You are here

The Yellow Springs Police can read everyone's email

Author: 
Gerry Bello
 

According to sources, one YSPD officer remarked to another “Isn't this the sort of thing we learned not to do in that ethics class?” The short answer is yes in this case. The long answer is that there is an advisory ruling from the Ohio ethics commission clearing this specific instance but the optics are horrible. YSPD Sergeant Joshuah Knapp has a second job. He is interning as a support engineer for a company called Tech Advisers. Techadvisors LLC runs all the servers for the village of Yellow Springs. Their network handles the records for the Police Department as well as the rest of the Village Government.

Knapp has had this job since March, taking the day off every Monday to filter his second paycheck through a contractor. Knapp also is the go to person for records for YSPD, although clerk of Council Judy Kinter is the official custodian of records for the village and Village Manager Patti Bates seems to filter all requests across her own desk in practice.

There has been discussion in Village Council meetings of hiring an additional person to handle records requests. That vague accusation of excessiveness basically alluded to this publication. In our recent suit, now resolved through mediation, that vague accusation surfaced as background as well. Should the village solicitor get us the remaining records by tomorrow, July 24th, as agreed, the Mockingbird will be satisfied with the results of our Court of Claims action. One might wonder why a fourth person is needed to satisfy records requests when one person has more than full time administrator access and dealing with records is another's near full time job.

The advisory ethics ruling (included for download below) allows Knapp to have this internship with certain provisos, mostly in regard TechAdvisors getting or keeping or having their contract renewed. One stipulation “the employee will not have access to village servers, computers, systems or software, or be given network credentials or permissions” is directly contradicted by Knapp's own linkedin profile which reads in part “I am completing an Internship as a Technical Support Engineer with TechAdvisors and have been the administrator for the Police Department's reporting and dispatching systems.”

Being an Administrator is server level access. Further Knapp does not need to be given network credentials. He can look them up at his second job. This reporter has been an intern at the same level as Sgt. Knapp many years ago, except he provided tech support for Unix machines. As a $10/hr employee I had root level access to the servers controlling 5% of trucking freight traffic in America. I could have brought the country to a halt for years afterwords. No company in the business TechAdvisors is in segregates client data as well as they think they do if they even bother to do so at all.

The advisory ethics ruling covers Knapp's posterior and that of the village, but it does zero on a security level to keep anyone who touches his computer while he is logged in from reading the work email of any village employee, up to and including Patti Bates, or members of council or the emails of constituents to members of council, or any investigative file. He could easily delete any file on any system the village has.

To be clear, there is zero evidence Sgt Knapp has done anything like this. There is no evidence he has stolen passwords to enable him to do this. But if he wanted to do such things, it would be trivial for him to do so, and if he didn’t know that, he is not qualified to sit in the chair he sits in on Mondays. If he does decide to engage in such activity, he is in a perfect position to cover his tracks. This is literally hacking 101: The best way to hack a system is with a job search.

TechAdvisors notes that 91% of all hacks begin with a spearphishing email. This is not true. 70% of all data theft is done by employees. What they mean is that 91% of all bad outside hacks done by teenagers start with a spearphishing email, but that is not how data is lost and a disloyal employee is the ultimate active persistent threat. Just ask the Sanders campaign.

Knapp began his internship in March of this year, just a records became hard to get, and Tim Krier helped his son evade prosecution for sexual assault before going on a paid medical vacation. The timing could be meaningless, but it is hideous optics, and ethical problems that undermine trust in government begin with the appearance of impropriety not the actual unethical acts. We will see if the village decides it would be best served by encouraging Sgt Knapp to intern elsewhere.