By Mark Gutglueck
San Bernardino County Sheriff’s Department higher-ups and some informed governmental officials throughout the county are tense with anxiety and uncertainty over the degree to which the most closely guarded files the department keeps have been compromised.
There is no doubt that an entity or entities unknown hacked the department’s computer system. Unclear is whether the hackers were able to download the entirety of the data bases they linked to. Moreover, some mystery attends if, given the degree of sophistication those black hats needed to have been able to compromise the security systems which were defeated in the course of their break-in, they have reverse engineered, based on the data in their possession, the access protocol which is known by only a handful of department personnel and is needed to open the data fields hidden in parallel files which contain compromising information on hundreds of the San Bernardino County community’s most prominent citizens.
The department has authorized entering into a quarter million contract with a New York-based cybersecurity and data privacy firm to ascertain not only what information has been compromised but whether the hackers left behind any tell-tale electronic fingerprints that might allow the department or outside forensic investigators to determine who they are.
Nevertheless, the information in the possession of the hackers is so sensitive and so explosive that if they have already succeeded in unlocking it or can do so in the future, they will be in a position to ruin the public reputations of a cross section of county officialdom, blackmail the sheriff and his command staff as well as other high ranking county officials, including members of the board of supervisors and administrators, rendering themselves, if not invulnerable to, immune from prosecution or reprisal of any sort.The sheriff’s department’s dilemma is rooted in three distinct causes.
The first factor extends back at least to 1954, when Frank Bland was elected San Bernardino County Sheriff. Nineteen years previously, Bland had not yet eclipsed the age of majority and was thus still not old enough to legally purchase or consume alcohol when he began his distinguished law enforcement career in 1935 as a railroad policeman in his hometown of Needles. Two years later, he joined the Needles police department. He served two years with the U.S. Marines during World War II, culminating in his participation in the Alaska campaign.
Upon his discharge in 1943, Bland returned to Needles and its police department. Dedicated to his profession, he became Needles police chief in 1947. Along the way, he attended the FBI National Academy. Years later, Bland would recall, “J. Edgar Hoover emphasized the importance of the police maintaining a jacket [i.e., a file or dossier] on every prominent member of the community.”
After he was elected sheriff, Bland had his department employ the FBI’s tactics. In those days, information was compiled by the department’s clerical staff, which kept the department’s records on 3.5-inch by 5-inch cards. The lion’s share of the information recorded pertained to the department’s interaction with the county’s citizenry and, occasionally, those visiting or traveling locally. There was no set standard for the information being accumulated beyond that used by law enforcement agencies generally, a record of incidents, encounters and actions of the department’s deputies in their contact with public, statements taken from witnesses, victims or the suspected perpetrator, physical descriptions, references to evidence collected, culminating in the charges if an arrest were made and ultimately, a conviction and sentencing notation upon adjudication of the matter in court. Over time, the files would come to be augmented with information gleaned from the incident reports filed by deputies relating to responses to or investigations of crimes and any follow-up supplemental reports filed by their supervisors or detectives. There was some unevenness to the thoroughness of the information contained on the cards, which was generally a function of the thoroughness and writing skill of the deputy authoring the original report and the conscientiousness of that particular member of the sheriff’s clerical staff, at that time composed virtually entirely of women, typing up the cards.
When the subject of the records being kept extended to someone involved in the government, an elected official or elected official’s family member, a captain of local industry, a mover and shaker or anyone deemed to be of some social or community significance, the information was typed onto similarly sized red cards. Thus, the department’s dossiers on “prominent citizens” in keeping with Bland’s dictate based on his FBI training became known as “the red card file.”
The second factor in the current debacle stems from the department’s transition, which began in the 1970s, to a computerized record keeping system. There have been several generations or iterations of the data entry/storage/retrieval model that have led to the digitized format the department has in use at present, all of which were adaptions of preexisting means and methods used by other agencies or governmental entities operating using commercially available software. Predominantly, those models included the NCIC – the National Crime Information Center – that was put in place by the U.S. Justice Department and the FBI in 1967; JDIC – the Justice Data Interface Controller – developed by the Los Angeles County Sheriff’s Department to replace its teletype system and first put into use in 1977; and CLETS – the California Law Enforcement Telecommunications System – maintained by the California Department of Motor Vehicles in conjunction with the FBI and California Attorney General’s Office used by law enforcement and criminal justice agencies to access criminal histories, driving records, restraining orders, concealed weapons permits and other information. The San Bernardino County Sheriff’s Department dubbed its data base CNI – the Central Name Index, though in very short order a large number, indeed quite likely a majority, of the department’s deputies began referring to it as the “criminal name index.” The computer system was designed or provided with software adaptions and patches to make it compatible with NCIC, JDIC, CLETS and other law enforcement data bases.
During Bland’s last term in office, the department’s clerical staff, working individually through the more than 100,000 white and red cards by random alphabet letter began the task of transcribing – essentially retyping – their contents into the digitized files the department was keeping.
The sheriff’s department or at least some of its personnel engaged in some missteps in not only managing the system but utilizing it.
In the run-up to the 1982 race for sheriff, Bland, who was retiring that year after 28 years as sheriff, allowed the computers operating the Central Name Index to be used by his political machine in its effort to prepare electioneering material and mailing lists for county voters to support his handpicked successor in that electoral contest – his undersheriff, Floyd Tidwell – who was running against Charles Callahan, a dissident captain with the department. Tidwell convincingly defeated Callahan 98,728 votes to 59,592 or 62.36 percent to 37.64 percent.
The first page or pages contained within the Central Name Index contained the name of the individual profiled, together with available further identifiers such as birth date, address, drivers license number, social security number if available, aliases and the like. Below that, a column was generally left blank, to be filled with the penal code section for which the individual was arrested and parallel to the penal code section in the first column was another column for the date of the arrest or arrests. Reserved for the space immediately below the penal code section grounds for the arrest would follow a second penal code section reference to charges filed by prosecutors, if indeed the filing of charges was made, parallel to which was a column for the date the charges were filed. Further below that was another blank for the charge upon which the individual was convicted, with a parallel column for the date of conviction. While the penal code sections cited for the arrest, charges and conviction were often the same, in at least some cases they would differ, as the prosecutors would adjust their prosecutions as they believed facts and admissible evidence dictated. Sometimes, both convictions and guilty pleas would occasionally be entered which did not match precisely what was alleged by the prosecution, as adjustments in charges would sometimes be made during trial or plea negotiations. In those cases where there were acquittals, there would be no entry for conviction and no date in the corresponding column. Thus, a logical conclusion to be made by anyone examining the record kept for any individuals whose name and personal information appeared in the Central Name Index would be that, unless the column for convictions was filled with a penal code section or penal code sections and the corresponding side-by-side column had dates in it parallel to that charge or charges, the person in question had an arrest record but no criminal record, with one singular exception.
In creating the templates for the pages to be contained within the filing system, the system designers, noting that San Bernardino County had a larger than average number of registered sex offenders than most other counties in the state, inserted an already specified section of the penal code into the column for which each individual entered into the system had been arrested on. That penal code section was 290.2, which pertained to the requirement that all those convicted of a sexually-based crime register as sex offenders and each provide a blood sample to authorities. In this way, every person whose name and identifying information was entered into the San Bernardino County Sheriff’s Department’s Central Name Index was marked within that data base with the reference P.C. 290.2 B/S, whether they had a criminal history or not. The B/S designation stood for “blood sample.”
Those familiar with the Central Name Index, i.e., the deputies and other members of the department who routinely accessed it, were aware of the idiosyncratic feature of the system as pertained to the Penal Code Section 290.2 reference contained within the column for arrests, charges and convictions and that they should disregard it if it did not have an accompanying date straight across from it in the adjoining column. Unfortunately, however, those who were unfamiliar with the system – such as employees with other law enforcement agencies who had requested information on a suspect or subject or a court employee and/or attorney or even an employer or potential employer seeking background information on a candidate or applicant for hiring or promotion – were not conversant with the system. On many occasions, when a printout or an electronic reproduction of an individual’s file from the Central Name Index was conveyed to those outside the department, misinterpretations of the data were made, including conclusions that individuals who had never been involved in any sort of sexually-based crime, who had never been charged with any order of sexually-based crime and who had consequently never been convicted of any sexually-related crime were registered sex offenders. Similar aspersions were erroneously cast on virtually every individual whose personal information was contained in the Central Name Index when that data base was merged with other data bases kept by other agencies. Partially as a consequence of this manner in which the San Bernardino County Sheriff’s Department had mishandled its own record keeping such that on occasion gross misinformation damaging to a cross section of the county’s residents made its way into the public domain and to private parties, the State of California repealed Penal Code Section 290.2 in 1998.
Another problem with the Central Name Index, particularly in its initial configuration, consisted of the inexactness or lack of clarity with regard to some of the data that was entered into it. By entering a name, a cybernetic cross-referencing function would be performed, directing the computer user to whatever data was available on that individual or linked to that name. In this way, someone who was a victim of a crime or a bystander who was a witness to a crime or possible crime whose identity had been taken down in an incident report, might appear in the Central Name Index. The crime that occurred or was alleged or was suspected to have occurred would be identified by a penal code section number. Depending upon the conscientiousness of the responding and reporting deputy or detective and the conscientiousness of the clerical staff member making the data entry, victims and witnesses sometimes became indistinguishable from suspects or perpetrators within the departments data banks.
The third factor in the nightmare the San Bernardino County Sheriff’s Department currently faces as a consequence of the breach in the department’s digital security is the hacking phenomenon that had existed prior to Tim Berners-Lee’s 1991 introduction of a mutually interchangeable World Wide Web of Information which effectively mushroomed into the internet.
Hacking, the compromising of digital devices and networks through unauthorized access to an account, accounts or entire computer systems, is often but not necessarily always a malicious act and associated with illegal intent. Nevertheless, in virtually all cases hacking represents a technically illegal breach of privacy or ownership. Most acts of hacking entail some level of data theft by cyber criminals, the misuse of devices, including computers, smartphones, tablets, and networks or the application of those devices for purposes unintended by their owners. Hacking often involves the corruption of systems, the gathering of information on users, the theft of data and documents and the disruption of data-related or cyber activity. All users of computers or digital systems are vulnerable to hacking, including private individuals, companies or corporations and governmental entities.
Hackers can be lone rogue programmers, ones working in concert or either individuals or teams employed by individuals, corporations or governmental entities, all of whom embody a relatively high degree of skill in coding and modifying computer software and hardware systems. As technology intensifies and grows in sophistication, so too are the methods of stealthy digital attack leaping forward, allowing such break-ins to go unnoticed by cybersecurity software and information technology teams for a short time, a longer time or perhaps completely. Hacking techniques involve the creation and mixing and matching of attack vectors to simulate the access protocol of a legitimate network member or individual computer owner, by which the victim is often tricked into opening malicious attachments or links and freely giving up data.
At some point earlier this year, the San Bernardino County Sheriff’s Department’s computer system was hacked. On April 7, members of the department became aware of, the department stated on April 8, “a network disruption that affected a limited number of our systems. Upon discovering this incident, the county immediately secured the network and began working with our information technology staff and third-party forensic specialists to investigate. The county has referred the incident to partnering law enforcement agencies, including the Federal Bureau of Investigations and the Department of Homeland Security.”
At risk as a consequence of the compromising of the sheriff’s department data is the exposure of the department’s practice of accumulating, using both legal and illegal means, and retaining information pertaining to citizens, and the way in which it has not only secured that information but bifurcated it into separate classes, one of which can be, in compliance with legal and professional standards that apply to law enforcement agencies, disclosed, and a second one which is available to a very select group of the department’s members but kept hidden from everyone else, including the vast majority of the department’s sworn and nonsworn personnel, prosecutors, judges, other government officials and the public at large. That data, the modern equivalent of the contents of Frank Bland’s red card file, has rendered current Sheriff Shannon Dicus, his predecessors as sheriff and a select group of the department’s command echelon and the investigative and clerical staff who work with them as the most powerful political collective in San Bernardino County, capable by virtue of the information at its command of blackmailing, extorting or otherwise controlling the politicians and highest ranking officials running the county, its 22 cities and two incorporated towns.
The hazard to the department and by extension the potential liability to the county from the data compromise is so great that the department took the unprecedented step of informing an individual outside of its confines about its system. It was necessary to bring San Bernardino County Counsel Tom Bunton in on the department’s illegal information gathering operation to orchestrate both the investigative and information recovery effort in a way that will not result in a public exposure of the department’s information retention system. In response, Bunton took immediate action to limit the liability the department and therefore the county potentially have if those so targeted learn that the department’s retention and handling of both confidential and prejudicial information pertaining to them resulted, as a consequence of the hacking, in that data falling into the hands of a criminal enterprise that is now in a position to take advantage of its possession of that information.
The Sentinel has learned that Bunton, in cooperation with the sheriff’s department, arranged for Ankura Consulting Group, LLC of New York to carry out the forensic investigation into the data theft and for the Pittsburgh, Pennsylvania-based law firm of Cipriani & Werner to handle all legal issues that might grow out of the sheriff’s department and its investigators and Ankura’s investigators tracking down the hackers involved in the data theft. Consequently, anyone who suspects, or anyone who learns, that they were a subject or target of the sheriff’s department’s illegal investigative or information repositing program would need to pursue relief in the federal courts of the Southern District of New York or the Commercial Division of the state courts within the County of New York under the limitations of New York law if Ankura is named and either in federal court in New York or Pennsylvania or state court in Montgomery County, Pennsylvania under the limitations of Pennsylvania law if Cipriani & Werner are named. This would make any legal remedy pursued by a resident of San Bernardino County both complicated and expensive.
Whether the hacker or hackers in question have been able to fully access the data extracted from the sheriff’s department system is unknown. The hacker’s or hackers’ ability to do so would hinge on several considerations, including how quickly the department learned of the compromise and whether it was able to shut the system down before all of the data, including programming data, was retrieved, the relative security of the programming data and the sophistication or skill of the hackers, including their ability to analyze and defeat the system’s encryption, analyze keystroke entry into the system and reverse engineer the system’s access protocol.
The Sentinel’s appreciation of that access protocol is somewhat dated. Previously, all department personnel were privileged to access the system through the use of an identifier, which at one time involved the employee’s initials taken together with a badge number or employee number. Once in the system, that employee had access to the standard information drawn up on any individual cataloged by the department, consisting of name, and basic particulars, along with any applicable arrest, criminal charge and conviction records. Any further information augmentations relating to that individual, including the department’s interaction with him or her or investigations conducted or information extracted from a host of potential sources, would be contained on a separate electronic page or pages, which were hidden from view when the initial page was open. If there was additional data on a secondary page or tertiary or even quaternary pages, an icon or letter would exist somewhere on the first page. If the operator placed the computer cursor over the icon while simultaneously holding down the control and shift keys and another designated letter key while clicking the cursor, the hidden pages would populate on the screen. Any information not appropriately contained in a subject’s official file, any sensitive information, information obtained through informants or by means of illegal means such as warrantless searches or “blackbag” break-ins or telephone taps not authorized by a judge’s warrant would be reserved for the augmentation page or pages rather than the official record.
If the department received a request for an individual’s record of the type that it would typically comply with, such as another agency seeking information or a potential employer doing a background check, or if the department were complying with a subpoena for an individual’s CNI readout, the assignment on that retrieval would be given to an employee who did not have knowledge of the record augmentation protocol. That employee would then go to the Central Name Index, enter the sought-after individual’s name, and then print out the page that was immediately visible on the computer screen. If required, the employee would be able to sign an affidavit to the effect that what was being provided – a hard copy print of the page or a PDF – was, to the best of his or her knowledge and belief under the penalty of perjury, the full and complete record. Because that employee did not know the augmentation protocol and did not possess awareness that such existed, the affidavit was true, and no one involved would be any the wiser.
What changes have been made to the access protocol in recent years with subsequent improvements to the department’s data storage and retrieval system is unknown to the Sentinel.
Over the decades, there have been occasional revelations of the existence of the red card file or its modern digital equivalent and how the sheriff’s department has been able to employ the sequestered information at its disposal to achieve its institutional objectives.
From its inception in 1977, the City of Rancho Cucamonga has contracted with the San Bernardino County Sheriff’s Department for the provision of law enforcement service within its city limits. In 1986, Rancho Cucamonga, which had formerly used a system by which its city council members were entrusted with selecting or appointing the city’s mayor from among their own ranks for what were essentially two-year terms, changed to having its citizens directly elect their mayor. Dennis Stout was elected mayor in that year’s election and remained in that post for the next eight years, until he was elected district attorney in 1994. Stout, after a time in office as mayor, clashed with then-Sheriff Floyd Tidwell with regard to certain issues pertaining to law enforcement in the city, some of them superficial and relatively minor and others that were substantive. As a consequence, there was discussion of ending the city’s contract with the sheriff’s department and having the city form its own municipal police department. Movement toward that end lost a bit of steam when Tidwell opted out of running for reelection in the 1990 election, and the personality conflict between Stout and Tidwell no longer loomed as an issue, particularly since Tidwell’s successor, Dick Williams, was able to form a more cordial relationship with Stout.
Nevertheless, Rancho Cucamonga by that point had grown to become the third largest city in San Bernardino County population-wise and there was a substantial impetus afoot for it to transform into a full-service city. In 1989, Rancho Cucamonga had subsumed the Foothill Fire District to take control of its own fire department. Some in the community were calling for the city to next take over the Cucamonga County Water District and then concentrate on forming its own police department. After Stout left his post as mayor to become district attorney, he was succeeded by one of his city council colleagues, Bill Alexander, as mayor. Events would soon transpire that would help prevent the creation of the Rancho Cucamonga Municipal Police Department.
When sheriff’s deputies caught some of Rancho Cucamonga High School students with marijuana, they offered them a deal, pressuring them to tell them where they had bought the stuff, hoping to work their way up the ladder of criminality, and perhaps bust the drug dealer selling the flowering green poison to local youths. Among those arrested pot smokers were two who named Alexander’s son as the person from whom they had made their illicit purchases. The sheriff’s department’s vice narcotics unit sprung into action, and moved in on young Alexander, who, despite being caught red-handed with enough contraband to establish that he was “in possession of marijuana for sales,” as the terminology went, was not actually booked nor charged by the district attorney’s office, which received no report of the matter. Instead, that report went into the electronic red card file system.
To this day, Rancho Cucamonga, the county’s fourth largest city population-wise with 174,450 residents, continues to contract with the sheriff’s department for law enforcement services, indeed as the city with the highest value contract of its sort in the county, forking over $48,954,570 annually to the sheriff. Seven other county cities of lesser population and with smaller budgets – Chino, Montclair, Upland, Rialto, Colton, Redlands and Barstow – all have their own police departments.
It is known that the sheriff’s department has compromising information pertaining to scores of politicians, government officials, judges, prosecutors, attorneys, businessmen and influential entities in San Bernardino County. Some of that information has criminal implication and some of it does not. References to, accounts of, as well as documents, photos and both video and audio recordings related to bribetaking, making payoffs, conflicts of interest in which public officials have an interest in the official action they have taken, other criminal acts, drug use, adulterous entanglements, gambling debts, affiliations with undesirable individuals and entities, being present in places of dubious reputation and the involvement of public officials’ family members or business associates in criminal activity both prosecuted and unprosecuted make up the lion’s share of the information and materials contained in the files at the center of attention. In department parlance, that information represents “holdback,” i.e., information that provides the sheriff and his department with leverage deemed more important than whatever advantage or prestige might come to the department from pursuing criminal cases that might or might not arise out of the public airing of that information.
That the information, in a format that may or may not be fully accessible, has fallen into the hands of individuals who might be able to overcome whatever remaining technical barriers there are to accessing it and further decrypting it, at which point they could themselves bypass the sheriff’s department entirely to engage in blackmail of their own. This has given the sheriff and his command echelon as well as many of those prominent members of the community pause.
An irony is that the FBI, the very organization that instilled in Frank Bland the belief that it was part of his duty as a law enforcement officer and an element of the charter of the law enforcement agency he headed that dossiers on the most powerful and influential members of the community be kept, is involved in the effort to run to ground those who were responsible for commandeering the San Bernardino County Sheriff’s Department’s data. Unknown at this point is, if the FBI does succeed in recovering that data from those who diverted it, how close of an inspection of it the bureau will make and whether it will deem that data and its nature to be indicative of a multitude of crimes unto themselves.
By Mark Gutglueck