Kootenai County officials debate alleged data breach

COEUR d’ALENE — Kootenai County assessor Béla Kovacs told commissioners that a county employee is responsible for a data breach in late April, though IT staff pushed back against the notion that any breach occurred. 

“Confidential, personal information was compromised,” Kovacs said in a Wednesday meeting with commissioners. “I’m not going to go into the details because I have other things I might want to say at a later point, but what we encountered was absolutely unacceptable.” 

Kovacs declined to specify what data was accessed or whether the employee he says accessed the data still works for the county. 

IT network administrator Grant Kinsey said Kovacs mischaracterized the incident by calling it a “breach.” 

“The situation being presented today is not a breach,” he said, adding that a “breach” occurs when an unauthorized person gains access to information that wasn’t accessible before. “It’s a misuse of already-granted privileges to which decisive and immediate action was taken by the IT department. I don’t know what else could’ve been done by the IT department to deal with the situation.” 

Kinsey said he knows of only one Kootenai County cybersecurity issue within the last decade and it occurred in recent months, when an employee in the assessor’s office allegedly attached an unauthorized wireless router to the county’s network and injected data into the network. 

He said IT staff addressed the matter and educated the employee about the county’s policy, which prohibits employees from adding personal equipment to county-owned computers without prior approval.

“If we want to talk about cybersecurity and what needs to be done, I think we definitely have a department we can focus on,” Kinsey said. 

Kovacs said he wasn’t aware of the router incident until Wednesday. 

“You should not have let that go without telling me,” he said. 

In a subsequent email to commissioners, IT staff and others, Kovacs called for an “independent, third-party internal controls audit.” He also suggested that IT staff had asked his office to “look the other way” after the April incident. 

“That was an unacceptable response, which only suggested to me that there may be a larger, systemic problem,” Kovacs wrote. 

The assessor also criticized Commissioner Bruce Mattare’s “cavalier” response during the meeting. Mattare had indicated he believes the county should work with IT staff to determine if an audit is necessary, rather than turn immediately to a third-party vendor.

“As was discussed, the prior issue was dealt with swiftly and appropriately,” Mattare wrote in response to Kovacs’ email.