BOCC meeting raises concerns over county cybersecurity

By Soncirey Mitchell
Reader Staff

Hostilities between the Bonner County board of commissioners and the offices of the sheriff, prosecutor and coroner temporarily deescalated during the regular business meeting March 19, after Prosecutor Louis Marshall revealed that the three offices would hold off on pursuing a lawsuit against the board over access to and control of the county’s information technology and data. 

The conflict stems from a security measure announced by the county Technology Department on Oct. 2, 2023, which stipulates that employees seeking access to sensitive records or administrative powers over the county’s Google Workplace Domain must first put in a request to the department.

In an effort to safeguard the sensitive personal and financial information stored on county servers, the Technology Department announced ongoing security upgrades to the Google Workplace following the principle of “least possible privilege to perform position.” 

According to a March 14 email from BOCC Chairman Luke Omodt to Marshall, there were “25,000 unauthorized attempts to gain access to Bonner County’s digital infrastructure” between Feb. 13 and March 14, 2024. 

“Half of these attacks are from foreign nations such as the United Kingdom, Panama, Venezuela and Nicaragua,” Omodt wrote.

Bonner County Commissioners Asia Williams, left; Luke Omodt, center; Steve Bradshaw, right.
Photo by Soncirey Mitchell.

The department therefore revoked super administrative clearance — which gives employees the ability to perform all administrative roles, like altering the Workplace or giving others access to privileged information — for an unknown number of accounts, including the Legal Department’s IT staff and BCSO Sgt. Marcus Robbins, specifically. 

Due to those changes, Marshall can no longer bestow super administrative clearance on members of his department.

Marshall, Sheriff Daryl Wheeler and Coroner Robert Beers subsequently sent a jointly signed cease and desist letter to Omodt on Feb. 21, objecting to the change in Robbins’ clearance because “he can no longer safeguard certain digital public records legally under the authority and control of the Bonner County Prosecutor. … Neither you [Omodt] nor the board as a whole may dictate how we access, control or monitor those records.” 

The three officials requested that Technology Director Jacob Storms reinstate Robbins’ credentials.

According to an email from Deputy Prosecutor Bill Wilson to Marshall, Omodt and Commissioners Asia Williams and Steve Bradshaw on Feb. 20 — provided to the Reader by a source close to the issue — “Marcus lost his super-admin credentials at least in part because he was prepared to give Scott [Bauer] ‘role-specific vault access,’ and this was deemed undesirable for a host of reasons.”

Former-Deputy Prosecutor Scott Bauer — who is also Wheeler’s son-in-law — has been placed on indefinite administrative leave, according to a March 7 email from Marshall to top county officials, amid multiple ongoing legal actions against the county, with one seeking a total of $500,000 in damages.

First, Bauer filed a notice of tort on Dec. 28, 2021 against then-Commissioners Dan McDonald, Jeff Connolly and Steve Bradshaw and Chief Information Officer Brad Ptashkin for “malicious defamation,” seeking $3 million in damages on the allegation that McDonald and Ptashkin spread misinformation by claiming Bauer had illegally hacked into commissioner email accounts using county computers. 

According to govinfo.gov, the judge stayed the case on Oct. 13, 2022 “until either the Idaho state court renders a decision in the State Case” or the issue was informally resolved.

Baeur filed an additional tort against County Clerk Mike Rosedale in November 2023, alleging defamation and requesting $500,000 in damages. His most recent lawsuit is against Bonner County Deputy Clerk Veronica Dixon on Feb. 23, 2024, wherein he claims that Dixon supplied him with a counterfeit copy of her job description, which he claimed had been falsified and improperly altered to appear as though the BOCC had approved it and transferred her direct report from the Prosecutor’s Office to the commissioners. 

Bauer’s purpose for the initial public records request was to clarify whether he had supervisory authority over Dixon, and therefore bore responsibility for her job functions.  

Since June 2023, Bauer has filed more than two dozen public records requests on topics related to his litigation, including information about potential financial fraud at the fairgrounds; communications, notes or documents mentioning his name; and, most recently, records related to Dixon’s job description. 

In the Feb. 20 email related to IT access, Wilson suggested the BOCC and Prosecutor’s Office compromise by reinstating Robbins’ credentials with the promise that he would not grant Bauer “the enhanced access he was looking for,” adding, “I have no idea why he needed it in the first place …”

What’s more, Wilson told the commissioners that he had “spoken with Louis [Marshall], and he has agreed to this arrangement from this end. … If Louis directs [Robbins] not to provide access to others, especially Scott [Bauer], can we put this thing to bed and move on?”

Despite the potential compromise, the various parties went back and forth until Marshall, in a March 11 email told the BOCC that if Robbins’ super-admin status wasn’t restored, “the next step will be the Sheriff and Coroner coming to the BOCC for funding for outside counsel [to sue the board].”

In a response to Marshall’s email, Omodt underscored that Robbins and Storms should get “into a room with a computer so that [Robbins] can show what he needs access to.”

Meanwhile, Omodt wrote, “simply put, you want the taxpayer to foot the bill for a lawsuit because Marcus [Robbins] has the access that he needs but won’t communicate with the Technology department who is protecting voter information, tax information and all recorded deeds from being accessed by people who shouldn’t have that access.” 

In an email on March 13, Marshall challenged Omodt’s authority to allow Storms to change the access policies and reiterated his legal opinion “that the various elected officials control their data, that necessarily means how the data is stored, accessed and controlled.”

Omodt responded March 14, citing Idaho Code 31-802, which defines BOCC powers and duties, including: “To supervise the official conduct of all county officers, and appointed boards or commissions of the county charged with assessing, collecting, safekeeping, management or disbursement of the public moneys and revenues; see that they faithfully perform their duties; direct prosecution for delinquencies; approve the official bonds of county officers, and when necessary, require them to make reports, and to present their books and accounts for inspection.”

Beyond that, Omodt wrote, “SGT Robbins intended to give role-specific access to the Google Vault that includes attorney-client communications of current and pending litigation to an individual who is suing Bonner County.” 

Marshall agendized his request for funding for outside legal counsel for the March 19 BOCC business meeting, though ultimately decided against making the request, calling it “premature.” 

Regardless, Marshall maintained that the records in question are under his jurisdiction and that the board does not have the authority to deny Robbins access.

“Not that long ago … my files were kept in file cabinets — locked file cabinets. No one had access to those file cabinets except me and my designees,” Marshall said at the March 19 meeting. “No one ever questioned that. No one thought that other people — no one thought the public — should have access to those. No one thought that the commissioners should have access to those. It was just clear, and it was defined.”

Marshall further elaborated in a March 20 email to the Reader: “I think they need to understand data is not some abstract concept — we are talking about sexual assault kits with pictures, autopsies and highly confidential personal information of our citizens.”

“There is no cogent argument that this information should be more transparent, and that for some unknown reason, commissioners should have control over it,” Marshall added. “It doesn’t make any sense whatsoever and as the co-chief law enforcement officer of this county I am not going to bend on this issue. It is too important.”

Though these county records are now stored digitally, Marshall explained that Idaho statute hasn’t changed to reflect the new technology, and therefore the offices of the prosecutor, sheriff and coroner need “mechanisms” to ensure their departments’ information remains under their control.

Marshall and all three commissioners informally agreed to give the Technology Department the opportunity to come up with a compromise that satisfies both parties. Marshall stated he did not believe that the solution would cost much money or introduce redundancies into the county’s IT system.

Meanwhile, the Prosecutor’s Office will deliver a legal opinion to the BOCC at an unspecified date that clarifies the board’s power over county records.

“I’ve been saying for a long time that [I.C.] 31-802 does give supervision by the board over all county officials in terms of budgeting and spending, but that is limited,” said Marshall.

When asked for clarification, Marshall cited I.C. 74-101, and the Idaho Public Records Act more broadly, in the March 20 email to the Reader, writing, “it is clear the legislature did not intend the Commissioners to be the custodian of all county records. If they did, they would have used language such as the ‘governing board’ as is used in the Open Meetings Act. It is clear from the Act and case law the custodian of records is the appropriate elected official over those records.”

I.C. 74-102 states, “A public agency or elected official shall designate a custodian or custodians for all public records, which includes any public official having custody of, control of, or authorized access to public records and also includes all delegates of such officials, employees or representatives.” 

I.C. 74-101 further defines a “custodian” as “the person or persons having personal custody and control of the public records in question,” and the “public agency” as a “local agency,” and therefore “a county, city, school district, municipal corporation, independent public body corporate and politic, district, public health district, political subdivision, or any agency thereof, or any committee of a local agency, or any combination thereof.”

Marshall further argued that, as Idaho follows the “Dillon Rule,” “if the legislature didn’t explicitly grant powers to the BOCC, they don’t have them.” 

Moreover, because the BOCC is a legislative and executive body, the separation of powers prevents the board from supervising judicial officers like the prosecuting attorney — except for the limited power they wield over county spending.

“Approximately 145 million dollars pass through the Bonner County Treasurer’s Office as fees, taxes and pass throughs from the federal and state government that are used across Bonner County to provide governmental services; I am mystified as to why taking cybersecurity seriously is not a greater priority for all elected officials,” wrote Omodt in a March 14 email to Marshall.