News / Articles

ADP’s Domain Block on Russell Township Police Remains in Place 

with Action Steps Created to Resolve the Issue 

ADP Board Meeting - October 9, 2025 

Meeting Details: The Automatic Data Processing Board (ADP) held a Special Meeting at 11:00 am on October 9, 2025 in the Geauga County Auditor’s Office Appraisal Conference Room at 231 Main St., Chardon, OH 44024. Virtual access was available via MS Teams, and the agenda was provided in advance. Members of the public may attend ADP meetings virtually via MS Teams by emailing an invitation request to Auditor’s Office Chief Operations Officer Pam McMahan at PMcMahan@geauga.oh.gov. This Observer attended via MS Teams.

Public Comment: ADP does not have a written public comment policy. In practice, public comment is solicited at the end of the meeting.

Board Attendance:

• Auditor/Chief Administrator – Charles Walder

• Clerk of Courts – Sheila Bevington 

• County Commissioner – Carolyn Brakey

• Engineer – Andy Haupt 

• Board of Elections – Michelle Lane and Nora McGinnis

• County Prosecutor – Jim Flaiz

• Recorder – Mike Risco for Celesta Mullins

• Sheriff – Scott Hildenbrand 

• Treasurer – Caroline Mansfield for Chris Hitchcock 

• Coroner – John Urbancic (absent)

• Common Pleas Court Judge - Observer Note - It was stated at the January 28, 2025 meeting that this seat will not be filled. 

ADP Staff Attendance: 

• Frank Antenucci – Chief Deputy Administrator

• Zach McLeod - Information Security Manager

• Akshay Raikar 

• Joe Birli (virtual)

• Andy Haines 

Reviewer Note: ADP restructured into three groups earlier this year: Department of Advanced Technology and Applications (DATA), Department of Advanced Research & Cybersecurity (DARC) and Department of County Archives and Records Enterprise (CARE). More information on this restructuring is available in the March 4, 2025 ADP Observer Report.

Other Government Representatives:

• Tom Swaidner - Russell Township Police Chief

• Lt. Lalich - Russell Township Police Department

• Samantha Harris - Prosecutor’s Office (virtual)

• Pam McMahan - Chief Operations Officer, Auditor’s Office

Others Present:

• Ryan Patrick, Simway LLC (an IT service provider for Russell Township Police Department)

• Emma MacNiven - Maple Leaf (virtual)

• Diane Jones (virtual)

• This LWV Geauga Observer (virtual) 

The meeting was called to order at 11:00 am by Mr. Antenucci. 

Minutes: None presented. Approved ADP Minutes are posted online here through June 18, 2025.  

 

The Board took the following actions:

DISCUSSED - Update on Russell Township Police Department Request

Issue: Whether to lift the county email/domain block on russellpolice.com after a cybersecurity incident involving Russell Township Police Department (RTPD).

Background: The key facts discussed were as follows:

• The ADP security team operates in a zero-trust environment. Email blocks are applied quickly when CrowdStrike alerts and suspicious DNS (domain name system) activity appear. Mr. Flaiz stated that ADP is “overly conservative and I’m happy for it.” Observer Note: The suspicious DNS activity is central to the RTPD block. DNS is a fundamental component of the internet that translates human-friendly domain names into the numerical IP addresses that computers use to identify each other on the network. Often referred to as the "phonebook of the internet," DNS allows users to connect to websites using domain names instead of having to remember complex IP addresses.

• Mr. Patrick installed SentinelOne on a Russell Township Police Department (RTPD) device that also had access to Spillman. ADP observed DNS lookups to malicious domains. Observer Note: SentinelOne is an AI-powered cybersecurity platform. Spillman is a comprehensive law enforcement software solution that provides agencies with the tools to manage and track records such as incident reports, case files, arrest records and crime statistics.

• The “Direct Send” configuration in Microsoft 365 was reportedly toggled off by Mr. Patrick. The discussion then centered over whether additional mitigations were necessary and if they were implemented and documented. Observer Note: Direct Send functionality in Microsoft 365 allows devices and applications to send emails directly to internal recipients without authentication, making it easy to set up. This functionality can be exploited by cybercriminals. See article in Cyber Security News about its vulnerabilities.

• The ADP team emphasized adherence to its incident response policy, the state’s election-period IT freeze, and the need for clear, fact-based remediation evidence.

• Mr. Walder raised concerns about the vendor’s tone and lack of clear answers and requested logs. He indicated that in an earlier communication to ADP, Mr. Patrick implied that “ADP conjured up the block” as an attempt to bring RTPD under ADP’s operational umbrella. RTPD argued there was no evidence email accounts were compromised and that the ongoing email block hindered operations with the courts, prosecutor, and general communications. 

Points of disagreement:

• Whether email should remain blocked when security indicators were on laptops and PCs, not on actual emails. Mr. Patrick argued that if there were no suspicious emails spotted, the email block should be lifted. However, ADP had concerns that a compromised or misconfigured machine can later be used to phish or send malicious mail. 

• ADP requested logs pinpointing the origin and cause of the DNS requests (not just that they occurred) and confirmation of complete mitigation steps taken beyond flipping Direct Send off.

• RTPD and Mr. Patrick asked for clearer, earlier communication on exact unblock requirements.

Alternatives offered: Temporary routing via a township.gov address or workstation under the township’s domain to restore vital communications in the interim.

Motion and decision:

• A motion was made to maintain the domain/email block on RTPD until:

  1. After the election period (election results are to be certified by November 25, 2025), respecting the Ohio Secretary of State’s election security guidance, and

  2. ADP staff are satisfied the risk is mitigated. ADP may lift the block without returning to the Board once satisfied.

• The motion passed unanimously.

Action items:

• Mr. Patrick to provide detailed logs and a clear remediation report including the cause of DNS activity, confirmation of Direct Send disablement and other recommended mitigations completed, status of the re-imaging affected devices and retest results.

• Mr. McCleod and Mr. Patrick to meet in person to reconcile evidence and close gaps of understanding to reach agreement on a path forward. Issue status updates to be provided, suggested weekly, until resolution.

• ADP to proceed with an alternate email solution via township domain if needed.

Regular Business: No additional business was brought forward.

Public Comment: Mr. Antenucci asked for any public comments/questions. There were none.

The meeting was adjourned at approximately 12:16 am.

Next Meeting: The next scheduled meeting of the ADP Board is a Regular Meeting on December 9, 2025. 

Minutes when posted are available here: Meeting Minutes | Geauga County Automatic Data Processing

Virtual Meeting Information: Contact Pamela McMahan at PMcMahan@geauga.oh.gov.

Observer: Carol Benton

Editor: Gail Roussey

Reviewer: Sarah McGlone

Submitted: October 28, 2025

The League of Women Voters of Geauga is a 501(c)(3) nonpartisan political organization that encourages informed and active participation in government, works to increase understanding of major public policy issues, and influences public policy through education and advocacy. They do not support or oppose individual candidates or parties. Learn more about the LWVG at www.lwvgeauga.org.