Technology deals a blow to open records

EVERETT — Those who worry about preserving access to Washington’s public records may one day look to Snohomish County for a case study of how easily common digital tools can be used to hide evidence of government misconduct.

When voters approved the state’s open records law more than 40 years ago, they could not have imagined that file cabinets stuffed with carbon copies soon would be all but replaced by electronic data accessible from mobile phones and residing in a place called the “cloud.”

They also had no way of anticipating the new forms of political mischief that would be made possible.

At his desk in the county office where he spent roughly two years as an aide to former executive Aaron Reardon, Kevin Hulten was always just a few clicks from digital cover.

He used county computers to create Google accounts under different identities and to send emails under multiple pseudonyms. He demanded records, threatened litigation and urged government investigations of his boss’s political rivals, all without leaving obvious evidence of his county connection. He employed web-based services to further obscure his identity. HideMyAss.com, for instance, made it appear as if he were accessing the Internet from somewhere in France.

On hundreds of occasions, he used the desktop computer in his office to dip into Dropbox. The popular cloud-based file-sharing program was later found to contain a secret stash of records about what Hulten dubbed “black hat jobs.” The trove included background checks on others in county government, online smear campaigns and memos — many drafted during business hours — suggesting strategies for undermining Reardon’s foes.

Those documents remained outside the reach of public records requests as long as Hulten denied their existence. The materials were recovered only after Hulten became the focus of a still-unfolding King County Sheriff’s Office investigation that included seizing the computers he used, and searching them using forensic software.

In the year since Hulten’s actions were first uncovered, Snohomish County has taken few visible steps to make it tougher for somebody to engage in similar behaviors.

The role digital tools played in the case highlights a growing headache for those who maintain computers and records at government agencies around Washington.

Even in situations where there is no ill intent, government workers are using computer services and devices that effectively can take the public’s business private, diminishing taxpayers’ ability to keep informed about what is done in their name and on their dollar.

Michael Cockrill, the state’s chief information officer, said some of that is a byproduct of the “consumerization” of information technology.

“You as a consumer, when you come to work you still want to use your phone and you still want to use your iPad and you still want to use your mobile computer and not very long from now you’ll want to use Google Glass,” he said. “The proliferation of devices and the ability to store information on each one of those devices, if not properly managed, ends up creating a very hard problem for enterprise document management.”

The state’s public records law since 1972 has mandated archiving documents and data for easy retrieval. But public employees, accustomed in their personal lives to using smartphones and other tools, routinely push back when told that retention of government records has a higher priority than their convenience.

The tension has been playing out for years, perhaps most frequently with government officials using their private email accounts for public business, said Toby Nixon, president of the Washington Coalition for Open Government.

The courts have ruled that records about government activity that wind up on private computers and digital accounts must be disclosed, but that doesn’t always happen without a fight, Nixon said.

“Getting people to produce records that might be a problem for them is always going to be a challenge,” he said.

So is getting people at agencies to take responsibility for mishandling records and misusing devices, said William Crittenden, a Seattle attorney experienced in disputes about access to government information.

It’s simple: don’t use personal phones and email to conduct public business.

“It’s 2014, people,” Crittenden said.

Part of the solution is finding technological options that meet needs while also preserving public records, Cockrill said.

Take Dropbox. It is a “super useful, consumer-oriented tool” that makes it easy to share documents and files, Cockrill said. But it also doesn’t match the needs of government because individual accounts can’t be easily searched by the agency to retrieve potential government records, nor does it have version control to protect against people altering content, he said.

Many agencies around the state recognized the challenges and told workers not to use Dropbox in their government jobs, Cockrill said.

“What happened was — frankly — people used it anyway. Because it was easy, people just used it,” he said. “The right solution to that is to make it easy for them to use the right thing, not make it hard for them to use the wrong thing.”

That’s why the state recently contracted for a similar file-sharing tool that doesn’t bring with it the same drawbacks, he said.

Similarly, the state last year published model guidelines for government use of cloud-based computing services.

In Snohomish County, the focus in recent months has been less on technology and more on who should lead in fixing county records problems made possible by leadership during the Reardon years.

“When I reflect on all the damage caused by that behavior, I shake my head. It’s so disappointing,” County Executive John Lovick said. “It certainly isn’t typical of county employees, but it shows what can happen — what did happen — when certain actions go unchecked.

“The public holds us to a higher standard,” Lovick added. “We need to do all we can to make sure no one else can abuse county technology like this again. Obviously, the solution starts with leadership that doesn’t tolerate deception and spying; it must be followed by policies and procedures that keep pace with information technology and the need for transparency.”

The County Council last year entrusted the county’s tech department to Auditor Carolyn Weikel. The emergency move came after stories in The Herald exposed the extent to which Hulten had abused his position in the executive’s office. The council voted to keep Weikel in charge of the tech department through 2017, but Lovick vetoed that idea, saying the county’s computer and communication system belongs under the executive’s authority.

Weikel’s time supervising county tech workers is set to end early next year. In the months remaining, she hopes to shore up weaknesses in how the county handles access to electronic records.

County policies need to be strengthened to leave no doubt that employees may only use county computers on work-related tasks, with the records stored on the county network, she said.

“Any technological tool that the county provides to you belongs to the county and you cannot use it for your personal use,” she said. “The current policy says that, but I want (policies) to say it so clearly that nobody would have any question about what the intent of the statement is.”

Weikel said the county also needs to do a better job of tracking where county computer equipment is being used and by which employees.

Lack of documentation not only allowed Hulten to use devices that weren’t assigned to him, but a spotty paper trail over who had control of a device, and when, cost the county thousands of dollars for an investigation to resolve how nude images of Hulten and a former girlfriend wound up on one computer.

The auditor also said she’s identified major flaws in how the county historically has conducted public record searches.

“One of the things that happened in the executive’s office, is when … public records requests came in, the public records officer asked all employees if they had any records that were responsive to this request,” Weikel said. “Kevin said ‘No,’ but of course he lied.”

There was no follow-up or independent checking of computers. Weikel wants the person responsible for responding to records requests in each county department to have access to a list of all devices that an employee has used so they can be checked for potentially responsive records.

As a recently elected county councilman, Ken Klein of Arlington said the county’s public records training left no doubt about the importance of not mingling personal and public business. No-nos include using private communication tools, such as a personal Gmail account, to discuss county matters, he said.

“They say not to use any kind of personal asset to conduct any kind of county business,” Klein said.

Klein knows that government transparency is a big reason for the policy, and he said that’s also one of his top goals as a lawmaker. Still, he concedes that searching for records, under the current system, is time-consuming. That’s a big frustration for him. He’d rather see the county post more records online without prompting, so elected officials and staff could focus on other aspects of their jobs.

“A big portion of my time, of my aide’s time and other council members’ aides’ time is spent looking for records,” he said.

On the other hand, the county’s mishandling of records has led to litigation — and heartache. Rose Saffioti was told in 2012 that no surveillance video existed from the day her son, Michael, died from an apparent allergic reaction while locked up in the county jail. In August, copies of the video surfaced, capturing the events leading to the young man’s death. Saffioti’s family now is pursuing legal action against the county, not only for a potential wrongful death, but also for failure to release public records. How county staff failed to find that video earlier has yet to be explained.

Lovick said he knows the county faces records challenges, but he is committed to finding solutions.

“I seriously doubt we’re the only government agency with these issues, but I’d like to see us lead the way in resolving them and moving forward,” he said. “When another city or county has the same problem, I’d like them to say, ‘Let’s call Snohomish County. They handled it the right way.’ ”

Scott North: 425-339-3431, north@heraldnet.com.