Documents reveal the timeline behind failed administrator login attempts, vendor questions, and an Attorney General referral.
What began as questions over who controlled the county’s camera system eventually led to allegations requiring review by the Iowa Attorney General. The documents reveal not only what happened, but why county officials concluded an outside investigation was necessary.
Emails, text messages, Board resolutions, public statements and meeting discussions reviewed by The Madison Report reveal how Madison County officials responded after multiple failed administrator login attempts were discovered on the Annex Building’s security camera system.
The documents establish several facts that are not in dispute.
On June 19, 2026, multiple unsuccessful attempts were made to log into the Annex camera system using the vendor administrator account. No successful login occurred. According to Summit Technologies, the county’s authorized vendor, the associated video establishes only who entered the server room and when—not why they were there. Later, after weeks of internal discussion and unanswered questions, the Madison County Board of Supervisors asked the Iowa Attorney General’s Office to review the matter for possible investigation.
According to Summit Technologies, repeated unsuccessful attempts to access the system using the vendor administrator account constituted a cybersecurity event requiring preservation of audit logs and video evidence.
The documents also reveal disagreements over who had authority to administer the system, whether another vendor had been authorized to perform work, and how county officials communicated after the incident.
Board reaffirmed Summit in March
The events that ultimately led up to the June 19, 2026 failed login attempts can be traced back to April 24, 2025 when Head Custodian Chip See signed a five-year contract with Johnson Controls. According to Board Chair Heather Stancil, the Board of Supervisors was not aware of the agreement at the time.
Stancil said she first learned that Johnson Controls had replaced Summit Technologies as the vendor for the Annex after being contacted by Summit owner Travis Daniels on March 2, 2026. She said she subsequently requested documentation from Auditor Michele Brant and was provided a copy of the signed agreement later that week.
On March 10, 2026 the Board of Supervisors unanimously adopted a resolution reaffirming Summit Technologies as the authorized vendor for the Annex and EMS camera systems after learning that services had been redirected to Johnson Controls without Board approval. The resolution also states that “no county department, elected officer, or employee shall substitute, contract or make changes with security vendors for such services or systems without prior approval of the
Board of Supervisors.”
That resolution became a recurring point of discussion throughout the subsequent investigation.
The Madison Report published an opinion piece on the contract issue in April.
June 9 Call to Summit
According to Travis Daniels of Summit Technologies, the authorized vendor for the Annex and EMS camera server, Sheriff Jason Barnes contacted him on June 9 requesting assistance with the camera system.
Daniels told the Board that the request reinforced Summit’s understanding that it remained the county’s authorized vendor. (View the July 14 Board meeting where Daniels speaks.)
“If Summit wasn’t the authorized vendor, why would he call us for service?” Daniels asked during public comment on July 14.
Barnes told The Madison Report that he contacted Summit because owner Travis Daniels was familiar with the system and was able to quickly answer his question. Barnes added that he learned after June 9 that Summit did not have a county maintenance contract and he believed that Summit’s responsibility was limited to warranty coverage.
Daniels said Summit’s audit determined that multiple unsuccessful attempts had been made to log into the vendor administrator account on June 19.
“The audit logs showed the attempted administrator logins had failed,” Daniels said. “There was no successful breach of the system.”
He added that the associated video established only a timestamp and the individuals present and “does not establish intent.”
Daniels said Summit preserved both the audit logs and video evidence and provided that information to the county.
Camera Server: Different Types of Access
One of the central issues throughout the controversy has been confusion over different types of access to the camera system.
During the Board’s July 14 meeting, Daniels explained that Sheriff Jason Barnes and County Attorney Stephen Swanson were issued advanced viewer accounts in 2025 at the direction of the Board.
Those accounts allow users to remotely view and export video but do not permit changes to camera settings, recording schedules, passwords, users, or other system configuration.
Those functions require administrator-level access.
Daniels explained that Summit retained the vendor administrator account because someone must always have administrative authority over the system, particularly when county personnel change.
He also said Summit discovered during a February firmware update that its vendor administrator password no longer worked and that a new administrator account labeled “MC Admin” had been created.
According to Daniels, transferring administrator control to another vendor normally requires documentation and a password reset coordinated through the camera manufacturer, Digital Watchdog.
Internal Emails Show Communication Breakdown
Internal county emails show that on July 2, after being notified by Summit Technologies that the Annex camera system had recorded ten failed administrator login attempts on June 19, Board Chair Heather Stancil alerted County Attorney Stephen Swanson, Sheriff Jason Barnes and Auditor Michele Brant and asked whether they knew what could have caused the login attempts.
The initial responses focused on other issues rather than directly answering the question. Instead, Brant questioned why Summit Technologies owner Travis Daniels had accessed the server, while County Attorney Stephen Swanson asked why camera-system issues were being reported to the Board Chair. Later that evening, Swanson said he could “check into it on Monday.”
When no explanation had been provided several days later, Stancil again requested an update and asked whether any investigation had identified the cause of the failed login attempts. Swanson replied that he did not know what had happened because the incident had not been reported to him or the Sheriff’s Office.
As the Board prepared to discuss the matter, Stancil invited both Barnes and Swanson to attend a special meeting or provide an update. Barnes declined to attend and later advised that he would defer to the County Attorney regarding any information that should be released. Part 2 will go into those email exchanges in more detail.
The email exchanges ultimately led to the Board’s July 9 special meeting, where supervisors voted to seek an independent review by the Iowa Attorney General. The Madison Report video recorded and summarized that meeting in our article here.
What the Attorney General Referral Reveals
On July 15, the Board’s outside counsel, Michael Boal, sent a referral letter to the Iowa Attorney General and Division of Criminal Investigation formally requesting an outside investigation. The referral letter also explains why Summit Technologies was asked to review the Annex camera system in the first place.
The referral states that during a June 4 closed session of the Board of Supervisors, Supervisor Diane Fitch was discovered attempting to audio record the confidential meeting using a concealed recording device. After leaving the meeting, Fitch disclosed confidential information from the closed session to third parties, including Auditor Brant.
Concerned that additional recording devices might have been placed in the Board’s meeting room, Supervisor Stancil contacted Summit Technologies, the county’s authorized vendor for the Annex camera system, to determine whether the camera system might provide information about what had occurred and whether anyone had attempted to view or listen to the closed session remotely. During that review, Summit discovered the June 19 failed administrator login attempts that ultimately became the focus of the Board’s investigation.
The referral further states that the Board sought an independent review because questions surrounding the June 19 incident remained unresolved and because it believed the County Attorney’s Office and Sheriff’s Office were not appropriate entities to investigate a matter involving officials from those offices. It also states that the Board “unequivocally” made no prejudgment regarding the outcome of any investigation.
Sheriff Barnes Responds
In a series of text messages with The Madison Report over several days, Sheriff Jason Barnes disputed suggestions that he or others had attempted to improperly access the Annex camera system.
Barnes told us on July 13: “During the week of June 8th, the Madison County Auditor contacted me and explained we needed to update our passwords to our camera system after she was contacted by the Secretary of State’s Cybersecurity team. I was told that they were able to crack our current password. So it was decided we’d update both passwords.”
Barnes said he was later informed the password change would occur on June 19 and that he was told he needed to be present “as another set of eyes.”
Barnes made it clear that there was “absolutely no intent to change settings, delete files, activate audio or anything like that.” He said that county officials had only discovered on June 19 that the password had been changed without their knowledge.
On July 15 Barnes told The Madison Report he had since been informed the password-change request may actually have originated with the Iowa State Association of Counties (ISAC), not the Secretary of State. He added that Brant could better answer questions about who specifically requested the password changes and what communications the county had received.
Documents obtained by The Madison Report through an open records request offer a different account of who initiated the password-change request. In a July 14 email to Stancil, Brant wrote, “I do not know anything about the Secretary of State…I hope you are not taking this information from Facebook. That would be ridiculous.”
Barnes also acknowledged shortcomings in the county’s communication. “You hit it on the head in an earlier comment,” he wrote. “We do need to work on communicating better. Most of our issues are self-inflicted.”
Questions Remain
The Madison Report asked Brant to identify who had contacted her to request the password changes. Brant replied that there was “much misinformation” but said she would not provide statements concerning the matter.
An open records request was also submitted seeking any emails or other communications regarding the password-change request. Brant cited Iowa Code section 22.7(50), the exemption covering certain cybersecurity records, as the basis for withholding the communications.
County Attorney Stephen Swanson was also asked to comment regarding the June 19 incident and related questions. No response was received before publication.
While the documents answer many questions about how the June 19 incident unfolded, others remain unresolved, including who specifically requested the county’s password changes, how another vendor obtained administrator control of the Annex camera system, and the circumstances surrounding the unsuccessful administrator login attempts. Those questions ultimately prompted the Board to seek an independent review by the Iowa Attorney General.
To see a list of all documents and videos referenced in this article in one place, check out our new Document Library.
Coming next in Part 2: Internal emails show how county officials discussed the June 19 incident in the days before the Board referred the matter to the Iowa Attorney General and why supervisors concluded an outside investigation was necessary.
