ADP Board Acts After New IT Incident at Water Resources

May 12, 2023 by Amy Patterson

After federal investigators with the FBI and U.S. Secret Service executed a search warrant May 3 on his office in the county building on Ravenwood Drive, Department of Water Resources Network Administrator Mike Kurzinger was placed on paid administrative leave by Geauga County Commissioners at their meeting May 9.

But a day later, Kurzinger returned to his office — shown on security camera footage being let in by a coworker in the water resources department — where he spent about four hours accessing workstations and files remotely, eventually locking other employees out of the department’s shared file server.

During a Geauga County Automatic Data Processing emergency board May 11, ADP Systems Administrator Corey Thompson said he was called to GCDWR earlier that morning to help another employee troubleshoot a problem.

“While working with that user, he mentioned that Kurzinger had been in the office (the day before) working and had connected to the servers and changed permissions so that people could do payroll,” Thompson said.

Geauga County Auditor Chuck Walder — who is also the administrator of the ADP IT department — asked his deputy ADP administrator, Frank Antenucci, to clarify.

“Hang on a second, I thought (Kurzinger’s) equipment was seized,” Walder said.

“We have him as logged in on a conference room computer at water resources,” Antenucci said.

Thompson said ADP discovered Kurzinger’s activities in the building after other GCDWR employees submitted help desk tickets when they discovered they were shut out of the department’s shared drive.

“Basically, whatever occurred on the (GCDWR) server resulted in all of these people not being able to access those drives anymore,” Thompson said. “They’re not able to properly perform functions.”

Thompson said Kurzinger also changed a group policy on the server to disable remote access, but Antenucci said ADP staff had another way to access remotely the server to allow GCDWR employees access once again.

The issue also affected the system that allows GCDWR to take payments from the public, Thompson noted, adding the GCDWR staff member responsible for scanning in checks was unable to do so.

“That was working yesterday,” he said. “The only thing I had from the water resources employees was that their reasoning that Kurzinger was in was ‘to adjust permission so somebody could do payroll,’ were the exact words.”

Fiscal Office Manager Pam McMahan told the board GCDWR’s payroll ran May 5, with the next payroll due by noon May 15. Commissioner Jim Dvorak, later in the meeting, confirmed he had been told a GCDWR employee already had been given access necessary to run payroll.

Walder commented on the alleged reason for Kurzinger’s presence in the department, noting GCDWR did not submit a help desk ticket to ADP to resolve alleged issues with payroll.

“They didn’t call ADP to do it. They called the guy on leave,” he said.

“Do we think this would be accidental or malicious?” Geauga County Sheriff Scott Hildenbrand asked his fellow ADP board members.

“That’s what I’m trying to find out,” Walder said. “But it’s either incompetence or malicious.”

“Given the history of it, (would you) bet on incompetence?” Geauga County Prosecutor Jim Flaiz asked. “He was there for four hours.”

In an email May 12, County Administrator Gerry Morgan confirmed Kurzinger was asked to come to GCDWR to help transfer files under his purview to another employee so payroll could be processed for May 15.

“Under normal circumstances, (Kurzinger) would take the files and set them up, then provide them to (the GCDWR fiscal specialist) to complete for submission to the auditor’s office for processing payroll,” Morgan said, adding Kurzinger was accompanied by a GCDWR employee at all times, who was present and watching what he was doing.

The Geauga County Sheriff’s Office deputy stationed at the building’s front desk also was notified Kurzinger would be present, Morgan said.

Morgan’s Response Questioned

Walder said Dvorak reached out to him May 5 to ask about shutting off Kurzinger’s access to the county’s IT infrastructure.

However, Flaiz told the pair he did not believe the ADP department had the authority to lock out another department’s employee.

“Either the (department) administrator, the elected official, or the county administrator or the director of that department would have to communicate, ‘Hey, revoke this guy’s credentials,’” Flaiz said during the May 11 meeting. “I just felt like that was — and no offense Jim (Dvorak) — one commissioner really can’t do that.”

Dvorak said after hearing Flaiz’s opinion he brought the matter to the commissioners’ meeting May 9, during which he asked his fellow commissioners to revoke Kurzinger’s access to county networks. At that meeting, Morgan told Dvorak he would look into it.

Dvorak presented a letter detailing the terms of Kurzinger’s leave.

“It states in the second paragraph: during the administrative leave period, you shall not enter upon water resources property unless requested by the water resource director, sanitary engineer or operations manager. If requested, you shall at all times be accompanied by water resources personnel,” he said.

Flaiz said Dvorak told him he thought the matter already had been taken care of by Morgan after the May 9 meeting.

“Yes, because (Morgan) said he would look into that. And then Wednesday he calls up — he or someone — called up Mike Kurzinger and invited him into the building, which really got me upset,” Dvorak said. “Things are out of control and the commissioners are not (being) informed by the administrator of the day-to-day process with this situation. And it’s very upsetting.”

In his email, Morgan said when Dvorak asked about Kurzinger’s credentials, he authorized the removal of access to water resources equipment, his department vehicle and keys to the building.

Kurzinger’s IT credentials, Morgan said, were under the authority of ADP.

“Mr. Kurzinger has not been treated differently than any other employee under the commissioners’ hiring authority that is placed on paid administrative leave,” Morgan said.

Kurzinger provided the FBI and other law enforcement access to everything he asked to during the search on May 3, Morgan said, including access to the empty safe in his office.

“In the end, they removed Mike’s desktop computer and Mike’s personal and work cellphones. They left behind several hard drives, thumb drives and two laptop computers,” he said. “Everything that was done and removed could have occurred without the necessity of a warrant or wasting the time of three individuals to stand guard outside Mike’s office.”

During the meeting May 11, Walder said he had trouble with the idea that Morgan — who worked at GCDWR for 12 years and was the department head — should be the one tasked with ordering Kurzinger’s credentials revoked.

“I think there’s indications, at least to me from a 30,000-foot view, he’s too close to the situation,” Walder said. “I’m not sure we’re making good decisions right now, as a county. I think we’re making some pretty bad ones. … I’m not sure what the threshold is going to be with the public to put up with this much longer.”

In his email response, Morgan said he started at GCDWR as design engineer and eventually became director of the department and a sanitary engineer. Morgan said he has worked with Kurzinger for many years.

Morgan said no restrictions were placed on Kurzinger by law enforcement and reiterated Kurzinger has not been charged with any crime.

“I personally have a concern about Walder and Flaiz having anything to do with discussing (Kurzinger), (GCDWR Director) Steve Oluic or myself given they publicly expressed dislike for all three of us, which I believe stems from the fact that we question things they say and their ideas instead of just falling in line,” Morgan said. “Unlike Mr. Walder and Mr. Flaiz, I am able to work with others until they are not willing to work with me.”

Planning for the Future

The board discussed creating a policy through which employees placed on administrative leave could automatically have their credentials revoked, with any appeal going to their direct hiring authority, as opposed to needing to wait for a board action to remove access to county systems.

Antenucci said currently, the ADP department does not have the authority to suspend credentials for any employee not under its hiring or appointing authority.

“(The request comes) either from the actual ADP board member or the alternate,” he said. “Not the IT guy, not the chief deputy who’s not an alternate. That’s the only two people I’ve ever accepted that from, informally and in writing.”

Antenucci said in this case, that would mean the request would have to come from Morgan or the board of county commissioners.

Since individual commissioners do not have appointing authority, they would need to act in a public meeting as a board to revoke an employee’s credentials, Flaiz said.

Walder said a policy could be worked on and presented to the board, but added he did not want the ADP board to create a new policy simply based on a one-off scenario that should never have happened.

“If the county administrator would have done his job, this wouldn’t have (happened),” Hildenbrand said.

“I think the question now is whether the county administrator is going to do his job,” Antenucci responded.

Hildenbrand motioned to send a letter to the board of commissioners, Morgan, and Oluic demanding to know why Kurzinger was allowed to return to the building.

“This was just, it was handled very sloppy,” Hildenbrand said.

Morgan said the only response he could give Hildenbrand is he is handling the situation the same as all other personnel issues regardless of department or employee.

“I will say I am doing my job,” he said of comments from Antenucci and the sheriff. “They may not like the way I am doing it, but I am doing it.”