The ongoing tug-of-war between County Executive Mike Hein and County Comptroller Elliot Auerbach has taken a bizarre turn of late, with dueling allegations of surreptitious recording, secret computer servers and unauthorized hacking of sensitive files.
The dispute comes amid a comptroller’s audit of the county’s Information Services Department and the abrupt resignation of an IS employee after, according to a county memo, they were pressed to explain how members of Auerbach’s team got access to finance department files.
The allegations, as laid out in a July 26 memo from Deputy County Executive Marc Rider to legislature Chairman Ken Ronk date back to May 9 when, Rider writes, Information Services staff uncovered a “security breach” on a shared hard drive used by all county departments, including the offices of the sheriff and the district attorney. In this case, the memo reads, staff at the county’s Department of Finance, which reports to Hein, told Information Services staff that they suspected that one or more people in Auerbach’s office had been accessing files they were not authorized to view.
The complaint spurred an investigation by county IS Director Jose DeLeon Jr., a retired Marine Corps lieutenant colonel with a background in cybersecurity.
DeLeon’s findings are contained in a July 25 memo to Rider, his direct supervisor. According to DeLeon’s memo, comptroller’s staff is supposed to access Finance Department data through a shared folder created in 2010. Deputy County Executive Ken Crannell said this week that the folder’s purpose was to allow Auerbach’s staff to access information needed to carry out monthly reconciliation of county accounts.
But, DeLeon found, at some point members of Auerbach’s staff had obtained “read only” access to the entire Finance Department folder. According to DeLeon’s memo, early in the investigation, an IS employee in charge of coordinating access was questioned as to how permissions may have been “misapplied” to comptroller’s staff. Instead, DeLeon wrote, the employee “abruptly and without notice to IS leadership submitted his [resignation] request with effective date June 4 2018.”
DeLeon’s memo lists three members of the comptroller’s staff as having accessed files “outside their authorization,” including Auerbach’s director of internal audit and control Alicia DeMarco (who has since resigned), senior auditor Elizabeth Weredyk and auditor Nancy Derella. Among the files accessed were draft versions of responses to comptroller’s audits and, in one case, communication between a Finance Department official and the county attorney. According to Crannell, staff at the comptroller’s office also attempted, unsuccessfully, to access files of the county executive’s office using a shortcut contained in the shared folder.
Auerbach said his office did nothing wrong in accessing the files, since the county charter gives his office the right to inspect all county financial records. But Crannell and other members of Hein’s staff said routine procedure calls for affected departments to be given notice when their files are audited. Additionally, they say, some of the records accessed, including draft responses and correspondence with the county attorney, are clearly off limits.
“What Elliot is saying is that he can walk into any county office, open a file cabinet and start riffling through it,” said Crannell. “And that’s simply not true.”
Recorded conversations
Along with the accessing of finance department files, DeLeon’s investigation also turned up old sound files — recordings made of conversations between Auerbach and another staffer and county officials and members of the public. The recordings, which date to 2013, were made without the knowledge of other parties. Under New York law, it is legal to surreptitiously record a conversation as long as one party to the conversation knows that it’s being recorded. Auerbach said the recording system was installed at his request by information services back in 2013 to create official records and to deal with threatening calls from the public.
Auerbach said he made only a handful of recordings, including budget discussions with county Legislator Rich Gerentine (R-Marlboro), chair of the Ways & Means Committee, and Legislative Clerk Vicky Fabella, as well as a “bizarre” phone call from a woman calling herself “The zucchini queen.” Auerbach said that he stopped using the system after six weeks because he found it “cumbersome.” In 2015, when the county switched over to a “Voice Over Internet Protocol,” or VOIP, phone system, Auerbach said he requested and received recording capability on his office phones. But he said, the system was never used and has since been removed. Auerbach said that recording system was installed and used in accordance with county policy.
According to Auerbach, the wrongdoing in this case did not come from his department. Instead, he said, he wanted to know who accessed the confidential recordings, extracted the files and shared them with Hein, who in turn played them for leadership of the county legislature. The removal of the files by someone outside of his office, he said, violated county policy and brought into question the security of sensitive data held by his office, including the Social Security numbers and other financial information of hundreds of county employees.
“It’s a red herring,” said Auerbach of the revelation of the recordings. “The real issue here is who accessed those files, extracted them and shared them with unauthorized persons.”
Auerbach noted that the outcry over the recordings and access to finance department files came as his office was conducting an audit of Information Services. Auerbach also noted the “abrupt resignation” of a IS staffer, apparently the same one referenced in DeLeon’s memo. Rider and Crannell meanwhile point out that DeLeon’s investigation began in May — a full two months before Auerbach’s audit — and accused the comptroller of trying to smear a diligent county employee.
“We’re standing by our IS director,” said Crannell. “He’s a retired Marine lieutenant colonel with a background in data security. Elliot is a typical politician trying to avoid the consequences of a self-created crisis.”
A new law
In response to revelations about secret taping, county Legislature Minority Leader Hector Rodriguez (D-New Paltz) has introduced legislation that would bar county employees and elected officials from recording conversations using county equipment without advising all parties. Rodriguez said while Auerbach’s recordings did not appear to violate the law or county policy, he wanted to ensure moving forward that he and other county officials did not repeat the practice. Rodriguez declined to comment on the accusations and counter-accusations between Auerbach and Hein’s office.
“We’re still looking at it,” said Rodriguez. “We’re looking at whether outside individuals or agencies need to look at it to make sure everything is on the up and up.”
Join the family! 
