Nassau County may have illegally declared a state of emergency for cybersecurity — a declaration that was not even known until revealed in a letter to a reporter by a county official.
Deputy County Attorney Gregory Kalnitsky confirmed the existence of a state of emergency in response to a request for more information on a cybersecurity contract approved by the county legislature's rules committee last December. The Herald as sought basic information about the agreement, including who the contract is with, and how much it will cost taxpayers.
"The county executive and Nassau County Legislature enacted a local state of emergency with respect to the county of Nassau's cybersecurity and information technology assets," Kalnitsky wrote in his letter, without providing further details.
State law generally requires a government body like a county legislature to announce the need of an executive session during a public meeting, provide a specific reason for such a session, and then hold a public vote on whether to allow such a session to take place.
While New York state laws are a bit broad on what can be discussed in executive session, they generally prohibit any action by formal vote that would spend public dollars.
A review of the December public meeting does include an announcement of executive session and a vote. All that was provided for its reason, however, was a control number for the cybersecurity contract the legislature was set to approve.
"It is a clear violation of the open meetings law to appropriate public funds in a closed-door private meeting, if that is what occurred," said Paul Wolf, president of the independent New York Coalition for Open Government.
"Any vote to spend taxpayer dollars — even in an emergency situation — should occur in public."
The contract came on the heels of a massive computer network hack in Suffolk County that shut down government services there temporarily, and is said to have cost taxpayers millions of dollars.
Nassau lawmakers voted unanimously to enter into executive session on Dec. 5 to discuss "E-137-22," which was listed in the agenda as a shared services agreement between the county's information and technology department and an unnamed vendor. After an hour of deliberation behind closed doors, the legislature reconvened without publicly discussing the contract, or anything else — including a state of emergency declaration.
But that declaration is exactly what lawmakers were deciding on in secret, according to one county source who declined to be identified because of the legal nature of executive sessions. No documents regarding a state of emergency were filed with the county clerk, according to the source, which is typically a required procedure.
Chris Boyle, spokesman for County Executive Bruce Blakeman, has not responded to requests for comment. County officials in the past said they would not reveal any details about its new cybersecurity plan — including the vendor's name or cost — over claims it would make the county vulnerable to attack.
Shoshanah Bewlay, executive director of New York’s Committee on Open Government — a state-sponsored watchdog on government transparency — said specific details of the contract, if made public, could provide hackers with information to mount a cyberattack. However, more broad details about the agreement — like cost — don't enjoy that level of shielding, and should be made available to public review under state law.
“While a portion of the contract may be exempt from disclosure for one or more statutory reasons, in my opinion, certain portions of the record should be made available,” said Bewlay, who can only operate in an advisory capacity, and cannot force Nassau County to comply.
Regarding the county’s Dec. 5 executive session, Bewlay agreed with Wolf that votes to spend public money must be made in public.
“The open meetings law makes it clear that you cannot vote to appropriate public money behind closed doors in executive session,” Bewlay said. “You can certainly discuss it. However, upon reaching agreement on the matter in the executive session, the board would have to come back on the record and vote to approve the contract in open session.”