County removed vendor forms, transparency tools after fraud

Sedgwick County removed a variety of forms, tools and databases for its vendors and the public from its website after it lost $566,088 to fraud.

The changes were based on recommendations from the vulnerabilities working group, a team of county staffers that began meeting last December. Some county commissioners are questioning why some things were removed and want further explanation.

“This team worked to find the appropriate balance of transparency and security as they reviewed the county’s website,” said Kate Flavin, the county public information officer, in an e-mail.

The county lost $566,088.90 to an e-mail phishing scam last fall. A Georgia man is charged with wire fraud in connection with the loss.

Commissioner Jim Howell said he believes the changes are needed to respond appropriately to the fraud case.

“I would like to make sure we’re as transparent as possible,” Howell said. “(But) I don’t want to do things that create vulnerabilities for fraudulent activity.”

Other commissioners say they are concerned that the changes went too far.

“It takes away a necessary layer of government transparency,” Commissioner Michael O’Donnell said. “I do believe it’s an overreaction.”

What’s offline

The working group recommended these items be removed from the county’s website:

▪ Vendor application: If you or your firm want to do business with the county, you need to fill out a vendor application. The county removed the online version of the vendor application, where you would provide mailing, contact, business and tax information. The application is “temporarily unavailable.”

The web page now tells prospective vendors to register by contacting the finance department at 316-660-7255.

▪ Open spending county checkbook: The county launched an online checkbook in 2009 following a suggestion of then-commissioner Karl Peterjohn. It allowed you to search revenues and expenditures by vendor, government function or fund type. It’s now unavailable online.

But officials discussed replacing the county checkbook last year anyway because the county launched a new online budget tool that was more interactive. That tool is still online.

▪ County employee directory: The individual staff directory allowed you to search a database of county employees. It provided their phone numbers and e-mail addresses by department. The web page now redirects users to a list of county departments.

The Eagle received a print-out copy of names, e-mails and phone numbers from the directory through a records request. But it’s unclear how long those records will be available.

▪ Tax exempt certificate: Sedgwick County is exempt from paying state sales tax. Vendors selling goods to the county can fill out a tax exempt certificate. A copy of the form is now offline. You can call the county’s finance department at 316-660-7255 to receive a copy of the certificate.

▪ ACH change form: Vendors used this document to provide their bank name, bank location, routing number and bank account number to receive payment from the county. The ACH is the Automated Clearing House, an electronic payment network.

▪ PDFs of contracts: The county web site still shows a list of contracts with local firms and other governments. But PDF copies of those contracts were removed. Copies of contracts are still available by filing an open records request with the county.

▪ Contracts for construction projects: They’ve also been removed from the website but are still available through an open records request, Flavin said.

‘Defraud the county’

Authorities arrested George James, a resident of an Atlanta suburb, in connection with the county’s fraud loss in January. He is accused of pretending to be a road contractor to receive payment for a county construction project, according to a criminal complaint.

An e-mail from a fake Cornejo and Sons account sent a completed ACH form to change payment information to another bank account. The FBI tied the account back to James.

The criminal complaint also noted that online vendor contract information could include the contract’s name, number, start date, value and other documents.

Commissioner David Dennis said he supports the working group’s recommendations.

“What they’re trying to do is take (down) the information where someone can put all these pieces of information together and be scamming us,” Dennis said. “It doesn’t take an expert to put the information together…to defraud the county.”

He said the county will remain transparent by responding to records requests from residents and the media.

“There are certain people in the world that we don’t want to be able to put all the information together,” Dennis said. “That’s one of the reasons we lost half a million dollars.”

Howell said he thinks the county’s new interactive budget is an upgrade over the former county checkbook. But he said he believed there were areas of potential compromise for some information to be left online and other information redacted.

“Maybe there’s things we could put out there,” Howell said. “Maybe we can do it in a way that doesn’t create vulnerabilities.”

“Does this information provide something the public would be interested in?” he asked.

‘Closing government transparency’

O’Donnell said he understood why some changes are justified, like removing PDFs of contracts. He pointed to the county getting a new external auditor and chief financial officer late last year.

“There were a lot of repercussions from the fraud,” he said. “But that doesn’t necessarily make a case for closing government transparency.”

O’Donnell called taking down the online vendor application “dumb.” He said the county should make it easier to become a county vendor by improving access.

“I’m really not trying to cast judgment on this working group because there’s an overabundance of caution,” O’Donnell said. “I just don’t find some of these changes to be appropriate or necessary.”

Chairman Dave Unruh also said the recommendations were a mixed bag. He said the ACH form “for sure” needed to be removed, but he didn’t see a problem in allowing vendors to register online.

Unruh said he asked the county manager’s office for further explanation of the rationale for the changes.

“Unless there’s a clear reason that we’re exposing ourselves to some vulnerability, I think we ought to continue our transparency,” he said.

This story was originally published March 24, 2017 at 1:41 PM with the headline "County removed vendor forms, transparency tools after fraud."