Warrant: Adams County clerk’s laptop investigated for misconduct in office, computer crimes

Investigation follows disclosure of data breach
Warrant: Adams County clerk’s laptop investigated for misconduct in office, computer crimes

Investigators are looking into a laptop used by an Adams County clerk following a massive data breach, according to search warrants filed in Dane County Court.

The search warrants filed on Aug. 3 and 6 by the Wisconsin Division of Criminal Investigation show investigators are looking into a laptop computer used by current County Clerk Cindy Phillippi after a data breach compromised the personal information of more than 258,000 people.

The warrant is to search for evidence of “computer crimes and misconduct in public office” between January 2013 and July 2018.

Phillippi has not been charged with a crime, and county officials would not confirm or deny that she is a suspect in the case.

Details in the warrant say investigators believe that, at one point, Phillippi had unexplained access to key security software, which would have given her access to sensitive information.

The warrant also says in January 2018, Adams County hired an investigator from von Briesen and Roper to “conduct an investigation of Cindy Phillippi with regard to the fulfillment of her official duties under Wisconsin law, Adams County Ethics Ordinance, Adams County Employee Handbook, and state and federal privacy laws.” That report was returned to investigators July 31, according to the warrant.

Adams County officials notified the public of a security breach Friday, saying an outside company, Schenck, had been conducting an information technology incident investigation at the end of March and had discovered questionable activity on the Adams County computer system and network. The breach was confirmed in June.

More than 258,000 people’s personal info statewide is affected as part of a security breach in Adams County. More info at https://t.co/vcacO5jFpj pic.twitter.com/DxTNPESv3t

— Madalyn O’Neill (@news3madalyn) August 10, 2018

On June 29, Adams County received a forensic report that personal identification information, personal health information and tax intercept information for approximately 258,120 individuals whose information was on the computer networks and systems had been compromised, officials said.

Departments affected by the breach include the Veterans Service Office, the Extension Office, Adams County employees, the Solid Waste Division, Health and Human Services, Child Support and the Sheriff’s Office, according to the release. The breach affected information from Jan. 1, 2013, through March 28, 2018.

Adams County Manager Casey Bradley confirmed the person responsible for the breach worked for the county, but would not confirm or deny to News 3 that Phillippi was a suspect.

Bradley said the person responsible no longer has any access rights to view the Adams County computer network and system.

About 160,000 of those affected had data in the system through the county’s Health and Human Services Department, which has partnerships throughout the state.

“We may have accessed their file, so it was on our network, therefore the numbers are substantially higher,” Bradley said.

There is evidence that there was unauthorized access of personal information in which unauthorized people obtained rights, usernames and passwords by manipulating certain software programs on the Adams County computer network that allowed them access, officials said.

Bradley said the data likely didn’t leave the county.

“From all the information we have, it’s an internal breach, so we have employees that access documents or records that should not have and that’s what we’re in the process of cooperating with law enforcement, to address that,” he said. Bradley also said he’s working with the Division of Criminal Investigations and an investigation that is ongoing.

County board agenda records show on Aug. 1, the board discussed scheduling a hearing on a verified statement of charges filed against a public official.

A county board member confirmed to News 3 that the board will hold a hearing on Aug. 16 to consider a statement of charges against a public official, but could not confirm or deny that the official is Phillippi.

The timeline means Phillippi will be in office on Tuesday for the primary election.

When asked about Phillippi’s employment, a spokesperson for the Wisconsin Elections Commission said the agency had been in contact with Adams County, and said the agency had not received any information indicating that the data breach involved the upcoming election.

The spokesperson also said the agency had been in touch with clerk staff who “assured WEC they have adequate resources to assist municipal clerks with the partisan primary election on Tuesday,” but the agency has offered assistance.

News 3 tried to contact Phillippi this afternoon for comment and did not immediately hear back.

Bradley said additional steps were taken to fix the breach, including giving the control of authorized access to the involved departments to one person, according to the release. A long-term solution to prevent future breaches is currently being worked on and will be implemented as soon as it is feasible in light of current design and costs, officials said.

County board member Mark Hamburg said the situation breaks his heart.

“It scares the daylights out of you,” he said.

Information about how to contact Adams County to see if you were affected by the breach can be found online.