Lake City IT Director Quits - Tells City Manager: “Another attack would destroy my career, jeopardize the City and my family.”
Posted April 26, 2021 10:59 am | (1 comment) | Part I | go to Part II
Photo: Joshua Woroniecki via Unsplash | Columbia
County Observer graphic
LAKE CITY, COLUMBIA COUNTY, FL – With City worker morale at an all-time low, a budget crisis looming, and IT security at a premium, Lake City's IT Director Mandy Rand quit. She told the City Manager, “Before I came to Lake City, the City received nationwide attention when it was attacked by ransomware… another attack, while I was IT Director, would destroy my IT career and jeopardize the City and my family.”
Background: Lake City brought to its knees
Over the weekend of June 8, 2019, Lake City was hit by a virus-malware cyberattack that brought the City to its knees. To retrieve its computer systems and information, Lake City paid an almost $500,000 ransom. The ransom was paid, minus a $10k deductible, through the Florida League of Cities, the insurance carrier for the City.
Cyber Security is Expensive
On October 13, 2019, a memo to the City Council by City Manager Helfenberger recommended Corvid CyberDefense as the IT security which “can best serve the City of Lake City’s IT needs.”
Mr. Helfenberger requested an emergency approval of $319,688 (a three-year contract) from the Council, which it approved.
Corvid Cyberdefense is a “recommended solution by some of the most respected names in the industry.”
The attack brought nationwide attention. The City fired its IT director and went on a national search for a new IT Director. In the last quarter of 2019, thirty-nine applications were received. City Manager Joe Helfenberger refused to sit on the ranking committee, although it was reported to the Observer that he “sat in.”
While the City was searching for its new IT Director, Utility Director Paul Dyal supervised the department.
IT pro Mandy Rand being introduced to Lake City
on Feb. 3, 2020.
At the time of Ms. Rand’s application, she had 20 years of progressive IT experience and was doing the following at her employer: supervised 17 "direct reports" including field engineers, telecom engineers, procurement and security; supported 4,500 endpoints; managed 350 smartphones; managed the budget, assets, licenses, and user administration; and wrote IT policy.
Ms. Rand, who has two children in elementary school, was attracted to Florida by the warm weather. She told your reporter, “Maine is so beautiful and so cold.”
After careful review, Mandy Rand, formerly of Maine, was chosen to lead Lake City’s IT Department. She was introduced to the City Council and the public on February 3, 2020.
Ms. Rand took charge and went to work. It is a big job. Besides general City business, finance, growth management, HR, and other vital City departments, the City IT department is also responsible for public safety (police and fire).
City Manager Moves to put IT Under Utilities
IT Director Balks, City Manager Changes Mind
Since Ms. Rand has been the City IT Director, all security and computer upgrades proposed by Ms. Rand have been approved by the City Council. Computer upgrades are costly.
As with Fire and Police, Lake City IT has difficulty recruiting and maintaining personnel due to its low pay scale.
On Monday, April 18, City Manager Helfenberger told Ms. Rand that he wanted to put the IT Department under the supervision of Utility Director Paul Dyal.
According to Ms. Rand, she balked, telling City Manager Helfenberger that she didn’t see “eye to eye” on security things with Mr. Dyal. “Paul is more interested in convenience. I’m more interested in security,” she reportedly told Mr. Helfenberger.
Mr. Dyal told your reporter, "I have never spoken with Ms. Rand about security."
Ms. Rand was also worried about IT morale issues with the IT Department reporting to Mr. Dyal.
According to Ms. Rand, City Manager Helfenberger told her, “Let’s hold off for now.”
Ms. Rand said she did not know what the problems were, and she had been giving reports to City management.
City Manager Joe Helfenberger's email left a
bunch of folk wondering, especially the City's
IT director.
City Manager Helfenberger is known not to check his email, and it is unknown if he read any of her reports.
It is common knowledge Lake City will be having a brutal budget year. Ms. Rand said Mr. Helfenberger told her that the realignment was “for the budget,” telling her, “The budget’s really going to be hard this year.”
According to both Mr. Dyal and Mr. Helfenberger, IT is the only department being put under the direction of Utility Director Dyal.
According to Ms. Rand, Mr. Helfenberger was questioning the cost of the Corvid IT security, which he brought to the City Council in 2019.
Mr. Helfenberger asked, “How do we know they are really doing it?”
According to Ms. Rand, she said, “They are definitely doing it.”
Since Ms. Rand began as IT Director, the City’s IT has remained secure.
One Day Later, City Manager Flip-Flops: Changes Mind – Again
According to Ms. Rand and others, at about 2:30 pm, Tuesday, April 19, City Manager Helfenberger caught her in the hallway and asked her to come to his office. He told her he had changed his mind, and Utility Director Dyal would now oversee IT.
Your reporter asked if she commented.
Ms. Rand said, “I didn’t say anything. It was pointless.”
About an hour and fifteen minutes later, at 3:46 pm, City Manager Helfenberger sent out an email to all “City Officials and Staff.”
"As of April 21, 2021, Paul Dyal will oversee the Information Technology Department. This will facilitate improved coordination among city departments and enhance accountability.”
Ms. Rand said, "When I read the email, it looked like I was being let go."
Ms. Rand said she went to HR and HR said, “It was about the budget.”
Ms. Rand packed her personal belongings in a box, turned in her keys, and said “Adios” to Lake City.
The next day, April 21, 07:50 am, Ms. Rand sent the following email to City Clerk Audrey Skies:
It is with sadness that I am resigning effective immediately.
The city manager decided to have IT report to the executive director of utilities. I have had multiple interactions with him that indicate he does not value network security to the degree necessary to completely insure the City against attacks. IT reporting to him is going to put the City at risk. Before I came to Lake City, the City received nationwide attention when it was attacked by ransomware. I enjoyed working with the City and the community. However, another attack while I was IT Director would destroy my IT career, and jeopardize the City and my family.
Mandy Rand
Epilogue
Ms. Rand did not leave City security in the lurch. As she drove away from Lake City, she called City Risk Manager Steve Roberts, told him that she was gone, and Mr. Robert's arranged for the City's IT system to remain secure.
