VA Reports Detail Misconduct By IT Officials

Two reports issued by the inspector general of the Department of Veterans Affairs point to a range of misconduct in the agency's IT department in recent years, including abuse of authority, prohibited hiring practices, and favors gained as a result of a personal relationship involving the agency's former CIO and an IT security official reporting to him.

Following an internal investigation, the inspector general said it substantiated that Katherine Adair Martinez, the agency's deputy assistant secretary for information protection and risk management, engaged in prohibited personnel practices when she influenced a VA contractor to hire a personal acquaintance and again later when that acquaintance was hired by the VA. Martinez was also found to have taken advantage of "an inappropriate personal relationship" with Howard, her supervisor, to relocate her office to Florida. Howard left the VA in January 2009; Martinez still works there.

According to one of the inspector general's reports, following Martinez' relocation to Florida in July 2008, the VA spent $37,000 on Martinez' frequent trips to and from Washington, ostensibly for job-related tasks. However, the inspector general determined that those tasks could have been accomplished from Florida, and that Martinez and Howard continued their personal relationship during that time.

According to the report, Martinez misused her position for the personal gain of Laura Nash, a friend who was hired for an identity security project despite little related experience. Nash was hired by contractor Engineering Systems Solutions in September 2006 as the project lead on a five-year, multi-million dollar contract to help the VA protect personally identifiable information, despite having taken only one computer class in college.

That project was part of an effort initiated by Jim Nicholson, the VA's secretary at the time, to overhaul the agency's cybersecurity processes, following data breaches that included a stolen laptop containing personal records on as many as 26.5 million veterans. Martinez was CIO of the Veterans' Benefits Administration at the time she met Nash nearly 10 years ago, according to the report.

The reports found improper action among other VA employees, including Martinez' top deputy for risk management and incident response, Kathryn Magginis, and Howard's executive assistant, Jennifer Duncan. Howard isn't implicated in the actions of Martinez, Magginis, or Duncan.

"VA expects our employees to set the highest levels of personal and professional conduct; therefore, we are extremely concerned by the descriptions of alleged improper conduct by VA staff," the Department of Veterans Affairs said in an e-mailed statement. "The department is aggressively pursuing a thorough review of the situation and will continue to work with the appropriate authorities. VA does not condone misconduct by its employees and will take the appropriate corrective actions for those who violate VA policy."

Current VA CIO Roger Baker said in a letter to the inspector general that he concurred with findings suggesting that the VA take "appropriate administrative action." Baker joined VA in May from IT services firm Dataline. Martinez, the inspector general report says, violated federal acquisition regulations in the process of helping Nash get hired at ESS, which was at the time positioning itself for a contract to protect personal information at the agency. Maginnis skirted proper procedure to get Nash hired, the report found.

During the time that Nash oversaw the ESS contract, the report notes, Martinez began assigning her executive assistant duties unrelated to the contract, and then hired Nash in November 2007 in a newly created position at the VA despite more qualified applicants.

In a second report, the inspector general found that Duncan, Howard's former executive assistant and (according to Howard) "de facto chief of staff," improperly hired more than a dozen friends, family members, and friends of family at the VA, including some at salaries above the going rate. Once hired, the report found, Duncan used her authority to give cash awards to many of them.

In a letter to the inspector general, current CIO Baker noted that he has since established new procedures for accountability in human resources and incentives. Baker concurred with the findings in both inspector general reports, which include sending bills to Duncan's family and friends for reimbursement of funds improperly paid for their education.

Reached at his new job at federal contractor Femme Comp, Howard declined to comment on the inspector general reports.

Martinez' attorney Kevin Owen said that Martinez is "looking forward to presenting a defense about the allegations when she has a chance to go through the allegations in full." Maginnis and Duncan didn't reply to e-mails seeking comment.

InformationWeek has published an in-depth report on e-health and the federal stimulus package. Download the report here (registration required).