Westfield’s latest lawsuit against clerk-treasurer alleges she compromised city data

The city of Westfield is once again suing Clerk-Treasurer Cindy Gossard, this time for giving an outside information technology contractor unauthorized access to the city’s computers.

The city filed a complaint Tuesday in Hamilton Superior Court 2 alleging Gossard compromised the city’s data security by hiring an unidentified IT professional to access and download information from three city employees’ computers. Gossard told the Indianapolis Business Journal she hired the contractor, whose identity she would not reveal, to evaluate software on those computers that she suspected of containing spyware.

The court has set a hearing on the city’s motion for preliminary injunction for 2 p.m. on Friday, Aug. 27.

“There is a trust and obligation that the City of Westfield ensure the city’s systems are secure,” Westfield Mayor Andy Cook said in a written statement. “This trust should extend to the Clerk-Treasurer and she has failed. Any data downloaded needs to be identified and returned as soon as possible.”

The lawsuit marks the third litigious act involving Cook and Gossard in the past eight months. While Gossard calls the lawsuit “frivolous,” Cook said it’s a “necessary response” because the city doesn’t know what data was accessed or compromised.

The mayor launched an ongoing examination of the city’s finances last September after city councilors made allegations that a contractor at the Grand Park Sports Campus owed the city money. Those related lawsuits dealing with separation of powers and access to city information were dropped earlier this year, but the latest complaint continues the legal fight.

Gossard said she first started noticing cursors on the clerk’s office employee computers moving without explanation earlier this spring, as well as city administrators’ login credentials auto-populating in fields where they shouldn’t.

After notifying the city of her suspicions that spyware had been installed on the computer, Gossard learned that six licenses for BeyondTrust had been purchased and installed on computers throughout her department.

At a July 26 Westfield City Council meeting, Gossard called BeyondTrust spyware and announced that she’d forgone a list of city-approved vendors to retain her own forensic IT professional to investigate the matter.

The city’s lawsuit refers to Gossard’s claims that the software BeyondTrust is actually spyware as “The Ruse.” It goes on to say that BeyondTrust — or a previous version of it — has been used by the city for at least 10 years and Gossard has previously used the software herself.

Gossard denies that claim, saying an alternative software used prior to the purchase of six BeyondTrust licenses in November 2020 requested the computer operator’s permission before gaining access.

“If you look up BeyondTrust, which we did, the capabilities of this software is not just for the normal everyday,” Gossard said. “This BeyondTrust can access a computer without the end user knowing, it can start up a computer that’s off and it can do pretty much whatever it wants.”

A representative for Johns Creek, Georgia-based BeyondTrust did not immediately respond to requests for an interview, but Westfield Informatics Director Chris Larsen did say at the July 26 council meeting that BeyondTrust is not spyware.

Larsen said it is software installed on every city-owned machine that allows the city to take remote control of computer. Though it does not require user permission, the computer displays the fact that it is under an IT professional’s control and users can end the session at any time.

“The data she’s trying to protect is the data I’m trying to protect,” Larsen told the council.

According to the lawsuit, Gossard’s contractor was provided with login credentials and had access to the city’s computers from 5:40 p.m. on July 23, until 3:30 a.m. the following morning.

Though it’s unclear exactly what information was accessed, the city’s lawsuit states Gossard’s contractor could have accessed the city’s financial information, bank information, confidential vendor documents, confidential police data and employee personal information.

“My IT person did not access the network. He copied the hard drives, that was it,” Gossard said. “They’re saying he got in and he’s got everybody’s information. My IT guy, in no way shape or form, did he access the network.”

The suit calls Gossard’s conduct “willful, wanton and malicious,” and states that she took action “selfishly and recklessly to shift attention away from her gross incompetence.”

Now, the city is seeking damages and requesting Gossard and her unidentified contractor return its information.

“I just want to find out what’s happened, if anything. If nothing, fine. I just need to know. A lot of all this nonsense going on, it’s interfering with us doing our jobs,” Gossard said. “I’m an elected official as well. I do have authority to take care of my office. I believe this lawsuit is just trying to intimidate me.”

The case is City of Westfield v. Cindy Gossard, 29D02-2108-PL-005841.