Readers: Information from the state Department of Labor on what to do with an affected Form 1099 and how to pursue identity theft and credit protection can be found at https://labor.vermont.gov/1099-incident-updates.
MONTPELIER — The hot seat at the Vermont Department of Labor got hotter on Wednesday, as Gov. Phil Scott appointed one of his top advisers as a deputy to Labor Commissioner Michael Harrington and a task force to address the problem.
Meanwhile, state House and Senate lawmakers sought more complete information from Harrington about what they should tell constituents concerned about the risk of identity theft as the result of corrupted tax forms sent to thousands of unemployment claimants.
Scott appointed senior advisor and former Franklin County state Sen. Dustin Degree as deputy labor commissioner and named two teams from the administration to focus on affected consumers' needs, and on recovery and replacement of the corrupted tax forms. He also called on state Auditor of Accounts Doug Hoffer to conduct a performance audit that identifies the root cause of the error, long-term quality control improvements, and other performance improvement opportunities and best practices.
Degree has served as a special assistant to Scott and executive director of the State Workforce Development Board. He previously served in the state House and as an aide to former Gov. Jim Douglas.
“Dustin has helped to lead our focus on growing and strengthening the workforce for several years and will bring additional leadership to the department as they work to rectify the current situation, modernize their business processes and refocus on supporting the needs of working Vermonters and Vermont’s long-term economic growth,” Scott said in a prepared statement issued Wednesday afternoon.
WRONG ADDRESSES, IDENTIFY THEFT WORRIES
Monday, the Department of Labor discovered that a number of 1099-G tax forms sent to certain unemployment claimants were misaddressed, or contained others' names, addresses and Social Security or tax identification numbers.
Harrington apologized for the breach, which apparently happened when data was moved from the department's antiquated mainframe computing system for printing and was corrupted. As a result, claimants received forms with the wrong names and addresses, and with other people's tax identification numbers.
Scott said through a spokesperson that he is “incredibly frustrated by the error” and “completely empathizes with the concern and anger of impacted Vermonters.”
Wednesday was the second straight day in which Harrington spent part of his morning with the Senate Economic Development, Housing and General Affairs Committee, being questioned about the breach, its causes, and the department's response. He also met with House Speaker Jill Krowinski and state Senate President Pro Tem Becca Balint.
While state Sen. Alison Clarkson, D-Windsor, and Michael Sirotkin, D-Chittenden, offered support to Harrington as the committee meeting began, they also made it clear that time is of the essence, and answers are needed.
"We want to be all over this," Sirotkin said. "It's no fun having your identity stolen."
Wednesday, Krowinski said she was "deeply troubled' by the breach and supports an investigation into how it happened, potentially in cooperation with the state Senate.
"We want to make sure we understand what happened and it doesn't happen again," she said.
Krowinski said House members are getting calls from constituents about what to do with their form 1099s, and where to turn for direction and assistance.
"I have concerns we're not getting this information out quickly enough," she said.
Tuesday, during the Senate Democratic Caucus' weekly meeting, Sen. Dick Sears, D-Bennington, called for a Senate investigation, possibly armed with the power to issue subpoenas. On Wednesday, Sears said he still believes an independent probe is needed to "look at what happened and what steps need to be taken to make sure that we take all necessary actions to prevent a repeat."
"I don’t think the Auditor of Accounts is necessarily the right office to do this," he added.
Sears said he thinks highly of Degree, with whom he served with in the Senate, "While he is extremely loyal to the Governor he’s not afraid to roll up his sleeves and do what needs to be done," Sears said.
Harrington told the Senate Economic Development Committee the breach appears to be limited to unemployment claimants who obtained benefits through the Lost Wages Assistance (LWA) program and the Vermont Short Term Supplemental benefit population.
In the LWA program, 39,126 forms were mailed, but less than 20 exposed someone else's identity, Harrington said.
But in the Vermont Short Term Supplemental Benefit population, 32,043 forms were printed and 18,000 were mailed before the error was spotted. Of that 18,000, "almost all of those had corrupted information," Harrington said.
That's fewer than the 44,800 people Harrington told the committee might be affected by the breach. But Harrington is sticking to that more conservative figure. "Our immediate need is getting clear information to claimants and getting those who want protection protection," he said. "I don't want to lose time by having people conducting counting downstairs. So we're going to treat 44,800 as starting point."
Accordingly, the department will let those people know they're potentially impacted and that the state will provide coverage, and "we will notify them at a later date if they're not involved."
Harrington said the Department of Labor is working to find a third party vendor to handle identity theft protected services for impacted Vermonters at no charge, should they request them. He advised that people not rush out to purchase such coverage, because the state does not presently have a way to reimburse that expense.
State Sen. Randy Brock, R-Franklin, previously an executive at for Fidelity Investments, said the manual transfer of data from the Labor Department's antiquated mainframe to spreadsheets as part of the mailing process was "a real danger signal." While Harrington has not blamed the mainframe specifically for the crisis, he said the processes made necessary by its use opened the door for error.
"It's frustrating that our team spent so much time validating the data from the mainframe just to have a human error, just to have an accident occur," Harrington said.
Brock warned that antiquated technology will only cause more trouble.
"The bad news is other departments with antiquated systems are doing exactly what you're doing," he said. "There’s a likelihood something like this is going to happen in state government again unless we get our act together."
The committee was also joined by Charity Clark, the chief of staff for Attorney General T. J. Donovan, and Ryan Kriger, an assistant AG in the consumer protection division, about how Donovan's office can help.
Asked by Sirotkin what he would do of he was in the same situation, Kriger said his advice is the same as it was during the 2017 Equifax data breach: "All Vermonters should assume their Social Security number has been acquired by someone."
"Freezing your credit reports is the single most effective way you can protect yourself," he said.
Kriger also advised residents to contact the state consumer protection division at https://ago.vermont.gov/cap/ if they had questions or concerns about how to obtain a credit freeze.
"We deal with a lot of data breaches," Kriger said. "Unfortunately this is a fairly common occurrence."
Kriger said the AG's office is charges with assuring that residents are given adequate notice of a data breach, whether that's the result of a private business or a government agency.
The two "tactical teams" appointed by Scott to assist the effort are being directed by Brittney Wilson, Scott's deputy chief of staff, who will report directly to Scott on their progress.
Wilson, along with Doug Farnham, the chief of operations in the Agency of Administration, and Shawn Nailor, deputy secretary in the Agency of Digital Services, are on the Response Coordination Team. They will focus on expediting recovery of the incorrect 1099-G forms; the timely delivery of correct forms; and improved, consistent communication to impacted Vermonters and legislators.
Meanwhile, the Consumer Protection Team (CPT), comprised of Kristin Clouser, the deputy secretary of the Agency of Administration, and Jaye Pershing Johnson, Scott's legal counsel, will work with the AG's office to provide information and access to protections from fraud or other illegal activities to any Vermonter whose information may have been compromised.