Harmon: Please Get Your House In Order

This will seem silly to some, confusing to others, infuriating to a few. I don’t care. Read it anyway. Spare me your emails about editing – this is a brain dump.

State Auditor of Public Accounts Mike Harmon offers what he calls a “SAFE-House” “secure” reporting system (SAFE, according to the site, stands for Secure, Anonymous, File-Encrypted.) on his website:


HARMON SITE


SITE DETAIL

Unfortunately, it’s not remotely secure.

It’s not safe for whistleblowers.

It’s not safe for anyone communicating with the APA.

His staff is lying to him about its security and about their dedication to both security and privacy.

I’ve tested the form throughout the past several months – most recently today – in order to keep an eye on its alleged security. Turns out, depending upon the day it’s accessed — because it apparently varies (!) — his “secure” form is less secure than holding a press conference to spill the beans. It’s alarmingly transparent. I didn’t have to put in much effort to determine what was going on.

At various times, the form serves JavaScript from an HTTP connection (not even HTTPS at times, which doesn’t offer THAT much in terms of anonymity and security but would be theoretically better than HTTP) and his staff have implemented Google Analytics code ON THEIR SECURE FORMS. That means they’re tracking your IP addresses, browsing data, all kinds of other information, sharing it with Google and potentially putting you at risk for code-injection by merely using a train wreck of a form that they claim is secure.

This means you can easily be identified. Your identifying data could potentially be subject to open records requests. Your supervisor or boss could hunt you down without much effort. Even if withheld from open records requests (that’s to be debated and could be fought because I’ve done it in the past), your data would be instantly exposed to any number of people working within state government – from Harmon’s staff to the Office of the Attorney General when deciding open records appeals. It’s a legitimate risk if you wish to protect your privacy or want to safely blow the whistle on corruption. Those staff may mean well but that means nothing in practice.

I’ve tried for months to get the APA to make changes. There’s apparently no desire to improve. Not even when it comes to security, which would come at minimal expense.

Until Harmon decides to use SecureDrop or PGP/GPG encryption (at a minimum) with more secure email addresses and explicit instructions for minimizing risk, you should not trust his claimed ability to receive confidential information. Neither he nor his staff have any idea what they’re talking about. (Pro-tip: If you don’t know what Tails is or are confused about Tor? If you’ve never heard of PGP and don’t know what an SSL certificate is? You have no idea what you’re talking about. Not to mention your confusion over Google Analytics tracking, SQL injection, .asp security and JavaScript safety.)

For the past week, I’ve attempted to pass confidential information to Harmon’s staff via his Communications Director, Michael Goins, and twice explained the importance of data security. Primarily because I have a strong desire to protect my sources from retaliation. So what’d he do? Despite knowing the risk involved (he follows me on Twitter, I’ve tweeted at him repeatedly about it the past year), he directed me to use their insecure contact form or their insecure hotline. He offered no alternative, shirking his duty and longstanding position in Frankfort. Then he ran his mouth to others, disclosing both my name and the issue I’d attempted to discuss with him. Had it been the source, he would have caused them harm. Not exactly behavior deserving respect from the media or public.

That’s the kind of intellectual laziness that resulted in Tim Longmeyer, Tim Conley, Richie Farmer and Sylvia Lovely. In each of those cases, it took someone going to federal government folks to nudge action. Because state government officials were exhibiting the same disregard and sloppiness as Goins. Yes, it’s really that simple in many cases. Yes, it’s important to name names and call this junk out when it comes to state government. Incompetence is no longer an acceptable excuse.

Another staffer (withholding their name for dramatic effect, otherwise people wouldn’t return to the site at a later date. Love it or hate it, you’ll have to have some patience), upon having a brief conversation with me, rushed to speak with former colleagues (colleages. plural.) about that conversation with me. Had I not exercised discretion, that would have turned into a typical Frankfort flustercuck.

Harmon’s Executive Director, Sara Beth Gregory, is the only person who didn’t turn a blind eye. She made an effort to accept information in a more secure manner and that’s saying a lot. Unfortunately, I’d already passed information to someone physically at that point. Gregory had a reputation for protecting people when she served in the state legislature and that’s, for whatever reason (this is Frankfort! A rarity), carried over to her work at the APA. Out of several APA staffers in positions of leadership, Gregory was the only one behaving without overt recklessness. Let that sink in.

Mind you, I’m not just some homo hillbilly off the street. Not an unknown entity. The previous Auditor and some of his staff ignorantly tried to blame me for getting Harmon elected (remember when Harmon’s campaign advertised here? they were upset over that – as if it mattered). Harmon’s staff all follow me and have communicated with me for the better part of a decade in their various capacities. I’ve provided information to some of them in the past that has led to prosecution, conviction, legislative change, termination. My point is that they know me and have had positive experiences receiving trustworthy information from me for several years.

As I’ve transitioned from writing and reporting the last couple years, it’s become increasingly common for me to facilitate contact with trustworthy people in government when sources make such a request. Usually when I feel it would be unethical for me to report or too risky for a source for me to report. But particularly when something no one else in regional media can reasonably handle reporting. It’s worked quite well.

But… If *I* can’t get data to them securely?

You absolutely cannot and you should not trust Harmon’s staff until something changes.

Mike Harmon means well. I know that is 100% the case. I detest his personal politics but still know that to be demonstrably true. The actions and lack of attention to detail from his staff, however, would lead the average observer to believe they’re incompetent. It leads someone like me to believe they’re not only incompetent but intensely partisan with no real desire to stop the good old boy corruption running rampant in the Commonwealth of Kentucky.

That has to abruptly change if there’s to be any cleanup in Frankfort.

-Jake

With Kentucky’s White Privilege Beams On High, Adam Edelen Stepped In It On Race in America

How Not to Save the Kentucky Democratic Party, Privileged White Guy Edition.

Ugh:





When a prominent civil rights attorney can point out just how detached you are in a single tweet, well…

I can’t even.

This is like telling a black person that you know best how to relieve their suffering. It’s like telling someone of a different race or ethnicity to sit down and be quiet because they’re making you uncomfortable. It’s like telling a person of color that they sound articulate.

It’s telling someone who is in pain that they need to stop talking, that they need to shut up, that they need to be polite. Big, tough, straight, white man knows best.

This is like telling a gay person they’re out-of-line for daring suggest that heterosexual microaggressions are harmful and dangerous. It’s like telling a gay person they need to be patient in demanding equal treatment under the law.

It’s like telling a transgender individual that their plight is fair game for bigoted political fodder.

Calling a black man a “horse’s ass” because he upset your delicate feelings on racial discrimination? That’s racist as fuck. Were you drunk out of your mind??? Or were you just showing your true colors? Unbelievable.

Wanna rebuild the Kentucky Democratic Party? Shut the fuck up, Adam Edelen, and stop alienating the people you need to help you. Seriously. Just stop talking. Maybe start consulting people who will tell you when to keep your mouth shut. You may care about racial division in the U.S. but you just pulled a Donald Trump in putting your foot in your mouth.

Yes, it’s white privilege that allows me to foam at the mouth about this without being shot. But don’t you think for a second that being gay is in any way helpful in terms of safety and security in the Commonwealth of Kentucky.

What The Heck, Magoffin County???

The Magoffin County Fiscal Court is a disaster.

Want a taste?

Here are the most recent audits from Frankfort:

Click here (Warning: External PDF Link) for 2013.

Some highlights:

  • These jackasses blamed the March 2012 tornado on their shenanigans
  • The county treasurer did not monitor disbursements which caused total budgeted appropriations to be over spent.
  • The fiscal court did not amend the county’s budget for unanticipated receipts.
  • The county treasurer did not present an annual settlement to the fiscal court within the time period required by state law.
  • The county treasurer did not monitor fund cash balances which caused the 911 Fund to have a negative balance.
  • The county did not maintain capital asset schedules in accordance with regulatory requirements.
  • The county’s administrative code does not address commuting mileage or the personal use of a county vehicle.
  • The fiscal court did not prepare a Schedule of Expenditures of Federal Awards.
  • The fiscal court lacks adequate segregation of duties over payroll.
  • The fiscal court does not have adequate controls over gravel inventory.
  • The fiscal court did not follow proper procedures for timesheets.
  • The fiscal court does not have adequate controls over health reimbursement accounts and flexible spending accounts.
  • County did not update insurance policies for capital asset changes.
  • The fiscal court does not have adequate controls over notes receivable.

Click here (Warning: External PDF Link) for 2014.

Highlights:

  • The county did not maintain capital asset schedules in accordance with regulatory requirements.
  • The county treasurer did not present an annual settlement to the fiscal court within the time period required by state law.
  • The county treasurer did not monitor bank account cash balances which caused the road fund bank account to have a negative balance.
  • The county’s administrative code does not address commuting mileage or the personal use of a county vehicle.
  • The fiscal court did not prepare a schedule of expenditures of federal awards.
  • The fiscal court did not have insurance on a 2013 Mack truck that could not be found during a physical inventory test.
  • The fiscal court lacks adequate segregation of duties over payroll.
  • The fiscal court does not have adequate internal controls over gravel inventory.
  • The fiscal court does not have adequate controls over health reimbursement accounts and flexible spending accounts.
  • The fiscal court does not have adequate controls over notes receivable.

This is why Eastern Kentucky can’t have nice things.

UPDATE

Bill Estep at the H-L is now covering the $35,000 missing truck.

Yesterday Was A Flustercuck For Kentucky

Tim Longmeyer, a former secretary of the state Personnel Cabinet under former Gov. Steve Beshear, pleaded guilty in federal court Tuesday to bribery. [H-L]

If you run a business, are employed by one, care about the stability of the financial system, or would prefer that the U.S. economy not be needlessly thrown into disarray — a group that seems like a pretty broad coalition of voters — Cruz’s economic policy is not OK. [HuffPo]

The Independent Pilots Association, the collective bargaining unit for UPS pilots, is turning up the heat on the shipping giant by opening a strike operations center in Louisville. [C-J/AKN]

Pope Francis says a brief meeting with Democratic presidential candidate Bernie Sanders just “good manners” and not political interference. [BBC]

Five hours after the Ashland Police Department posted a Facebook status about a recent spike in theft and burglary, officers were on the hunt for a robber downtown. [Ashland Independent]

Mitch McConnell is “increasingly optimistic that there actually may be a second ballot” at the Republican National Convention in Cleveland this summer, the Senate majority leader told a Kentucky ABC affiliate over the weekend. [Politico]

People in rural areas of Appalachia are more likely to die early deaths than in other parts of the country. A big reason, researchers say, is that people in places such as Leslie County, Kentucky, or Boone County, West Virginia – both part of coalfield regions – die from drug overdoses at greater rates than the rest of the country. [Glasgow Daily Times]

If you’re a gay person surprised by the reality that most Republicans, and many Democrats, are ignoring you or politicizing you? You’re screwed up. [ThinkProgress]

Fried mushrooms, mushroom soup, mushroom hunting, and a Fungus 5K, will be just a few of the mushroom-themed items and activities sporing downtown at the City of Irvine’s 26th annual Mountain Mushroom Festival. [Richmond Register]

The Associated Press won the Pulitzer Prize for public service for reporting on abuse in the seafood industry that helped free 2,000 slave laborers, and Reuters and The New York Times shared the breaking news photography award for images of the European refugee crisis. [Reuters]

A Morehead woman was shot by accident by her son on Wednesday. [The Morehead News]

The Obama administration has made a concerted effort to improve its relationship with Mexico following Donald Trump’s call for a massive border wall and his criticism of undocumented immigrants in the United States. [The Hill]

They cover this sort of crap but ignore Montgomery County. Clark County Superintendent Paul Christy, and George Rogers Clark High School baseball coach Matt Ginter and principal David Bolen all have to take three hours of training from the Kentucky Department of Education on accounting procedures for school activity funds, according to a final report from the Kentucky Office of Education Accountability dated March 30. [H-L]

An eight-member Supreme Court appeared skeptical on Monday that President Barack Obama’s decision to defer deportation for millions of undocumented immigrants could be subject to a multi-state legal challenge in a court of law. [HuffPo]

Solve This Nightmare In My Hometown

This is about a childhood friend of mine, Jon.

From The Morehead News:

Morehead police and the Rowan County coroner are on the hunt for a man who left another for dead.

Coroner John Northcutt said at about 5 a.m. Sunday, a black sport utility vehicle arrived at St. Claire Regional Medical Center with an unresponsive male in the back.

“Two nurses were outside the emergency department area and witnessed a gentleman exit the vehicle he was driving,” said Northcutt. “The man then made a brief statement to the nurses and left immediately, leaving the vehicle.”

Northcutt said that’s when the nurses found Jonathan Lykins, 34, of West Liberty, in the back of the SUV.

“When he was found not breathing,” Northcutt said. “Emergency personnel tried to resuscitate him, but were unsuccessful in doing so.”

-SNIP-

Lykins’ body was taken to Frankfort to be autopsied by the Kentucky Medical Examiner’s Office.

Anyone with information on the operator of the vehicle is asked to Northcutt through MPD Dispatch at 784-8824 or Salley at 784-7511.

Jon, like many back home, got caught up in the world of addiction. But that doesn’t make his life any less valuable than yours or mine.

If you know who left him, contact the police, tell someone, spill the beans.

This horrific drug nightmare in Eastern Kentucky has gotta come to an end.

Will it be over in my lifetime? Is that a silly hope?

And when will agencies in EKY start distributing Narcan? It’s already saving lives in Louisville.

HEAD-DESK.

If anyone wants to help me focus more on digging in to the mess in Eastern Kentucky, please consider throwing your support this way. The cityfolk are too busy worrying about Bernie Sanders and fair trade coffee to care about what’s going on in the foothills.