A group of county officials are challenging Geauga County Commissioners over security keycard access to their departments in the new administrative building on Ravenwood Drive.

A group of county officials is challenging Geauga County Commissioners over security keycard access to their departments in the new administrative building on Ravenwood Drive.

The Automatic Data Processing board, which is made up of nine county department heads, unanimously chose to seek mediation with commissioners via the Ohio Supreme Court at an emergency meeting Aug. 9 over what they called “illegal” operation and control of keycard access.

At issue is whether the operation of the security keycard system falls under the powers of the ADP board. State law says no county office shall purchase, lease, operate or contract for the use of any automatic or electronic data processing or record-keeping equipment, software or services without prior ADP board approval.

In an email Aug. 10, Commissioner Tim Lennon said neither the existence of an ADP board nor a recommendation from an ADP board is a necessary condition for the county commissioners to purchase equipment, according to a 1977 opinion from the office of the Ohio Attorney General.

“Competitive bidding must be followed by a board of county commissioners when purchasing data processing equipment and supplies,” he said.

Commissioner Jim Dvorak, who sits on the ADP board but was absent from the Aug. 9 meeting, said later that day the decision to take the commissioners to mediation works for him.

“It’s good to have someone look at this outside of Geauga County,” Dvorak said.

County officials have also expressed frustration over commissioners and County Administrator Gerry Morgan reportedly delaying granting them access.

“On multiple occasions, I have requested access credentials to the security keycard controls system and again, while (Morgan) has made promises to the ADP board and myself to turn over the access credentials, he has not followed through with his promise and has violated an agreed-to deadline to turn over the credentials,” Geauga County Auditor Chuck Walder said in an Aug. 9 ADP press release.

The county maintenance department currently assigns keycards, Morgan said, adding they handled physical keys for departments before the move to the new building.

However, Walder — on behalf of the ADP board — said by their nature, electronic keycard systems fall under ADP purview, since they transfer electronic data, involve username and password credentials, and store records of who has been granted access to which areas in the building and when.

In an Aug. 18 email, Morgan disputed that assertion.

“Operation and control (of an electronic keycard system) are the same as with a traditional hard key system,” Morgan said. “The county provides keys to the departments for distribution to their staff. However, in this situation, the county provides access to the keycard system and which doors will be able to be controlled by the departments’ keycards.”

Each office or department will be able to set access to specific doors within their space rather than providing a list to the commissioners for cards to be created and then given to the office or department, Morgan said.

“All of this is the same as a traditional hard key system, with the only difference being that this system is electronic,” he said.

The argument is over whether ADP or commissioners, who have legal responsibility for all buildings owned by the county, have overarching control of the building, Morgan said.

County Prosecutor Jim Flaiz abstained from the Aug. 9 vote to pursue mediation with commissioners.

“However, I am pleased that the board voted to request that I initiate mediation with the Ohio Supreme Court over this matter,” he said.

Flaiz told county department heads, as well as the commissioners and Morgan, it is unlawful and improper for control and operation of the keycard system to be under the purview of the maintenance department, in an email Aug. 2, according to records obtained by the Geauga County Maple Leaf.

Commissioners are required by law to provide office space to certain departments, but this does not empower them to “intrude upon the operations and functions” of those outside their hiring authority, Flaiz said.

“Access control and security are a vital function for any office,” he said.

While commissioners are required by statute to provide office space for offices outside their hiring authority, Flaiz said they do not have any authority to regulate, control or dictate access to that office space.

“The authority of (commissioners) to control the office space of any entity ends at the front door of that respective office,” Flaiz said.

Administrative control of the access cards, as well as all physical access cards and keys to any office or space — including computer server rooms — should be turned over to their respective offices immediately, Flaiz said in the email.

“Failure to do so could result in civil and criminal liability,” he added.

In his communication to commissioners, Flaiz said it would be unacceptable for commissioners to dictate access to spaces outside their hiring authority ­— which includes the offices of the auditor, clerk of courts, common pleas court, coroner, engineer, prosecutor, recorder, sheriff and treasurer.

Geauga Public Health, he added, is entrusted with medical records that are protected under state and federal law.

Clerk of Courts Sheila Bevington said in an email Aug. 22 she has not been given controlling access to the keycard system.

“I was asked what employees I would like to have access to certain areas of the office,” Bevington said. “I was also asked about employees outside of my department and whether or not I would allow them to have access to different areas within the office.”

Bevington said uncontrolled access to certain secure areas within her department would be an exposure to theft of vehicle title stock, money and property belonging to the State of Ohio.

By signing on to the request for mediation along with the rest of the ADP board, she said she hopes the court will determine who controls access to secure areas in the county building.

Walder alleged the county maintenance department has failed to secure existing keycard systems for county offices located on Chardon Square in an Aug. 22 email, adding it is “plausible” the department would mismanage the keycard access system in the new building in a similar fashion, possibly leaving the county vulnerable to hacking, data breaches, and unauthorized access to secure areas, secure data and confidential data.

The maintenance department has “mismanaged” the keycard system on the square, allowing the server to reach a state where it can no longer be secured, Walder said.

“(The system is) highly vulnerable to hacking by groups as sophisticated as the Chinese Communist Party operators to local hackers operating out of a coffee shop,” Walder said.

Morgan, however, had a different version of events. ADP did not notify the maintenance department of the need to update their system until a month before they deemed it necessary to shut it down over security concerns.

“They want to run the (information technology) system, but they don’t want to do all the things that you need to do with I.T.,” he said.

The ADP Department of Information Technology found a new system, but wants maintenance to install it, Morgan said.

“The money’s there and ready to go, and it’s just — who’s gonna do it,” Morgan said. “From my perspective, you’ve got an auditor and ADP trying to claim that the keycard systems are theirs, but then they want maintenance to do everything with them. So which one is it? Is it they’re ADP’s (responsibility) or maintenance?”

Morgan said some officials are basically making the accusation the county is just leaving doors in the new building wide open.

“Every department was talked to about who should get keycards,” he said. “I don’t have access to every room, the commissioners don’t have access to every room or office in this building. The maintenance department does not have access to every room — only those where they have permission from the departments to go into those rooms.”

There still must be someone with overall control of the building, which is secure as long as those with keys make sure to lock their doors at night, he said.

However, Walder said the current situation outlined by Flaiz could cause major headaches for the county.

“This potentially unsecure environment created by the county commissioners could cause financial liability for the entire county by increased (insurance) premiums, audit violations by the state auditor and serious legal liability by continually violating the Ohio Revised Code,” Walder said. “While Ohio is yet to adopt an encompassing privacy statute like other states, it will mostly likely follow suit in the future, putting Geauga County in a precarious spot as the commissioners continue to violate the revised code by blocking ADP from operating (keycard) technology.”

Walder said although the ADP board voted to pursue legal action, the hope is to reach a “swift collaborative agreement,” without unnecessary legal costs.

“I have great hopes for the free mediation phase, but I am also realistic enough that promises have been made and not kept, and so we must pursue a mediated agreement through the Ohio Supreme Court. Because of the urgency of this matter, our counsel has immediately made application for this mediation,” he said.

Morgan said the county hasn’t hired legal counsel specifically for the mediation because they are not sure if it’s going forward.

“They’re saying they want to go to mediation, but you don’t go to mediation to force the other side to do what you want, which is what their language is,” he said. “(But) if it solves this issue, we’re willing to go to mediation.”

To access our complete online news coverage!

8389 Mayfield Rd. B-4, Chesterland, OH 44026 | (440) 285-2013

Copyright Geauga County Maple Leaf. All rights reserved. | Privacy Policy | Terms of Use

Website Designed & Developed by Company 119