Russell Township Trustees voted Feb. 2 to pay a $4,700 invoice from the Geauga County Automatic Data Processing board for work performed during a cybersecurity incident involving the Russell Township Police Department last fall.
Russell Township Trustees voted Feb. 2 to pay a $4,700 invoice from the Geauga County Automatic Data Processing board for work performed during a cybersecurity incident involving the Russell Township Police Department last fall.
The move resolved a dispute that lasted more than six months.
The incident involved an outside vendor, Simvay, installing SentinelOne antivirus software on the department’s mobile data terminals. The software conflicted with ADP’s required CrowdStrike antivirus program, said ADP Chief Deputy Administrator Frank Antenucci.
ADP acted out of caution after detecting a potential security issue, blocking the department’s email domain due to safety concerns, Geauga County Auditor Chuck Walder — who sits on the ADP board — said last fall.
The township was originally invoiced $5,700 for ADP’s work, which included email and phone correspondence, after-hours alert monitoring and the attendance of six ADP employees at a Sept. 18 trustees meeting.
“Significant county resources were invested in responding, investigating, managing and attempting to remediate this issue from September 2025 through the present,” Walder said in a Jan. 7 letter to trustees. “As the associated costs were incurred solely due to Russell Township’s police department email incident and subsequent lack of fulfilling committed obligations, they should not and cannot be absorbed by the broader county user base or its taxpayers. An itemized invoice is enclosed and we respectfully request reimbursement.”
Trustee Chair Chris Hare scheduled a special meeting Jan. 29 to review the invoice, expressing qualms about the charges and discussing the possibility of refusing payment.
Russell Police Chief Tom Swaidner warned trustees that failing to pay could result in ADP cutting off its services to the township.
“We risk suspension of performance (and) the suspension of clients’ access to services,” Hare added.
Swaidner said such a move could violate the Ohio Revised Code.
“Under the Ohio Revised Code, under 2909.04, disruption of public services, it does state, ‘No person shall knowingly use any computer, computer system, computer network, telecommunication device or other electronic device or system or the internet so as to disrupt, inner interrupt or impair the functions of any police, fire, education, commercial or government operations.’ So, if (cutting off services) is the response if you respond you’re not paying (the invoice), and they shut your services off, I would believe that they would fall under that revised code and that is a felony in the fourth degree.”
Geauga County Prosecutor Jim Flaiz later disputed that claim.
“That’s an incredibly irresponsible thing for a police chief to say in a public meeting, and the prosecutors and the grand jury ultimately make those decisions,” he said in a Feb. 3 follow-up interview. “I can’t imagine a scenario under that law where criminal charges would be applicable because of a contract dispute. Certain matters are criminal and certain matters are civil.”
Antenucci also responded to the allegation.
“I’m aware of Mr. Swaidner’s comments and my opinion is that a ‘Google search’ is not a substitute for a legal analysis of contract law,” Antenucci said Feb. 3. “Questions about whether conduct implicates the revised code belong with the prosecutor’s office.”
Four days after the Jan. 29 meeting, Hare called a second special meeting and invited Walder, Antenucci and Flaiz, he said Feb. 2.
Trustees raised several objections to the invoice, including concerns that ADP performed work without a formal work order, Trustee Amy Heutmaker said.
“Under Section C of your contract, paragraph one, ‘ADP may not perform work without first having a work order from the client or monies in full,’” Heutmaker said. “My question is, can either of you identify a written work order service request or an authorization initiated by Russell Township or Russell Township Police Department that triggered the MDT installation work built by ADP?”
Walder explained Feb. 2 the township had previously agreed to ADP’s cybersecurity policy, which includes an “endpoint quarantine policy.”
“That endpoint quarantine policy sets in motion that the county is an ‘act first, investigate second,’ incident response crew,” Walder explained. “So, we do that to secure the vital business systems that the county operates under. In this particular case, the business system involved was the county’s Spillman system, which is a law enforcement system we consider a critical environment system. As such, we don’t wait for confirmation. We don’t wait for proof of issue. In this particular case, when the scoring is at a certain level, it informs us to isolate and quarantine. We follow that policy, regardless of what the incident is or who it is with.”
Swaidner also questioned the charges, noting ADP had previously said the police department was not an ADP client, but rather a client of the sheriff’s office, which requires the antivirus software.
Walder clarified Geauga County Sheriff Scott Hildenbrand serves as an extension of ADP because he sits on the ADP board.
Trustees objected to the line items labeled “Phone Call with Auditor Walder,” which appeared three times on the invoice, Trustee Kristina Port said.
Walder explained the charges were for calls with ADP technicians, which Antenucci admitted were wrongly labeled. Walder said he does not bill for his time as a public official.
Trustees also objected to being charged for six ADP staff members attending the Sept. 18 trustees meeting without invitation or notice.
“I have some disagreement about just bringing the staff without agenda notice on Sept. 18,” Hare said. “That is the only line item on the bill I personally contest.”
Port added, “I was chair at the time and didn’t really have any heads up that there was going to be (six) people attending (Sept. 18). I would have thought that it would have been courtesy if you let our board administrator know if you needed to speak on the agenda as an item to talk about ADP incidents at that time, (it) would have been the more correct way of approaching this, as opposed to just being in the crowd in attendance.”
Walder agreed to remove the three phone calls and the Sept. 18 staff attendance from the invoice, reducing the total to $4,700.
Trustees unanimously voted in favor of paying the amended invoice.
Trustees and ADP officials also discussed potential legal action against Simvay.
Simvay’s installation violated county protocols, Flaiz said.
“The MDTs are supposed to be imaged by the (Geauga County) Sheriff’s Office. They were not,” Flaiz said Feb. 2. “They were imaged by an outside vendor, which we would never allow. It’s completely against our protocols and that outside vendor was loading on software that we’re unaware of.”
Simvay previously admitted wrongdoing, Heutmaker added.
“Essentially, this invoice is really a recourse against us because of reactions taken against us by our vendor,” Hare said.
Walder said ADP has no legal standing against Simvay.
“I don’t know what the scope of agreement was with Simvay, but if they — like any other contractor — if they either fail to perform or in doing their work (and) there’s consequential damage, then you have certain rights under contract that you could pursue,” he said. “But again, that’s not a contract that ADP has. We did not contract with Simvay, so we have no recourse to Simvay.”
Flaiz said the township would need outside counsel to pursue action against Simvay, as the county prosecutor’s office also represents the county. He added the township’s assistant prosecuting attorney has recused herself from the matter.
“I would also be interested in the subrogation part of it somewhere along the line, too,” Heutmaker said. “I still think we do have an entity (Simvay) that has admitted some fault in this, so I think that is still an option to look into. I think based on what we heard this evening, that that does become our responsibility in looking to collect funds in a fiduciary way on behalf of our residents.”
