Dallas police data loss: IT employee reckless, but no malicious intent, report finds

DALLAS - An attorney hired to review the massive loss of Dallas police data said a city IT employee acted recklessly. But her firm believes the employee did not have malicious intent when he erased millions of files. 

The report released last week by former U.S. attorney Erin Nealy Cox cost the city $500,000. The major conclusion is the city still has a lot of work to do to protect the city's data. 

Cox told a Dallas Council Ethics Committee that the actions of a former city IT technician were accidental but also inexcusable.

"He either disregarded or misunderstood the warnings in the software and did not have proper training, but we did not identify any evidence of malicious intent," she said. "Even though I think he sincerely believed he wasn't doing anything wrong, I think his actions were reckless."

That mistake — deleting 20.68 terabytes of Dallas police data — is still difficult for Councilwoman Paula Blackmon to understand. 

"The thirteenth and the nineteenth, there were quite a few internal memos or emails going back and forth, and yet this exercise still continues," she said. "If you've seen the police chief saying missing files or folders from network drives, and you see another saying potential mass data loss because of an error, and they continue. Why did they continue all summer? 

It is a question still difficult for the city's independent investigator to answer. 

"His testimony will be he did not believe these additional deletions were going to impact data," Cox said.

So far, the lost data has not been critical to any current criminal cases. 

Committee Chairwoman Cara Mendelson said she believed the most important recommendation from the 62-page report is for the city to conduct a full review of the IT department with a $100 million budget.

"The report highlights broader problems in ITs and potential for other losses," she said. "Sadly, with 20 terabytes of data loss, we are actually lucky. We might not get lucky next time."

Some changes the city needs to make are akin to cybersecurity 101. 

UT Dallas cybersecurity expert Dr. Murat Kantarcioglu says the key thing to preventing data losses is to have files stored in three locations.

"Anytime, a file should be in two locations," he said. "So if a cyber-attack or fire, it will have a different location."

The city needs more people signing off on archiving, so mistakes can be caught.

"Any single individual should not be able to make mistakes," Kantarcioglu said. "There should be other layers."