Columbus officials embarrass themselves with lack of transparency on data attack

File photo of Columbus Mayor Andrew Ginther. (Photo by Alex Wong/Getty Images)

Ultimately, the City of Columbus victimized — and embarrassed — itself with its horrific lack of transparency.

The cover-your-ass antics of Mayor Andrew Ginther and other officials led them to a courtroom on Thursday to stifle a self-described cybersecurity expert providing details to reporters on the data stolen in a ransomware attack on the city computer system.

David L. Ross Jr., aka Connor Goodwolf, says he turned to the news media when the city ignored his calls to several departments about the troubling trove of personal information he found in the city databases posted to the dark web in the ransom attempt.

The public, he felt, deserved to know if their privacy had been compromised because Ginther and others were not exactly forthcoming with details as they hemmed and hawed and ducked and covered about the potential for identity theft.

Ross proved that Ginther either did not know or provided incorrect information about the depth of the danger, which included not just details about city employees, crime victims and witnesses, and undercover officers, but personal info about city hall visitors and municipal court cases.

It was not a good look for Ginther, who apparently rallied other officials to also duck hard questions — and record requests — about the city’s failure to adequately protect its data from sophisticated hackers.

With Ross becoming a fixture in news stories, City Attorney Zach Klein sought and won a temporary restraining order on Thursday seeking to control Ross’ conduct.

With the city arguing Ross’ downloading of the stolen city data posed the danger of irreparable harm, Franklin County Common Pleas Court Judge Kim Brown ordered him to not access or disseminate the pilfered data.

Ross denied any scheme to harm the public and was scrambling to find a lawyer to oppose the 14-day TRO, (which was listed in the online court docket as “*ACCESS DENIED*” for nearly 24 hours) that was secretly granted with no notice to him.

The city also wants Ross to pay monetary damages, accusing him (even though no charges have been filed) of receiving stolen property and other offenses for possessing files that can be downloaded by anyone with the needed expertise.

All this over a problem of the city’s own making for its lack of openness and a failure to secure the bytes of computerized data with which it is entrusted.

It should not have come to such an extraordinary and troubling action that invoked free speech and prior restraint concerns that inevitably accompany such Big Brother acts by the government.

While Ginther and others profess to be concerned about the good of the public — offering credit monitoring for every city resident — downplaying bad news and playing loose with the facts is a slap in the face of the citizenry. The public’s right to know should not be mere lip service.

Honesty and transparency in government should always reign above half-truths and self service. The public should not have to turn to a third party for the truth.

Randy Ludlow retired in 2021 as a Statehouse reporter for The Columbus Dispatch following a journalism career that spanned 50 years.