ADP Board Special Meeting - May 9, 2023
Meeting Details: The Automatic Data Processing Board (ADP) met in special session at 1 pm on May 9, 2023 in the 3rd Floor Conference Room at the Geauga County Office Building at 12611 Ravenwood Drive, Chardon, OH. Virtual access was available via MS Teams and the agenda was provided in advance. This observer attended in person.
Public Comment: ADP does not have a written policy. In practice, public comment is solicited at the end of the meeting.
Board Attendance:
-
Auditor/Chief Admin - Charles E. Walder
-
Board of Elections - Michelle Lane, Director
-
Board of Elections - Nora McGinnis
-
Clerk of Courts - Sheila Bevington
-
County Commissioner - Timothy Lennon
-
Engineer - Joe Cattell
-
Prosecutor - Laura LaChapelle for Jim Flaiz
-
Recorder - Celesta Mullins
-
Sheriff - Scott Hildenbrand
-
Treasurer - Christopher Hitchcock
ADP Staff Attendance:
Other Government Representatives:
-
Ron Leyde – Chief Deputy Auditor
-
Pam McMahan - Fiscal Office Manager, Auditor’s Office
-
Kate Jacob - Chief Compliance Officer, Auditor’s Office (Virtual)
-
Paul Pestello - Auditor’s Office
-
Katie Taylor - Engineering
-
Ralph Spidalieri - County Commissioner
-
Gerry Morgan - County Administrator
-
Nicholas Gorris - Sanitary Engineer, Dept. of Water Resources
-
Roger Peterson - Director, Emergency Management
-
JoAnna Santilli - Director, Geauga County Transit
-
Duane Bidlack - Fiscal Officer, Geauga County Transit
-
Adam Litke - Administrator, Geauga Public Health
-
Velta Moisio - IT Director, Court of Common Pleas
-
Rean Davis - Fiscal Coordinator, Dept. of Developmental Disabilities
Others Present:
-
Chris Alusheff - HDAC, Aquilla Village Council
-
Amy Patterson - Geauga County Maple Leaf
-
Elise Von Gunten - Chagrin Valley Times
-
Adam Ferrise - Cleveland.com
-
Diane Jones (Virtual) - www.auburntownship.org
-
Gail Roussey - LWV Geauga
-
Shelly Lewis - LWV Geauga
The meeting was called to order by Mr. Antenucci at 1 pm.
Minutes: Minutes from the March 14, 2023 meeting were approved without discussion or edits.
ACTION ITEMS
ADP Equipment List for March 2023 - APPROVED without discussion
ADP Purchases List for March 2023 - APPROVED without discussion
Engineers Precision Laser & Instrument Inc - APPROVED
Mr. Cattell explained how the equipment would be beneficial in the field
Sheriff IPS Jail Camera Project - APPROVED
Sheriff Hildenbrand stated the nearly 20 year old cameras were being replaced, both inside and outside the facility.
Transit Safety Vision Bus Cameras - APPROVED
Mrs. Santilli stated grant funds are being used to replace vehicle cameras.
BOCC Operation of Key Card System purchased by the BOCC - TABLED
Background: Historically, building access has been controlled by BOCC’s Maintenance Department. In recent years, building access has evolved from physical keys to electronic key card systems. During construction of the Geauga County Office building, ADP vetted and recommended a cloud based key card system to secure the building and control access. BOCC instead opted to purchase a system that uses an on-site access control driver, which BOCC currently houses and operates. ADP asserts it is the only party authorized to operate the driver and has requested that BOCC turn over control to them. BOCC has refused to do so.
ADP Position - authority is derived from:
-
ORC 307.84, which states: After the initial meeting of the automatic data processing board, no county office shall purchase, lease, operate, or contract for the use of any automatic or electronic data processing or record-keeping equipment, software, or services without prior approval of the board.
BOCC Position - authority is derived from:
-
ORC 307.843, which states: The board of county commissioners may purchase, lease, or otherwise acquire any automatic or electronic data processing or record-keeping equipment, software, or services that the board determines is necessary, or that the county automatic data processing board recommends, from funds budgeted and appropriated by the board of county commissioners for such purposes.
-
ORC 307.01(A), which BOCC asserts gives them authority to access, secure and exert operational control over all county buildings.
Observer Comment: on pg. 8 of its Complaint for Declaratory and Injunctive Relief against Charles E. Walder, Allen Keener and Frank Antenucci, BOCC asserted that under 307.01(A) they had an”inherent right” to operate systems. After failing to reach a mediated resolution through the Ohio Supreme Court, BOCC filed a Notice of Voluntary Dismissal on April 4, 2023.
Mr. Morgan was invited to give his presentation. He proposed moving the server from the current IT closet to another location, with the Commissioners continuing to operate the server. Mr. Lennon added they are working with Intertech Company to set up each department’s individual access needs.
-
Mr. Litke, Mrs. Lane and Mrs. Bevington discussed some of their unique needs. Mr. Litke stated he needed remote access through his phone.
-
Mrs. Mullins inquired if the system they are proposing will be cloud based. Mr. Morgan responded that they intend to use the access control server they bought previously.
-
Mr. Walder stated he was concerned about non-technical people maintaining the server. Mr. Lennon indicated that Intertech will maintain and update the server. Observer Comment: notably, the recent cybersecurity breach at the Department of Water Resources involved a server being run outside of ADP authority with an outside contractor providing support.
-
ADP confirmed the server will be on the county network. If not properly maintained and updated, the server could present a security risk.
-
Mr. Antenucci requested a network diagram.
-
At this point Mr. Lennon suggested tabling the motion so that they could gather more information.
BOCC Operation of Mission Technology at Department of Water Resources - RESCINDED & TABLED
Background: Mission Technology was implemented at the Department of Water Resources sometime in the late 2000’s without being vetted and approved by the ADP Board.
Mr. Gorris (filling in for Mr. Kurzinger, who is currently on Administrative Leave) stated that the technology is used to monitor lift stations, water treatment plants and pumps. He said it is a web- based system that users login to.
-
Mr. Walder inquired about the login process and Mr. Gorris responded that they are working with the vendor to implement Multifactor Authentication and strong password protocols.
-
Mr. Walder asked where the server was kept and Mr. Gorris responded that he did not know but would find out.
-
Mr. Walder said he was concerned that the controls were active, not passive, and pointed out the pumps could be turned on as opposed to just being monitored.
-
Sheriff Hildenbrand noted that the motion authorizes BOCC to operate the technology and he inquired who is operating the technology now. Mr. Gorris responded that Water Resources is operating the technology.
-
Mr. Antenucci inquired who was acting as the System Administrator and Mr. Gorris responded that he had assumed this role in Mr. Kurzinger’s absence. Observer Note: earlier that day, BOCC placed Mr. Kurzinger on Administrative Leave but did not revoke his network credentials. Mr. Dvorak specifically requested this action but the Commissioners were advised by Administrator Gerry Morgan that “he would look into it.”
-
Mr. Antenucci requested a schematic and Mr. Walder agreed that this information was needed so that they could begin to assess any risk to the network.
-
At this point Mr. Lennon moved to rescind the resolution and then made a second motion to table the motion until more information could be gathered.
Updated ADP Price list - APPROVED without discussion
Transit Technology and Networking Technologies Erie - APPROVED
Mrs. Santilli explained she is using grant funds to replace 4 workstations and purchase a laptop. These assets will transfer to LakeTran on July 1, 2023, in accordance with their partnership agreement.
470 Center Street Network Switching Upgrades - APPROVED
Mr. Haines explained that the county offices at 470 Center Street continue to be utilized by the Board of Elections, CASA, Department on Aging, and the Maintenance Department. It is necessary to upgrade the internet switches at that location. He clarified that Water Resources no longer has a presence at that location.
-
Mrs. Lane stated that the Board of Elections’ moving date depends in part on whether there will be an August election. She noted that the deadline for the General Assembly to act on that question is the next day (May 10).
-
Mr. Hitchcock inquired if the internet switches could be used elsewhere and was told they could likely be repurposed.
Spectrum Fiber Circuit - APPROVED
MicroAdvantage Inc Camera System - APPROVED
Discussion Items:
Geauga Court of Common Pleas - Security Concern
Background: The Geauga Court of Common Pleas includes four elected officials::
-
Clerk of Courts - Sheila Bevington
-
Court of Common Pleas/General Division - Judge Ondrey
-
Court of Common Pleas/General Division - Judge Paschke
-
Court of Common Pleas/Probate & Juvenile Services Division - Judge Grendell
The ADP policy requiring 25-character password length for all Geauga County users went into effect on November 1, 2022 and the multifactor authentication (MFA) requirement went into effect on March 1, 2023. Admin, service accounts, and servers require much longer passwords.
ORC 307.84 states, in part: As used in sections 307.84 to 307.846 of the Revised Code, "county office" means any officer, department, board, commission, agency, court, or other office of the county, other than a board of county hospital trustees (emphasis added).
Mr. Walder opened the conversation by stating that ADP’s efforts to improve network security have been hampered by departments that resist adopting the new security protocols.
-
Ms. Moisio, IT Director for the Geauga Court of Common Pleas, reported that three of the four officials are “on board” with implementing Gateway MFA and long passwords. The fourth party has been advised of the security protocols but has not taken steps to adopt them.
-
Mr. Antenucci asked if the non-compliant party was Juvenile and Probate court and Ms. Moisio confirmed this was the case. She also stated that the Court systems are on the Geauga County network and confirmed that their servers are with ADP.
-
Mr. Walder commented that email is going to become a huge issue when ADP shuts down Microsoft Exchange Server in July. Ms. Moisio indicated she is well aware of that problem but cannot force the parties to comply with the ADP security protocols.
Observer Comment: Judge Grendell heads the Court of Common Pleas/Probate and Juvenile Division. It is unclear to LWVG why the Common Pleas Courts would not be subject to ADP’s authority over the operation of IT systems. We have requested additional information.
Termination of the Geauga County Auditor’s Separation Agreement
Mr. Walder explained that the agreement automatically terminated when BOCC fully restored staffing and equipment budget cuts it had made in December, 2022. See our Jan 9, 2023 ADP Observer Report for more details.
Emergency Services Migration to MS365
Mr. Peterson described significant difficulties migrating from Windows 7 and Exchange Server to Microsoft365. He and his staff were unable to access email for a week and ultimately requested a “rollback” on April 29 to the previous system. His department also needs to identify a replacement for a now unsupported program that provides data to FEMA.
-
ADP staff commented that “the split domain issue” was complicating the migration and referred to a similar issue when the Prosecutor’s Office migrated.
-
Mr. Walder said that the migration must move forward and directed ADP staff to timely address Mr. Peterson’s concerns.
Public Comment: Shelly Lewis, President of the League of Women Voters of Geauga, after requesting permission to address individual members of the ADP Board, asked two questions:
-
Of Mr. Walder, she inquired why the Geauga County Courts would not be subject to ADP’s statutory authority? Mr. Walder indicated that the courts were quasi-government county bodies and explained that protection of the county network historically has been achieved through cooperation between ADP and the IT Director for the Court of Common Pleas.
The meeting was then adjourned.
Minutes when posted are available here: Meeting Minutes | Geauga County Automatic Data Processing
Virtual Meeting Information: Contact Pamela McMahan at pmcmahan@gcauditor.com
Observer: Shelly Lewis
Editor: Anne Ondrey
Reviewer: Gail Roussey
Submitted:5/10/2023
The League of Women Voters of Geauga is a 501(c)(3) nonpartisan political organization that encourages informed and active participation in government, works to increase understanding of major public policy issues, and influences public policy through education and advocacy. They do not support or oppose individual candidates or parties. Learn more about the LWVG at www.lwvgeauga.org.