Obstacles to the Orderly
Operation
of the Santa Cruz County Grand
Jury
Background
The
Santa Cruz County Grand Jury exists as a check or balance on the operations of
local government. If wrongdoing is uncovered, information will be turned over
to the appropriate authorities for proper action; but, in general, the purpose
is to act as a watchdog on county operations and ensure that everything is
working fine. The jurors' expectations are that things are mostly working fine.
The
Grand Jury is composed of people essentially donating their time.[1] They are doing this to provide a benefit to
the taxpayers and citizens of Santa Cruz County. Members of the Grand Jury do
not generally anticipate earth-shaking discoveries. They are simply serving in
the hope of providing a fresh and useful look at local governments and special
districts. The belief is that their perspectives will be able to assist in
improved operations.
The
Grand Jury also hopes that everyone it works with will understand this, and
will help the Jury accomplish its function. The time available for Grand Jurors
is very limited, so the Jury needs substantial cooperation in order to complete
its tasks on time. The Jury's main goal is to help improve the efficient, fair
and forthright operation of various government agencies throughout Santa Cruz
County; this cannot be done without everyone's help.
Scope
This
year's Grand Jury has determined that it would be useful and informative to
report on its perception of the difficulties it encountered in trying to accomplish
its task. There were many obstacles: some were systemic; some were unique due
to the courts being moved to state control; some were normal misunderstandings;
others were without explanation. The Grand Jury wrote this with the hope that
it can be used to encourage greater understanding and cooperation between
future Grand Juries and the agencies they will be working with.
Findings
1. Some information was unnecessarily difficult to obtain. One
committee began an investigation into the operations of the Information
Services Department (ISD). They received substantial cooperation from the
director and his department heads. At least they received substantial verbal cooperation and actually stumbled
into the following problems:
a)
On
occasion, requested materials from ISD were promised, but not delivered.
Follow-up requests were ignored, stonewalled, routed through intermediaries or
vetted through superiors. Requests for written responses were often ignored.
Through this process, some responses were also lost entirely. We cannot report
on the actual cause of some of these problems. Much of the feedback was
informal and came from verbal sources.
Response: Santa Cruz County Board of
Supervisors
The County is not aware of requested material that was not provided to the Grand Jury. It is the County’s policy that all legal requests from the Grand Jury are to be provided in a timely fashion.
b)
Several
Grand Jury members requested virtual private network (VPN) access to the
County's internal network. They wanted this access to facilitate researching
county operations and to make it possible to edit Grand Jury documents from
home. The ISD department made unequivocal assurances that no security issue was
involved. Nevertheless, after initial approvals, the requests were stonewalled,
run around, deferred, ignored, even promised and then ultimately denied due to
unspecified “concerns about security”. Pressing the issue was strongly
discouraged due to the cost of the necessary “political capital”.
Response: Santa Cruz County Board of
Supervisors
An initial
positive verbal response was given to the Grand Jury regarding the request for
remote access to the County’s computer systems. After further review, the
request was denied in writing due to the County’s security concerns. The County does not
anticipate or plan to provide VPN access to non-employees except for the highly
restricted access authorized for certain vendors to support specific software
products. The use of home computers which are not under the County’s control or
supervision presents specific concerns regarding virus protection and
firewalls. Anyone accessing the County’s network must have a virus free
computer. Any persons using DSL or broadband for access to the internet must
utilize a firewall between their home computer and their Internet Service
Provider. VPN, coupled with persistent connection technologies such as DSL and
broadband, provides continuous 24 hour internet connections that create the
opportunity for hackers to probe home computers and potentially gain access to
County networks. For these reasons, it remains inappropriate for the
Information Services Department to authorize any expansion of VPN access to the
County’s computer networks.
The Grand Jury would like to make it clear that this situation is not
the norm. There were many cases where people graciously bent over backwards to
be helpful. The Grand Jury is pointing out situations that should not have
happened.
Response: Santa Cruz County Board of
Supervisors
The County appreciates the comment and will continue efforts to work cooperatively with the Grand Jury.
2.
Access
to the county's internal network is important and even crucial for efficient
and effective research. Despite this, access was denied for several weeks. The
reasoning, we were led to believe, was due to fears that Grand Jurors would
break into private areas of the county internal network. However, the Grand
Jury has the authority to investigate all areas of the County, whether on the
network or not. In any case, access was removed with little notice and we
weren't officially informed in writing until near the end of our term.
Response: Santa Cruz County Board of
Supervisors
ISD is responsible for safeguarding County computer resources, and by due diligence, requires a signed security agreement for access, and uniformly monitors all access. Access to the County’s internal network was provided as soon as the signed security agreements were received from the Grand Jury.
3.
This
incident was followed by a request that Grand Jurors sign a somewhat modified
internet access form that contained language granting the ISD department
authority to monitor all Grand Jury computer network activity. This conflicts
with the confidentiality required by the oath taken by the Grand Jury members.
Upon careful consideration of this language, many on the Grand Jury chose to
uphold the oath and forego signing the form. Though it is difficult to imagine
county ISD employees monitoring the Grand Jury, this explicit right has been
asserted through all versions of the document presented so far. The Grand Jury
is concerned about the county government's insistence on including this
language in the form.
Response: Santa Cruz County Board of
Supervisors AGREES
The County agrees with this finding with the following clarification.
As stated in a letter to the Grand Jury, the County of Santa Cruz has
no intention of hindering or restricting the Grand Jury’s operations or
investigations in any way and is committed to complete compliance with the
legal responsibility to provide requested information to the Grand Jury.
However, the County is also responsible for maintaining the security of its
computer data and systems. To meet these disparate obligations, the County will
provide all information requested by the Grand Jury in such a way as not to
jeopardize computer system security.
4.
The
transfer of the financial administration of the Grand Jury from the Superior
Court to the county had been planned for a number of years. Nevertheless, the County proved to be ill-prepared to
handle the transfer. Worse, county staff exhibited little concern or
responsibility for the problems created. Some bills were left unpaid for
inordinate amounts of time and that led to significant inconveniences. As
examples:
a) It took nearly six months for
some of the Jurors to be reimbursed for their training expenses and three
months after submittal to be paid for most of the quarterly mileage and per
diem expense reports. The primary cause of these delays was that the paperwork
got lost and the subsequent failure to notify the Grand Jury about their loss.
b) The post office box rental
went unpaid until the Post Office sealed the box. This was inconvenient.
Response: Santa Cruz County Board of
Supervisors PARTIALLY AGREES
The Courts did not inform the County of their intention to transfer administration of the Grand Jury to the County until after the 2002-03 Grand Jury was in place. This late notification resulted in transition difficulties. County staff immediately worked with Court personnel to resolve these issues, and the Courts have retained responsibility for training reimbursements, mileage, and per diem payments. We regret any inconvenience.
5.
There
were occasions when "not expending political capital" was more
important to County officials than their official responsibility to assist the
Jury. The Grand Jury determined that there were two avenues of investigation
that held promise for substantial savings in county operations. The problem was
that doing a proper investigation required more time than was available to
Grand Jury members. Consequently, the investigations would have required
outside agencies to do much of the work. That kind of consulting work must be
requested through the advocates of the Grand Jury to the Board of Supervisors.
The jurors who were qualified and interested in presenting the case to the
Supervisors were never called upon. Consequently, these investigations were
pocket vetoed instead of openly decided upon. Some counties simply budget for
outside consultants as part of the normal annual budgeting process.
6.
The
ISD department charges the Grand Jury $200 per month for network connections.
This is $150 more than a DSL connection from the phone company.
Response: Santa Cruz County Board of
Supervisors AGREES
The County agrees with this finding, with the following clarification. The monthly network connection fee is $105.00 for any workstation on the County network. In addition to connectivity, this fee covers the cost for additional services including virus software with timely updates, internet access, help desk support, etc.
Conclusions
1. A few of the County employees
and elected officials show a lack of understanding of the role of the Grand
Jury and their legal responsibilities to it. These individuals show a
reluctance to communicate forthrightly with the Grand Jury under some
circumstances.
2. Detailed oversight
of the Grand Jury network usage by any county agency is inappropriate and
contrary to both the letter and the intent of California state law regarding
grand jury responsibilities.
3. In operations the size of
Santa Cruz County, there are almost always significant inefficiencies and
waste. Given the complexity of county government, it would be beneficial to
follow Santa Barbara's example and make an annual appropriation for external
management audits.
4. Working with certain
county employees leaves the Grand Jury with the distinct impression that they
are reluctant to work with the Grand Jury and do so only out of necessity. The Grand Jury is concerned that these County
employees are working under a fear over the consequences of supplying requested
information to the Grand Jury. It is not clear what concern they might have,
but they should not be facing any concern over consequences.
5. The vetting of responses
through superiors delays responses and makes working with county employees much
more cumbersome and difficult.
6. The County did not take full
responsibility for ensuring that all the necessary infrastructure was in place
for the Grand Jury to go about its duties.
7.
The security concerns
the county has regarding VPN access by Grand Jury members also apply to county
employees, contractors and elected officials. Anyone using VPN access to the
county network presents identical vulnerabilities.
Recommendations
1.
It
would be extremely useful for the CAO, key department heads, and the Board of
Supervisors to meet with the incoming Grand Jury at the start of each year. In
this fashion, the leaders would have an opportunity to become acquainted with
the people who will be conducting the investigations. People do communicate
more freely with people they have met.
Response: Santa Cruz County Board of
Supervisors
County leaders would be pleased to respond to all invitations from the Grand Jury to meet informally. Some years, the County staff has been requested to participate in Grand Jury orientation, and these efforts have been well received. The County Administrative Officer would welcome the opportunity to discuss how best to formalize such a procedure for the future.
2.
All
county governmental employees should be encouraged to cooperate and communicate
freely with the Jury and not have to worry about their jobs. The Grand Jury
should be treated as a fully functional partner in Santa Cruz County
governance.
Response: Santa Cruz County Board of
Supervisors
This recommendation is
already in place and will be reiterated.
3.
The
Grand Jury needs a network connection that can be reasonably assured of being
free from intrusion by any County employee. It needs a confidential direct DSL
line to an outside ISP. It will also save $150.00 per month in the Grand Jury
budget.
Response: Santa Cruz County Board of
Supervisors
The recommendation for a network connection
that can be reasonably assured of being free from intrusion by any County
employee is already in place. The County could provide the Grand Jury with a
separate DSL line, but this would prevent the Grand Jury from accessing the
County intranet, which the 2002-03 Grand Jury required. The County will
continue working with each Grand Jury to provide them with the computer
resources needed to complete their efforts.
4.
The
Board of Supervisors should make regular annual appropriations for outside
management audits and structure the execution of the audits in such a way that
they compliment the activities of the Grand Jury.
Response: Santa Cruz County Board of
Supervisors
This recommendation has already been implemented. Individual departments recommend funding when necessary to employ outside auditors or management consultants to review County operations.
5.
There
should be no security concerns about access at all. Since there is, all VPN
access to the County internal network should be halted immediately. Once secure
access can be assured, then VPN access should be resumed and be granted to any
Grand Jury member who requests it.
Response: Santa Cruz County Board of
Supervisors
This recommendation will not be implemented for the reasons described in the responses to the findings above.
6.
Incoming
Grand Jurors should have a proper orientation meeting replete with a County
Grand Juror procedures manual, forms packet and contact list. There should be
no confusion over how to fill in and submit expense reports and other forms.
Response: Santa Cruz County Board of Supervisors
This recommendation has been and will continue to be implemented. County staff will continue to work with Court staff and Grand Jury members to maintain and enhance the existing procedures manual and contact list.
Responses Required
|
Entity |
Findings |
Recommendations |
Respond
Within |
|
Santa
Cruz County Chief Administrative Officer |
1-4,6 |
1-6 |
90 Days (Sept. 30, 2003) |
|
Santa
Cruz County Information Services Department |
1b, 3, 6 |
2,5,6 |
90 Days (Sept. 30, 2003) |
|
County
Board of Supervisors Of
Santa Cruz County |
10 |
1,3 |
60 Days (Sept. 2, 2003) |
Note: County Board of Supervisors of Santa
Cruz County responded for Santa Cruz County Chief Administrative Officer and
Santa Cruz County Information Services Department.