Contact: Lynn Cox, ext 7426

Jeff Pattison, ext. 7321

1 Summary

1.1 Following on from the report to this committee on the 30^th July 2001 regarding Members Conduct, IT Services (ITS) was asked to investigate the amount of unauthorised usage that the PC allocated to former Cllr Emery-Wallis was put to for viewing unauthorised material.

1.2 This type of analysis is a specialist service not available within ITS, and would need to be undertaken externally to ascertain detailed information. This would be a very time consuming and costly exercise, with no guarantee of success. This report summarises the process required, explains the systems operation now and in the future and makes a recommendation based on these factors.

1.3 If it should be decided to take further action, the recommendation would be to use the services of an organisation that already undertakes forensic analysis of PC systems. This can be arranged through the private sector or Regulatory Services who have links with a number of authorities across the South East to create a facility which provides this type of service.

2 PC Set Up and Configuration

2.1 The PC loaned to Mr. Emery-Wallis was supplied with a modem enabling connection to services over a standard telephone line. Mr. Emery-Wallis would have been shown how to switch the attachment of this modem between two telephone lines (the County supplied line and his own telephone line) for business and personal use. This was a manual exercise that he would have to perform each time.

2.2 Whichever phone line was used, if the number dialled was to the ITS service, then this would be for Hantsnet business access and the connection could not then have been used for accessing any inappropriate sites. He was also provided with connection to a separate internet service provider for general internet browsing, and it was for any personal use of this facility that he was expected to switch the lines. However it was possible for him to use the County supplied line to dial this or any other service provider since there is no way to control which numbers a PC user connects to.

2.3 It is not practically possible to monitor all telephone calls to determine which have been claimed legitimately as business calls and which are private. This applies both to voice calls and Internet calls, which the telephone equipment treats as indistinguishable.

2.4 In the case of either the old or new PC equipment, however, members will be physically able to use their own private telephone line to access Internet sites. If this is done contrary to County Council policy, members must be fully aware that to do so, even where there is no telephone charge to the Council, will be a serious breach of policy and the Code of Conduct and inevitably result in a formal investigation by the Monitoring Officer or the Standards Board and a report to this Committee.

3 Browser Usage Analysis Process

3.1 It appears from the analysis undertaken so far that the amount of disputed telephone charges is low, amounting to no more than £10 for the final quarter of 1999. An exercise to establish the full amounts would involve the following.

Step 1 - Retrieve System Logs

3.2 The first step would be to retrieve whatever logs are available on the PC. What's available will depend on the operating system; the version of the browser used. However, all of this information could easily have been erased or not stored in the first place. In addition, these logs are most likely to contain only information regarding sites visited "relatively recently" prior to confiscation of the PC.

3.3 Recovery of older information would require specialist forensic tools and would need to be contracted out.

3.4 To ascertain the amount of usage that the system may have been put to for viewing unauthorised information, this log file information will only be useful if it contains date and time of access; without that, it will not be possible to tie this back to the phone bills.

Step 2 - Determine Accesses to any Inappropriate Sites

3.5 Assuming the logs of sites visited, with date and time, could be retrieved, the next step would be to determine which of them were unauthorised sites by checking each site individually. This would be a time consuming task.

Step 3 - Cross Check Against Phone Bills

3.6 Having obtained the list of unauthorised accesses, this information would then need to be cross-referenced to the bills for the County supplied telephone line to see if it was this line that was being used at that date and time. Clearly itemised bills would be needed for this purpose.

4 Costs

4.1 All of this would be a very time consuming and costly task. An estimate has been obtained from a specialist IT consultant that the work identified in Steps 1 and 2 above could cost in the region of £1,000. This though is very much an estimate and although it is unlikely to be less, it could well be more. Another estimate has been obtained from a local government supplier which would be in the region of £400, for a similar service. The cost of the work in Step 3 would be additional to this.

5 Conclusion

5.1 It can be seen that although a forensic examination of the PC can be undertaken, it is likely to be expensive with no guarantee that the information obtained will be comprehensive. Furthermore the costs of the examination are likely to be disproportionate to the value of any unauthorised telephone charges to the County Council based on the information presented to the Committee at its meeting on 29 July 2001.

5.2 Another issue to consider is the action to be taken by the County Council in the event of more detailed information on unauthorised usage being obtained. Mr. Emery-Wallis is no longer a County Councillor and is indeed disqualified from being so for another five years. Any debt recovery action is likely to be time consuming and complex with no guarantee of success. It would not, therefore, be recommended to pursue this course of action in the light of the likely small amounts of money involved.

5.3 The Committee should note that elsewhere on the agenda for this meeting, changes are suggested to the Protocol on Member/Officer relations which reflect the requests of the Committee at the last meeting and which further strengthens the County Council's policies on any unauthorised use of PCs supplied to members.

Recommendation

That the Committee notes the further information contained in the report, and, in view of the advice of the Head of Corporate and Legal Services, agrees that no further action be taken in this matter.