Ex-Fort Worth police chief Fitzgerald says computer security lapses put public at risk
Former Fort Worth police chief Joel Fitzgerald took the witness stand Tuesday at a hearing that will determine if an injunction to prevent the city from hiring his permanent replacement will be extended.
Fitzgerald sought the injunction so he could make a case for indefinitely delaying the hiring of a new chief while his lawsuit is pending. In July, State District Judge Gena Slaughter approved a temporary restraining order that is set to expire this week. The hearing to decide if the injunction will remain in place began Monday in Dallas.
Fitzgerald testified that he believes he was fired unjustly. He is seeking reinstatement to the police chief job in the lawsuit he filed against the city.
Fitzgerald also said that the city put residents at risk by not acting quickly and decisively enough to fix problems with the Criminal Justice Information Services system, or CJIS, a federally maintained computer network designed to share law enforcement information nationwide.
Fitzgerald testified that when he discovered the scope of the problems with CJIS — problems that city information technology employees told him had been repaired — he wrote a 10-page memo to Jay Chapa, assistant city manager, and David Cooke, city manager.
It was the best way to document the noncompliance, Fitzgerald said.
“Writing this memo was a way to describe the gravity of the situation to the city manager and the assistant city manager,” Fitzgerald said. “If we were to lose access to CJIS material, we would lose the ability to communicate criminal justice information to officers on the street. It was not only a public safety issue for officers but also for residents.”
Officers making traffic stops would not be able to quickly get information about wanted felons from other areas of the country without access to CJIS information, Fitzgerald explained. For example, officers would not know if they were stopping someone who was wanted for murder, Fitzgerald said.
Fitzgerald says the city retaliated against him
Fitzgerald also testified that he firmly believes that he was retaliated against for applying for the police chief position in Baltimore and for investigating city officials in the IT department for misrepresenting facts prior to a CJIS compliance audit.
Fitzgerald testified his termination and paperwork that labeled it a general discharge rather than an honorable discharge has affected his ability to find another job. He said he has received 105 rejection letters. It was one of the ways the city retaliated against him, he said.
“I got another one (rejection letter) while I was testifying,” Fitzgerald said.
If Fort Worth hired a police chief from another city and the court reinstated Fitzgerald, the city could force the new police chief to step down and put Fitzgerald in his old position, he said.
“But that person would no longer have a job,” Fitzgerald said.
Officers typically are given the opportunity to address their discharge designation, Fitzgerald said.
“We look at commendations, performance evaluations, sick time,” he testified. “There are several factors to be looked at.”
Fitzgerald said he appealed within a day and applied for an administrative review to challenge the decision to give him a general discharge. Interim Police Chief Edwin Kraus testified that if Fitzgerald had opted to take the resignation package he was offered instead of being terminated, Kraus would have given him an honorable discharge.
City Attorney Christopher Troutt presented evidence that had Fitzgerald resigned, he would have walked away with approximately $250,000 and received an honorable discharge.
The city has stood by its decision to fire Fitzgerald. In a termination memo in May, Chapa references several examples of Fitzgerald’s “increasing lack of good judgment.”
Fitzgerald alleges Fort Worth employees lied about the city’s compliance with regulations concerning the security of CJIS which he was investigating on the day he was fired, May 20. FBI agents were waiting for him in the hallway when he was told by Cooke and Chapa that he was being let go, he said.
“I was told that we were lied to for the past few years,” Fitzgerald testified Tuesday.
Unknown even now if computer system is secure
Fitzgerald acknowledged that the city got a passing grade on the CJIS audit in February but said that problems persist. Unauthorized people may still be able to access to CJIS, Fitzgerald testified. Mason Fincher, the officer who investigated computer security issues Fitzgerald identified, said someone took control of his computer during the investigation.
Stephen Kennedy, Fitzgerald’s attorney, said that Oswald Enriquez, a Texas Department of Public Safety auditor, told officials he was misled. Enriquez said city officials told him security issues with the CJIS system had been fixed when they had not, according to a deposition.
City employee Heather Herriage testified on Monday that she filled out the final survey that went to a CJIS auditor for approval. But Herriage said she did not have the technical expertise to determine whether the survey information was correct.
Herriage testified that even now she was not sure all the items that were supposed to be addressed had been addressed. Herriage testified that she was a member of the city’s CJIS compliance team, and relied on the city’s IT employees to give her the information that she needed to fill out the audit the city ultimately passed, according to witness testimony.
Even though it appeared that people in the information technology department had given city officials false information before, Herriage said, she trusted the employees from that department to give her the correct information to complete the audit survey in January.
Herriage testified that she did not know if issues with encryption, data access logs, 6-digit pin codes or unauthorized access had been solved or whether those issues were still in the process of being fixed.
Last year, an email told city employees that the city’s email system was unsecured and that sensitive criminal justice information should not be shared in city emails, Herriage said. At one point, the city took down its WiFi because of security issues, Herriage said.
“We had been out of compliance for years,” testified Rabiah Memon, a former Fort Worth information technology employee.
The city was out of compliance for at least three years, Memon testified Monday. Memon said some city servers were no longer being supported because they ran Windows 3 operating systems.
The city changed the designation for some employees who had access to the CJIS system, which caused some of their data and messages to be lost, Memon said.
Microsoft could possibly access the lost data, but city employees could not, Memon said. Memon testified that she tried to get her concerns to Fitzgerald in person, but could not do it before he was fired.
Those concerns were included in a memo sent to Kraus; Assistant City Manager Susan Alanis; and Dennis Shingleton, city councilman and vice chairman of the audit committee, Memon testified.
This story was originally published November 19, 2019 at 12:11 PM.
