Listen to this article

WATSEKA — Ex-employees of the now-dissolved Ford-Iroquois Public Health Department spent an estimated 2,700 hours per year using their work computers for personal business, amounting to more than $81,000 per year in wasted taxpayer money, a forensic computer expert told the Iroquois County Board last week.

Andrew Garrett of Decatur-based Garrett Discovery Inc. said the estimated number of hours spent by employees on personal business — including searching dating sites and classified ad sites, posting to their personal Facebook pages and selling merchandise for their personal businesses — was based on a conservative estimate of 30 seconds spent on each website.

The $81,000 figure, meanwhile, was based on "a modest" $30 an hour paid to the average employee, including salary and all benefits, Garrett said.

Garrett presented an investigative report to the board during a policy and procedure committee meeting Friday, showing that, in addition to inappropriate use of the Internet by the bi-county health department’s employees, some used anti-forensic software in a possible attempt to delete their Web histories.

At the request of former Iroquois County Board Chairman Rod Copas, the board approved last December spending up to $5,650 to have Garrett examine 18 computers used by ex-employees of the health department, which was dissolved in July 2014. Those 18 were in addition to five that were already examined, free of charge to the county, for evidence of misuse and fraud. 

Among the findings ...

Garrett said he was able to extract data from only 17 of the 18 computers, because one computer’s hard drive was damaged. Garrett said the hard drives of each computer were copied and analyzed at his lab.

"Some of the artifacts recovered from the computers included social media posts, classified ad posts, browser searches, torrents, pictures, various personal website searches and videos," Garrett wrote in his report. "It appears the vast majority of misuse of the Internet at the county is due to the activity on Facebook, eBay, Amazon, dating sites and classified ads such as craigslist."

Garrett said employees visited Facebook 33,745 times, visited non-work Web-based email services 1,754 times, backed up their personal iPhones to their computers eight times, visited dating and chat rooms 444 times, and visited classified ad sites such as eBay, Amazon and craigslist 27,699 times.

Using what is called "incognito" or "safe" browsing, the users of the 17 computers chose to hide their Web history for 196,561 websites visited, Garrett added. Garrett, however, said he was able to recover "the hidden history that was previously hidden."

Garrett said evidence of "file-wiping utilities" was found on some computers, as well, which, in some cases, destroyed Garrett’s ability to link a specific file to the user of a computer.

"An estimated 30 percent of the usage could not be tied to a specific user due to the use of file-wiping utilities and deletion of files," Garrett’s report said.

Garrett said he also found evidence of employees using their work computers to run "their own personal business." For example, Garrett said, at least one health department employee was using their work computer to promote products and services to county employees for

"We found evidence of at least one employee running a personal business at work — selling products at work, delivering those products at work, shipping those products at work," Garrett told the board. "There’s a substantial amount of that."

Thousands of emails, too

More than 100,000 emails were also recovered — all of which were provided Friday to County Board Chairman Kyle Anderson, but not the news media. At Garrett’s suggestion, the board will review those emails to determine whether they were work-related.

Depending on what is found, the board could ask State’s Attorney Jim Devine — or a special prosecutor — to criminally charge some former health department employees, Anderson said.

In his report, Garrett said some emails were related to "contracting issues that were the subject of great concern by board members based on discussions I had with (them)." Those emails discussed the health department’s proposed expansion of its home health care program into Indiana and a contract the health department arranged with a company owned by the husband of one of its employees for the installation of solar panels on the agency’s offices, Garrett’s report said.

After his initial examination last year of five computers used by health department managers, Garrett delivered a preliminary report to the board last November that revealed that three former health department officials used their work computers for "personal use and gain and possibly illegal and unethical activities" at least 70 percent of the time they were on them. Among the findings was that the health department’s former administrator used his work computer to download pornography.

Internet usage policy?

Like he did in November, Garrett encouraged the board Friday to adopt a "strict Internet usage policy" for Iroquois County’s employees. Such a policy would prohibit employees from visiting sites such as Facebook, dating sites, eBay or craigslist, "regardless of position within the county," Garrett said.

"We suggest each employee sign agreements (saying) that if inappropriate (computer) use is found within an audit, the employee is subject to termination," Garrett said. "We also suggest routine audits of users’ Internet activity by use of auditing software. ... The state of Illinois uses it on all of their employees."

Garrett said that once auditing software is installed, local staff could be trained to review audit reports, or the county could instead hire a "competent forensic examiner" to review the reports each month, either on or off site. The cost would only be "a couple of hundred bucks a month," Garrett said.

"It can be done with little to no impact on the computer, and with no downtime," Garrett noted.

Meanwhile, Garrett said the report he delivered to the board last week would be acceptable as evidence in a criminal trial. Garrett said his firm provides testimony in about 50 to 100 court cases per month, and Garrett has personally testified in about 145. Garrett said he has been deemed an expert witness in federal court and multiple state courts. Since Jan. 1, 2015, Garrett’s firm has processed 254 hard drives for court purposes, he added.