Two technology administrators were wrongly fired in the wake of Ohio University's network security breach, a grievance committee decided earlier this week.
Tom Reid, former director of the now-dissolved Computer Network Services, and Todd Acheson, former manager of Internet and Systems, did not contribute to network security lapses that led to a series of data breaches, which was the basis for their firings, according to a letter from Administrative Senate's Grievance Committee.
The letter, dated Oct. 1, also finds fault with Bill Sams, associate provost for information technology and chief information officer, for failing to address security and institutional problems before the network breaches.
The Administrative Senate Grievance Committee is composed of Douglas Franklin, assistant dean of Recreation and Wellness and chair of the committee; Anne Lombard, director of Campus Life; and Cris Milligan, Mathematics Department administrator. The three interviewed Acheson and Reid, as well as Sams, to evaluate the grievance, according to the letter.
Provost Kathy Krendl will make the final decision regarding Reid and Acheson's grievance. University policy states that the Planning Committee, of which Krendl is head, should consider the committee's findings. Because Krendl also makes the final decision on any appeals that result from the Planning Committee's decision, the university will probably simply allow her to make one final decision, said John Burns, director of Legal Affairs.
An investigation of the security breaches that compromised 173,000 identities, including Social Security numbers and medical records, by Moran Technology Consulting prompted Sams to fire both Reid and Acheson on Aug. 3.
Both were fired for nonfeasance
the total neglect of duty ' a charge the committee stated is unfounded. The committee suggested to Provost Kathy Krendl that both former administrators be reinstated and provided with back pay and benefits, in addition to a public apology.
Grievants see justice
Fred Gittes, Acheson's attorney, said he can't ask for more. He asserted that Acheson was relatively low on the totem pole and can't be blamed for failing to warn higher-ups of the possibility of security breaches, he said. The committee found that both Reid and Acheson acted within the parameters of their jobs.
The university by circulating that really false and totally unfair report and then making it worse by firing him ... really damaged him Gittes said.
Reid said the recommendation lends credibility to his claim that he was scapegoated, adding that he is cautiously optimistic about his future.
In light of the security breaches, the Communication Network Services and Computer Services departments were combined to form Computer and Network Services. In the process, several positions were eliminated.Reid said he filed the grievance to protest his wrongful termination, but sees an obstacle in returning to work.
My job doesn't exist anymore
Reid said. It would be kind of tough.
The committee's letter recommends that Reid and Acheson be assigned to posted vacancies or remain under contract for the rest of the school year while being assisted in finding other employment.
The committee's report added that if Reid and Acheson were terminated because of restructuring, their contract should have not been renewed for that reason. As classified employees, both were only signed to a one-year contract. Instead, the university fired the two.
Blame shifts upward
The committee's statement also blames Sams for neglecting to solve the fragmented and disjointed state of the information technology department before the security breaches.
Moran's July report concluded that the IT organization's structure created unnecessary competition, which contributed to a neglect of network security. Sams has previously acknowledged he was aware of the competition prior to the breaches.
The committee finds Mr. Sams' failure to address these issues through reorganization within the first six months of accepting his position was inappropriate for this level of administration
the letter stated.
In the past year, Sams slashed the IT budget by 15 percent, including a 12 percent reduction in 2006 that was cut short by the breaches. The cuts were part of a university-wide budget reduction.
Sams, who stepped down from his post in August but will continue working until the university finds a replacement, declined to comment.
Also in late August, Acheson and Reid filed a lawsuit against OU for the destruction of documents related to Moran's investigation into the data breach. Destroying such public records violates Ohio law and carries a $1,000 fine per document. The case is still pending in the Athens County Court of Common Pleas.
Gittes said he expects that Krendl's decision concerning the future of Reid and Acheson at the university will reflect the committee's independent review.
If they don't accept the recommendation
it raises serious questions of another motive
he said. There's no reason to think that either of two these people did anything wrong.
17
Archives
Sean Gaffney
