Council moves to protect employees after theft Delay in notification may have violated state law, Acropolis says BY PATRICIA A. MILLER Staff Writer All 510 people on the Brick Township payroll will receive credit-monitoring services for the next seven years, following the theft of a laptop computer that contained their Social Security numbers. Township Council members voted unanimously to provide employees with the service, which will protect workers even if they retire or are no longer employed by the township for seven years. The township may have violated the Identify Theft Protection Act by not informing employees that their personal information may have been compromised, council President Stephen C. Acropolis said at the Oct. 9 council meeting. "This is a disaster," he said. "It's going to wind up costing people money. It's a disaster." The act requires employers to disclose security breaches to the state police as soon as possible, Acropolis said. The computer theft was discovered on the night of Sept. 19. The employee, who has not been identified, called police and told them her home had been burglarized. Personal items were stolen, along with the computer the employee had taken home. Township Administrator Scott M. Pezarras and Mayor Daniel J. Kelly have said police informed them of the theft on Sept. 21. Both said police advised them not to reveal details about the theft, because it could compromise the investigation. Pezarras prepared a memo for employees, but they did not receive the notification until Sept. 28, in their paychecks. "As Harry Truman said, the buck stops here," Kelly said at the meeting. "It stops on my desk." Pezarras was told by township police to "be as vague as possible" with details about the theft, the mayor said. "If the people who committed the theft knew what they had, it would be worse," Kelly said. Police Capt. Nils R. Bergquist has said that although the department advised the township administration to keep details of the theft "limited," no one was advised to delay the notification of employees. New Jersey's Identity Theft Protection Act mandates that any business or public entity must disclose a breach of security to the state police, before notifying anyone whose information might have been compromised. "Have we done that?" Acropolis asked Pezarras. "I have not done that," Pezarras replied. "The notification required by this section shall be delayed if a law enforcement agency determines that the notification will impede a criminal or civil investigation and that the agency has made a request that the notification be delayed," the act states. "The notification required by this section shall be made after the law enforcement agency determines that its disclosure will not compromise the investigation ..." Council members also approved a resolution that calls for all township security and privacy procedures to be "reviewed, revised and strengthened." "I know it was a mistake, I know it wasn't intentional," said Councilman Joseph Sangiovanni. "All of these maneuvers now, that's great. But at the end of the day, I don't think anybody is going to be comfortable with the information in this building." Sangiovanni called for an outside auditor to examine the administration, pay- roll department and any other department that might have access to sensitive information. "I'm not comfortable that everything in this building is secure," he said. "We might have other breaches. I don't want to be sitting up here six months from today as angry as I am now." Pezarras said at first the number of employees involved was 430. But he later amended the number to 510, because parttime employees, such as school crossing guards and members of various boards also had to be included. "Is that the final number, Scott?" Acropolis asked Pezarras. "Yes, that's the final number," Pezarras replied. "I guess the buck stops right here," Acropolis said, looking at Pezarras. "Steve, that's a cheap shot," Kelly said. "Among many." "Mayor, please, please," Acropolis said. Pezarras said earlier this month he took "full responsibility" for the delay in notification. Pezarras has said he also held back releasing the information until Sept. 28 because the burglary appeared to be random, not targeted, and involved the theft of other items as well as the computer. Acropolis, a Republican, and Kelly, a Democrat who was sworn in on Jan. 4 to replace former Mayor Joseph C. Scarpelli until the November election, are both vying for Scarpelli's two-year unexpired term. Scarpelli resigned last December and pleaded guilty in federal court on Jan. 8 to accepting bribes from an unnamed developer.