On the first page of a four-page agreement signed by Hasty, the first bullet point in the scope and manner of services in the September 2016 agreement with RVC Data & Recovery states that services will include, “1. Remote backup of data (geographic separation)”.

It appears the Camden County Commission may or should have already known that the county’s data backup system was inadequate despite expressing surprise at the lack of off-site backup revealed in a meeting with Huber & Associates earlier this week.

On Monday, Presiding Commissioner Greg Hasty met with a Huber representative regarding the firm’s proposed contract for IT services, but the meeting turned into a discussion that the county had not been backing up sensitive network data and files to a secure off-site location.

Clayton Shepard with Huber explained that one of the county’s most important servers - used by the collector’s office for property tax bills - is currently being backed up on physical tapes that are stored in a fireproof safe in the basement of the administration building. The county’s other servers and data files are backed up on the actual hardware in the courthouse building.

Hasty claimed he didn’t know that that was what was occurring and expressed fear that this has left the county in another vulnerable position as it pertains to IT and records. The county saw a devastating shutdown of its computer network and internet systems in September 2016 after the FBI confiscated servers following an alleged security breach of sensitive information.

A contract between the county commission and a different IT provider, hired and fired within a two-month span last fall, shows that the commission should have been well aware of the need for an off-site backup system.

On the first page of a four-page agreement signed by Hasty, the first bullet point in the scope and manner of services in the September 2016 agreement with RVC Data & Recovery states that services will include, “1. Remote backup of data (geographic separation)”.

RVC was terminated by Hasty due to a dispute that arose between RVC, Huber and the commission over access to certain parts of the network system with sensitive data connected to the Missouri State Highway Patrol CJIS network, according to Reuben Chambers with RVC.

An invoice from Huber to the county verifies the confrontation between Chambers and a Huber worker. With Huber then assisting RVC with restoration of network systems following the shutdown, Chambers denied the other IT worker access to this part of the system without clearance from CJIS, despite the county commission telling Chambers to give the worker access.

RVC was terminated after less than two full months of service, and Huber’s role with the county for IT needs grew. Despite now having provided services through purchase orders signed by commissioners over the last seven months, an official agreement to outline a scope of service to ensure certain services, such as remote backup, was never approved by the commission.

Huber does not appear to have notified the county of the need for remote backup of data until now as it seeks a long-term contract for service.

Upon the Lake Sun’s request for such a contract with Huber, the county’s Sunshine Law attorney Matthew Growcock of Lowther Johnson confirmed no agreement existed between the commission and Huber. The lack of an agreement has also been verified verbally by Huber in its current proposal for a contract.

“Until we get this contract in place we are not backing up off-site from this building,” Shepard said during the meeting Monday. “Right now everything is being backed up in two places, in case something happened, but under the contract, that all changes and we would back up to our office.”

He did add that the backup work could be added to the county’s current billing, done on an hourly basis as needed.

Huber officially proposed a full-time, all-inclusive contract last week, but the commission wanted to seek a legal opinion from County Attorney Charles McElyea regarding the potential need to request qualifications from other IT firms and undergo a bidding process for IT services.

It was unclear whether or not guidelines to obtain qualifications and bids had to be applied to a professional service such as IT administration before signing a contract.