TO: Jan Homan, Deputy Chief Operations Officer-Bus FROM: SUBJECT: Lisa Johnson, Assistant Director Field Operations \\ V\ Arleen Schilling, Acting Director Program Evaluation and u d i t ~ J Investigation Findings-Richard P. Johnson, Employee# 09221 Background On February 10, 2014 I was contacted by Chad Loeffler, Assistant Director of the Transit Control Center (TCC) and informed that an employee, Richard Johnson, had used his Council granted access to Driver and Vehicle Services(DVS) records,
Mr. Loeffler inquired about the possibility of having an analysis done of Mr. Johnson's work computer hard drive. Mr. Loeffler stated that Dan Abelson, Associate General Counsel, was working with him and Sergeant Troy Schmitz of the Metro Transit Police Department (MTPD) concerning the allegations. Mr. Johnson was reported to have accessed over 7,000 DVS records. When searching for DVS information the search can be by last name which may result in multiple individual's records appearing. Within the DVS system driver license photos, including historical ones, can be accessed in addition to name, address, height and weight. A lookup of a driver's license information may result in multiple accesses on DVS reports. Under Federal law individuals who have had their information obtained inappropriately may be awarded, monetary damages. Methodology To determine what information was viewed by Mr. Johnson and how the information was used the following activities were performed: Mr. Johnson was interviewed on March 12, 2014. Mr. Johnson was provided a Tennessen Advisory which he signed. The following were present at the interview: 11 Deb Downing, TMSA Steward 11 Steve Jaegar, TMSA President 11 Ron Rollins, TMSA Attorney Chad Loeffler, Assistant Director, Transit Control Center Curt Olson, Assistant Manager, Transit Control Center A forensic analysis was conducted on the computer hard drive that was identified as Mr. Johnson's main workstation, DVS usage records were reviewed for the time period of January 1, 2011 through May 24, 2013, IP addresses were reviewed, Investigatory interview notes were reviewed. Meetings were held with TCC, MTPD and General Counsel staff. Page- 1 METROPOLITAN COUNCIL Findings PLEASE NOTE: These findings and conclusions may contain non-public private data on Council employees. This report should not be disclosed to persons who do not have a business reason to see or have the findings and conclusions. Questions about the status of this report under the Minnesota Government Data Practices Act should be directed to the appropriate "designee" identified in the Council's Data Access Procedures. 1. Council Policy 4-6 requires all employees to abide by all laws and to adhere to high professional standards. Council Policy 4y6-a, Code of Ethics Procedure, prohibits employees from using data on individuals for personal benefit and from providing access to others who are not authorized. Council Policy 4-6-3d prohibits employees from using Council owned equipment for the employee's private interest. Mr. Johnson utilized Council owned equipment and DVS access rights to view private and confidential information for his personal interest. Mr. Johnson admitted that he looked up driver and car license information on the DVS website for reasons of opportunity, boredom and curiosity. He stated that he had no malicious reason for doing so. He stated that he had not downloaded any information or pictures from the DVS site. The forensic analysis of his computer showed no evidence that any information had been downloaded. Mr. Johnson said that he had been trained on the appropriate use of the DVS system and that he had received emails from his supervisors that warned against the misuse of the system. These emails were ones sent to all TCC staff. Mr. Johnson stated that in his position he did not have a need to access the DVS system and that in May 2013 his access was removed. Review of DVS access by Mr. Johnson found that from January 1, 2011 through Mary 24, 2013 he accessed 7,324 records. 1,017 of these records were license plate records while the remaining 6,308 were drivers' license records. The majority of the license plate lookups occurred while he was utilizing TCC IP locations. This would indicate that these were planned lookups since he wouldn't be seeing random car license plate numbers while working inside the TCC. When asked why he looked up car license plate numbers he stated it was because he might have liked the car. Mr. Johnson accessed the DVS system on 69 different days from IP addresses outside of the Metropolitan Council. He admitted accessing the system from his home. He said that he really doesn't know why he did it but he didn't mean any harm by it. When asked who the people were whose data he was accessing from home about half were relatives. There were five ex-girlfriends and three public figures that he also accessed from home. He was unable to identify some of the people who's data he accessed. He stated that he had not shared his log in information with anyone else. When reviewing the names of the people accessed by Mr. Johnson I looked at the number of days accessed as opposed to the number of times accessed due to the sheer volume of records. Mr. Johnson accessed the records of more than 100 Metro Page - 2 I METROPOLITAN COUNCIL Transit employees or their relatives as well as over 40 public figures or their relatives. Many of the people accessed were relatives, neighbors or former friends. DVS information on former girlfriends, their spouses or their friends was accessed on more than 50 different days with some exceeding 100 different days. 2. Minnesota Government Data Practices Act provisions were violated by Mr. Johnson. Minnesota Statute 13.05,subd.4, provides the following: "Private or confidential data on an individual shall not be collected, stored, used, or disseminated by government entities for any purposes other than those stated to the individual at the time of collection in accordance with section 13.04, except as provided in this subdivision." Minnesota Statute 13.09 states "Any person who willfully violates the provisions of this chapter [Minnesota Government Data Act] or any rules adopted under this chapter is guilty of a misdemeanor. Willful violation of this chapter by any public employee constitutes just cause for suspension without pay or dismissal of the public employee." As stated in finding number one Mr. Johnson collected this data for his personal interest and use in violation of the Minnesota Government Data Practices Act. Conclusion Mr. Johnson abused his position as a Transit Control Center Supervisor and violated the Minnesota Government Data Practices Act as well as Council policies and procedures when he repeatedly viewed confidential and private information through his access to the DVS website. He admits to repeatedly viewing, both at work and from at home, individual Driver and Vehicle Service system information without having a work related reason to do so. He violated the trust placed in him while fully cognizant of and trained on appropriate use of the DVS system. Disposition Barring the emergence of new information, this concludes our investigation of this matter. If I can be of further assistance, please let me know. Cc: Pat Born, Regional Administrator Brian Lamb, General Manager Metro Transit Dan Abelson, Associate General Cout')sel Sandy Blaesar, Labor Relations Christy Bailley, Director Bus Operations Chad Loeffler, Assistant Director Transit Control Center Marcy Syman, Director Human Resources Page- 3 I METROPOLITAN COUNCIL