The Madison County Board of Supervisors held a special meeting on July 9 to discuss a cybersecurity concern involving the county’s security camera system.
The meeting was scheduled as a possible closed session; however, Chair Heather Stancil stated that after receiving additional information she believed discussing the matter in open session would better avoid potential Open Meetings Law concerns.
Stancil said the issue stemmed from ten failed attempts to access the vendor administrator account for the county’s security camera system. She told the Board that security footage showed County Attorney Stephen Swanson, Sheriff Jason Barnes, and what she described as “the unauthorized vendor that we removed in March” accessing the server room. According to Stancil, only the Board should authorize changes to the camera system.
Stancil also explained that vendor administrator access goes beyond simply viewing security footage. She stated that a vendor administrator can add or remove users, change passwords, delete footage, activate microphones in the meeting room, and access audit trails. She said those capabilities were especially concerning because of a prior closed session involving legal counsel, adding that she wanted to ensure those who had been conflicted out of the meeting could not access or share information from it.
Stancil told the Board she had contacted both County Attorney Stephen Swanson and Sheriff Jason Barnes after learning of the failed login attempts. She said she reached out the previous week but had “never received a response from the sheriff,” adding that the county attorney’s response “was less than professional.” Supervisor Jessica Hobbs noted that Barnes had responded the previous day. Stancil acknowledged receiving the response but said it only indicated Barnes would not attend the meeting and directed her to the county attorney. She said neither Barnes nor Swanson had provided an explanation for the attempted access. Before making her motion, Hobbs said there had been ample opportunities for Swanson and Barnes to explain what had occurred, adding that “40 emails went around about this matter.”
After discussion, Supervisor Jessica Hobbs moved to refer the matter to the Iowa Attorney General’s Office and the Iowa Division of Criminal Investigation for an independent review. The motion passed 2-1, with Stancil and Hobbs voting in favor and Diane Fitch opposed. Fitch said she preferred to address the matter internally.
The Board also discussed strengthening its camera system access policy. This included clarifying who may authorize vendor access and improving documentation of future access to the system. Hobbs then moved to update the camera access policy, and the motion passed unanimously.
The Board also agreed to place a broader cybersecurity policy on a future agenda for additional discussion.
Finally, the Board voted to direct legal counsel to prepare documentation to cancel the existing service agreement with Johnson Controls and request a refund. That motion also passed 2-1, with Fitch voting nay.
