STATE OF NEW MEXICO COUNTY OF SIERRA SEVENTH JUDICIAL DISTRICT COURT No.

: D-0721-CV -2009-00098 Judge: WILLIAM SANCHEZ

sTt,H. OF NEW MEXIC .S EYE NT Ii J UDI C I A L DISTRICT COURT FILED

2010"inN 7 Pr1 3 03
COURT .CLERK usafJ8.l.\8t DE UTY

STATE OF NEW MEXICO, ex. reI. DEBORAH TOOMEY, Individually, Petitioner, vs.

BY~-'-]

]
]

] ]
] ]

CITY OF TRUTH or CONSEQUENCES, a Municipality; LORI MONTGOMERY, Individually, and in her Official Capacity as Mayor; JERRY D. STAGNER, Individually, and in his Official Capacity as Mayor Pro-Tern; FRED TORRES, Individually, and in his Official Capacity of City Commissioner; EVELYN RENFRO, Individually, and in her Official Capacity of City Commissioner; STEVE GREEN, Individually, and in his Official Capacity of City Commissioner; JAIME AGUILERA, Individually, and in his Official Capacity of City Manager; MARY PENNER, Individually, and in her Official Capacity of City Clerk and Custodian of Records; BERNADINE GARCIA, Individually, and in her Official Capacity as Utility Billing Supervisor; DISTRICT ATTORNEY FOR SIERRA COUNTY, Respondents. CITY'S REPLY TO PETITIONER'S REPLY TO RESPONDENT'S MOTION TO DISMISS

] ]
]

] ] ] ] ] ]
]

]
]

]
]

] ] ]
]

Page 1 of 4

COMES NOW the City and hereby replies to the Petitioner's December 3 , 2009 Reply as follows: 1. Despite the Petitioner's insistence to the contrary, there "audit log" which exists. 2. In our December 28, 2009 Motion to Dismiss, we attached a December ,
IS

simply

2009 letter from Mark Jost of the American Data Group (ADG) which definitive y stated that there are no automatic auditing reports created. 3. In response to the Petitioner's Reply of December 31, 2009, the City h s obtained a follow-up letter from Mr. Jost dated January 4,2010, a copy of which is attached. 4. The City emphasizes the highlighted portion on page 2 of the Jost lett r whereby he responded to the Petitioner's paragraph 15 as follows: "The log file is a system log file and does not track user activity. The log file tracks when the

database service is started, stop, had maintenance functions performed on it, and a user's machine name login/logout data and time. This log file DOES NOT have any audit trail of a user's activity within the database. 5. Paragraph 1 of the Petitioner's Discussion misquoted Berna Garcia's and Jaime Aguilera's comments from City Commission Meetings. The relevant

minutes are attached. The highlighted portions made it clear that any discussion of an audit log would need to be referred to the IT person.

Page 2 of 4

6. The City is in full compliance with all State and Federal regulations. Th Petitioner fails to explain her contention as to why she feels we are in violation. 7. The requested information could only be created in the burdensome an costly manner outlined on pages 4-5 of our October 21, 2009 response. 8. In the absence of the documents being created, the requested audit 10 s do not exist. 9. The Inspection of Public Records Act does not contemplate creating ne documents to satisfy a request. Rather, the IPRA only contemplates public recor s that are already "made or received by any agency in pursuant of law or n connection with the transaction of public business." See 14-3-2( c). 10. As noted, this is not a case where the City has public records which it is refusing to produce. Rather, this is a situation where the Petitioner is asking the

City to create over 50,000 pages of new documents. 11. This Court can take judicial notice of Sierra County Cause No. CV-2009159 Audette and Toomey vs. City of Truth or Consequences. Petitioner is seeking the production of non-existent In that case, the The

DVD recordings.

Petitioner improperly uses the Courts to request non-existent information. WHEREFORE, the City seeks the following relief: A. The Petition should be dismissed.

Page 3 of 4

B. The Petition contains six (6) separate paragraphs alleging fraud, perju or producing false records against the City personnel. Petitioner re-stated h r

allegations at least nine (9) times during the December 29, 2009 hearing. The Ci y does not seek sanctions against Petitioner for her wild and baseless allegations, b t she should be admonished from making similar allegations in her other litigatio s against the City.

JAIME F. BIN, Esq. City Attorney Jaime F. Rubin, LLC P.O. Drawer 151 Truth or Consequences, NM 879 11 575.894.3031 Fax: 575.894.32812 CERTIFICATE OF MAILING The undersigned hereby certifies that a copy of the foregoing CITY'S REPLY TO PETITIONER'S REPLY TO RESPONDENTS' MOTION TO DISMISS was mailed to Deborah Toomey, Petitioner, at 415 W. Riverside Dr., Truth or Consequences, New Mexico, 87901, on the ih day of January, 2010.

JAIM~IN'

Esq.

Page 4 of 4

:~:II. :1: :

AMERICAN DATA GROUP

5730 E Otero Ave Suite 300 Centennial, CO 80112-6600 Telephone (303) 741-5711 FAX (303) 741-4966

January

4,2010

Berna Garcia City of Truth or Consequences 505 Sims St Truth or Consequences, NM 87901

Dear Ms. Garcia, This letter is in response to your email of January 4,2010 regarding the log files and ODBC Connection. Regarding Item 13: Instead of creating a report to manually go through, you can use the System Administration Menu - option# 10 'Export Data For SS/WP' to accomplish the same task. Select the SYAUD file, then F6 to select all fields. Fl to GO, enter a file name like Audit.csv to create and then Fl again. This will create a CSV formatted file that can be imported in to an access database or excel spreadsheet (maximum rows of 65k) and then viewed and modified. CO# is the company number and is always 1. Control# is the account number when the module id is MA,CT,DT,DP; or service location code when the module id is LC,LS,LT,SV. Field is the description of the field the data is for. Key2 is the Location Service identifier when the module id is LS; or Question Number when the module id is DT,LT; or Third party contact# when the module is CT. Mod Date was the date of the transaction. Module identifies which master file was accessed. New Value is the new value that was added. Old Value was the previous value before the change. Time is seconds from midnight the transaction occurred. Who was the logged in operator id that made the change. You could use this file and create macros to delete records where the field data is confidential and you wish not to provide it. The other option would be to print a big report to file and then do a search and delete of data. Regarding Item 14: The Microsoft ODBC driver provided with the Microsoft operating system is only for Microsoft products. The driver does not talk with 3'd party databases. If you connect the Progress!Merant ODBC driver to the database you can extract more data. You would have to use the Server to connect to the ODBC or install the Progress/Merant Driver on the system you wish to use to extract the data. Once the driver is installed, you must have a login id and password to access the data. The data is not just accessible unless you configure the proper log-in requirements. The information provided in 'Regarding Item 13' will accomplish the same thing as

connecting an ODBC unless you know how to use the SQL language to refine your data extraction. Regarding Item 15: The Progress Log file is a standard text file that is accessible from any editor or word processor. The log file is a system log file and does not track user activity. The log file tracks when the database service is started, stop, had maintenance functions performed on it, and a user's machine name login/logout data and time. This log file DOES NOT have any audit trail of a users activity within the database.

Regarding Item 16: Because the audit file report and extract is be field within each master file, the report can be extremely large. If an operator accesses and account and changes 4 fields of data, 4 different records are created. Any data NOT CHANGED, is not included in the audit log.

Regarding Item 17: Yes the audit log report can be printed or saved to a text file. Regarding Item 18: What we call a report or a file has to do with what we mean for it, not how a dictionary may describe the same word. Regarding Item 19: NO DATA is 100% capable of being protected. If you look at all the PCI DSS restrictions for credit card processing to help promote security, even the largest credit card processors who conform to the restriction have been hacked. Please let me know if you have any other inquiries. Sincerely, Mark J. Jost President

Ms. Kelley stated last week she went to Oklahoma City with the NM Dept. of Tourism exhibiting at the Oklahoma City RV and Boat Show. She was also there in June for the North American Travel Journalists Assn. Conference, and indicated her main catch there was to capture their attention with Spaceport America. She stated Cultural Heritage Tourism is very big right now and was able to push that aspect of our County, and reported she had really good response and will see more press visits out of it, and expressed there was a lot of interest. Ms. Kelley reported in May she hosted 20 tour operators with the NM Tourism Department, and that they were all bus tour operators from around the US who had never been to Southern New Mexico before, and several of them indicated they would be booking tours here in 2009 & 2010. And in June they hosted 8 journalists from Mexico ... from Chihuahua and Juarez and were here for 2 days. She stated last weekend she hosted the editor from Rand McNally road Atlas ... "Best of the Road" series, and indicated in 2010 they will be doing Southern New Mexico as their best of the road, and it will be in front of the Atlas and is available all year long, and stated the editor enjoyed it here so much that the next morning she went to their web-site and wrote a travel log about Truth or Consequences called "What Lies Beneath." Ms. Kelley stated she has been exhibiting at other holistic conferences to get the word out about our hot springs. She stated she is working with the up coming Elephant Butte Golf Shoot Out Tournament. And she is also working with the NM Department of Tourism doing joint efforts with Socorro County to pool their resources and not having to spend as much money, and that they are doing a lot of joint projects together to market the southern half of the State and their two counties specifically. Information only no action needed.

1\V\lfbREPORT
UTILITY OFFICE:

FROM

City Manager Aguilera reported on information from the utility office regarding department policies and privacy rules. He stated 4 cities were contacted who have the same utility services that T or C does, and that they also require social security numbers, and if a customer refuses they require the last four digits, plus all the drivers' license information. On deposits some are flat rate, others average, and some use a letter from a utility to waive deposits. He stated the Commission was provided information on the 1974 Federal Privacy Act and how it pertains to this, and they also have opinions from our City Attorney and the NMML Attorney that we are able to require the SS#. City Manager Aguilera stated on the computer security policy ... on what our IT department is doing ... the Utility System has a pair of firewalls, and the net-work in between the two firewalls are nonroutable ... meaning there is no way to route query to get into the second net-work. He stated the program they use is a proprietary database and could not be read without the actual software, and indicated our back-up or server these files are encrypted for safety and requires the proprietary software to view the file and that the back-up is stored in a secure off-site location. He stated the City also has a pass-word security policy and that the utility system has an audit log for several areas within the system to

see what changes are made, and that the system will log the operator that performed the process with the date and time, and what the old field was and what the new filed contains, and that this allows them to print a period of time and see any changes made to that account and who made them, and this audit also contains exempt and nonexempt information. City Manager Aguilera stated that the other cities contacted do not have the amount of write-off of bad debts that our city does. City Attorney Rubin stated that all the other municipalities that were contacted, and that they have one thing in common ... all contemplate asking applicant's for social security numbers which is what they have been saying for the last couple of months. Report only, no action required. CONSIDER APPLICA nON FOR DOWNTOWN GRANT: "Commissioner Green read from a preamble and moved that the City apply to the McCune Charitable Foundation for the 2009 funding for a non-matching grant in the amount of $50,000. He indicated the grant money would be used to hire an urban planner creating a master plan for the revitalization and preservation of our historic downtown and possibly to cover to capital expenses." Seconded by Commissioners Stagner/Renfro. Commissioner Torres asked if all this could be done for $50,000. City Manager Aguilera stated that he and Commissioner Green had a conversation and indicated they couldn't hire a professional company for that amount of money. He stated he contacted SCCOG and asked them to apply for a planning grant, and mentioned that SCEDO just received a $50,000 grant that they used to do an economical development study, and he thinks they can get a $50,000 grant to do a downtown study, and thinks that this grant and the one SCCOG could get us could be put together in order to hire a consultant to do the work. Commissioner Stagner commented ... they were talking about downtown being deteriorated, and pointed out when he came 12 years ago, and expressed it looked a whole lot worse than it does today, and there has been buildings revitalized, and new businesses downtown since he has been here. He thinks they should continue the revitalization. Commissioner Torres stated there was a comment made about them not caring about the flood problem in the downtown area, and that he is definitely for flood control if they can come up with something they can afford. Motion carried unanimously. AGREEMENT - 1 City Manager Aguilera stated this is an unfunded mandate from the State of New Mexico, and as of the l " of January they are required CALL VILLAGE & CITY OF T OR to locate underground utilities when someone wants to dig they call an 800# and then the City receives a call, and then they go out and C: locate the utilities underground. He stated the City is already in compliance and have set up the system, and explained that the Village of Williamsburg does not have the staff available to do this, and they own their own sewer system and the City owns the water system, so when someone is

Commissioner Renfro - are they filing liens. Berna - they do file liens against homeowners, but they cannot file against a homeowner if they have a letter on file of nonresponsibility ... which most owners do have on file. And stated having the information available helps them in identifying customers prior to opening a new account and helps internally and sending off to collections. Commissioner Green - are record systems that are not encrypted or secure ... once they have this information on a computer. . .is that encryption changed every so often so people don't fall asleep at the switch, and all of a sudden someone goes out to lunch, and the other person in the office can actually just start doing some destructive work against the City, and against its residents ... do they update that ... do they change .. .it's a password ... a code .. .I mean what do they have in place .. .I'm just looking at the word encrypted or secure. Berna - stated that would be something that the IT person would have to answer, and as far as our office they have different ... they each have to have a password to get into the system, and if one of our Clerk's is doing something he is going to know which Clerk was in doing what at what time, so the IT people is the one who actually takes care making sure they are not doing anything incorrectly, and anything done to the system is counter acted with the GL, so anything they do is printed out after the report is done. Commissioner Torres stated social security numbers are personal property, and that maybe they need to work ... get more money up front. Commissioner Stagner stated he would like to see them do a study ... a little broader study and see about larger deposits, and would like to see what other cities are doing. Mayor Montgomery stated she has a list of items for them to research - Continue to research what other cities do, Info., on the 1974 Federal Privacy Act and how it pertains to this specifically, Computer Security Policy on what IT is doing, Password Security Policy on what they are doing and how IT is tracking that, and if there is a way to go back and check who has accessed the system at what time and what they went into ... that type of security program, and research higher deposit options for those individuals that absolutely refuse to give their social security numbers. Berna - stated there were two items that she presented to the board ... which was social security deposits, and the social security policy that they have in place. Mayor Montgomery stated those deposits should be substantial to cover first and last, and any other period of time they take in between that time that person would be red tagged .. .I'm envisioning 90 days ... there should be enough money in our account to cover that if that person chooses to be a bad debt to the City. Berna stated on the Privacy Act that Ms. Toomey read, on the top portion of the print out on line on her Goggle Search, indicated the following section was originally part of the privacy act but was not codified and may be found at 522a ... which to her understanding it might have been intended but was never codified, and so she can

,,

'-

12