Office of the Ohio Inspector General - Ohio Department of Rehabilitation & Correction Report of Investigation, 2018
Download original document:
This text is machine-read, and may contain errors. Check the original document to verify accuracy.
State of Ohio Office of the Inspector General RANDALL J. MEYER, Inspector General Report of Investigation AGENCY: OHIO DEPARTMENT OF REHABILITATION & CORRECTION FILE ID NO.: 2016-CA00032 DATE OF REPORT: MAY 22, 2018 The Office of the Ohio Inspector General ... The State Watchdog “Safeguarding integrity in state government” The Ohio Office of the Inspector General is authorized by state law to investigate alleged wrongful acts or omissions committed by state officers or state employees involved in the management and operation of state agencies. We at the Inspector General’s Office recognize that the majority of state employees and public officials are hardworking, honest, and trustworthy individuals. However, we also believe that the responsibilities of this Office are critical in ensuring that state government and those doing or seeking to do business with the State of Ohio act with the highest of standards. It is the commitment of the Inspector General’s Office to fulfill its mission of safeguarding integrity in state government. We strive to restore trust in government by conducting impartial investigations in matters referred for investigation and offering objective conclusions based upon those investigations. Statutory authority for conducting such investigations is defined in Ohio Revised Code §121.41 through 121.50. A Report of Investigation is issued based on the findings of the Office, and copies are delivered to the Governor of Ohio and the director of the agency subject to the investigation. At the discretion of the Inspector General, copies of the report may also be forwarded to law enforcement agencies or other state agencies responsible for investigating, auditing, reviewing, or evaluating the management and operation of state agencies. The Report of Investigation by the Ohio Inspector General is a public record under Ohio Revised Code §149.43 and related sections of Chapter 149. It is available to the public for a fee that does not exceed the cost of reproducing and delivering the report. The Office of the Inspector General does not serve as an advocate for either the complainant or the agency involved in a particular case. The role of the Office is to ensure that the process of investigating state agencies is conducted completely, fairly, and impartially. The Inspector General’s Office may or may not find wrongdoing associated with a particular investigation. However, the Office always reserves the right to make administrative recommendations for improving the operation of state government or referring a matter to the appropriate agency for review. The Inspector General’s Office remains dedicated to the principle that no public servant, regardless of rank or position, is above the law, and the strength of our government is built on the solid character of the individuals who hold the public trust. Randall J. Meyer Ohio Inspector General State of Ohio Office of the Inspector General RANDALL J. MEYER, Inspector General REPORT OF INVESTIGATION FILE ID NUMBER: 2016-CA00032 SUBJECT NAME/POSITION: Carl “Gene” Brady Infrastructure Specialist 2 Jason Bunting Warden Rebecca Shafer Business Administrator 3 AGENCY: Ohio Department of Rehabilitation and Correction Marion Correctional Institution BASIS FOR INVESTIGATION: Complaint ALLEGATIONS: Criminal Conduct INITIATED: August 15, 2016 DATE OF REPORT: May 22, 2018 INITIAL ALLEGATION AND COMPLAINT SUMMARY On August 9, 2016, the Office of the Ohio Inspector General was notified that Marion Correctional Institution (MCI) inmate David Dean, during an interview with an Ohio Department of Rehabilitation and Correction (ODRC) investigator, disclosed the location of prison contraband, including a hidden computer hard drive, razor blades, drill bits, and miscellaneous tools. These items were concealed inside an HP8000 printer in the Ohio Penal Industries (OPI) area of MCI. Dean claimed MCI-OPI staff instructed him to keep the contraband items in his work area “ … to keep them safe.” Dean also claimed the hard drive contained thousands of dollars’ worth of software programs illegally obtained. BACKGROUND The Ohio Department of Rehabilitation and Correction (ODRC) is charged with the supervision of felony offenders in the custody of the state; including providing housing, following offenders’ release from incarceration, and monitoring the individuals through the parole authority. The department also oversees the community control sanction system that provides judges with sentencing options to reduce the inmate population. There are currently 27 correctional institutions throughout the state. The director of ODRC is appointed by the governor and confirmed by the Ohio Senate. ODRC is funded through general revenue funds, federal funding, and revenue earned through sales from the Ohio Penal Industries.1 Ohio Penal Industries (OPI) is an inmate work program and a division of the Ohio Department of Rehabilitation and Correction. OPI manufactures goods and services for ODRC and other state agencies through the use of inmate labor under close staff supervision. OPI inmates produce and process a variety of products, including: inmate clothing, toilet paper, license plates, milk, meat, furniture, dentures, eyeglasses, cleaning compounds, plastic bags and other items. Inmates that work in OPI also service vehicles, provide office support, and install modular furniture. 1 Biennial budget documents. 1 The Marion Correctional Institution OPI metal shop produces metal furniture, including office chairs, institutional lockers, and radio consoles for the Ohio State Highway Patrol. Offenders at the MCI metal operation design and manufacture various types of institutional and security beds and storage solutions, and produce specially ordered products for other state agencies. The operation is now refurbishing dumpster containers.2 Prison News Network (PNN) is an ODRC inmate work program involving video editing, audio editing, graphic design, and animation at MCI.3 Ohio Department of Administrative Services The Ohio Department of Administrative Services (ODAS) is responsible for providing support services to state agencies. ODAS is organized into five divisions: Collective Bargaining, Equal Opportunity, General Services, Human Resources, and the Office of Information Technology. The director of ODAS is appointed by the governor and confirmed by the Ohio Senate. ODAS is funded through the general revenue fund and fees charged to agencies for services provided.4 Office of Information Technology The Office of Information Technology (OIT), a division of the Ohio Department of Administrative Services, is responsible for establishing policies and procedures regarding the purchase, use, and security of computer hardware and software in use by state agencies. The office is overseen by a state chief information officer appointed by the director of the Ohio Department of Administrative Services. All state agencies, excluding the elected officials, are subject to the rules and standards issued by OIT. RET3 RET3 Job Corp. is a non-profit organization dedicated to refurbishing, reusing, and recycling computer and electronic equipment while educating and training recipients and the transitional 2 Correctional Institution Inspection Committee (CIIC) report. Committee (CIIC) is a legislative committee f ODRC website. 4 Biennial budget documents. 3 2 workforce to repair, upgrade, and use computers. In 2003, the RET3 Job Corp. was formed as a 501(c)(3) non-profit organization by Ken Kovatch Sr. to establish a computer repair program for Ohio prison inmates, where they would learn to disassemble, sort, clean, and refurbish computers.5 INVESTIGATIVE SUMMARY On April 11, 2017, the Office of the Ohio Inspector General released Report of Investigation 2015-CA00043, which involved inmates at the Marion Correctional Institution who improperly obtained computers that were intended to be dismantled at MCI through the RET3 recycling program. The investigation determined inmates repaired and reassembled the computers and used the devices to access the ODRC internal IT network and the internet, commit identity theft, and obtain approved debit card accounts. As part of his remediation of the MCI inmate security breach of the ODRC IT network system, Ohio Department of Administrative Services Chief Information Security Officer (CISO) Nathan Norris removed unneeded network lines and increased the security of network switches. During Norris’ remediation of ODRC’s IT network system, a series of events occurred that lead to the discovery of a hidden Western Digital (WD) MyPassport6 terabyte hard drive inside an HP8000 printer in the Ohio Penal Industries (OPI) area of MCI: July18, 2016 - an anonymous kite7 was received by MCI officials which reported that the Marion Technical College (MTC)8 computer lab contained pornography. July 26, 2016 - a computer in R-Block of MCI was found to contain porn/child erotica. Inmate Kevin Kinkle was listed as the administrator on this computer. Kinkle worked in the MCI-OPI office area and had a computer assigned to him. July 28, 2016 - a search was conducted of the MCI-OPI office area where Kinkle worked and during this search miscellaneous contraband was discovered in the work areas of inmates David Dean and James Doyle, who were also MCI-OPI workers. 5 RET3 website home page. A portable external hard drive. 7 Kite - form used by inmates to communicate with prison officials. 8 Marion Technical College provides college-level courses for inmates at MCI. 6 3 August 9, 2016 - inmate Dean was questioned about contraband items found in his MCIOPI work area. On August 9, 2016, Norris was present while inmate Dean was speaking to an MCI investigator, and he overheard Dean disclose the location of the MyPassport hard drive hidden in an HP8000 printer. The printer was moved to the MCI investigator’s office, where Dean was able to remove the top part of the printer to reveal a hidden compartment containing the hard drive and other contraband. Norris reported this information to the Office of the Ohio Inspector General and the Ohio State Highway Patrol. Dean also reported that inmates working in the Prison News Network (PNN) area of MCI were pirating movies. The OPI, PNN, and MTC areas were secured on August 16, 2016, and Dean was later transferred to Allen Correctional Institution. On August 17, 2016, an interview was conducted with MCI-OPI inmate James Doyle. Doyle stated he had been held in the segregation unit of MCI since July 29, 2016, for possessing contraband items that were found in his OPI work area (office) that he shared with Dean. Doyle’s job in OPI was payroll clerk for the shop, which he said involved, “Keeping track of their money every day for all the guys that worked there. Clock in, clock out times; when they went on passes; what kind of passes; sick leave, personal leave, things of that nature. Plus, clerical duties.” Doyle said the contraband items found in his work area were network cabling ends, crimper plyers, and part of a power supply wiring harness. Doyle explained that the items had been in his work area for years and their use did not cause any concerns. Doyle stated during the interview that he was being told by MCI officials that his security level was going to be increased and he would be transferred to another institution. Investigators asked Doyle to explain why he believed the questionable items found in his work area, which had been in his possession for some time, were now considered contraband. Doyle said OPI Information Technology (IT) Technician Jerry Rable changed the passwords on his and Dean’s computers. Doyle said, “Deano checked him on it, he [Rable] gets an attitude.” Meaning, because of the conflict between Dean and Rable, the OPI staff now labelled items9 they had in their desk as contraband items. 9 Allen wrench, multi-meter, small piece of metal, and a can of white spray paint. 4 On August 18, 2016, an interview was conducted with inmate David Dean at Allen Correctional Institution. Dean had been incarcerated since 1987 and his parole board review was scheduled in 2017. He explained that on July 29, 2016, he and Doyle were placed in segregation at MCI for having contraband near Dean’s work desk in the OPI metal shop. Dean claimed these miscellaneous items were an Allen wrench, multi-meter, small piece of metal, and a can of white spray paint. Dean also claimed that MCI staff members brought the spray paint into OPI and the items had been there for years and that the staff knew about them. On August 8, 2016, after being informed by MCI officials that his security level was raised and he was going to be transferred to a different institution for possessing contraband, Dean reported that he knew where a MyPassport terabyte hard drive containing illegal or cracked10 software could be found hidden inside a printer in the OPI shop. Dean also said that the terabyte hard drive was brought into OPI by an MCI staff member and that the staff was aware of the hard drive’s existence. On August 9, 2016, the copier was moved to the investigator’s office and Dean showed staff how to open the printer to reveal a cavity area that contained the terabyte hard drive, razor blades, and drill bits. Dean claimed the hard drive containing the cracked software came from former MCI inmate John Malarchick who, when released from ODRC, was hired by RET3 in Cleveland Ohio.11 Dean said, “As for that Passport coming in, it was sent to Gene Brady and Gene Brady gave it to Mike Doyle. And that’s how it came in the institution.” Dean claimed there was a plan where Malarchick would hide drugs, cellphones, and other items in the middle of the pallets of computers transported in from RET3 into MCI for disassembly. Dean stated, We were allowed to build computers. We have built hundreds of computers in that office for Gene Brady. And I don’t even know where they went. They could have went right back out the back door. But we’ve done hundreds of computers with illegal software. Software cracking (known as “breaking” in the 1980s) is the modification of software to remove or disable features which are considered undesirable by the person cracking the software; especially copy protection features (including protection against the manipulation of software, serial number, hardware key, date checks and disc check) or software annoyances like nag screens and adware. 11 Malarchick was released from ODRC on September 14, 2012, and began work at RET3 on September 24, 2012. Malarchick left his employment at RET3 on July 15, 2014. 12 Carl “Gene” Brady was an MCI infrastructure specialist 2 and network administrator. 10 5 Dean noted that the computers brought into MCI from RET3 contained the hard drives with personal information of the devices’ previous owners: I have had people’s uh last will and testaments on the computer ... We get fully loaded computers that people unplug and donate … We read everything. We took anything we wanted off these computers … I had birth certificates in my hands. Death certificates in my hands ... We had business records, uh credit cards. Dean also reported that MCI staff members would rent movies, bring them into PNN where the movies would be copied by inmates onto computers, and then the staff members would return the movies to the rental facility. These copied movies were then shown at MCI on the inmate movie channel. On August 25, 2016, OPI employee Walter Holly was interviewed. Holly was asked why he removed Doyle’s computer. Holly explained that OPI IT Technician Rable informed him that Dean and Doyle had administrator access on their computers, a level of access that should not have been granted to them. Holly, his supervisor Sherri Smith, and Rable agreed that Dean and Doyle’s computers should be seized. While removing the computers, they discovered the contraband items. Holly listed the contraband items as a soldering gun, wire, computer video card, computer wire connectors, Allen wrench set, voltage meter, computer wire, crimpers, sand paper, RAM memory cards, and computer program disks. Holly reported that the tools were returned to the OPI shop and the computer items were returned to the MCI IT technician. On August 25, 2016, MCI-OPI Superintendent Sherry Smith was interviewed regarding the removal of Dean and Doyle’s computers and the contraband that was found in the devices. Smith explained that Rable checked the computers used by inmates Kinkle, Dean, and Doyle in the OPI office. Smith said Rable changed Doyle’s password access to his computer which irritated Doyle, who told Rable that he “… did not need a computer anyway.” Smith confirmed that Rable, Holly, and she then removed Dean’s and Doyle’s computers. Smith also confirmed that while removing these computers, contraband was discovered, which resulted in a conduct report charging Dean and Doyle with possession of contraband. 6 From these interviews, investigators determined the following series of events occurred leading to Dean’s subsequent report of the hidden MyPassport hard drive: On September 20, 2016, inmates Kevin Kinkle, Martin Crago, Roy Tarbet, and Donato Lombardozzi were interviewed. These inmates confirmed that many of the computers they had access to were built by themselves or other inmates. Lombardozzi and Crago confirmed that they would download movies that were purchased or rented onto a computer in PNN and then those movies could be broadcast through the institution. Kevin Kinkle told investigators that he worked in the OPI shop as an AutoCAD drafter, creating drawings of items manufactured in OPI. Kinkle was housed in R-block which was a merit or honor housing unit. Kinkle said several years ago he was given a computer to use in R-block to work on AutoCAD projects during the evenings, and this computer was linked to the inmate network, so he could do OPI work from his OPI office or his housing unit in R-block. Kinkle complained to then-Warden Jason Bunting13 that other inmates were using his R-block computer, 13 Warden Bunting was demoted on September 11, 2016. 7 and as a result, Kinkle was given an additional computer to use in R-block. When a previous investigation at MCI uncovered network violations in 2015,14 the network access was removed from this additional computer, requiring any work Kinkle did on the R-block computer to be transferred to his OPI computer by use of a thumb drive. Kinkle said, “Brady, the last IT guy kind of let us just do our thing.” When questioned about the building of computers in MCI, Kinkle said the computer parts were obtained from Brady: He had tons of computers … But everybody was just putting their own computers together --- I’m telling you this place was wide open for 10 years. They, they let us feed into that. And then whatever happened last year that put the brakes on everything --- and people were just building their own computers. There were hard drives everywhere. I mean it was just like we were on the streets … Uh I built the one in R-Block. I put the hard drives in and I loaded it. I did everything. Inmate Martin Crago told investigators that he worked in PNN for 10 years doing computer animation. When questioned about the building of computers, Crago explained that, “… we’ve kind of built computers uh from pieces and parts over the years.” Crago also confirmed that inmates would take DVDs or VHS movies, “… and we would import them onto the system and then we would uh play them on, on the computer.” Inmate Donato Lombardozzi also confirmed the building of computers by inmates in the PNN area and the downloading of movies to the PNN computer for broadcasting at MCI. On January 10, 2017, MCI Infrastructure Specialist 2/Network Administrator Carl “Gene” Brady was interviewed. Brady explained that his duties included the installation of inmate computers used in Lifeline, OPI, and PNN programs. Regarding PNN, Brady admitted that computers were built from parts that were purchased separately and installed by inmates. Brady admitted going to RET3 in Cleveland, Ohio and receiving hard drives which he then brought into MCI. Brady 14 Report of Investigation #2015-CA00043 - MCI inmates built computers and hacked into the state IT network to commit various crimes. 8 first claimed he had received one hard drive, then two, and finally admitted to receiving 15 hard drives from RET3. Brady also admitted receiving hard drives from Malarchick at RET3, but claimed he wiped the hard drives at his home before bringing them into MCI. PNN’s Copying of Movies Swank Motion Pictures, Inc. and Criterion Pictures provide both public performance licensing rights and licensed movies to numerous non-theatrical markets, including correctional facilities. MCI had a contract with Swank and Criterion Pictures to broadcast movies in the institution. However, both contracts prohibited the editing, copying, or downloading of movies. Swank Motion Pictures, Inc. confirmed that PNN’s downloading of movies violated the contract with MCI and the US Copyright Act 17 sections 101 and 106, but Swank representatives told investigators that prosecution was not sought because there was no financial profit. MyPassport Terabyte Hard Drive Analysis On May 2, 2017, investigators completed a forensic review of the 1 TB Western Digital MyPassport hard drive that was hidden in the MCI-OPI metal shop HP8000 printer. The printer was located in room D039 near the desks of inmates Dean and Doyle. The following is a list of items of interest discovered on the hidden hard drive: Cracked Autodesk/AutoCAD Software Investigators identified five folders in the 1 TB MyPassport hard drive that appeared to contain cracked versions of software, including instructions for installation and use. The cracked software included AutoDesk/AutoCAD and DVDFab Platinum. 9 Additional Cracked Software and Torrent15 Downloads: Investigators identified 11 folders that appeared to contain torrent downloads, which inmates should not have been able to either access or download: 15 A torrent is a file sent via BitTorrent protocol. BitTorrent is a peer-to-peer (P2P) file sharing protocol designed to reduce the bandwidth required to transfer files. In a P2P network, the “peers” are computer systems that are connected to each other via the internet. While P2P networks allow for easier, more convenient file sharing, they are also associated with software piracy and illegal music downloads; www.techterms.com. 10 Folders with Photos/Videos of Interest Investigators identified two folders in the hard drive that contained photos and videos of interest. One folder contained photos of former MCI inmate and RET3 worker John Malarchick postrelease from prison, and a second folder contained photos and videos related to Ford muscle cars; a self-admitted hobby of inmate Doyle and MCI-OPI Supervisor Joe Forester. Name 0 Arkansas - Oklahoma - Texas Pictures 0 Ford Pictures Path MCI-WXB1E84FPULY-2016-10-27 10-54-47.E01/Partition 1/My Passport [NTFS]/[root]/0 Arkansas - Oklahoma - Texas Pictures MCI-WXB1E84FPULY-2016-10-27 10-54-47.E01/Partition 1/My Passport [NTFS]/[root]/0 Ford Pictures Category Accessed Folder 4/26/2015 19:14 Folder 4/23/2015 13:57 The photos of John Malarchick holding a sign displaying his former inmate number corroborates Dean’s claim that the MyPassport terabyte hard drive came from Malarchick and was conveyed into MCI. 11 Using Industrial & Entertainment (I&E) Funds to Pay the Copier Lease Payment As part of the investigation, the Office of the Ohio Inspector General requested and received from ODRC copies of transaction reports from January 1, 2015, through August 2016 for various financial accounts held by Marion Correctional Institution. Pursuant to the Ohio Revised Code, all ODRC institutions are permitted to hold various bank accounts to process inmate group and 12 employee activities. All transactions, including deposits, expenses, and adjustments, are processed through a centralized accounting system called CACTAS. Industrial and Entertainment Ohio Administrative Code (OAC) §5120-5-04, Administration of industrial and entertainment funds, allows for the establishment of the Industrial and Entertainment (I&E) account. This fund is to be used for the entertainment and welfare of inmates. Income is generated from: Commissary profits Occupational activities Interest from interest-bearing checking accounts Transfers of funds Donations Vending machine commissions Interest from institutional investment accounts OAC §5120-5-04 (C) states, in part; “all disbursements from the industrial and entertainment fund shall be used for purchases which exclusively benefit inmates. No disbursements will be approved for items to be used for the benefit of an individual inmate, inmate group, or employees.” When investigators received and reviewed ODRC transaction reports from the MCI business office, it was discovered that the Prison News Network (PNN) had a separate account set up for its operation at MCI. From this account, checks were written monthly to GreatAmerica Financial Services Corporation,16 a vendor providing copier lease services. However, investigators believed the check amounts seemed low (typically under $100 per month) given the large size of the copier located in the PNN offices and for the volume of jobs PNN produced. Additionally, 11 transactions listed in the reports and totaling $912 were specified as PNN expenses for “incentive meals” and “movie night refreshments.” Transactions were also identified for coffee, hot chocolate, sugar, and creamer which were purchased for use by PNN staff comprised mostly of inmates. 16 GreatAmerica Financial Services Corporation is a nationwide provider of commercial equipment and technology financing. 13 A review of the MCI I&E account identified 19 additional transactions for GreatAmerica Financial Services Corporation. These expenditures averaged $2,000 a month and seemed more in line with the expected amount that would have been paid for use of the PNN copier. Investigators also identified other payments from the MCI I&E fund to various vendors where supplies and other items associated with products PNN produced could be procured. These payments were selected by investigators for further review to determine if they should have been paid from PNN’s account. Also, selected for further review were all payments to the Inmate Personal Account which were part of MCI’s I&E account. On September 15, 2016, investigators obtained for analysis the vouchers from the transactions identified above from the cashier’s office at MCI. This review found that all 19 of the GreatAmerica Financial Services Corporation’s vouchers which were paid out of the MCI I&E account were identified as “PNN Copier.” On one of the vouchers there was a handwritten note stating, “PO [Purchase Order] closed all future invoices to be processed by OPI.” However, the following month, the invoice for the PNN copier was again processed through the MCI I&E account. The total amount of payments made for the PNN copier through the MCI I&E account totaled $38,787. These transactions should not have been processed through the MCI I&E account, and instead processed through the PNN account. During a December 13, 2016, interview with then-MCI Business Administrator Rebecca Shafer,17 Shafer agreed that, … for that purpose that you’re saying is the copier really should not be paid out of I&E, but um no one wanted to just cut it off until we figured it out because a lot of times these things take awhile to develop and it just took us, you know, this long to get it over to OPI, and um --- and then it was being paid by, by OPI in their PNN account. On April 24, 2017, investigators from the Office of the Ohio Inspector General and OSHP interviewed MCI acting Business Administrator Patricia Fitch regarding the PNN purchasing records originally supplied by Shafer. Investigators questioned Fitch about why PNN’s copier lease payments were made from the MCI Industrial & Entertainment account, which per the Ohio Administrative Code states that, “… all disbursements from the industrial and 17 Shafer retired March 31, 2017. 14 entertainment fund shall be used for purchases which exclusively benefit inmates. No disbursements will be approved for items to be used for the benefit of an individual inmate, inmate group, or employees.” Fitch acknowledged that the copier lease payments were for PNN’s business purposes and did not necessarily benefit all the inmates as designated by code. Fitch stated that PNN could not sustain such a large copier lease payment on its own and continue to operate normally; for this reason, she believed the MCI I&E account was used to make the payments. Fitch also stated that the funds should not have been taken out of the MCI I&E account, but Shafer directed the payments be taken from the I&E account. Fitch stated that she was not privy to any conversations Shafer or Bunting had regarding the justification for using I&E funds for copier lease payments. A review of the supply vendors found some of the items paid for out of the MCI I&E fund were purchased for the library, chapel, One Stop center, the music program, and recreation area. Other vouchers were identified for the Lifeline program.18 Thirteen of these vouchers were for incentive pay for 12 inmates involved in the Lifeline program. As the Lifeline program did not benefit all inmates, these expenditures should not have been processed through I&E. Improper Inventory Control/No Property Asset Tags The ODAS Asset Management Handbook states, in part: As required by Section 125.16 of the Ohio Revised Code (ORC) and DAS Directive GS-D-05, all state agencies, boards and commissions have stewardship responsibilities with maintaining and reporting an inventory representing the activities of their state-owned assets in accordance with procedures prescribed within this document. On the topic of inventory control, the ODAS Asset Management Handbook requires: All assets classified as tangible personal property and maintained on OAKS AM or on an agency in-house asset management system shall each be affixed 18 19 The Lifeline Program is a workforce development and job readiness program. Ohio Administrative Knowledge System Asset Management System. 15 with at least one bar code inventory label (a.k.a. asset identification tag or tag) or radio frequency identification (RFID) tag (a.k.a., electronic medium device). The bar code inventory label shall have the agency name, including the division or institution name if applicable printed on it. Recognizable abbreviations can be used to replace the agency, division, and institution names. Investigators found that the 28 computers located in PNN were various brands and did not have the proper bar code labels affixed; however, they did have a plain generic label identifying the computers as PNN001, PNN002, etc. The MCI asset management records showed an asset tag number was listed for each computer, but in place of the serial number was the generic PNNassigned number. This was done so the computers could be replaced without changing the identification information of the computer and assigning a new asset tag number. During the January 10, 2017, interview with MCI Infrastructure Specialist 2/Network Administrator Carl “Gene” Brady, he said; I’ll --- will take the heat for that one. We put just generic tags on them because we knew --- we dis… --- in discussions with Miss Shafer, uh I was told that any area where there was going to be a high turnover rate, I could use a, a (stutters), a tag that had the same basic information on it and le --- and just you changed the information in the database and leave the same number on the 15 pieces of equipment that we’re gonna re --replaced [sic] in the next year. During the December 13, 2016, interview with MCI Business Administrator Rebecca Shafer, she admitted that the PNN computers were not purchased per ODAS policy. Shafer confirmed that the asset tags were not affixed to the computers, and the computers were listed in the asset management system as donated items after they were assembled from purchased parts into working computers. Investigators reviewed the MCI Internal Management Audit Reports for 2014, 2015, and 2016. In all three of these reports were findings of noncompliance for asset management. The same violation was noted on all three year’s audits; “… the active assets selected from the OAKS 16 AMS report were unable to be located within the institution grounds as required.” When questioned about this, Shafer said, So this is 2016 so that would have been 2014. Uh 2014 and ’15. And then I had the same finding last year, but again, with um the computer situation when they put an emphasis of testing on the computers, we knew we were gonna fail that anyway, so. It just kind of emphasized as we still had a problem. On March 9, 2017, Shafer provided the Office of the Ohio Inspector General with purchasing records in an attempt to identify which MCI Prison News Network (PNN) computers were assembled from various parts, purchased from multiple vendors between 2007 and 2015. Shafer previously provided investigators with asset management printouts and PNN computer inventory records that contained several questionable entries such as conflicting descriptions, lack of corresponding workstation numbers, and notations that all PNN computers were donated on two specific days in March of 2013. These entries prompted investigators to request additional supporting documentation, which included purchasing records (e.g., purchase orders, quotes, requests to purchase). Following an additional review of the asset management records, a review of the purchasing records, and several conversations with Shafer, investigators were unable to resolve the various discrepancies identified. On March 31, 2017, Shafer retired from MCIODRC. On April 24, 2017, MCI acting Business Administrator Patricia Fitch was provided an example of a single purchase order (PO# 039PN15) that Shafer had claimed detailed the purchase of parts for three separate PNN computers (PNN007, PNN018, and PNN023). Investigators informed Fitch that Shafer claimed that the phrase “all items” on the purchase order was used to describe all the parts used to build PNN023, but the phrase “all items” was also listed for PNN018. In addition, a video card listed on the purchase order referred to computer PNN007. Investigators asked Fitch how one purchase order could be used to justify the building of multiple computers when the term “all items” was listed multiple times. Fitch stated that she could not explain how this purchase order could be used for justification on multiple computer builds. Investigators 20 Ohio Administrative Knowledge System Asset Management System 17 also asked Fitch how the same purchase order (PO# 039PN15) could have three different “document date(s)” over a several-month-period as provided by Shafer. Fitch stated that she could not explain why there were multiple dates associated with the purchase order or how Shafer reached the conclusion that she could use a single purchase order to make multiple purchases documented on different dates. Investigators asked Fitch why every PNN computer was listed as “donated” in MCI’s asset management system and whether any donation records existed. Fitch could not explain why the computers were listed as “donated” and did not believe documentation existed detailing any donations. Investigators presented Fitch with a photo of a laptop computer that was seized from the studio in PNN. The laptop lacked not only a state asset tag and PNN workstation number, but was also not recorded in MCI’s asset management system. Investigators asked Fitch how MCI could accurately track assets when no asset tags were affixed to assets and no identifiable records exist at MCI. Fitch could not explain to investigators where the computer came from or why the computer was not assigned an asset tag. Information Technology Purchasing Violations Investigators determined that the computers found in PNN were built from purchased parts, and those parts were then assembled by inmates to create a complete computer, by-passing ODAS Office of Information Technology policy. The ODAS Office of Information Technology (OIT) provided the following requirements for agencies when purchasing IT equipment: Section 125.18 of the Ohio Revised Code (ORC) - Office of information technology duties of director - contracts: (B) Under the direction of the director of administrative services, the state chief information officer shall lead, oversee, and direct state agency activities related to information technology development and use. In that regard, the state chief information officer shall do all of the following: 18 (2) Establish policies and standards for the acquisition and use of common information technology by state agencies, including, but not limited to, hardware, software, technology services, and security, and the extension of the service life of information technology systems, with which state agencies shall comply; Ohio Department of Administrative Services IT Standard ITS-PLF-01, “Enterprise Client Computer Hardware” states, in part: ITS-PLF-01 Section 4.0: State agencies shall acquire client computers and LCDs that conform to standard configurations, include mandatory security features, and meet environmental compliance defined by this state IT standard. Client computer hardware shall meet and not exceed the standard configurations defined in the attachments to this standard. ITS-PLF-01 Section 4.5 Exceptions to this Standard: Agencies requesting a Release and Permit to procure client computers and LCDs not in conformance with this state IT standard shall provide sufficient business justification to document why a standard configuration does not satisfy their business requirements. In general, no exceptions will be granted to the mandatory security features and environmental compliance and labeling. As stated previously, MCI could not identify which computer parts were placed in each computer assembled and no corresponding serial numbers were recorded in the asset management system. CONCLUSION On August 8, 2016, MCI-OPI inmate David Dean was institutionally charged for possessing contraband which was found in his OPI work area. Dean was removed from his OPI job, was informed that his security level was being raised, and that arrangements would be made to transfer him to Allen Correctional Institution. As a result, on August 9, 2016, Dean spoke with 19 an MCI investigator and disclosed the location of a Western Digital (WD) MyPassport terabyte hard drive hidden in a HP8000 printer in the Ohio Penal Industries (OPI) area of MCI. The HP8000 printer was moved to the MCI investigator’s office, and Dean showed the investigator how to remove the top part of the printer which revealed a hidden compartment containing the hard drive and other contraband. Investigators analyzed the hard drive and found it contained five folders of cracked AutoCAD or pirated software, torrent downloads, hard drive cleaning software, and various photos. Dean claimed this hard drive came from a former MCI inmate, John Malarchick, who worked at a recycling service, and who gave the hard drive to MCI Infrastructure Specialist 2/Network Administrator Carl “Gene” Brady. Brady then brought the hard drive into MCI. Reviewing the photos on this hidden hard drive, investigators found photos of Malarchick after his release from MCI, adding to the credibility of Dean. Brady admitted bringing hard drives he had received from Malarchick into MCI. Dean and other inmates reported building and or repairing computers for Brady, which Brady confirmed. Dean also reported that inmates working in the MCI Prison News Network (PNN) were pirating movies. MCI allowed employees to bring movies in to MCI from video rental stores, which inmates then downloaded onto a computer in PNN, which violated the Swank Motion Pictures, Inc. and Criterion Pictures movie contracts in effect with MCI. Accordingly, the Office of the Inspector General finds reasonable cause to believe a wrongful act or omission occurred in this instance. Then-MCI Business Administrator Rebecca Shafer acknowledged that the lease payments for an MCI copier located and used in the PNN area of the facility should not have been made with MCI I&E funds. MCI I&E funds are designated to be used for the entertainment and welfare of inmates exclusively. Investigators determined that PNN maintained its own separate account at MCI from which the costs of leasing the copier should have been paid. 20 Accordingly, the Office of the Inspector General finds reasonable cause to believe a wrongful act or omission occurred in this instance. Then-MCI Business Administrator Rebecca Shafer and MCI Infrastructure Specialist 2/Network Administrator Carl Brady both acknowledged that asset tags were not affixed to the PNN computers. Additionally, the computers were incorrectly listed in the asset management system as donated items even though they were in fact assembled from purchased parts into working computers. MCI Internal Management Audit Reports for 2014, 2015, and 2016 noted ongoing problems with MCI’s asset management system and inventory control and MCI’s failure to resolve the issues. Accordingly, the Office of the Inspector General finds reasonable cause to believe a wrongful act or omission occurred in this instance. RECOMMENDATION(S) The Office of the Ohio Inspector General makes the following recommendations and asks the director of the Ohio Department of Rehabilitation and Correction to respond within 60 days with a plan detailing how the recommendations will be implemented. The Ohio Department of Rehabilitation and Correction should: 1. Conduct a complete inventory of all IT equipment to bring MCI into compliance with ODAS Asset Management policy. All computers and computer components improperly acquired should be salvaged through ODAS State Surplus and documentation of such provided to the Office of the Ohio Inspector General. 2. Assure that inmates are not used in installing, operating, maintaining, or servicing any information technology hardware, software, or system assets. ODRC should assure that inmates no longer have access to computer hardware or wiping and imaging software. 3. Assure that all ODRC employees involved in the acquisition of IT equipment comply with the statewide ODAS IT Policy Office requirements. 21 4. Review the actions of all employees involved to determine if administrative action or training is needed. REFERRALS The Office of the Ohio Inspector General has referred this report of investigation to the Ohio Auditor of State’s office for consideration. The Ohio State Highway Patrol presented the investigation to the Marion County Prosecutor for consideration. 22 State of Ohio Office of the Inspector General RANDALL J. MEYER, Inspector General NAME OF REPORT: Ohio Department of Rehabilitation & Correction FILE ID #: 2016-CA00032 KEEPER OF RECORDS CERTIFICATION This is a true and correct copy of the report which is required to be prepared by the Office of the Ohio Inspector General pursuant to Section 121.42 of the Ohio Revised Code. Jill Jones KEEPER OF RECORDS CERTIFIED May 22, 2018 Rhodes State Office Tower ◊ 30 East Broad Street – Suite 2940 ◊ Columbus, Ohio 43215-3414 Phone: 614-644-9110 ◊ FAX: 614-644-9504 ◊ Toll Free: 800-686-1525 ◊ Email: email@example.com The Ohio Inspector General is on the World Wide Web at www.watchdog.ohio.gov MAILING ADDRESS OFFICE OF THE INSPECTOR GENERAL JAMES A. RHODES STATE OFFICE TOWER 30 EAST BROAD STREET – SUITE 2940 COLUMBUS, OH 43215-3414 TELEPHONE (614) 644-9110 IN STATE TOLL- FREE (800) 686-1525 FAX (614) 644-9504 EMAIL OIG_WATCHDOG@OIG.OHIO.GOV INTERNET WATCHDOG.OHIO.GOV