Governor M. Jodi Rell today announced that, at her direction, the CORE-CT Steering Committee met this afternoon to take several steps related to the loss of sensitive state information and to assist in the preparation of a lawsuit planned by the Office of the State Comptroller and the Attorney General.
A backup computer tape stolen in Ohio in June contained data removed by a consulting firm, Accenture, from the CORE-CT computer system, which performs the state’s payroll, personnel, purchasing, accounting, inventory and other functions. Accenture, the company that developed the CORE-CT system, was developing a similar government information system in Ohio.
On Sunday, a Department of Information Technology (DOIT) analysis found the tape contained virtually all state agency bank account numbers, bank names and types of accounts as well other highly sensitive information. Governor Rell ordered numerous security measures, including directing the Department of Administrative Services (DAS) and Office of Policy and Management (OPM) to check with all Executive Branch agencies to determine which of the accounts were still active, whether any had been improperly accessed and what steps were necessary to prevent fraud or misuse in the future.
DOIT, DAS and OPM, together with the Office of the State Comptroller, are the members of the CORE-CT Steering Committee. Governor Rell directed the Committee to:
Begin reckoning the costs of state actions taken to deal with the data loss and supply that information to the Attorney General
Modify the Accenture contract to prevent future problems
Implement administrative recommendations to improve CORE-CT from the Auditors of Public Accounts and the Gartner Group
“Like a citizen whose wallet has been stolen, our first priority had to be safeguarding the information that was missing – and that’s just what we have done,” Governor Rell said. “Now we need to start adding up the expenses we incurred in taking those actions and provide those figures to the Attorney General so that he can recover those costs from Accenture. The repercussions of this loss are still being tallied – and the final figure may not become clear for some time – but we already know that Connecticut has incurred considerable expenses to deal with the loss of this information.
“At the same time, we must ratchet up security to make sure this never happens again,” the Governor said. “That is why I directed the Steering Committee to make a number of changes to the contract with Accenture. First and foremost, the contract must be made iron-clad and absolute: No Connecticut data is to leave CORE-CT. Period. Secondly, Accenture must be required to answer the question that I put to them on Monday: What Connecticut data is still in its possession, and has it been used anywhere else?
“Finally, it is time to implement the administrative improvements to CORE-CT that were proposed by the Auditors of Public Accounts and by the Gartner Group,” Governor Rell said. “Although some of the changes will require legislative action, a great many of them do not. Our state has invested countless hours and some $125 million in this system and these improvements are needed if we are to get the most out of it.”
