Weighing criminal vs. civil
Authorities will determine best way to proceed with Courthouse breach investigation
What is the best way to proceed in the investigation of the breach of the Anderson County Courthouse servers discovered in July, 2016?
Should that investigation be a criminal vs. civil process?
That’s the question authorities have been wrestling with of late.
Last month, the Anderson County Finance Committee sent a letter to Anderson County District Attorney Dave Clark requesting his advice on whether the county should proceed with conducting a forensic audit — specifically if a forensic audit would interfere with law enforcement’s ongoing criminal investigation.
The letter was the finance committee’s response to Clark’s letter the finance committee sent to his office in January, asking for updates on the investigation.
In Clark’s response he encouraged county officials to take whatever steps they deemed necessary to repair or replace its computer system problems going forward.
“To my knowledge, the investigation should not and has not impaired those efforts,” Clark stated in his letter to the finance committee dated January 12, 2017.
The finance committee met March 9, discussed the updates they had received from Clark’s office on the technology breach, and sent a letter to Clark on March 10, seeking his advice on what appropriate steps county officials should take going forward.
Clark responded to the finance committee— and a separate letter from Anderson County Mayor Terry Frank seeking a similar request — on March 15.
In the letter, Clark explained that whether a forensic audit would interfere with the ongoing criminal investigation depended largely on “the scope of the forensic audit.”
Said Clark, “If the audit is limited to examining hardware and software, then no, a forensic audit would not interfere with the criminal investigation. The computer system is yours and my understanding from the investigators is that it is free for you to do with as you please.
“However, if ‘forensic audit’ includes interviewing people or discussing the matter with them in any way, then yes, a forensic audit may interfere with the criminal investigation.”
Clark also released information disclosing a timeline for when the criminal investigation will likely come to a close.
“The investigators estimate that they need another 60 days before a process like that would not interfere with their activities,” he stated.
He did not explain in his letter why a 60-day window is needed, but his statement implied the investigation will likely come to a close because no evidence can be found to conclusively determine a crime was committed.
Clark reiterated that, at this point in the investigation, it still “isn’t clear that any crime has occurred.”
One of Clark’s responsibilities is determining when there is an “adequate civil remedy” such that law enforcement resources “can be spared for other possibly more serious or clearly criminal matters,” he told finance committee members.
“This may be such a matter,” said Clark, “Law enforcement has been involved, but it isn’t established at this point that law enforcement’s role is necessary.”
The additional option Clark proffered the finance committee is for Clark to consult with the Anderson County Sheriff to see if it is appropriate at this point for law enforcement to terminate the criminal investigation — and if the Sheriff determines the investigation can be terminated — to allow Anderson County to proceed with its own civil investigation into the breach.
If law enforcement terminates the criminal investigation and Anderson County officials are willing to press forward with a civil investigation, Clark told finance committee members he would like “some sort of documented and unequivocal expression of that desire from Anderson County” that they want to pursue such an investigation.
