link to page 1 link to page 2 link to page 2 link to page 4 link to page 5 link to page 8 link to page 9
Investigation into Council’s email
quarantining practice
Agency
Horowhenua District Council
Complaint about
Email quarantining practice
Ombudsman
Peter Boshier
Case numbers
459861, 459877, 462166, 465831 and 470152
Date
12 November 2018
Contents
Summary ___________________________________________________________ 1
Ombudsman’s role ___________________________________________________ 2
Background _________________________________________________________ 2
Complaint and investigation ____________________________________________ 4
Analysis and findings _________________________________________________ 5
Chief Ombudsman’s opinion ___________________________________________ 8
Recommendation ____________________________________________________ 9
Summary
Between 2011 and 2017, the Horowhenua District Council kept a list of people whose emails
were deemed to pose a risk to staff. This list included the names of some of the Council’s own
elected officials. Anyone on the list who attempted to email Council staff would automatically
have their emails diverted to the Chief Executive to be vetted.
During this time, the Council did not have formal policy in place regarding the quarantining of
emails, which meant this practice went largely unchecked. A high proportion of the emails that
were quarantined did not appear to reach all of their intended recipients.
Five of the individuals who were added to this email quarantine list complained to my Office.
Opinion | Page
1
Office of the Ombudsman | Tari o te Kaitiaki Mana Tangata
Based on the information before me, I have formed the opinion that the Council acted
unreasonably. The Council’s email quarantine practice ran contrary to the principles of
transparency, accountability and fairness. I recommend that the Council apologise to the five
complainants, but I do not consider it is necessary to recommend any further action given the
Council has addressed the administrative issues I identified by ceasing this practice and
introducing a new email quarantining policy.
Ombudsman’s role
1.
Under section 13(1) of the Ombudsmen Act 1975 (OA), I have the authority to investigate
the administrative acts, decisions, omissions and recommendations of the Council.
2.
My role is to consider the administrative conduct of the Council, and to form an
independent opinion on whether that conduct was fair and reasonable (sections 22(1)
and 22(2) of the OA refer).
3.
My investigation is not an appeal process. I would not generally substitute my judgment
for that of the decision maker. Rather, I consider the substance of the act or decision and
the procedure followed by the Council, and then form an opinion as to whether the act
or decision was properly arrived at and was one that the Council could reasonably make.
Background
4.
The Council first introduced an email quarantining practice in 2011 ‘
with staff safety and undue interference in mind’. At the time, the Council did not have a specific email
quarantining policy.1
5.
Early in 2012, two of the complainants were added to the Council’s quarantine list
without their knowledge. The Council could not find a record of why these two
individuals were added.
6.
On 12 October 2013, Mr Michael Feyen was elected as a Councillor of the Council.
7.
On 29 April 2015, Mr Feyen sent an email to all Councillors and all Council staff raising
concerns about an upgrade of the Tokomaru Water Treatment Plant and the perceived
credit given for this project. Mr Feyen referred to comments made about this upgrade as
‘
grandstanding’.
8.
On 4 May 2015, the Chief Executive, Mr David Clapperton, wrote to Mr Feyen raising
concerns that his email had upset staff members. Mr Clapperton requested Mr Feyen be
added to the quarantine list to avoid further criticism of staff. Mr Feyen maintains that
1 Over the six year period that the Council’s email quarantine practice operated, the current Chief Executive, Mr
David Clapperton, was only responsible for the last three years.
Opinion | Page
2
Office of the Ombudsman | Tari o te Kaitiaki Mana Tangata
he mistakenly sent this email to all staff. Both Mr Feyen’s official council email address
and subsequent personal email address were added to the quarantine list.2
9.
In May 2016, the Council added the fourth complainant to its quarantine list without the
complainant’s knowledge. The Council could not find a record of why this individual was
added.
10. On 19 May 2016, Mr Clapperton advised the fifth complainant that he had added them
to the quarantine list due to an email they had sent the Council. The email at issue
contained a comment that was critical of a senior Council staff member.
11. On 29 August 2016, the Council removed Mr Feyen from its quarantine list.
12. On 8 October 2016, Mr Feyen was elected as Mayor of Horowhenua District Council.
13. On 10 October 2016, two days after the local election, Mr Clapperton instructed the
Council’s IT department to remove all remaining email addresses from the quarantine
list.
14. In March 2017, an internal auditor reviewed the Council’s compliance with its
Sensitive Expenditure Policy (this audit was conducted as part of a shared services
arrangement with the Manawatū District Council). In their review report, the auditor
raised concerns about the Council’s email quarantining practice and labelled this as an
‘
extreme risk’. The Council was concerned about the quality of this report. Details of this
report were leaked to the media.
15. On 11 April 2017, the Council approved a new Electronic Communication Policy. The
policy stated that ‘
email usage is monitored, and emails can be inspected at random
without notification (including personal emails) to ensure they comply with expected
professional behavioural standards’ and that emails should not be ‘
derogatory, obscene,
offensive or misrepresent other people or organisations’. However, the policy did not
specify a quarantining practice.
16. On 19 May 2017, Mr Clapperton advised the fifth complainant that he had re-added
them to the quarantine list due to an ‘
offensive’ email they had sent the Council. Mr
Clapperton stated that the individual’s emails would be reviewed for ‘
legitimate content,
queries and [official information] requests and such will be forwarded to the appropriate
part of the organisation’ for response.
17. On 20 June 2017, the Council commissioned KPMG to undertake a peer review of the
internal auditor’s report.
18. On 9 August 2017, KPMG presented its peer review report to the Council. KPMG did not
do an in-depth review of the Council’s email quarantine process and could not comment
on the appropriateness of the practice. However, KPMG did recommend that the Council
cease the quarantining of emails ‘
in order to develop a robust process in order to protect
2 While Mr Feyen’s emails to Council staff were vetted by the Chief Executive, his emails to other Councillors or
members of the public were not captured by the quarantine practice.
Opinion | Page
3
Office of the Ombudsman | Tari o te Kaitiaki Mana Tangata
all staff and elected officials’ health and safety’. KPMG also commented that it had ‘
seen
emails which could be considered offensive or abusive in nature by a recipient’.
19. On 10 August 2017, the Council suspended its email quarantining practice pending the
development of an appropriate policy framework in line with KPMG’s recommendation.
The fifth complainant was removed from the quarantine list as a result.
20. On 12 October 2017, the Council adopted a new
Electronic Communications (Email
Quarantine) Policy.
Complaint and investigation
21. Five individuals who were added to the quarantine list complained to my Office raising
concerns that the Council’s previous email quarantine practice may have:
a.
interfered with their ability to achieve ‘
timely and appropriate outcomes’ in iwi
negotiations;
b.
unnecessarily ‘
censored’ interactions with Council staff; and
c.
interfered with Resource Management Act (‘RMA’) processes (including RMA
submission processes), local election issues and Environment Court proceedings.3
22. In light of the concerns raised, I considered whether a wider systemic investigation of the
Council’s email quarantining practice was warranted. My staff discussed the issues with
Council, along with the Auditor-General’s Office and Privacy Commissioner’s Office, the
Department of Internal Affairs, Local Government New Zealand and the Society of Local
Government Managers.
23. During the course of my inquiries, the Council ceased its email quarantining practice (in
line with KPMG’s recommendation) and developed a new formal email quarantining
policy.
24. As a result of the Council’s actions, I decided that it was not necessary for me to
undertake a systemic investigation. However, I proceeded with investigation of the
individual complaints received from the five individuals (who were directly affected by
the practice).
25. I conveyed my provisional opinion to the Council on 28 September 2018. The Council
accepted my provisional findings and did not wish to provide any further comments. The
Council also stated that there were opportunities arising from the opinion to provide
learnings to the wider local government sector, particularly in relation to policy
development in response to similar issues to those experienced by the Council.
3 The complainants also raised concerns about an apparent interference with their privacy. I understand the
Privacy Commissioner’s Office considered this matter but decided not to take formal action on the basis that
the primary issues were best reviewed by the Office of the Ombudsman.
Opinion | Page
4
Office of the Ombudsman | Tari o te Kaitiaki Mana Tangata
Analysis and findings
The first part of this section comments on the general difficulties in reviewing the Council’s
previous email quarantine practice. The second part comments on the findings from a detailed
analysis of quarantined emails.
Email quarantining process
26. Over the period the Council’s previous quarantining practice operated, there were four
quarantining processes that overlapped at various stages. These processes, while similar,
contained different IT rules for capturing the quarantined emails. The quarantine
processes also operated over two of the Council’s email servers: ‘
Aftermail’ (prior to June
2015), and ‘
ARCmail’ (post June 2015).
27. For all processes, the Chief Executive was responsible for receiving quarantined emails
and determining whether they should be forwarded to their intended recipients.
28. My ability to review the quarantined emails at issue, during the course of this
investigation, was limited. Firstly, a third party IT contractor for the Council advised that
it would take an extensive amount of manual work and be very costly to extract and
analyse emails quarantined prior to June 2015 (in Aftermail). Secondly, emails between
June 2015 and December 2015 (under the ARCmail server) had been archived as the
Council had run out of storage space. Emails quarantined over this period were also
much more difficult to extract and review.
29. Although quarantined emails after January 2016 were more readily retrievable, it still
required a substantive amount of work by the IT contractor to extract these emails and
then determine whether they had been forwarded to their intended recipients. The IT
contractor was unable to identify whether emails were modified in any way prior to
being forwarded without manually comparing each email. Again, this exercise would
have been impractical and costly. Overall, the process of extracting and analysing the
Council’s quarantined emails was considerably complex and onerous, which has made
any review of this practice difficult.
30. However, on the basis of the information available, it is evident that there was a clear
lack of transparency and accountability in terms of how the Council’s previous email
quarantining practice operated. There was no formal policy, the reasons why people
were quarantined were not documented and there was a notable lack of records
regarding whether the emails were ultimately forwarded to their intended recipients. I
am also mindful of the fact that three of the complainants were never informed that
their emails were being quarantined (until after the internal auditor’s report was leaked
to the media).
Analysis of quarantined emails and findings
31. Despite the difficulties identified above, my staff were able to review two samples of
quarantined emails in greater detail (47 emails in total).
Opinion | Page
5
Office of the Ombudsman | Tari o te Kaitiaki Mana Tangata
32. The first analysis had already been conducted by an IT contractor. The contractor
reviewed a sample of quarantined emails between June 2015 and October 2016 and
noted that there were 261 emails quarantined over this period – 143 of which did not
appear to have a record of being forwarded to their intended recipients and required
closer inspection. Out of a sample of 21 emails that were inspected further, ten were
identified as not reaching all of their intended recipients.
33. I also requested that the Council provide me with direct access to the IT contractor so
that I could set the terms for further analysis, with the results being provided directly to
my staff. The Council agreed to this, and I am satisfied that the contractor performed this
task professionally and independently, and without interference from the Council.
34. The second analysis reviewed all quarantined emails sent by the five complainants in
June 2016. A total of 26 quarantined emails were identified and investigated further.
Eight were identified as not reaching all of their intended recipients.
35. While I have no means to determine definitively whether any emails were altered before
being forwarded to their intended recipients, there is no clear evidence to suggest that
the Council attempted to distort or obstruct any email exchange. In other words, there is
no basis to suggest that the Council used its email quarantining practice to somehow
interfere with or obstruct iwi negotiations, RMA submission processes, local election
processes or Environment Court proceedings (as per the concerns raised).
36. I note that that there is currently a heightened level of conflict in and around the
Horowhenua District Council. I also acknowledge that the Chief Executive has an
obligation to put in place reasonable measures to protect staff from abusive or offensive
messages where necessary. I consider that the Council should have a degree of control
over its email server in this respect.
37. However, having viewed the specific examples of ‘
unacceptable’ email correspondence
that led to quarantine action for Mr Feyen and another complainant, I consider the
Council’s decision to add these two individuals to a quarantine list, without warning and
without recourse, to have been disproportionate and unreasonable.
38. Further, the Council was unable to provide any record or examples of emails that led to
the other three complainants being added. Having viewed a sample of quarantined
emails and other emails from these three individuals over the course of this
investigation, it is difficult to identify a clear basis to suggest the Council had reasonable
grounds to add these three individuals to the quarantine list.
39. I also consider it was unreasonable for the Council to keep two of the complainants on
the quarantine list for over four years with no apparent attempt to review their status.
40. The Council has provided me with two examples of emails that demonstrate behaviour
that is particularly problematic. The first example contains explicit and racially-charged
language. The second example includes a statement referring to a staff member as being
‘
the most unprofessional, incompetent “secretary” I have come across’. These emails
were not sent by any of the five complainants at issue.
Opinion | Page
6
Office of the Ombudsman | Tari o te Kaitiaki Mana Tangata
41. It is not necessary for me to identify an express threshold of unreasonable email
communication that would warrant adding an individual to an email quarantine list. Each
case would need to be examined on its own merits. However, I consider the above two
examples exhibit behaviour that, if continued, would need to be managed appropriately.
42. While the Council may have been concerned about the frequency of the email
correspondence received from particular community members, I consider this could have
been managed through other means.4
Quarantined emails that were not forwarded
43. I am concerned by the high proportion of quarantined emails (sent by the five
complainants) that were identified as not having a record of being forwarded to all of
their intended recipients. In particular, there were numerous cases where emails were
effectively blocked from reaching their intended recipients without any discernible
reason. None of these emails contained language or other content that could be
described as abusive or offensive. The sender would also have been unaware that their
emails were not passed on.
44. It is unclear whether the Council considered that some of these emails were relatively
unimportant at the time (for example, acknowledgement emails or ‘thank you’
messages). However, I would expect these emails to be forwarded to all of their intended
recipients unless there was a valid reason not to do so.
45. It is particularly concerning that there were examples of quarantine emails being blocked
from reaching elected representatives. In principle, I consider that constituents should be
able to communicate with their locally elected representatives over email without undue
interference.5 This is fundamental to democracy.
46. In this case, Mr Feyen resorted to using personal email accounts to ensure he received
emails from constituents that might otherwise have been blocked.6 I consider the
Council effectively incentivised the use of personal email accounts in this way.
47. In the absence of a clear organisational policy or internal guidance on the use of personal
email accounts for official Council business, the accessibility, visibility and retention of
Council communications and official information may be reduced. Poor record-keeping
practices fundamentally undermine the operation of the Local Government Official
Information and Meetings Act and reduce transparency and accountability.
4 The Office of the Ombudsman’
s guide on handing unreasonable complainant conduct includes strategies for
managing unreasonable persistence.
5 The Council has a general practice of not opening physical mail prior to it being delivered to elected
representatives.
6 Mr Feyen was given an assurance that emails he sent community members and other elected officials would
not be quarantined. However, this exclusion rule did not apply to community members on the quarantined list
(who sent emails to him).
Opinion | Page
7
Office of the Ombudsman | Tari o te Kaitiaki Mana Tangata
48. Overall, I consider the Council took a cavalier approach to forwarding quarantined emails
to their intended recipients. As a result, Council staff and elected officials were not privy
to the full extent of email conversations and range of concerns raised by the affected
individuals.
New email policy
49. I consider the Council’s new
Electronic Communications (E-mail Quarantine) Policy that
was introduced on 12 October 2017, addresses the administrative concerns identified
above. In particular, the new policy:
a.
defines (insofar as possible), behaviour that will trigger the quarantine process (and
defines the process itself);
b.
introduces appropriate, standardised notification to individuals who are/may
become subject to the policy;
c.
is readily accessible on the Council’s website;
d.
requires the designated Privacy Officer to check quarantined emails for legitimate
business content, and pass that on;
e.
introduces a six-monthly review of the status of quarantined individuals;
f.
has an appropriate reporting structure (to the Chief Executive and Finance, Audit
and Risk Subcommittee); and
g.
introduces a complaints process for affected individuals.
50. The policy also excludes emails sent to elected officials. However, elected officials may
manage inappropriate email communications at their own discretion (with assistance
from Council) and taking into account the guidelines in the new quarantine policy.
Chief Ombudsman’s opinion
51. For the reasons set out above, I have formed the opinion that the Council has acted
unreasonably by:
a.
adding the five complainants to the quarantine list without reasonable or
identifiable grounds;
b.
failing to take steps to review the status of two of the individuals on the quarantine
list for over four years; and
c.
operating a previous emailing quarantine practice, without a clear policy, that ran
contrary to the principles of transparency, accountability and fairness.
Opinion | Page
8
Office of the Ombudsman | Tari o te Kaitiaki Mana Tangata
Recommendation
52. Pursuant to section 22(3) of the OA, I recommend that the Council apologise to the five
complainants. I understand that the Council has accepted this recommendation.
53. I do not consider it is necessary to recommend any further action given the Council has
addressed the administrative issues identified above by ceasing its previous practice and
introducing a new email quarantining policy.
Opinion | Page
9
