On April 24, 2024, the Denver Auditor's Office presented a series of audit findings and updates covering cybersecurity, construction contract management, wage enforcement, public notice, homelessness services, and other city initiatives. The presentation also included segments on Denver Public Schools' electric bus program, food waste prevention, and workforce training for electric vehicle repair. The following summary captures the key points from the various segments.
My name is Hunter Hayes, and I know my buzz warning signs. Buzz driving is drunk driving. Buzz driving is drunk driving. Buzz driving is drunk driving. Buzz driving is drunk driving. Okay. Buzz driving. I just I feel like I'm not being real. I think if you just do it the way we're, you know, we're asking. Why don't I do the interview? You can sit here and just can you say it? Buzz driving is drunk driving. Buzz driving is drunk driving. Yeah, it's loosen up. The bad guys only have to be right once. Our cybersecurity has to be right every single time, every day. We tested thousands of employees to see how well they responded to a common cybercrime tactic. This is an example of our extensive cybersecurity audit work. My office regularly does audits of various city agencies cybersecurity. One recent audit examined how the city's thousands of employees respond to one of the most common cybersecurity threats, phish. Their goal is to lure an unsuspecting person into sharing sensitive information or downloading malicious software such as ransomware. The information or software can then be used to access systems or important accounts, which can result in identity theft, data loss, and financial loss. Common signs of a phishing email include misspellings and grammar errors, domain spoofs, logo imitation, or outdated branding, creating a sense of urgency and too good to be true offers or unexpected attachments. These kinds of attacks are not unique to government agencies, and every person and every organization should be on the lookout for these fishing warning signs. During the audit, my team created two simulated phishing emails and sent them out to about 6,500 randomly selected employees. Half got an easy-to-spot phishing email, the second half got a more difficult polished looking phishing email. We compared how city employees handled the fake emails to their job types, length of time with the city, management level, VIP status, and number of recent completed cybersecurity trainings. Based on the results of our testing, we found a positive but limited impact of the city's cybersecurity trainings. Employees who had more recent training that included information about fishing were more likely to correctly report a fish. But the number of employees who responded correctly to the phishing emails still needs to be much higher. Like many technology audits, we found technology services would benefit from a comprehensive strategy in preparation for any worst case scenario. An example of what can happen if a hacker or cyber criminal gain access to government systems and other infrastructure include the 2018 case of the city of Atlanta where employees were locked out of files for five days while people using malware held the city for ransom. I am confident in the steps technology services takes to keep the city's data secure in response to our work. We have done many cybersecurity audits since I took office, and I am confident that as a result, the city is in a much more secure place when it comes to protecting data and important city systems. Well, that's it for this episode of Ask the Auditor. If you have a question, submit it to Auditor at DenverGov.org, and maybe your question will be the next question we answer on the next episode of Ask the Auditor. Oversight and transparency are key tools to serving the people of Denver well. Some city agencies need to step up their efforts. That wasn't the first time our audit teams found a lack of oversight. Auditor O'Brien decided to do a series of construction and contract audits because we keep seeing it over and over. Inadequate contractor oversight and concerns about how the city is managing its vendors. An area of high risk for the city is how managers are ensuring taxpayer dollars are used by third-party contractors and vendors to the best benefit of the people we serve. Contract managers should have specific policies and procedures that allow them to track public money, verify invoices are accurate, and ensure the city actually got what it paid for through a fair and transparent process. Based on what we've seen after doing several audits of the management of the city's contracts and construction projects, that's easier said than done. Our most recent audit looked at the Department of Transportation and Infrastructure's management of a construction project to build a new fire station. We found city managers weren't keeping a close enough eye on the contractor to ensure the city wasn't overcharged and that the process for hiring subcontractors was as transparent and fair as possible. City staff relied too much on the contractor to take care of everything. Without performing due diligence to check up on the costs and subcontracting processes, it's a lot more difficult for the city to reassure the people their tax dollars are used wisely. Inadequately managing city construction projects means the city and county of Denver potentially waste taxpayer money. The city might not receive all contractually required services and deliverables it is paying for, and it risked paying too much for the services it does receive.