computer system be fixed. We're happy the cabinet responded quickly to the initial report and has taken many steps to correct the problems, but we're continuing to monitor them."
