Internal Memorandum

DATE: March 17, 2014

TO: Jan Homan, Deputy Chief Operations Officer-Bus
FROM:
SUBJECT:
Lisa Johnson, Assistant Director Field Operations \\ V\
Arleen Schilling, Acting Director Program Evaluation and u d i t ~ J
Investigation Findings-Richard P. Johnson, Employee# 09221
Background
On February 10, 2014 I was contacted by Chad Loeffler, Assistant Director of the Transit Control
Center (TCC) and informed that an employee, Richard Johnson, had used his Council granted access
to Driver and Vehicle Services(DVS) records,

Mr. Loeffler inquired about the possibility of having an analysis done of Mr. Johnson's work computer
hard drive. Mr. Loeffler stated that Dan Abelson, Associate General Counsel, was working with him
and Sergeant Troy Schmitz of the Metro Transit Police Department (MTPD) concerning the allegations.
Mr. Johnson was reported to have accessed over 7,000 DVS records. When searching for DVS
information the search can be by last name which may result in multiple individual's records appearing.
Within the DVS system driver license photos, including historical ones, can be accessed in addition to
name, address, height and weight. A lookup of a driver's license information may result in multiple
accesses on DVS reports. Under Federal law individuals who have had their information obtained
inappropriately may be awarded, monetary damages.
Methodology
To determine what information was viewed by Mr. Johnson and how the information was used the
following activities were performed:
Mr. Johnson was interviewed on March 12, 2014. Mr. Johnson was provided a Tennessen
Advisory which he signed. The following were present at the interview:
11
Deb Downing, TMSA Steward
11
Steve Jaegar, TMSA President
11
Ron Rollins, TMSA Attorney
Chad Loeffler, Assistant Director, Transit Control Center
Curt Olson, Assistant Manager, Transit Control Center
A forensic analysis was conducted on the computer hard drive that was identified as Mr.
Johnson's main workstation,
DVS usage records were reviewed for the time period of January 1, 2011 through May 24,
2013,
IP addresses were reviewed,
Investigatory interview notes were reviewed.
Meetings were held with TCC, MTPD and General Counsel staff.
Page- 1 METROPOLITAN
COUNCIL
Findings
PLEASE NOTE: These findings and conclusions may contain non-public private data
on Council employees. This report should not be disclosed to persons who do not
have a business reason to see or have the findings and conclusions. Questions about
the status of this report under the Minnesota Government Data Practices Act should
be directed to the appropriate "designee" identified in the Council's Data Access
Procedures.
1. Council Policy 4-6 requires all employees to abide by all laws and to
adhere to high professional standards. Council Policy 4y6-a, Code of Ethics
Procedure, prohibits employees from using data on individuals for personal
benefit and from providing access to others who are not authorized. Council
Policy 4-6-3d prohibits employees from using Council owned equipment for the
employee's private interest. Mr. Johnson utilized Council owned equipment and
DVS access rights to view private and confidential information for his personal
interest.
Mr. Johnson admitted that he looked up driver and car license information on the DVS
website for reasons of opportunity, boredom and curiosity.
He
stated that he had no malicious reason for doing so. He stated that he had not
downloaded any information or pictures from the DVS site. The forensic analysis of
his computer showed no evidence that any information had been downloaded.
Mr. Johnson said that he had been trained on the appropriate use of the DVS system
and that he had received emails from his supervisors that warned against the misuse
of the system. These emails were ones sent to all TCC staff. Mr. Johnson stated that
in his position he did not have a need to access the DVS system and that in May 2013
his access was removed.
Review of DVS access by Mr. Johnson found that from January 1, 2011 through Mary
24, 2013 he accessed 7,324 records. 1,017 of these records were license plate
records while the remaining 6,308 were drivers' license records. The majority of the
license plate lookups occurred while he was utilizing TCC IP locations. This would
indicate that these were planned lookups since he wouldn't be seeing random car
license plate numbers while working inside the TCC. When asked why he looked up
car license plate numbers he stated it was because he might have liked the car.
Mr. Johnson accessed the DVS system on 69 different days from IP addresses
outside of the Metropolitan Council. He admitted accessing the system from his
home. He said that he really doesn't know why he did it but he didn't mean any harm
by it. When asked who the people were whose data he was accessing from home
about half were relatives. There were five ex-girlfriends and three public figures that
he also accessed from home. He was unable to identify some of the people who's
data he accessed. He stated that he had not shared his log in information with anyone
else.
When reviewing the names of the people accessed by Mr. Johnson I looked at the
number of days accessed as opposed to the number of times accessed due to the
sheer volume of records. Mr. Johnson accessed the records of more than 100 Metro
Page - 2 I METROPOLITAN COUNCIL
Transit employees or their relatives as well as over 40 public figures or their relatives.
Many of the people accessed were relatives, neighbors or former friends. DVS
information on former girlfriends, their spouses or their friends was accessed on more
than 50 different days with some exceeding 100 different days.
2. Minnesota Government Data Practices Act provisions were violated by
Mr. Johnson.
Minnesota Statute 13.05,subd.4, provides the following: "Private or confidential
data on an individual shall not be collected, stored, used, or disseminated by
government entities for any purposes other than those stated to the individual at the
time of collection in accordance with section 13.04, except as provided in this
subdivision." Minnesota Statute 13.09 states "Any person who willfully violates the
provisions of this chapter [Minnesota Government Data Act] or any rules adopted
under this chapter is guilty of a misdemeanor. Willful violation of this chapter by any
public employee constitutes just cause for suspension without pay or dismissal of the
public employee." As stated in finding number one Mr. Johnson collected this data for
his personal interest and use in violation of the Minnesota Government Data Practices
Act.
Conclusion
Mr. Johnson abused his position as a Transit Control Center Supervisor and violated
the Minnesota Government Data Practices Act as well as Council policies and
procedures when he repeatedly viewed confidential and private information through
his access to the DVS website. He admits to repeatedly viewing, both at work and
from at home, individual Driver and Vehicle Service system information without having
a work related reason to do so. He violated the trust placed in him while fully
cognizant of and trained on appropriate use of the DVS system.
Disposition
Barring the emergence of new information, this concludes our investigation of this
matter. If I can be of further assistance, please let me know.
Cc: Pat Born, Regional Administrator
Brian Lamb, General Manager Metro Transit
Dan Abelson, Associate General Cout')sel
Sandy Blaesar, Labor Relations
Christy Bailley, Director Bus Operations
Chad Loeffler, Assistant Director Transit Control Center
Marcy Syman, Director Human Resources
Page- 3 I METROPOLITAN COUNCIL