Westfield clerk, mayor battle over spyware installed on city hall computers

WESTFIELD, Ind. (WISH) — Spyware was found on all of the computers in the Westfield clerk treasurer’s office, and now she and the mayor are battling in court about it.

This particular software allows remote access to all the data stored in that office, which includes information for a dozen city bank accounts, and personal information for city employees and taxpayers. 

Cindy Gossard, Westfield’s clerk treasurer, says she never gave permission to anyone to install the software and she doesn’t know who has access to sensitive city information held by her office.  

“And I’m responsible for all the records for the city of Westfield — financial, payroll, sensitive information — and I don’t know who has been in it. I don’t know how many times they have been in it. I don’t know what, if any, damage has been done,” Gossard said. “And we just worry about the files when we enter things, because this would give them access to the city’s bank accounts so we just don’t know. It is very concerning.”

One thing that is clear is this rift between the two highest-ranking elected officials in Westfield government has cost taxpayers thousands of dollars in legal fees, information technology consultants and outside auditors. 

Gossard says she is leery of using her computer for just about anything, even sending emails. She believes the spyware was installed by the city’s information technology department in November. She discovered the software around the same time the mayor of Westfield, Andy Cook, sued her. 

“So last summer, there were some comments about fiscal mismanagement. So, the mayor said, let’s do a real legitimate financial investigation into all city processes, all accounting; let’s just do it. He legally, by statute, brought in an accounting team, which includes a law firm, an accounting team and then a law firm that just helps manage. So, that is what’s been happening,” Vicki Duncan Gardner, communications director for Westfield government, said.

The mayor claims in the lawsuit that Gossard had not handed over all the paperwork needed for the financial investigation.  

“He wanted unfettered complete access for he and his staff into the city’s financial systems and he told the review team I was not giving the information he requested,” Gossard said. 

Gossard will not say the mayor ordered the spyware installed in her office, but she points out that the city’s information technology department is under the mayor’s control.  

Scott Shackelford, an associate professor of Business Law and Ethics at Indiana University, says the clerk should have been notified.  

“I think yes, that is an issue. You know, spyware installers have an ethical obligation to users to obtain informed consent for the collection and use of personal information and if that wasn’t being done in this case, then that is problematic…. A lot of cybersecurity data privacy is not black-letter law, right? A lot of it is operating in these gray areas, which is why ethics is so important,” Shackleford said. 

The mayor’s office says the new software is the same software the city has used for years, just under a different name.