At the July 26 Westfield City Council meeting, Westfield Clerk-Treasurer Cindy Gossard accused the city’s administration of installing “spyware” on all six computers in the clerk’s office and accessing the data on those computers without her permission.
The software, which provides remote access for the city’s IT department to handle computer issues, is created by BeyondTrust. The city issued a statement after the meeting refuting Gossard’s claims.
Gossard said that the software “appears to give unfettered and unauthorized access” into computer and data systems managed by her office.
“This situation is deeply concerning given that this software would allow a user to potentially access city financial information, city bank information and information on city employees,” Gossard said. “Further, a user could potentially use this software to access and change data in a way to make it appear these systems were being accessed and changed by either myself or one of my staff.”
Chris Larsen, the city’s director of informatics, said the software wasn’t spyware and that the city has installed a version of the software on every computer in the city since 2011.
Council member Scott Willis said his personal business uses a similar software and IT staff must ask permission to obtain full control of the computer. Larsen said the city’s software is able to take full control without the user’s permission, however the user can end the session at any time.
“A box pops up and shows ‘information support is here.’ It’s an icon we can’t remove,” Larsen said. “The data she is trying to protect is the data I am trying to protect.”
Larsen said members of the IT department using the software are unable to login as the user. He said if the IT department had logged into a computer, an investigation would show the login as an IT member and not the computer user.
Gossard said she and her staff have made repeated requests to have the software removed. A meeting between city attorney Blake Burgan, Gossard’s attorney Will Webster, Larsen and council member Jake Gilbert was tentatively set for the week of Aug. 2.
“I can advise the council that my office is undertaking efforts to further investigate this matter to determine who has been accessing my computer or all the computers in the clerk’s office and if any systems have been compromised,” Gossard said.
Gossard said she retained a forensic IT investigations company to look into the matter and expects the results in several weeks. Gossard said the city administration also has limited her ability to communicate directly with the city’s IT staff and has restricted her use of email and other modes of communication with city staff.
Mayor Andy Cook was not present at the meeting, but the city issued a statement after it concluded.
“Prior to the financial investigation commissioned by Mayor Cook, the clerk’s office never raised any concerns about the security of the city’s computer network. The BeyondTrust software (or predecessor) is a program that the clerk is well aware of and has used dozens of times,” the statement read. “It allows the IT department, upon request and with permission, to remotely access a computer while it’s in operation to assist with issues raised by individuals throughout the city. It’s on every city computer and has been used for 10 years. This technology is standard in almost all industries.
“It is strange that this is coming at a time when the clerk has, after months and months, provided BKD (a CPA firm currently conducting an audit of the city) with most – but not all – of the financial documents that have been requested. To impugn the professionalism and character of our city’s IT department is not acceptable and highly unprofessional.”
Cook ordered the audit of the city’s accounts in August 2020, after which BKD was retained for the audit.
For more, visit westfield.in.gov.
