Public Signals

In addition to a looming tax increase and other financial challenges, its inability to set a sensible direction on long-term care, Albany County, New York has been suffering from County Comptroller Mike Conners’s release of Social Security numbers (SSNs) of staff of the District Attorney. There’s been some confusion about the sequence of events, but there’s no confusion about the release of SSNs.

No one should be surprised.

Conners did his own, hardly independent, report of the incident and bragged privately to others about how well he had handled the public relations. Note that Conners admits looking at the relevant data before there was a Freedom of Information request. As this was relevant to a campaign for District Attorney, in which he had taken sides, the timing of events may be relevant. Certainly they suggest the possibility that his looking for the data was less an “investigation” than it was using County resources for political meddling. Certainly Conners should have been aware that the bonus program was nothing untoward, but structured to minimize the risk of budget increases. Now, evidently, Conners is annoyed that County Executive, Dan McCoy triggered an investigation by the County Attorney, complete with subpoenas.

What Conners has not told anyone is that this was not an isolated incident. The same staff person, Assistant Comptroller, Anthony Fontanelli, who generated the report with the Social Security numbers, and who is a very senior staff person and who reports directly to Conners, was central to a previous incident, abusing the same, central information system. Moreover Conners didn’t tell you is that Fontanelli previously had his access revoked to the Human Resources module which contains the SSNs, but that his privileges were restored at Conners’s insistence.

And what Conners didn’t tell you is that, having previously failed to deal managerially with a significant problem within his own agency, he is now using the same arguments to again restore Fontanelli’s information system privileges, holding the entire County hostage if he does not get his way.

After the earlier incident, Conners refused to do anything about Fontanelli’s behavior and then insisted that without Fontanelli, his Office could not perform its job. Michael Perrin, then Deputy County Executive directed that Fontanelli’s privileges be restored. Now Fontanelli’s privileges have been once again been restricted. The following is from Conners’s SSN report:

Monday September 17, 2012: Without notice to the Comptroller, County Executive Office staff accessed the administrative protocols of the MUNIS system and reduced a Department of Audit and Control’s employee’s access to the MUNIS. System. As a result, the staff member is unable to complete his civil service duties. His duties include updating and posting the County Budget per the Legislature’s monthly resolutions. He is also unable to access payroll lines to determine funds available for allocation or movement to other lines. These actions are necessary to keep operations moving without issue, as a fiscal control. The employee is now also unable to insure updates are properly entered for year-end reports to the Legislature and budget action.

The information system in question is MUNIS, which is Albany County’s central and most important information system and one of the very few that’s used throughout Albany County government. MUNIS includes all the key financial functions such as budget, general ledger, accounts payable, accounts receivable, and human resources.

Unfamiliar readers should know that at the time, I was the County’s Commissioner of Management & Budget, having responsibility for budget, cash management and information services and technology. Under the County Charter, I worked for the County Executive. To ensure appropriate checks and balances, the County Charter divides financial responsibility between the Comptroller and the Commissioner of Management & Budget.

The earlier incident was grave. I detailed it at the time in a letter to Conners, dated September 1, 2009 (PDF). The earlier incident involved:

• Most importantly, Conners’s papering over and excusing a significant security breach and a breach of trust by his own senior staff. This was particularly egregious because, among other things, it was an attempt to increase the budget for his own agency. Whether he induced it, tacitly or explicitly approved it, or created on organizational culture where such behavior is considered acceptable, even normal, I don’t know. But he is certainly responsible for his organization’s behaviors and failures.
• At least in my judgement, violation of the County Charter by the Comptroller’s staff. By intruding into the Budget module, where he did not have system privileges, Fontanelli was also intruding into the Budget process, where the Comptroller does not have Charter responsibilities. Here too, this is Conners’s responsibility.
• Violation of the County’s information technology security policies by the Comptroller’s staff. In many private sector organizations, the violations were of a nature that would have led to immediate firing – as in the employee would have been escorted to the exits immediately without making it to the end of the day. These violations including Fontanelli’s giving himself at the highest level (5), access to the Human Services and Budget modules of MUNIS, the County’s central information system.
• Using this unauthorized access, Fontanelli’s secretly changing the Comptroller’s budget, long after the County Charter mandated deadline. Other staff of Conners, William Curran, whether knowing that it was based on a lie or not, then sent a Fontanelli generated report to Budget staff that because of the date-time stamp, proved the unauthorized intrusion. Note that Curran is Executive Deputy Comptroller, ranks even higher than Fontanelli, suggesting that at the highest level of Mike Conners’s Department of Audit & Control, this is standard behavior. So is the failure to actually read the reports they generate and to consider their implications.
• Fontanelli’s secretly changing the budgets of two other County agencies, long after the County Charter mandated deadline, and one, the Sheriff’s without the Sheriff’s knowledge. That was to hide $275,000 in “revenue” in the Sheriff’s budget. Neither the Sheriff nor his staff was aware of this change. Moreover, without getting into the technical details, this was a means for the Comptroller to hide “revenue.” It may or may not have been real revenue, but it was well hidden and Conners had previously “found” exactly the same type of revenue and, playing the “hero,” offered it to the Legislature to reduce the need for reductions, and undermining the budget process where he now asserts there is a “structural deficit.” That is most certainly true, but ironic as this behavior contributed to it. The other changes were to the Probation Department’s budget were small, of a technical nature, but also unknown to the Probation Director.

Among other things, I specifically recommended to Conners at the time that he should:

• Re-evaluate Mr. Fontanelli’s role in your Department, particularly as to whether he should continue to have any role in MUNIS.
• Assign Mr. Fontanelli’s responsibilities to another person or persons in your Department.

Conners did neither.

In short, Conners didn’t tell you that the Social Security Number incident is strikingly similar to the earlier event, involving the same staff, misuse of the same information system, the same excuses, the same management failures, and the same holding the entire County hostage to avoid any restrictions, reforms or penalties. Conners clearly did nothing to remedy a significant problem within his own agency, leading directly to the Social Security Number release.

Conners’s hostage taking succeeded the last time in getting Fontanelli’s system privileges restored. It should not this time. This time, Conners should take responsibility for his own managerial failings. So should the County Legislature.

Note 1: Conners did respond to my letter, but I do not have a copy. It used a lot of words, but clarified nothing except his insistence that the office for which he was responsible could not function without Fontanelli, effectively saying that he could not manage his own agency.

Note 2: Even before the above incident, there was another about which I know relatively little and which was probably more about Fontanelli’s carelessness, if not incompetence, but probably not abuse. In that incident, Fontanelli, destroyed some files being prepared by Human Resources for the transition from one fiscal year to another. Then rather than seeking help, or testing a solution, he destroyed all of the individual salary files necessary for the first payroll of the new year. Human Resources staff spent a lost, angry weekend rebuilding the entire payroll individual line by individual line. Except to note that I should have been more sensitive to the question of what Fontanelli was doing in the HR module, I’ll defer to others to detail that debacle.

Tagged as: Albany County, Information Systems, Security

{ Comments on this entry are closed }