State investigates computer security breach; city likely to discipline officer

WASILLA — No criminal charges will result from a months-long probe by state investigators into the improper accessing of records within the Wasilla Police Department.

A report detailing the investigation was released Thursday, and includes interviews that show how a lapse in security on the WPD computer server system allowed a longtime officer to improperly access files on personal drives of other department employees, including a supervising lieutenant.

Interviews with WPD personnel included in the report, compiled by Investigator Nathan Bucknall of the Alaska Bureau of Investigation Technical Crime Unit, say the department’s server system was inadvertently left unsecured in April 2010 after the city’s IT contractor worked on it. That allowed employees to access the personal hard drives of others stored on the server without having to supply a password. That breach of security allowed Officer Rick Manrique on Dec. 30, 2010, over a two-minute timeframe to access documents on four other employees’ drives. Those documents related to a personnel squabble between a pair of employees in the city’s dispatch center.

Exactly why Manrique, one of several union shop stewards at the WPD, accessed the information is not completely clear. According to an interview Bucknall conducted with Lt. Kelly Swihart, who was in charge of the dispatch center and who is no longer with the department, Manrique said he “accidentally” accessed the information when doing a computer search for the name of one of the dispatchers.

Interviewed about the investigation on Friday, Wasilla Mayor Verne Rupright and Police Chief Gene Belden said the officer accessed the files to show the breach of security to his superiors.

“Sgt. (Ken) Conn approached Swihart and (then) chief (Michael) Hughes,” Bucknall writes in his report about an interview conducted with Swihart. “Conn told them that Manrique just came to Conn and asked if there was an investigation into Manrique because he ‘accidentally’ accessed some confidential files when he did a search for (the dispatcher’s name).”

Swihart said that he attempted to replicate those search results on the WPD network and couldn’t, Bucknall writes. “Swihart stated that he cannot think of any reason to do a legitimate search for (that name) on the network for union information or law enforcement reasons.”

When he learned of the computer system breach, Rupright said he immediately wanted to know what information was accessed. He said he also discussed the matter with Manrique.

“He told me he went in, snapshotted or printed off one or two letters to prove that it could be done, is what I understood,” he said. “So Rick snitched on himself, and Rick just proved you could do it.”

The mayor said he wanted to know “why isn’t this thing secured? They (the IT technician) said it’s secured now, boss. Our screw-up in April. Nobody from the outside could get in and look, it was just internal.”

Interviews conducted with Rupright and Belden during the state investigation show the city officials preferred the matter be handled in-house. They both said Manrique’s actions were a definite violation of the city’s standard operating procedure, but were not criminal.

“Here’s the one thing,” Rupright said. “As a union steward, (Manrique) has the right to investigate, but he should ask first. It probably was not the smartest thing Rick’s ever done, OK? As he’s now found out and has been dragged through this for the past nine months.”

That it became a subject of a state investigation was a surprise, Rupright said. After learning about the improper accessing of files, then WPD Police Chief Michael Hughes sent a letter to John Skidmore in the state Office of Special Prosecutions. In the letter, he details the incident and voices his concerns that Manrique potentially committed criminal acts, including official misconduct, criminal mischief and misuse of confidential information.

In Hughes’ letter dated Jan. 16, 2011, he said the brouhaha came to his attention Jan. 6 when he received an email from a dispatcher as a complaint against Lt. Swihart for alleged improper workplace conduct. One of the complaints was that Swihart left electronic information about an internal affairs investigation she was a part of “in the ‘common drive’” of the department’s server.

“(She) said Officer Rick Manrique provided her with this information, and documented in her complaint that she viewed the information Officer Manrique provided,” the letter states.

That dispatcher was protesting discipline doled out by Rupright stemming from an earlier altercation with a co-worker in which the first dispatcher “was untruthful with Lt. Swihart during an interview,” Hughes’ letter states.

When Hughes questioned Swihart about the files, “Lt. Swihart told me there were electronic files regarding internal affairs’ investigations, and other official files, kept in a drive assigned only to him,” the letter states. “Those files were stored in a folder marked ‘Personnel.’”

In an interview with state investigators, Swihart said he never gave permission for anyone else to access this information.

It was while looking into this breach that it was discovered the WPD security had not been enabled and the IT specialist fixed it, Hughes wrote. This is also when Manrique’s historical computer information showed “that he accessed Lt. Swihart’s official files, including the personnel folder and a document regarding (the dispatcher). This access was without authorization.”

Between 4:19 and 4:21 p.m., Dec. 30, 2010, Manrique accessed the drives of four employees, Hughes wrote. “It is unknown how long Officer Manrique had the folders and files open. Further, it was impossible to access that information in a non-purposeful manner.”

Hughes concludes that he was relatively new to Alaska at the time, but because he thought there may be potential violation of the law, including a felony, he reached out to the state.

“Ethical compromise is not an option in professional police organizations, and it will not be an option for the Wasilla Police Department,” he wrote. “It is important to me to confirm whether there are violations of law present here.”

Something Rupright said he didn’t like was that Hughes sent his letter to state prosecutors without first checking with the city attorney, the mayor (who is also an attorney) or the city’s human resources specialist. Had he done so, Hughes could have saved the city and WPD months of frustration, Rupright said.

“Yeah, pretty much from the beginning” it should have been an internal matter, he said. “When I found out they had gone out to the state cops, I didn’t know.”

The state first decided not to investigate, then reconsidered, Rupright said.

“All of the sudden, marching orders are coming down from the commissioner himself, so I just went, ‘That’s it, I’m waiting until this plays out,’” he said. “I’ve been a lawyer too many years, I’m not going to go in and try and stop them.”

Although Belden joined the department after the investigation had begun, he said he agreed it should have been handled within the organization.

“Basically, it’s because there has been no real crime committed, based on the information I had,” Belden said. “(Manrique) did violate city municipality procedures. I said we’ll deal with it in house.”

Aside from this incident, Belden describes Manrique as a “very excellent” cop, who breached city policy. But his mistake should not be a career-ender, he said.

Manrique is on vacation, but now that the state has concluded its investigation, Belden said he will take disciplinary action.

“When he comes back, I’m going to invite him into my office with union representation and I’m going to talk to him about what’s in this report,” Belden said. “Based on that information that I gather from him, he will most likely get a letter of reprimand and possible time off. … He violated this particular municipal code. We have to deal with it or the municipal code doesn’t mean anything. We couldn’t really do anything until the investigation was done.”

That state officials declined to prosecute the incident isn’t a surprise to Rupright. For a crime to have been committed, there has to be a victim, he said.

“Who’s the victim?” he asked. “Me. I don’t feel victimized. I don’t feel the city was victimized because of what happened in house. It’s not like somebody went in there intentionally for profit or with (an unsavory) motive. My concern always was this: is our (system) secure? Nobody from the outside could ever get in. And he snitched on himself, so what’s the issue?”

Capt. Dennis Casanovas, who heads up the ABI, said that question of whether or not there’s a victim likely played into the decision to not prosecute.

“If you don’t have a victim and you don’t have somebody going through huge efforts to access data, and they’re not exported outside the environment for evil purposes, why would you do a criminal investigation?” Casanovas said.

Contact Greg Johnson at greg.johnson@frontiersman.com or 352-2269.