Last month’s paralyzing shutdown of the Secretary of State’s computer systems and web site has state lawmakers asking how to make New Mexico’s constitutional offices subject to the same IT rules most other state agencies comply with.
“We’ve got to address it,” said Rep. Janice Arnold Jones, R-Albuquerque.
But the state’s IT chief, Marlin Mackey — who has authority over how most state agencies manage information technology — doesn’t have such control over the state’s constitutional offices, Mackey said.
Unlike other state agencies, the state’s constitutional offices – the Secretary of State, the state Land Commissioner, Attorney General, State Auditor and State Treasurer — “can call their own shots” regarding IT practices, Mackey said recently.
Mackey can require that state agencies use properly backed-up database information, qualified IT managers and databases safe from security breaches. If he runs into resistance, “we can meet with governor’s office,” Mackey said. “Usually after that, people fall in line.”
But he can only hope for a willingness to comply from constitutional officers.
Mackey’s authority gap exploded into view last month when the public was unable to access the Secretary of State’s website for several days. The public was unable to use the many services the agency offers, from accessing campaign and lobbyist information to registering trademarks and other dealings between businesses and state government.
An evaluation put together since then by the Legislative Finance Committee found that the Secretary of State’s office lacked both the technical capability to manage information technology projects and a “viable disaster recovery” plan for its “mission critical” systems.
But extending Mackey’s authority to constitutional offices could be a dicey proposition, state lawmakers say. The executive agency may not be able to tell constitutionally elected officer holders what to do.
Arnold Jones’ proposed solution is to use the Legislature’s power over the state’s purse strings to demand compliance.
“We can as a body say if you want us to give you money you will comply with IT rules,” said Arnold Jones, who is ready to propose legislation saying as much.
“The only power that we can exert over these offices is the power of the budget. You hate to be that awful. But that’s a constitutional office. That’s the only power we have.”
The chairman of the Legislative Finance Committee, Rep. Luciano “Lucky” Varela, D-Santa Fe, stops short of talking about authoring new legislation. But he is similarly determined to see the Secretary of State’s office improve its handling of IT matters and has said publicly that he’s ready to withhold money if he doesn’t see the improvement.
“I told them we’d be very stingy about providing extra dollars unless we saw indications of strong oversight, good planning,” Varela said.
‘Project is nowhere near completion’
The gap in authority is best illustrated by the process state agencies use to earn certification to proceed with IT projects.
Executive-branch agencies generally must submit their plans before work begins, Mackey said. If they pass muster, the committee charged with certifying state IT projects frees up money to pay for it.
But even here constitutional offices have some leeway, compared to executive branch agencies. The constitutional offices have their own budgets and can start funding an IT project if it wants, as occurred at the Secretary of State’s office.
The agency had already begun work on a new campaign finance reporting system when it went before the certification committee, Mackey said.
“As part of that review, we asked when was the last time you have had an external security assessment,” Mackey said.
“It was more than a couple of years. We advised them it would be a good idea. If there were any holes they could close those off before they go live.”
The agency contracted with a firm affiliated with New Mexico Tech to perform the security test. While doing that, questions arose how much work had been completed on the campaign finance reporting system, officials have said.
The system had been constructed by an in-house developer and agency employee and originally had been scheduled to go online June 30. A new deadline of October 2009 has been proposed for the campaign reporting system. The office is preparing a contingency plan in case it is not operation by then, the evaluation says.
The in-house developer, Brad Allen, has since been placed on administrative leave and agency officials confirmed earlier this month that an investigation into Allen had started, although originally they said Allen was not under any suspicion.
Allen has said he has done nothing wrong.
In addition to other gaps, the Legislative Finance Committee review found that the agency failed to effectively communicate as the new campaign finance reporting system was under construction. And there was a lack of supervision and oversight, as some internal Secretary of State e-mails make clear.
“Brad reports 60 – 70% done. [Department of Information Technology] consultant believes more like 5%,” State Elections Director A.J. Salazar wrote to Secretary of State Mary Herrera on June 10 of this year.
Six days later, Salazar again wrote to Herrera: “Candidate side is not very user friendly. Project is nowhere near completion. I do not recommend having anyone from the outside the organization look at the system in its current state.”
The new campaign finance reporting system originally had been scheduled to go online June 30.
Mackey said that the Secretary of State’s office has been cooperative with his agency and he feels good about his agency’s working relationship with the constitutional office.