IAFF not convinced data breach was unintentional

Post of employees’ personal information an accident, board chairman tells Call.

By MIKE ANTHONY

An International Association of Fire Fighters official is not convinced the recent disclosure of personal in-formation about Mehlville Fire Protection District employees on the district’s Web site was unintentional.

But district officials disputed such a claim, noting Chief Tim White’s personal information was included in the inadvertent disclosure.

Officials recently posted on the district’s Web site —

— a list of employees’ salaries and benefits for 2009. But the document also included an embedded spreadsheet containing employees’ birth dates and Social Security numbers.

Contacted by the Call, Nick Fahs, president of IAFF Local 1889, declined to comment. Fahs referred the newspaper to Mark Woolbright, a captain with the Pattonville Fire Protection District and IAFF 2nd District vice president.

Asked if he believed the disclosure of employees’ personal information was intentional, Woolbright said, “Well, there’s a good possibility, but obviously that’s unknown.”

Board of Directors Chairman Aaron Hilmer said the posting of district employees’ personal information was an accident.

“… The board had no idea this was going on. The chief didn’t have any idea this was going on,” he said. “The only person who knew these were on here — and I believe it was an accident — was the district comptroller. And to even insinuate that Chief White would somehow do this on purpose is asinine because his numbers were out there too for everybody to see.”

In an e-mail sent Friday to district employees, White told employees he first learned about the disclosure of the personal information when he “was confronted” by a television reporter earlier that day.

“… I wanted everyone to know that as soon as I was confronted by News Channel 5 with the information that the district knew nothing about, I immediately pulled our Web site within two minutes,” White stated in the e-mail. “I then began pursuing identity theft protection for all affected employees and am currently processing it for all of us. It was only after that when I found out who was behind all of it.

“I only wish that the employees that knew that our information was unintentionally being disclosed would have contacted me instead of their attorney and the news media to sensationalize this. I could have protected you and your family sooner. I suppose I could apologize for their behavior,” the chief’s e-mail stated.

But Woolbright disputed White’s assertion that he first learned of the disclosure from a television reporter.

“We believe that’s inaccurate. The attorney, our attorney sent them a letter basically demanding that the information come down off the Web site and I think that happened around I believe around 11 o’clock or so the other morning (Friday),” he said.

“There was a statement or contact to the chief or to the district when this was discovered, but quite honestly … there’s just no trust between the union and administration and we know that there’s been contacts made from the union leadership in the past that have concluded in disciplinary action. And unfortunately, we’ve got that relationship … We have not been able to change that relationship,” Woolbright added.

Rick Barry, an attorney who represents Local 1889 and the Missouri State Council of Fire Fighters, and his associate Megen Hoffman told the Call faxes addressed to the district’s Board of Directors and White were sent to MFPD headquarters between 11 and 11:30 a.m. Friday. In addition, a fax was sent to the office of Matt Hoffman, the fire district’s legal counsel, during that same time frame.

“… The standing policy that the district and the chief have is that the shop is not allowed to contact the chief to talk about union business,” Barry said. “In fact, when they’ve tried to do so in the past, shop officials have been disciplined. So that was an avenue that was foreclosed to the members of the shop. So it fell to me and Megen to communicate to the district and the district’s lawyer.”

Matt Hoffman told the Call he was out of the office Friday.

“How hard would it have been for whoever first saw it to call the district, then their lawyer?” Hilmer asked, adding he learned of the situation Friday when he was contacted by White.

“He (White) said he had been contacted Mike Owens from Channel 5. Some of the first words out of Mike Owens’ mouth was that Rick Barry was very upset with what’s going on. And Tim’s response was: What is going on? And that’s when he explained to him about the unfortunate incident that happened with the Social Security numbers being inadvertently posted embedded on the district’s salaries that we had two days before posted on the Web site. It was an unfortunate accident …,” Hilmer said.

“If this would have been brought to the district’s attention immediately, you’re talking less than a handful of people would have ever even known about it, completely protecting the employees. But instead they try to turn it into some kind of media circus that only harms the employees. It’s really sad,” he said.

In a press release issued Friday, Woolbright stated, “The decision today by the Mehlville Fire Protection District to post personal information about its firefighters on its Web site is just the latest lapse in judgment by the public officials who run the fire district. Members of the Mehlville Fire Protection District consistently exhibit behavior and engage in activity that calls their decision-making skills into question.”

Woolbright also stated, “The Mehlville Fire Protection District today did so much more than unlawfully expose the personal information of its hard-working employees. They exposed their poor judgment and their true feelings for the firefighters who are sworn to protect the residents of Mehlville. It is increasingly uncertain whether the members of the Mehlville Fire Protection District can fulfill their obligation as public officials.”

Regarding Woolbright’s press release, Hilmer said, “It shows a couple of things. No. 1, someone had discovered this well be-fore it was ever brought to the district’s light. By doing so for their political games they want to play, they set their own members at risk. Their own dues-paying members, they let their Social Security numbers hang out there that much longer so they could try to make a media circus out of it — once again, harming their members more than the district. It makes no sense to me.”

Local 1889 members have been let down by their union leaders, he said.

“I really feel bad for the people who work there. They have to pay over a thousand dollars a year in union dues and this is what they get — being used as a political pawn,” Hilmer said.

In a letter sent to the fire district Friday, Barry wrote:

• “My client is demanding that a letter be sent to every affected employee whose personal and confidential information was posted on the district’s Web site informing them of the unlawful disclosure and issuing a formal apology from the board, including Chairman Aaron Hilmer. My client also demands that a letter be sent by the district to the attorney general with information and an explanation regarding the unlawful disclosure of employees’ confidential in-formation on the district’s Web site.

• My client is also demanding identity theft counseling for every affected employee and intends to hold the district responsible for any consequences which may occur as a result of this unlawful disclosure and ask for confirmation from the district that it will indemnify the affected employees against identity theft.

• Finally, my client is demanding that this matter be addressed by the board at a public meeting and that it take steps to review the security of all confidential information of its employees held by the district and issue new written policies regarding the district’s handling of confidential employee information.”

Barry’s letter also stated, “Please be ad-vised that my client intends to pursue all legal remedies available to it for this unlawful disclosure of its members’ confidential information and reserves those legal remedies, notwithstanding any steps taken by the district to remedy the situation.”

Barry told the Call, “Clearly, this information shouldn’t have been on the Web site. I think everybody agrees with that and the concern that the local and the Missouri State Council have is that either there was insufficient oversight in place or those cast with oversight for whatever reason didn’t comply with the requirements of law.

“But what the shop and the state have as their primary concern is what can be done going forward to protect those who had their private information out there …”

In a letter sent Saturday to current and former employees, White wrote, “We are contacting you because we have learned of a serious data security incident that involved some of your personal information.

“Employee wage and benefit information was posted on the district’s Web site mehlvillefire.com and there was an embedded spreadsheet containing employee date of birth and Social Security number. This spreadsheet was created in September of 2006. Employees hired in 2007 and after do not appear to be on the spreadsheet.”

The chief’s letter recommended current and former employees closely monitor their financial accounts and promptly contact their financial institution if they see any unauthorized activity.

Current and former employees also may want to consider obtaining a free credit report from the three major credit report companies, he wrote.

White wrote, “The district is pursuing an identity theft protection plan for all affected employees and former employees. Additional information on this matter will be forwarded to you in the near future. We apologize for any distress this situation has caused you. We are ready to assist you in any way.”

Hilmer told the Call, “… This is a very unfortunate incident that could have been handled much better if the district would have been made aware of it, and that’s what it comes down to … I hope that one thing that comes out of this unfortunate incident is residents and readers of your paper will visit

and see what they are paying their public employees.”

Woolbright said, “We’re just greatly disappointed again that personal financial risk is out there right now that affects our members and the employee group and really for what? You know, we just don’t understand. These employees risk their lives every day and this is the environment that they continuously have to live with and this appears to be just something else that stems from hatred from the board and the fire chief. It just appears to us that every opportunity that this administration has, they cross the line. And this once again is another example of it.”