An inmate at the Flagler County jail was able to Facebook live out of a GED class on Wednesday, a security breach that had been an issue in April and that the sheriff’s office had asked the county’s IT department–which handles the sheriff’s information technology–to address. The county did not.
The failure angered Sheriff Rick Staly, who is threatening to end the agency’s reliance on the county for IT. The incident led to the suspension of George Holloway, a long-time computer system analyst and IT manager in Flagler County government who is being blamed for the breach. Such breaches are not only security problems–and an embarrassment to the agencies–but could potentially compromise the jail’s hard-won accreditation.
“This is an unacceptable failure and calls into question the decision maker who took the shotgun approach to fix a minor issue and then did not really solve the problem,” the sheriff’s Chief Mark Strobridge wrote Cameron, on behalf of the sheriff, on Thursday in a hand-delivered letter. “I have no confidence in the person making this decision to ‘fix’ what should have been a very narrow scope of an issue. This leads me to believe the decision maker is incompetent or took a shortcut.”
County Administrator Jerry Cameron this afternoon confirmed that Holloway was suspended based on two alleged violations: first, that he did not address the sheriff’s issue when the sheriff’s office first alerted the county of a potential vulnerability in April. And second, that Holloway, after being ordered to stay off county computers–and being blocked from them–found a way to access them anyway through a back-door unknown to county officials, and download materials, some of which he’d requested through public record requests. Holloway, long a protégé of former Deputy County Administrator Sally Sherman, has a pre-disciplinary hearing early next week. He likely faces being fired.
Cameron, who was at a conference in Orlando Friday with the county’s human resources director, spoke with Staly, but said he could not reassure the sheriff just yet that the matter was resolved, or reassure himself that county records have not been compromised. “Until I get a full report on how it happened and what got compromised, I can’t put anybody at ease,” Cameron said with characteristic candor late this afternoon. “I’d like to tell you that there’s no damage done and everything is fine but I can’t be honest at the same time and say that. It is our hope that there is no damage.”
He was referring specifically to Holloway’s alleged breach of computer records. The inmate’s breach of jail security is the other issue.
William Medders is a 25-year-old resident of Bunnell and so frequent an offender that he’s been booked at the Flagler County jail 17 times in the last six years, mostly on non-violent crimes and probation violations. He’s been arrested three times in March and April, and has been at the jail since mid-April on grand theft and burglary, among other charges. Wednesday, he was taking a GED class as part of the jail’s Strive program, which is intended to help inmates reintegrate society with additional tools.
Cpl. Mita Nicholas was working Wednesday afternoon when she got a call from a concerned citizen saying Medders was broadcasting on Facebook Live at 1:54 p.m. from Classroom 2 at the jail. Nicholas logged into Facebook and confirmed the fact. “Please be advised,” Nicholas wrote in his disciplinary report, “in the footage you can clearly hear inmates Mcdermott and Swartz telling inmate Medders to tag them in the video. The video footage was approximately 2 mins and 29 secs long and has been shared by other Facebook viewers. When questioned, inmate Medders admitted to using a Bypass Proxy to access Facebook.”
Inmates are facing discipline “in accordance with Progressive Discipline due to the severity of the breach of security.” Brian Lee Swartz is a 26-year-old homeless man in jail since mid-April on grand theft and other charges. Michael E. McDermott is a 32-year-old Palm Coast resident, at the jail since last December on a grand theft and probation violation charges.
“It’s serious but it was preventable,” Stobridge said. Strobridge coordinated the agreement with the county that handed responsibility for IT to county staff. The arrangement is part of the agency’s efforts to share rather than duplicate resources. In his letter to Cameron, Strobridge refers to an April incident that resulted in the county cutting off the sheriff from all access to social media platforms, though the sheriff’s office uses some of those platforms, including Facebook and Twitter, extensively to connect with residents, issue alerts and disseminate profiles of department personnel and other popular features. The block “hampered” the department’s ability to investigate crimes and inform the public, Strobridge wrote, but access was restored–with the understanding that the security breach had been addressed.
The sheriff’s network is broken down into various portals, so that certain IP addresses may be white-listed (or considered free of blocks) while others are black-listed. “My assumption was the inmate facility issue was solved with the standard practice of locking-down the network router,” Strobridge wrote. Savvy users can also use proxy servers to circumvent many blocks. But it is also possible to prevent access to proxy servers.
Somehow, Medders slipped through.
“I don’t know exactly what happened over there on the tech side of the house, what I do know with certainty is they should not have been able to access this,” Strobridge said this afternoon. “This shouldn’t have happened based on the April discussion that had occurred. Those things could have been locked down.” The GED room with those particular devices was the only place where such a breach could have happened, Strobridge said.
Cameron said Holloway–the county employee who’s been suspended–was already on a performance improvement plan for violating security issues regarding web access. “I do not have any information that has he has damaged any of our data at this pt, that’s still being looked into. He accessed and downloaded information” after his suspension, Cameron said. “It’s a wake-up call for the county. We’ve got to compartmentalize more than we are.”
JF says
I cannot wait till 2020 so that we can get this so called Sheriff out of office. Rick you are a disgrace to the community and taxpayers alike. We don’t need a damm wannabe cowboy running our Sheriffs office! We need someone like Kevin Berry who knows a thing or two about police work. BTW, your signs about closing drug houses. Did you actually do any of the work ? No wait it was your understaff who did it. And on that note how many of them have been in fights, arguments etc at out local establishments of which you will not even look into. I hope to hell you are voted out of office as well as your admin whom you promoted just so you could get your seat. I want you out of my county and I hope you have a great retirement thanks to the citizens of this county.
InIT18years says
In all fairness the county does not have a security department in IT nor do they have an employee in the IT department that is a certified IT Security Administrator. Until the county hires an actual certified IT Security Administrator the county will continue to have issues.
Holloway doesn't deserve this says
Sounds to me Cameron is working in concert with the Sheriff to flex muscle. Doesn’t sound like that big of a deal. Holloway is competent and is being a whipping boy for those with Napoleon syndrome. Holloway has proved himself….he isn’t new in town. Cameron is not a fit for Flagler County, he sucked in his last position, and the BOCC needs to wake up before they have another Craig Coffey on their hands.
Katelin says
Huge error but fixable. However Medders is the model citizen to allow this to happen!
Yes tighten the Raines FCSO
Willy Boy says
During an inspection at Leavenworth in the ’80’s, a storage room in the Education Department was found to be chock-full of defunct electronic teaching aids, mostly small tape players. The inmates had removed the small electric motors for use in tattoo guns. So it goes.
Really says
They are in jail. No access should be allowed. Give them a damn book
WILLIAM J NELSON says
Will we get follow-up information ?? (or will this just quietly go away like so many other issues )
Brian says
Medders was actually reaching out to his Mondex neighbors in an attempt to find someone who would bring him his banjo to the jail.
palmcoaster says
This is why I am concerned abut the IT Tech and how much power these IT guys have in their hands and the potential to download sensitive information files and cause havoc if or when discontent, suspended or fired!
Concerned Citizen says
And the issues with this agency continue to pile up.
I have long since lost faith in Rick Staly. He continues to have serious issues with his agency and has yet to address them publicly. Instead they get reported to local media then fade away. He moves on with busniess as usual.
In the past two years we’ve had a wrongful death, deputies show up drunk at work, jail staff in possesion of drugs, deputies make racial statements, deputies wreck patrol cars and last but not least a deputy had weapons “stolen” out of How in the world does this agency maintain Accreditation?
I’ll catch hell from readers for this but here goes. I served in the military and I served in Law Enforcement then Fire Rescue. I have had several command positions. When you are in command the buck stops with you.
You Sheriff Staly are in command at all times of FCSO. And that means ALL divisions. Not just the glamorus ones. You need to lead by example. That means no fugitive bingo and silly signs. That means no riding around with ex has been celebrity felons.
You should figure out how to professionalize your agency. And aquire your own IT department, I believe if you’re accredited you have to have certain things. And take ownership of your agency shortcomings.
It’s time to get new leadership in this County. We need a new BOCC and a new Sheriff. These folks stopped representing us a long time ago. Remember ALL of this next election. I intend to.,
Stretchem says
1. Why was a cell phone even there in the first place? Is that the IT guy’s fault? Is the computer guy supposed to conduct the shake downs and strip searches?
2. Perhaps (probably) the live stream was done via the phone’s cellular data? Is the IT guy supposed to somehow magically control the wireless carriers also?
Andy says
I’ve known Mr Holloway for almost 20 years and never known him to be anything but an upstanding citizen and dedicated civil servant for our County… This reeks of scapegoat-ism. I wonder what his bureaucratic constraints were, and the political environment? Let’s hope the discovery process is open, fair, and brings some sunshine into the process…
Spencer Anderson says
I have been in manufacturing my whole life and don’t know IT but consider me confused. There was a security breach documented in April and the agency let it go on for nearly a month? Does this manager not have a boss or does the buck stop with him?
Michael Van Buren says
I couldn’t agree more. Unfortunately Jimmy Manfre never owned up to his screw ups and I have no faith that Staly will either. Thank God that we still have hard working men and women in the trenches that keep this county safe. (And I will bet that not a one of them give a crap about Fugitive Bingo or Drug House signs). The media hound needs to go.
BlueJammers says
Concerned Citizen: I sincerely hope you do not catch hell from readers for the simple reason of your experience in the military and first responder you earned the right to voice an educated opinion. The above captioned article was well written but your commentary made me think about our Sheriff.
I trust I could speak for all readers to say thank you for serving our country and your service as a first responder.
Flatsflyer says
The instructor should be able to monitor the activity of each and every inmate and tablet real time. This is very basic and school teachers have been able to do this for years. Staley would rather throw people under the bus than address his own short comings. He will do anything and everything to make headlines news, except for doing his job.
The original woody says
If the inmates need something to do have them pick-up all the trash around the city that dirt bags throw out their car windows.
PCMann says
As Concerned Citizen wrote, the buck stops at the top. Why is all the blame/responsibility being put onto Mr. Holloway for this issue? The County’s IT Director… excuse me… CIO (and why is there a CIO but no CEO or CFO in the BoCC???) is ultimately responsible for all IT related issues for the BoCC, FCSO and Flagler Beach yet there is no mention of him here. Especially as, with his managerial style, no IT decisions get made without his approval or say so. I have a hard time believing that Jarrod Shupe did not have any knowledge of this or that he was not involved what-so-ever with the decisions that led to the incident. This sounds more like Mr. Shupe coverering his butt by throwing one of his employees under the bus to the Sheriff and BoCC Administration and saying Mr. Holloway did this on his own by taking a “shotgun” approach to an issue without his knowledge. Not saying Mr. Holloway is without blame here but this definitely goes deeper than just one person… I personally think that the FCSO should have their own in-house IT staff again but the irony here is that then Undersheriff Staly was responsible for disbanding the former IT Department and negotiating the MOU with the BoCC. The downside is only to Mr. Shupe as he would lose part of his title… Just my two cents.
Concerned Citizen says
@ BlueJammers
You are welcome. It was an honor to serve in both fields. And a valuable learning experience. I have nothing personal against the Sheriff. I think at some point he meant well but lost sight of his mission.
Almost every job I have had required an oath. I remember being 18 and taking my enlistment oath. It weighed heavily on me at the time as things were getting serious. I took an oath going into Law Enforement as well. When you take on a job that requires an oath it holds you to higher standards.
This agency has an Accreditation. That also holds you to higher standards. Yet time and time again we see this Sheriff violate almost every single one of them. And continue to get away with it. To me that is shameful. And I won’t go into the obvious railroading of George Holloway
I still currently volunteer in the Emergency Services field in the area. I have had to interact on several occasions with local agencies. I just have to shake my head sometimes at the shennanigans that go on. Especially in Flagler County.
Bill says
IMO it looks like Holloway is going to be the scapegoat for the County and Sheriff. A inmate seemed to find a way to use a computer for things he should not be doing?? Who was overseeing him right then?? Is this IT guy a IT security expert?? I do see a big issue with his ability to regain access to the county’s computers when on suspension. Although the story states he was accessing ” materials, some of which he’d requested through public record requests.” That make me wonder why did he think the County would NOT give him all the information???Maybe because he knows how corrupt our County officials have become???
Gary Hiatt says
Flatsflyer is correct. Where was the instructor? I have taught GED classes in a neighboring county jail facility for over 20 years and know what each student is doing at all times. The article states that this went on for 2.5 minutes. Teacher needs to be held accountable. Maybe the instructor should be investigated as well.
ASF says
Soon, these inmates will be voting and choose candidates that will promise that all jailbirds will be able to access computers to their hearts’ contents–maybe by using “Free Speech” as an excuse. That way, they will be better able to continue their “enterprises” from jail and harass and intimidate whoever they wish. Sounds good, right?