by
LOUISVILLE, Ky. (WDRB) — Kentucky agencies lost track of nearly $1 million of state-owned property during the past two years — everything from firearms to chainsaws to desks and even a John Deere Gator.
But inventory managed by the Commonwealth Office of Technology – about $715,000 worth of servers, internet hardware and other computer gear — accounted for the vast majority of the missing property, according to documents obtained by WDRB News in an open records request.
The disclosures come a year after the Kentucky Auditor of Public Accounts faulted the Technology Office for its inventory practices, noting that the office wasn’t able to identify all servers it oversees, nor which ones contain “confidential or sensitive” information.
There is no indication that the lost servers put important data of Kentuckians or state agencies at risk, but there also is no proof that the machines were discarded under rules meant to keep that information safe.
The office is headed by the state’s chief technology officer, Charles Grindle, whose $375,000 salary is the highest of any state IT executive, according to the Council of State Governments. Grindle also is the highest-paid member of Republican Gov. Matt Bevin’s administration.
But the technology equipment was declared missing some time after a 2012 initiative ordered by former Democratic Gov. Steve Beshear, and it’s unclear when exactly the items were lost. Grindle was hired in late 2017.
In a written statement, the Technology Office said “it is likely that these assets were no longer servicable and scrapped, traded or disposed of,” without records of those activities.
Beshear ordered the office to consolidate computer and other systems across state government. It has since moved more than 1,800 servers to a state data center and added security upgrades and other protections, “limiting possible security threats to the agencies and the Commonwealth as a whole,” its website says.
State policies require agencies to follow a detailed process that includes having the Technology Office remove data from any machines they want to dispose of or donate to a nonprofit.
The Technology Office declined an interview with WDRB News. Its parent agency, the Finance and Administration Cabinet, couldn’t confirm that the missing servers were handled under those guidelines, which call for destroying their hard drives.
Nevertheless, cabinet spokeswoman Pamela Trautner said all state agencies are supposed to follow longstanding rules governing the disposal of IT equipment.
The lost computer items could pose a security risk if they contained social security numbers or other personal data, said Roman V. Yampolskiy, associate professor in the University of Louisville’s computer science and engineering department.
At least 20 servers were reported missing between July 1, 2017 and June 30, 2018. State government acquired the servers between 1997 and 2012, the records show.
Data show that 15 of the IT items, with an original value of $207,997, were purchased since 2010. The most recently acquired equipment was three managed switches, which control network traffic, that date from 2013, while a $25,263 Dell network storage apparatus from 2012 can’t be found.
For the remaining 28 assets, 12 were acquired between 2005 and 2010; and 16 between 1997 and 2005.
Most of the lost IT equipment was originally purchased by the Cabinet for Health and Family Services (12 items worth $257,891.05), followed by the Kentucky Department of Education (9 items worth $191,023).
Servers typically contain multiple hard drives, or components that permanently store data.
In general, Yampolskiy said data from hard drives could be recovered as long as their components aren’t damaged.
“It would be good to have more accountability of what happened,” he said. “If they sold them, where is the money? If they reused it to buy new equipment, is it just sitting somewhere?”
The most expensive item was an IBM AS/400C server that was purchased in 1997 for $150,000. It was fully depreciated, meaning at the time it went missing it was worth only its salvage value.
The Technology Office originally reported that five items valued at $75,000 were lost during the 2019 fiscal year. However, the Finance Cabinet said late last week that the equipment had been accounted for and no data was affected.
As a result, the losses all occurred during the 2018 fiscal year, when the Technology Office said “management made the decision to report equipment over which (the office) never took physical control of or disposed as ‘lost/stolen’ so that the inventory report would accurately reflect the current state. This was the only factual way to capture the inaccuracies since 2012.”
Over that time, Trautner said, the Technology Office repeatedly reached out to agencies and asked them to look for the missing property. It was only after those efforts failed that the items were considered lost, she said.
The Technology Office has come under scrutiny in recent years for its oversight of the state’s information technology systems.
Kentucky State Auditor Mike Harmon’s office found earlier this year that the Technology Office had not completed a disaster and recovery plan and failed to talk with state agencies about their own emergency plans.
It was one of two “significant deficiencies” the state auditor noted, in addition to servers that allowed “unnecessary access to shared folders on (technology office)-managed machines housing sensitive and confidential information.”
Auditors said the office took no steps to modify that access in fiscal 2018.
Earlier this year, a GOP-backed bill sought to limit Grindle’s salary to no more than that of the highest-paid information officer in any state bordering Kentucky. Tennesssee’s information systems chief makes $207,420, the Council of State Governments says.
The House of Representatives unanimously passed the measure; it died in the Senate.
Tracking state property
As part of annual counts, Kentucky agencies reported 299 items originally worth $980,160 missing in the past two fiscal years, a period from July 1, 2017 through June 30, 2019.
Most of the items were beyond their useful lives when they were declared missing in recent years. In all, the state listed inventory with a depreciated value of about $50,000 as missing.
The statewide inventory includes all units of state government except the Kentucky Transportation Cabinet, which does its own counts. (WDRB has requested but not yet received the agency’s previous two fiscal years of missing or lost items.)
The data show the Kentucky Department of Agriculture lost the most things – 53. Those items had an original value of nearly $50,000, although they were worth $3,700 at the time they were reported missing.
Three laptops, including one that was acquired in 2015 and still worth $336, couldn’t be found.
The Agriculture Department declined an interview request, but spokesman Sean Southard said in a statement that it takes the inventory procedures seriously and has made changes to get a more accurate count.
Agencies must disclose missing items worth at least $5,000 but are encouraged to list anything that cost $500 or more. In 2016, Southard said, agriculture officials chose to begin voluntarily including the lower valued equipment.
Had the agency used the $5,000 threshold, it would have not listed any inventory as missing, records show.
Also in 2016, Southard said the Agriculture Department reorganized its staff and put a single employee in charge of property, including working with colleagues scattered across Kentucky. The department also now has its office on one campus.
“We believe this helps Department staff track property and report it in a transparent manner, out of respect for Kentucky taxpayers,” Southard said.
The state Department of Corrections lost 46 items originally valued at $43,000. The list included two-way radios, a washing machine, a file cabinet and two pistols.
The department believes most of the items were properly disposed of or used for parts, spokeswoman Lisa Lamb said in statement. Police reports were filed for the two firearms that were reported stolen, she said.
“Due to staffing changes, departmental moves and system upgrades, not all tracking was updated or documented accordingly,” she said. “The Department of Corrections has been working diligently on updating inventory lists with more accurate information.”
Two other agencies – the Department for Natural Resources and the Parks Department – each reported losing more than $30,000 of inventory.
That includes a John Deere Gator all-terrain vehicle that was purchased in 2016 and stolen from Levi Jackson Wilderness Road State Park in Laurel County in southern Kentucky in 2018, Parks Department spokesman Gil Lawson said in an email.
Lawson said it was one of 106 such vehicles owned by the department. In all, the agency tracks 47,800 items across 45 parks.
“We make every effort to properly account for all state property,” Lawson said. “It’s possible that some of the items on this list have been sold, declared surplus or moved to another park but have not been properly documented for inventory purposes.”
Reach reporter Marcus Green at 502-585-0825, [email protected], on Twitter or on Facebook. Copyright 2019 WDRB Media. All rights reserved.
