Whistleblower files suit against Marquette County

MARQUETTE, Mich. (WLUC) - A whistleblower has filed a lawsuit against Marquette County. The suit says a county employee was wrongfully terminated after alerting his superiors to cybersecurity concerns within the county’s network. The summons was filed on Monday.

According to the complaint, Paul Carley started working with Marquette County as an information systems manager in May of 2012.

This July, the county was undergoing an audit of its information systems. At that time, the county also hired Houghton-based Karhu Cyber Security (KCS) to do an additional audit. That’s when Carley told his superiors there couldn’t be two audits happening at the same time.

The attorney representing Carley says the county wanted to allow more access for KCS employees than was legally allowed.

“They wanted all access for multiple employees,” said Robert Howard, Cunningham Dalman P.C. Attorney. “There was also the issue where somebody had installed a device on the system that tapped into the system without the knowledge of the county administrator.”

Documents show that around July 7, Carley responded to alerts that something was trying to access the system and found a personal computer hidden behind a copier running an unauthorized operating system called Kali Linux.

Carley says that device was running a brute force attack on the network, trying to gain access. He brought the concerns over a lack of background checks and violations of security protocols to his superiors’ attention.

The complaint continues to show on Aug. 18, Carley was put on leave by County Administrator Duane DuRay. Carley was told the county board and KCS staff wanted the device plugged back in.

When Carley told DuRay he would not provide what he called “illegal access” to the network for KCS staff, he was offered a separation agreement, which Carley did not accept.

“The Michigan Whistleblowers Protection Act prohibits employers from taking action against employees who have reported a violation of the law or a suspected violation of the law to a public body,” Howard said.

The complaint says:

“Carley was discharged for acting in accordance with this public policy by reporting cybersecurity incidents and vulnerabilities that posed potential threats to public safety and security. Carley was discharged shortly after reporting cybersecurity incidents and vulnerabilities.”

The complaint seeks for Carley to get his job back, plus back wages and compensation for emotional distress, mental anguish, humiliation and damage to his professional reputation.

“This was a really good job that he had,” Howard said. “Opportunities for a job like this in the U.P. are frankly, limited, so he’s going to have a hard time finding a similar job. It strikes to the core of this guy is trying to do what’s right, what’s ethical and what the law requires and he got terminated for doing exactly what he should.”

TV6 called DuRay multiple times for comment but has not yet heard back. We also called the Marquette County Circuit Court to see if it responded to the summons with a written response yet, but again, we have not yet heard back. The county has until Tuesday, Oct. 27, to respond.

The video above will feature the TV6 livestream until staff can clip the corresponding story, if available, from broadcasts or other TV6 content. You can subscribe to our YouTube page or download TV6+ to stream the latest local news and weather.