MARQUETTE, Mich. (WZMQ) – A whistleblower has filed a lawsuit with Marquette County over claims of wrongful termination, after reports of a cyber security concern within the administration.
Paul Carley had worked as an Information Systems Manager with Marquette County for 13 years, responsible for overseeing the county’s aspects of information technology, including security administration and network infrastructure. A summons was filed Monday.
In July, the county underwent an annual state audit of its information systems. The company Karhu Cyber Security (KCS) was hired to also perform an audit on its systems. Carley informed the county that performing two audits at the same time would trigger each other and become ineffective.
Carley told the county that KCS employees working within the network must also undergo fingerprinting and a background check prior to gaining access. Carley agreed to work alongside one employee from KCS, only listed as ‘Chad.’
On July 7, the network began receiving intrusion detection alarms, before Carley discovered a mini personalized computer running an un-authorized program known as Kali Linux plugged into the network, hidden behind a copier, with the KCS logo attached. The device was running a brute force attack on the county’s network, attempting to gain access.
Carley reported what he found to his human resources officer, who said the Marquette County Board of Commissioners had authorized the use of the device, but no authorization was given by its IT department.
Security footage of the device being planted was also viewed by Carley. Chad, the only authorized KCS user, was no longer with the company by this time.
In August, Carley was put on administrative leave by county administrator, Duane DuRay.
Carley now seeks trial against the county.
WZMQ 19 News will stay up to date as this story continues.
