One of the sad realities if the modern world is that data breaches take place all the time. It seems a month can’t go by that you don’t hear about a retail store or restaurant experiencing a data breach that gives outsiders access to personal information like credit card numbers.
But, when it’s a county government and the breach impacts 72,000 people, there is reason for legitimate concern. Such a breach took place in Wright County in April and Wright County Board Chair Mark Daleiden opened the Dec. 18 board meeting reading a prepared statement as to the county’s response to the breach.
"Wright County takes data privacy very seriously and the government agencies are held to a much higher standard for data protection," Daleiden said. "We have many protocols, procedures and annual training requirements in place. While we regret the actions of our former employee, want to reiterate that no evidence has been found to indicate there was any sale or distribution of private data. The data was recovered and returned to the county by law enforcement. Unlike other data incidents, this case involved numerous data bases and multiple computer systems that were reviewed by computer forensic consultants to determine the scope of the breach and then determine the identities of the individuals effected. The multiple data bases also meant the county didn’t have addresses associated with many of the individuals impacted, which then had to be obtained before the notices were sent out. The county attorney’s office is reviewing the case for criminal charges."
The breach itself wasn’t a criminal enterprise, but an employee of the Information Technology Department downloaded files from several data bases to a flash drive and subsequently downloaded it into his home computer to work at home to work on a project he was working on. Because taking private information out of the county courthouse is a clear violation of county policy, the employee was let go as a result.
Commissioner Darek Vetsch said that his family of seven – he, his wife and five children (the youngest being just 8 years old) – all received letters from the county as those who were potentially impacted. But, Vetsch said that he had no legitimate concerns about any danger because the employee didn’t have any malicious intent and was unaware of all the information that was included in the files he downloaded.
"I personally feel comfortable knowing that I feel my information is safe," Vetsch said. "I don’t feel that my information has been compromised in any manner that would put my family’s personal information at risk. It’s unfortunately regrettable that an individual made a decision that he did to do what he did, but given what has taken place, I feel comfortable that all the information has been recovered and we are safe."
The story broke Thursday, Dec. 13, when a pair of Twin Cities television stations reported on the breach, which was part of a search warrant back in April. Part of the delay involved the first computer forensics firm hired by the county. While no county officials would confirm the information, sources said that the firm reached an impasse with the county during the summer that lasted two month – refusing to hand over data until the county met its asking price for compensation. The county would then hire another computer forensics firm and the first firm is believed to be the source that notified the Twin Cities TV about the issue.
As it pertained to the delay in getting information out, County Coordinator Lee Kelly said that the issue was the type of data that was included in the files that were downloaded. They often had names associated with them, but not addresses. With up to 72,000 names included in the files, tracking down addresses for all of them to send notifications were sent out.
"The biggest piece of this is that, when you think of data breaches, you have everyone’s line of information – date of birth, Social Security number and address all in one thing," Kelly said. "Here we had a case where you might have a first and last name and a date of birth and that’s it. It’s enough to personally identifiable, so we had to notify the individual. A lot of them we either didn’t have addresses for or we had to find an address for them. This was county data that had been collected over a while, so it was a long and complicated process."
The delay in reporting wasn’t unusual. This summer, a similar data breach took place in Ramsey County impacting about 500 people and it took five months for letters to be sent out. In this case, there were 72,000 people involved and tracking down addresses to match to the names was a full-time job for county employees.
The county maintained that it has attempted to be transparent with residents, but Vetsch said that releasing some of the notices before others would have created more problems than it would have solved by letting residents know piecemeal.
"There has been concern that we withheld information, but that’s not true," Vetsch said. "Had we announced it immediately, my concern was that there would be fear-mongering for nothing. I still stand behind our decision. We strongly felt that the threat was really low from the get-go. We didn’t want to alarm the public and not be able to answer anything because we didn’t know a whole lot of details. Now at least we can answer people very cohesively because we went through the whole process."
In other items, the board:
n Approved an updated lease agreement between the county and the Wright County Fair Board. The agreement hadn’t been updated in 30 years. The agreement officially allows the fair board to sub-lease buildings for cold storage without approval of the county to indemnify the county from any potential liability for damage to property being stored.
n Set the 2019 salary for the county attorney for $152,437, auditor-treasurer at $132,500 and county commissioners at $41,129 – all of which represent a 3 percent increase over 2018. The board also set the salary for Sheriff-elect Sean Deringer at $129,000, which is approximately $4,000 less than outgoing Sheriff Joe Hagerty made in 2018.
n Authorized board attendance at the Minnesota Rural Counties meeting at 10 a.m. Monday, Jan. 7, at the county courthouse.
n Approved a memorandum of understanding with the Wright County Deputy’s Association for the county’s 2019 contribution to the health insurance plan.
n Announced the cancellation of the Dec. 24 Health and Human Services Board meeting.
n Approved a memorandum of understanding with the cities of Albertville, Cokato, Waverly and Cokato Township for the storage and purchase of salt for the 2018-19 snow and ice control season.
n Authorized signatures on a 2019 caretaker agreement with Green View Inc.
n Approved a three-year building and sewer code agreement between Wright County and Corinna Township.
n Accepted the November revenue/expenditure budget report. Through 11 months of the year, the county is on pace with the expenditure budget and above the projected revenue, due primarily to funds raised by the local option sales tax, which can only be spent on local road and bridge projects.
n Appointed Michael Young as the county drainage inspector for 2019. The position is up for annual appointment at the end of each year.
n Set the per diem rate for mileage for use of private vehicles for county business at 58 cents a mile – the same reimbursement rate set by the Internal Revenue Service. It marks the first time the county has ever reimbursed at the IRS rate.