State audit criticizes oversight of emergency computers

DENVER - State employees surfed dating, entertainment, restaurant and travel Web sites on the state's emergency operations computers, according to a state audit Monday.

However, the Department of Local Affairs (DOLA), which oversees the disaster center in Centennial, did not discipline any of the employees involved.

State lawmakers asked for the audit of the state's emergency operations center after a 9Wants to Know investigation last year revealed that workers in the (DOLA) planned to use the computers to buy Colorado Rockies baseball tickets for the World Series.

Another TV news report found the department was not closely monitoring who was using the computers or which Web sites they were visiting.

"You showed a serious lack of judgment and serious disregard for the purpose of the emergency operations center," said Rep. Frank McNulty (R-Castle Rock) to DOLA Director Susan Kirkpatrick, who initially told employees they could use the center to buy Rockies tickets. "This is a very special type of facility that is for a specific purpose."

"I apologize for any misunderstanding that I had in 2007 about the use of that computer facility," replied Kirkpatrick. "We did learn from the audit and I think we are now a better department."

The audit found that state employees and others who use the facility for training visited 341 questionable sites since 2004.

The audit also found that the department's control over Internet access and the use of the computers was "somewhat lax" in 2007. Since then, the department has been monitoring who uses the computers and which sites they visit.

Auditors did not find that any obvious pornographic Web sites were visited with the state's computers.

After the 9NEWS reports, the department installed Web filters on the computers, which block sites that involve alcohol, criminal activities, dating/social networking, drugs, gruesome content, hate/discrimination, instant messaging, nudity, pornography and violence. DOLA chose not to block gambling, entertainment, humor, shopping and travel Web sites.

Employees are now also asked to sign "acceptable use" agreements that say they are supposed to use the computers for ethical business purposes only.

The 30 computers inside the emergency operations center were installed in 2004 for $80,500. The computers are supposed to be used by local and other emergency management personnel for training or to help respond to disasters. The center was activated 40 days in the last two years for six emergencies, including the January 2007 blizzard, the Holly tornado in March 2007 and the Weld County tornados in May 2008.

The center +also provides a secure location for the governor during a disaster to assemble and analyze homeland security information.

The computers are not directly linked to any federal, state, department division or local databases that contain sensitive, confidential or critical information, according to auditors.

The center is used most often for training and meetings. Five other states also allow their emergency operations centers be used for non emergency purposes such as training. Those states are Arizona, Kansas, New Mexico, Utah and Washington.

The audit findings were presented before the legislative audit committee hearing on Monday morning.

Rep. Rosemary Marshall (D-Denver) said the motivation for the audit seemed political.

"I would just hope that the committee in the future doesn't move forward with audits that are clearly politically motivated," said Marshall.

The chairman of the legislative audit committee, Republican Rep. Jim Kerr, said politics had nothing to do with it.

"The problems with the emergency center happened more than once, it happened on more than one occasion," said Kerr about the reason he asked for the audit.