July 2015

By David Broadland and Daniel Palmer

News of a secret investigation involving Saanich interim CAO Andy Laidlaw may throw the District into more turmoil.

IN THE SAANICH SPYWARE DEBATE, either you believe that the senior manager who approved the installation of employee monitoring software on newly-elected Mayor Richard Atwell’s computer understood what she was approving, or you believe that a systemic disconnect from BC’s privacy law occurred and no one in particular was to blame.

That latter position was all that could be found in a report to Saanich Council on the issue delivered by the District’s interim CAO Andy Laidlaw and made public on June 24. In his introduction to the report Laidlaw noted, “I am acutely aware that my report will be subject to criticism by those who believe it does not confirm their perceptions.”

The “perceptions” Laidlaw acknowledged are that there was wrong- doing and that it’s being covered up. The installation of the spyware was approved by Director of Corporate Services Laura Ciarniello.  Laidlaw and Ciarniello worked together at the City of Campbell River. Their working relationship there was described to Focus by former Campbell River Mayor Walter Jakeway as “chummy.” The perception of a cover-up stems from the concern that Laidlaw’s investigation of Ciarniello’s actions would be a whitewash.

Laidlaw’s introduction went on to say, “This situation has been infused with ‘politics’ from its origins and I am cognizant that my findings will be subject to that lens.”

Laidlaw may have misjudged the “lens” through which his report would be viewed. 

The widely-held perception of a cover-up in Saanich apparently motivated some citizens to go looking for evidence to support that perception. As a result of one of those fishing expeditions, documents landed in Focus Magazine’s mailbox the day before Laidlaw made his report public. The information they daylight calls into question Saanich Council’s decision to hire Laidlaw in January this year and then appoint him to investigate the spyware question.

Those documents indicate that between November 12 and November 24, 2014, Laidlaw was the subject of an internal investigation by the City of Campbell River. The investigation considered whether Laidlaw’s business association with Jerry Berry Consultants Inc, and another unnamed entity, had constituted a conflict of interest. Jerry Berry was Nanaimo’s City Manager between 1987 and 2009. Berry now describes himself on his website as “a management consultant and educator specializing in local government issues.” Laidlaw worked at the City of Nanaimo between 1980 and 2011.

Campbell River retained private lawyer Richard Grounds to conduct the investigation. Grounds has done work for such organizations as the Civilian Review and Complaints Commission for the RCMP.

Grounds’ investigation looked at whether Laidlaw performed paid work for Jerry Berry Consultants Inc, or another entity, while Jerry Berry Consultants or another entity had been engaged to provide services to the City of Campbell River. Additionally, the investigation considered whether Laidlaw had a business relationship with Jerry Berry Consultants Inc or other entities, and may have been paid for services provided by him to Jerry Berry Consultants Inc, or other entities, in circumstances where Laidlaw had a role in awarding or recommending the award of contracts by the City to Jerry Berry Consultants Inc or other entities. As well, the investigation considered whether Laidlaw, through his business activities with Jerry Berry Consultants, had disclosed the City’s confidential information to Jerry Berry Consultants Inc or another entity.

For confirmation that an investigation had taken place, Focus contacted Jakeway, who agreed to speak on the record. According to Jakeway, who was narrowly defeated in last November’s election, the investigation found that Laidlaw’s activities did constitute a conflict of interest and that he had disclosed the confidential information of the City of Campbell River. Jakeway told Focus this finding was made following the election and was considered by the outgoing council. It decided to leave a decision on whether any action should be taken against Laidlaw to the incoming council. That council, sworn in on December 2, has sat on Grounds’ findings ever since.

According to Campbell River’s 2014 statement of financial information, Grounds’ investigation cost taxpayers $25,523. This does not include the cost of a legal opinion by Campbell River's legal counsel Dean Crawford.

Laidlaw was paid $182,455 in remuneration and $6,392 for expenses by the City of Campbell River in 2014.

Laidlaw declined to answer questions on this subject. Campbell River Mayor Andy Adams would only confirm that Laidlaw had retired from his position on January 16.

This news—and Laidlaw’s unwillingness to answer questions about it—may feed the perception of wrong doing and cover-up at Saanich. Ciarniello was, until August, 2013, Campbell River’s Director of Corporate Services. She was tasked by Saanich Council on December 8 last year with creating a shortlist of candidates for the CAO position to replace Paul Murray.

Was Ciarniello aware of the investigation into Laidlaw and its outcome at the time she put him on that shortlist? In response to that question Ciarniello told Focus, “I am unable to answer your…question as it deals with personal information and if discussed would be subject to in-camera confidentiality.” 

The possibilities here aren’t endless. If Ciarniello wasn’t aware of the investigation, then Laidlaw didn’t inform her. What would that possibility suggest about Laidlaw’s suitability to conduct an investigation into the perceived malfeasance in the spyware case? If she was aware of the investigation, and informed councillors about it, why did they choose Laidlaw? Did councillors request a reference?

Focus contacted Saanich Councillor Colin Plant and described in broad brush strokes what we knew about the investigation in Campbell River. Would Plant have voted to approve Laidlaw if he had known that an investigation in Campbell River had found Laidlaw in a conflict of interest position? “Unlikely,” Plant said. “However, to be fair, I would have needed to know more about the situation before answering that definitively.”

LAIDLAW'S CONTRACT WITH SAANICH is set to run out in August unless a new CAO has not yet been found. Whether he can survive a storm blowing down from Campbell River until then remains to be seen. In the meantime, will his report bring closure to the spyware issue?

Laidlaw’s report referenced Privacy Commissioner Elizabeth Denham’s late-March Investigation Report, which found that Saanich had broken BC privacy law when it installed the spyware. In that report Denham stated, “One of the most disappointing findings in my investigation of the District of Saanich’s use of employee monitoring software is the near-complete lack of awareness and understanding of the privacy provisions of BC’s Freedom of Information and Protection of Privacy Act.” Parts of Laidlaw’s report read like an investigation of Denham’s investigation. His statement that “The Commissioner has provided new interpretations applying to security and the collection of personal information,” could be read: “She’s just making this stuff up.” 

With evidence recently brought forward by current and former employees of Saanich’s IT division that indicates Atwell was the target of three IT initiatives that either intercepted communications made on his office computer, or prevented him from accessing the District’s computer network, the thorny question of whether such actions by public servants are excusable or should result in some disciplinary action hasn’t been fully answered. The portion of Laidlaw’s report that addressed that question was attributed to “Brian Simmons, Labour Relations Consultant.” Simmons’ report stated: “Finding no evidence of malfeasance, I find no cause to terminate or discipline any employee based upon those considerations.”

How did Simmons come to that conclusion? Focus was unable to get an answer from Simmons because he couldn’t be contacted. We asked Laidlaw for information about Simmons but he refused to provide any biographical information or any way of contacting Simmons. Invoking a concern for Simmons’ privacy, Laidlaw promised, “I will forward this request to him.” An extensive web search for “Brian Simmons, Labour Relations Consultant” provided no information. Atwell, interviewed for the report by Simmons, told Focus that he was only able to obtain an email address from Simmons—no business card, no telephone number, and no website. Repeated emails by Focus to the email address given to Atwell produced no response.

Similarly, Focus was unable to question Simmons about his statement that “I find that on the balance of probabilities, and considering all of the circumstances, the evidence does not support a claim that the Mayor’s computer was targeted.”

How did Simmons arrive at such a conclusion? Did he interview “Whistle Blower,” whose story was published in the last two editions  of Focus? It’s our understanding that Saanich threatened Whistle Blower with legal action unless he signed an agreement that limited  his right to self-expression about the issue. Whistle Blower has said that the District's Assistant IT Manager John Proc told him on November 20: “They are nervous about the new mayor. We’re installing it on the directors’ computers as well to make it [look like] it is not targeted.”

With Simmons secreted away, the question of whether the actions of the employees involved in the spyware issue are excusable remains unanswered since the basis for Simmons’ findings appears to be limited and can’t be examined or questioned. 

Saanich resident Karen Harper, a vocal critic of the way the issue has been handled by the District, is a retired Chief Information Officer of BC Pension Corporation. Following the release of Simmons’ and Laidlaw’s reports she told Focus, “I can state with utter certainty that had I authorized the installation of spyware on our system, I would have been fired for cause. It would not have mattered whether I did so out of incompetence or if I had some other motivation. I would have been gone. Why? I would have brought disrepute onto the organization to a degree that cannot be ignored.” Harper called the reports a “whitewash,” and said, “As a concerned Saanich resident and taxpayer, I believe that a public inquiry is still needed—by truly independent persons—in order to restore any faith in the bureaucracy and council.”  

CIARNIELLO HAS BEEN AT THE CENTRE of the spyware story from day one and the details of that involvement are now well-documented. On November 17, 2014, just two days after Atwell was elected mayor, Ciarniello and the District's Manager of IT Forrest Kvemshagen met, they have said, to discuss the recommendations of a May 2014 audit of the District’s IT security system by Wordsworth and Associates. But Ciarniello and Kvemshagen have not provided any written evidence that the plan they developed was motivated by the security audit.

Two days later, a meeting took place between high-level staff that included Ciarniello, then-CAO Paul Murray, Fire Chief Mike Burgess, Legislative Services Director Carrie MacPhee (also responsible for privacy compliance), Planning Director Sharon Hvozdanski, Parks and Recreation Director Doug Henderson and Finance Director Valla Tinney. According to the District, no minutes were recorded at this meeting. Denham reported, however, that a decision was made to install “protection and monitoring software” on the workstations of everyone at the meeting (CAO, directors, fire chief), on workstations used by two executive assistants, on computers used by councillors and on Mayor Atwell’s computer. Ciarniello and Kvemshagen told Denham this decision was made in response to the security audit.

By December 2, Spector 360 software had been purchased, downloaded and silently deployed on 13 computers, including that of the incoming mayor. The IT technicians doing the work were given explicit instructions to enable the most privacy-intrusive features of the software, which included logging every keystroke made by Atwell and frequent automated screen shots. At the same time, a log that would have recorded when managers viewed the information collected by the software was left disabled. If someone did sift through Atwell’s private information, it can’t be proved.

Before activating the software, Kvemshagen emailed Ciarniello: “In order to ensure there is appropriate authorization in place for this work, please reply to this email stating your approval.” Ciarniello replied, “I approve of this program and the machines it has been installed on.”

There is no question, then, that Ciarniello approved the installation. The question that remains unanswered, by anyone at Saanich, is this: Did Ciarniello know she had approved the installation of spyware?

In the investigation undertaken by Denham, Assistant IT Manager John Proc told investigators that he understood the software agreed on at that November 19 meeting was meant to have “forensic auditing capability… and ability to determine whether user accounts were accessing areas which they were not supposed to be accessing.”

A January 14 press release from Saanich, however, used very different language to characterize Spector 360, describing the software as a means of monitoring “internal activity that may result from external threats,” and assisting Saanich by deterring theft, potential leaks of data and by “protecting high profile users.”

This claim was dismantled by Denham’s report as well as several IT experts. Denham also noted that the author of the May 2014 security audit “confirmed that he did not make any such recommendation nor did he intend to make any recommendation that could be interpreted to recommend the installation of monitoring software such as Spector 360.”

The claim that the software was a security fix was also challenged by former Saanich IT manager Jon Woodland. “You don’t buy a system like that to protect a network; you buy it to investigate someone or their activities,” said Woodland, who is now IT manager at the Township of Esquimalt. Woodland alerted Atwell to the spyware in December after speaking to former colleagues who were worried the process “was being rushed in.” “Any of the colleagues I’ve talked to have been shocked, as I was, that the municipality would install this type of software,” Woodland said.

That the intention of installing the software wasn’t security, but spying, is also supported more directly by the testimony of the former Saanich IT department analyst, “Whistle Blower,” whom we mentioned above. His statement is powerful and bears repeating: He stated that Assistant IT manager John Proc told him on November 20: “They are nervous about the new mayor. We’re installing it on the directors’ computers as well to make it [look like] it is not targeted.”

There is reason to believe, then, that Ciarniello and Kvemshagen both knew—or should have known— they were setting up a system for spying on Atwell, not securing the network from external threats.

Contacted for her side of the story, Ciarniello told Focus that she refutes the allegation made by Whistle Blower.

From December 3 until January 21, Spector 360 was actively collecting all data from Atwell’s computer and from 12 other workstations. By January 12, of course, the affair had spilled out into the open when Atwell announced at a press conference that he was being spied on by Saanich staff.

Focus has previously reported on additional records that show the installation of Spector 360 on Atwell’s computer was only one of three actions Saanich’s IT department was ordered to undertake that were aimed directly at the new mayor. Those actions included setting up Atwell’s computer without shared drive access, a privilege enjoyed by his predecessor Frank Leonard; and configuring Atwell’s computer to redirect to the public internet if he attempted to access the central corporate intranet—the heart of information exchange between Saanich employees.

Focus asked Ciarniello if she had authorized the configuration of the new mayor’s computer so that he was unable to access the same departmental shared drives to which Mayor Frank Leonard had access. She said, “Mayor Atwell’s computer has been configured in the same manner as Mayor Leonard’s.”

On this question Laidlaw told Focus, “Mayor Atwell has the same access as the previous mayor.”

Whatever the case, what is the implication of Ciarniello’s decision that the mayor could be monitored without his consent? For one thing, it suggests she believed an elected mayor is subservient to bureaucratic managers, that a mayor is an “employee” subject to the same conditions under which rank and file District employees are required to operate. This is evident in Ciarniello’s subsequent justifications about the program of employee monitoring she approved. For example, in a January 12 press release, in an effort to prove that Atwell had been informed that his computer was under surveillance, Ciarniello stated, “Prior to being permitted access to the Saanich corporate computer network, employees are required to sign a Network Access Terms and Conditions form.”

Atwell has consistently said he was never given the form. Councillor Colin Plant has confirmed that he, too, wasn’t given the form.  

So Ciarniello’s claim that Atwell was warned his computer would be under surveillance is unsettled. But since everyone agrees that Atwell didn’t sign the form, by logical deduction there is agreement by everyone, including Ciarniello, that Atwell didn’t consent to having his communications intercepted. Yet intercepted they were.

PROFESSOR DAVID SIEGAL, an expert in Local Government and Public Policy and Administration at Brock University, said the relationship between staff and council is clear: staff works for council and not the other way around. “The actions of installing the spyware without telling people it had been installed is the sort of thing where mayor and council could discipline somebody. It’s almost the kind of thing where you could fire somebody with cause,” Siegal said. “This seems to be a pretty serious matter. I guess what it indicates is a complete breakdown in trust between staff and council … but it’s staff who leave, not councillors or the mayor.”

Siegal said the designation of the mayor as “Chief Executive Officer” in the Community Charter is little more than a title, but he acknowledged that the mayor does have some exclusive powers, like the ability to suspend municipal staff. If Atwell did suspend an employee, it would then trigger a review by council to reinstate the employee, confirm or extend the suspension or fire the person in question.

“The CAO or senior staff being disciplined is the kind of thing a mayor and council collectively, not the mayor by himself, can ultimately do,” said Siegal. 

If Ciarniello’s actions regarding the Spector 360 installation represented a “complete breakdown in trust,” as Siegal speculates, there’s been no explanation of how such a deterioration could have occurred. Atwell hadn’t even been sworn in by the time all the decisions about the spyware had been made. As well, subsequent events, as told by Atwell, suggest Ciarniello’s actions may have been guided somewhat by Atwell’s fellow councillors. This is illustrated by the fact that it wasn’t Atwell’s signature that appeared on Laidlaw’s contract. The authorizing signature came from Councillor Judy Brownoff, who was designated by staff as acting mayor in Atwell’s alleged absence the day the contract was signed. 

Yet Atwell hadn’t taken leave or left the District, and the only attempt Ciarniello made to contact him about the contract was through his executive assistant, Brandy Rowan. “I was asked in person by Laura Ciarniello on Friday [January 16] to sign the contract, but as it was the end of the day, I told her I would have to take the contract home over the weekend to read it before I signed it,” Atwell said. “She told me, ‘No, the contract has to stay within the walls of municipal hall.’ I was dumbfounded by this statement as I have a right as mayor to take confidential documents home, given that I’ve sworn an oath of office…I do this all the time.”

On Thursday, January 22, Atwell emailed Ciarniello to ask again about accessing Laidlaw’s contract; on January 23, after inquiring again, Atwell was told by Ciarniello via email that Brownoff had already signed Laidlaw’s contract five days earlier. “There has to be a reasonable justification for staff to defer to the acting mayor,” Atwell said. “Simply stating that they were ‘eager to put out a press release’ isn’t one that stands up. I was shocked when I found out Brownoff signed the contact, as was every other elected official I have told.”

Focus asked Ciarniello if she had gone around Atwell to obtain authorization on Laidlaw’s contract. She said, “No, the Mayor did not make himself available.”

CIARNIELLO'S POSSIBLE SIDE-STEPPING of Atwell to get Laidlaw’s contract signed wasn’t the only time she overstepped her authority, Atwell says.

On January 27, Atwell emailed a New Year’s address to his assistant, Jennifer Downie, and asked that it be distributed to all Saanich staff through the E-link internal website, to which the Mayor was not given access.

In that letter, Atwell wrote that he planned to schedule drop-in coffee sessions with staff in the coming weeks “at our various facilities throughout Saanich. I would love to share a coffee with you, hear about your role in this organization and your ideas for making our community a better place for all citizens.”

According to Atwell, Downie blocked the letter. She told Atwell it touched on governance and operational lines and had forwarded it to Ciarniello for direction. Atwell said Ciarniello explained to him that the email to staff was blocked “as it contravenes council’s direction.” Focus asked Ciarniello if she refuted Atwell’s claim. She said, “Yes, I refute the allegation.” 

Atwell told Focus that many municipal hall staff have told him that they have been directed not to talk to him and that staff are afraid of retribution from their managers for disobeying this unwritten order. Focus has seen documentary evidence that Saanich IT division staff have been told not to talk with Atwell.

Siegal, who recently published Leaders in the Shadows: The Leadership Qualities of Chief Administrative Officers in Canada, observed, “If the mayor was trying to give staff direction about fixing a pothole or something that council hasn’t authorized, then the mayor is clearly overstepping his bounds. But if the mayor is wanting to talk to people, to staff, I don’t know very many CAOs who would intervene in something like that.”

Contacted for comment, Laidlaw told Focus, “District staff have not been told not to speak with the Mayor.”

Atwell, elected on a platform promising change at the District, appears to be sharing a similar experience to that of former Campbell River Mayor Walter Jakeway. Laidlaw was the city manager and Ciarniello was director of corporate services during Jakeway’s mayoral term.

Jakeway—a mechanical engineer with an MBA who had cut his teeth in the pulp and paper industry—had been elected in 2011 on a platform of change and keeping tax increases at zero percent. He wanted to reform the budgeting process and make good on other election promises early in his term. But a strained relationship soon developed between Jakeway and senior staff.

He remembers strong opposition from Laidlaw, his bureaucracy and incumbent councillors. “In a lot of ways, Andy was like the eighth member of council,” Jakeway said. “I did not have a positive relationship with either of them [Laidlaw and Ciarniello]… My idea was to make change happen… They did everything they could to try to block those ideas and gave me no options.”

Both Laidlaw and Ciarniello told Focus that they disagreed with Jakeway’s characterization. Ciarniello said, “I took direction from the CAO and council.” Laidlaw said, “As city manager, I work for ‘council.’  The direction followed is subject to the collective decision making process of council. The mayor often had different viewpoints than council.”

Jakeway said he believes that entrenched bureaucratic opposition exists across local governments to elected officials who try to upset the status quo. “There’s a bureaucratic code that at all costs you protect the bureaucracy, and when something goes wrong, hang onto that bureaucratic code…At all costs, protect the bureaucracy.”

FOLLOWING THE JANUARY 12 announcement by Saanich Police that the software had been installed as a security fix, Atwell complained to the Office of the Police Complaints Commissioner. On June 23, a brief statement from OPCC noted, “Based on the information we have received to date, we have determined Mayor Atwell’s complaints against members of the Saanich Police Department are inadmissible as they do not constitute misconduct as defined pursuant to the Police Act of British Columbia.”

That, of course, did not settle the matter of whether Atwell’s communications had been intentionally intercepted.

Saanich Police Chief Bob Downie rejected a criminal investigation on January 12 based on a legal opinion that Section 184 of the Criminal Code did not apply since “[The] software was put in place to protect from a computer breach from the outside or unauthorized access from within. It was not and is not being monitored and the information stored on the computer is only accessed by two persons, both of whom are managers in IT.”

 But Denham and IT experts have made clear Spector 360 is an employee monitoring tool, not a firewall, anti-virus program or external threat monitor. In fact, Saanich had to turn off some IT security measures for Spector 360 to work on the affected computers, and Denham said it may have made security less effective by creating a “honeypot” of passwords and other high-level information on the Spector 360 server.

Downie also ruled out a criminal investigation based on the premise that employees have no expectation of privacy at the workplace. Denham said the opposite is true.

Saanich Police Sgt. Steve Eassie confirmed the department is not reconsidering its previous conclusion, as there is no new information to evaluate. “Nothing has changed,” Eassie said. “The [Privacy] Commissioner did not assert any criminality.” A determination of criminality, however, has never been within the scope of the Privacy Commissioner’s authority.

The Province won’t be launching a public inquiry, either. Justice Minister Suzanne Anton’s deputy, Kurt J. W. Sandstrom, has told concerned Saanich residents that the issue is a matter of civic governance, so it won’t get involved. 

Neil Turley, one of several Saanich residents who wrote to Anton, said he believes the Saanich bureaucracy—and several councillors—just want the spyware scandal to go away. “Democracy at our municipal level seems to be broken. Laws were broken,” Turley said, “and the Privacy Commissioner’s report should have been enough red flags for consensus at the top and for council to come out and admit this is wrong. But instead, it just starts to rot. This issue is not going to go away until someone decides justice needs to be served.  Once we lose a bit of democracy, you just don’t get it back.”

David Broadland is the publisher of Focus Magazine. Daniel Palmer is the former editor of The Saanich News and is now a freelance writer.