November 15, 2021

New York State needs to improve cybersecurity support to local governments and public authorities

In a letter dated November 12, 2021, New York State Comptroller Thomas P. DiNapoli advised the New York State's Division of Homeland Security and Emergency Services [DHSE] that his audit of its operation indicates that DHSES cannot assure the critical cybersecurity support they are providing to state agencies, local governments, and public authorities through their Cyber Incident Response Team [CIRT] to achieve the desired outcomes or is targeting the appropriate customers and their needs.

Essentially, the audit reports that the agency responsible for providing cybersecurity help to 2,800 public entities responds to attacks lacks strategies for preventing them.

“New York’s Cyber Incident Response Team plays a vital role in safeguarding our infrastructure and critical data against cybersecurity threats,” DiNapoli said. “There are a lack of forward-thinking strategies, widespread training, and specific and measurable objectives that are critical in assessing progress. Additionally, the agency needs to be more proactive. As cybersecurity attacks continue to rise, I encourage the state’s Division of Homeland Security and Emergency Services to take quick action on this urgent issue.”

The recent passage of the federal Infrastructure Investment and Jobs Act underscores how critical strengthening cybersecurity is across New York. The legislation will provide much needed funding for local governments to modernize and protect their networks against future cyberattacks. In New York, cyberattacks have impacted public entities large and small, including reported attacks at state agencies; 911 systems; counties including Albany, Chenango, Erie, Nassau, Schenectady and Schuyler; cities including New York, Buffalo, Yonkers, Long Beach and Olean; towns including Brookhaven, Ulster, Canandaigua and Moreau; as well as school districts like Buffalo Public Schools and Guilderland Central School District.

Cyberattacks pose a fiscal risk and can have significant impacts on the public when they target public authorities and local governments, including water systems, utilities, airports, schools and health care facilities. For example, a 2019 ransomware cyberattack on the City of Albany cost the city roughly $300,000 because of destroyed servers, the cost to upgrade user security software, the purchase of firewall insurance and the performance of other improvements to firm up the city’s systems.

Cybercrimes, including phishing remain on a troubling rise and reach far beyond New York. Between 2019 and 2020, complaints of cyberattacks increased by 110%, from 114,702 in 2019 to 241,342 in 2020, according to the Federal Bureau of Investigation.

The rise in cybercrimes across our state highlight how vulnerable local governments are and presents CIRT with an opportunity to implement solutions ahead of future attacks. Between May 2018 and December 2020, CIRT responded to 122 cyberattacks statewide, including 39 phishing incidents, 23 ransomware attacks and incidents of compromised accounts.

Although it is responding to incidents, CIRT has not made enough progress when it comes to proactively evaluating the cybersecurity needs of the agencies it assists and measuring its progress in improving security. Its activities have only reached a fraction of the 2,800 entities it is responsible for. For example, despite acknowledging the need for specific training on how to detect phishing and prevent ransomware attacks, CIRT only provided five training sessions on phishing emails between July 2020 and March 2021.

Between August 2019 and December 2020, CIRT conducted just 11 risk assessments at counties and other local government entities, upon request by those entities. It also held or participated in 32 training sessions and 13 tabletop exercises, which stimulate discussion of various issues regarding a hypothetical situation, for county Boards of Elections, critical infrastructure, and transportation authorities to test whether they were prepared for a cyber incident emergency.

DiNapoli’s audit also noted that most of CIRT’s activity is on a by-request basis or when areas of need are identified. Failure to conduct proactive outreach limits the ability to evaluate the needs of the entities in its purview and effectively prevent cyberattacks.

Officials said that they did not do surveys or collect data to see how many of the entities it covers have undertaken their own training. Without clear goals and documentation of security needs and progress officials cannot be assured their work is achieving the desired outcomes, if it is focused where public entities most need help, and if its limited resources are being used to the greatest benefit of the entities it was created to support.

DiNapoli offered several recommendations, including that DHSES:

Develop specific, measurable objectives and quantifiable, attainable goals, along with associated reporting mechanisms, to allow CIRT to evaluate if it is achieving its mission.

Take steps to determine the cybersecurity needs of the agencies, local governments, and public authorities CIRT is charged with supporting.

DHSES generally disagreed with the audit’s recommendations. CIRT officials stated that it has developed a sound and effective cybersecurity program that delivers valuable services to the entities they support. The agency’s full response is included in the audit.

Click HERE to access the Cyber Incident Response Team Report 2020-S-58.

New York State needs to improve cybersecurity support to local governments and public authorities

Essentially, the audit reports that the agency responsible for providing cybersecurity help to 2,800 public entities responds to attacks lacks strategies for preventing them.

DiNapoli offered several recommendations, including that DHSES:

Develop specific, measurable objectives and quantifiable, attainable goals, along with associated reporting mechanisms, to allow CIRT to evaluate if it is achieving its mission.

Take steps to determine the cybersecurity needs of the agencies, local governments, and public authorities CIRT is charged with supporting.

Click HERE to access the Cyber Incident Response Team Report 2020-S-58.

November 12, 2021

Deciding an action seeking to reinstate the Petitioner/Plaintiff's decedent to his position

Matter of O'Hara v Board of Educ., Yonkers City Sch. Dist.

2021 NY Slip Op 05703

Decided on October 20, 2021

Appellate Division, Second Department

In a hybrid proceeding pursuant to CPLR article 78, inter alia, to review a determination of the Board of Education, Yonkers City School District, dated October 12, 2017, which terminated the petitioner/plaintiff's decedent's employment as Director of Transportation, and action pursuant to Civil Service Law §75-b, among other things, to reinstate the petitioner/plaintiff's decedent to the position of Director of Transportation, the petitioner/plaintiff appeals, and the Board of Education, Yonkers City School District, Yonkers City School District, and Luisa Erika Lassi cross-appeal, from an order and judgment (one paper) of the Supreme Court, Westchester County (George E. Fufidio, J.), dated October 31, 2018. The order and judgment, insofar as appealed from, (1) granted that branch of the motion of the Board of Education, Yonkers City School District, Yonkers City School District, and Luisa Erika Lassi which was pursuant to CPLR 3211(a) to dismiss the first cause of action, and dismissed that cause of action, and (2), in effect, dismissed the third cause of action.

The order and judgment, insofar as cross-appealed from, (1) denied that branch of the motion of the Board of Education, Yonkers City School District, Yonkers City School District, and Luisa Erika Lassi which was pursuant to CPLR 3211(a) to dismiss the second cause of action, granted that cause of action, annulled the determination, and directed that the petitioner/plaintiff's decedent be reinstated to the position of Director of Transportation as a permanent employee, with back pay and benefits, and (2) denied that branch of their motion which was to dismiss the third cause of action.

ORDERED that the order and judgment is modified, on the law, (1) by deleting the provisions thereof granting that branch of the motion of the Board of Education, Yonkers City School District, Yonkers City School District, and Luisa Erika Lassi which was pursuant to CPLR 3211(a) to dismiss the first cause of action and dismissing that cause of action, and substituting therefor a provision denying that branch of the motion, (2) by deleting the provisions thereof granting the second cause of action, annulling the determination of the Board of Education, Yonkers City School District, and directing that the petitioner/plaintiff's decedent be reinstated to the position of Director of Transportation, as a permanent employee, with back pay and benefits, and (3) by deleting the provision thereof, in effect, dismissing the third cause of action; as so modified, the order and judgment is affirmed insofar as appealed and cross-appealed from, without costs or disbursements, the first and third causes of action are reinstated, and the matter is remitted to the Supreme Court, Westchester County, for the service and filing of an answer and the administrative record within 20 days after the date of this decision and order, and for further proceedings on the petition/complaint consistent herewith.

Shelley A. O'Riley was employed by the Yonkers School District (hereinafter the school district) as its Director of Transportation. After serving in the position on a temporary basis from August 31, 2015, through November 19, 2015, and later on a provisional basis from November 20, 2015, through April 20, 2017, she was eventually appointed to the position by the Board of Education, Yonkers City School District (hereinafter the Board), on April 21, 2017. A probationary period of 26 weeks commenced upon her appointment in April 2017. On October 20, 2017, the Board terminated O'Riley's employment.

O'Riley subsequently commenced this hybrid proceeding against the Board, the school district, and Luisa Erika Lassi, in her official capacity as the Director of Transportation for the Yonkers City School District (hereinafter collectively the respondents), pursuant to CPLR article 78 and Civil Service Law §75-b, inter alia, to annul the Board's determination. In the petition/complaint, as a first cause of action pursuant to CPLR Article 78, O'Riley alleged that the Board's determination was made in violation of law and lawful procedure and was arbitrary and capricious. The second cause of action pursuant to CPLR Article 78 alleged that the Board's determination was made in bad faith and for improper reasons. In the third cause of action pursuant to Civil Service Law §75-b, O'Riley alleged that, by terminating her employment, the respondents retaliated against her after she engaged in protected activity. Prior to answering the petition/complaint, the respondents moved pursuant to CPLR 3211(a)(1) and (7) to dismiss the petition/complaint.

In an order and judgment dated October 31, 2018, the Supreme Court granted that branch of the respondents' motion which was to dismiss the first cause of action, denied that branch of the motion which was to dismiss the second cause of action, granted the second cause of action, annulled the determination, directed that O'Riley be reinstated to the position of Director of Transportation as a permanent employee, with back pay and benefits, and denied that branch of their motion which was to dismiss the third cause of action. However, the court, in effect, dismissed the third cause of action on the ground that it had been rendered academic in light of the relief granted on the second cause of action. O'Riley appeals from so much of the order and judgment as dismissed the first cause of action, and, in effect, dismissed the third cause of action. The respondents cross-appeal from so much of the order and judgment as denied that branch of their motion which was to dismiss the second cause of action, granted the second cause of action, annulled the Board's determination as arbitrary and capricious, directed that O'Riley be reinstated to the position of Director of Transportation as a permanent employee, with back pay and benefits, and denied that branch of their motion which was pursuant to CPLR 3211(a) to dismiss the third cause of action. During the pendency of the appeal, O'Riley died, and the adminstrator of her estate was substituted as appellant-respondent.

"On a motion to dismiss a petition pursuant to CPLR 3211(a)(1), the movant has the burden of providing documentary evidence that utterly refutes the petitioner's factual allegations, conclusively establishing a defense as a matter of law. On a motion to dismiss a pleading pursuant to CPLR 3211(a)(7), the factual allegations in the pleading must be deemed true, and the petitioner must be afforded the benefit of every favorable inference" (Matter of Palmore v Board of Educ. of Hempstead Union Free Sch. Dist., 145 AD3d 1072, 1073 [citations and internal quotation marks omitted]). "When evidentiary material outside the pleading's four corners is considered, and the motion is not converted into one for summary judgment, the question becomes whether the pleader has a cause of action, not whether the pleader has stated one, and unless it has been shown that a material fact as claimed by the pleader is not a fact at all, and unless it can be said that no significant dispute exists regarding it, dismissal should not eventuate" (Matter of Clavin v Mitchell, 131 AD3d 612, 614).

A probationary employee may be discharged without a hearing and without a statement of reasons (see Matter of Griffin v MTA N.Y. City Tr. Auth., 127 AD3d 1083, 1084). "However, this broad discretion is not 'unlimited'" (Matter of Lake v Town of Southold, 189 AD3d 1588, 1591, quoting Matter of Maynard v Monaghan, 284 App Div 280, 283). "The employment of a probationary employee may not be terminated 'in bad faith, for a constitutionally impermissible or an illegal purpose, or in violation of statutory or decisional law'" (Matter of Lake v Town of Southold, 189 AD3d at 1591, quoting Matter of Lane v City of New York, 92 AD3d 786, 786).

Here, the documentary evidence does not utterly refute the allegation that the termination of O'Riley's employment was not in compliance with law and lawful procedure and it does not show that she does not have a cause of action on this basis. Consequently, the Supreme Court should not have granted that branch of the respondents' motion which was to dismiss the first cause of action.

Contrary to the respondents' contention, the Supreme Court properly denied that branch of their motion which was to dismiss the second cause of action, which alleged that the Board's determination was made in bad faith and for improper reasons. The respondents argue that the Board's determination to terminate O'Riley's employment as Director of Transportation was based on her poor job performance. On the evidence submitted, O'Riley has a cause of action pursuant to CPLR Article 78, on the ground that the Board's determination was made in bad faith. The petition/complaint alleges that the determination to terminate O'Riley's employment as Director of Transportation was based on her efforts to have transportation vendors and bus monitors comply with certain laws, with which they had not been required to comply under her predecessor, which angered the Board's president and the president of the Union that represents the school district's bus monitors, both of whom held sway with the school district superintendent.

However, the Supreme Court improperly awarded O'Riley the ultimate relief sought on the second cause of action. Upon denying the respondents' pre-answer motion to dismiss, the Supreme Court should have permitted the respondents to answer the petition (see CPLR 7804[f]; Matter of NassauBOCES Cent. Council of Teachers v Board of Coop. Educ. Servs., 63 NY2d 100, 102; Matter of Irfan v Vullo, 168 AD3d 733, 734; Matter of Smiler v Board of Educ., 15 AD3d 409, 410). Accordingly, we remit the matter to the Supreme Court, Westchester County, inter alia, for the service and filing of an answer and the administrative record.

Finally, "Civil Service Law §75-b(2)(a)(ii) provides that adverse employment action may not be taken against a public employee based upon his or her disclosure of information 'which the employee reasonably believes to be true and reasonably believes constitutes an improper governmental action'" (Tipaldo v Lynn, 26 NY3d 204, 210-211, quoting Civil Service Law §75-b[2][a][ii]). In light of our determination with respect to the second cause of action, the Supreme Court improperly, in effect, dismissed the third cause of cause of action pursuant to Civil Service Law §75-b on the basis that it had been rendered academic. Moreover, on the merits, the respondents were not entitled to dismissal of the third cause of action pursuant to CPLR 3211(a), since the documentary evidence neither utterly refutes the allegation that O'Riley's employment was terminated in retaliation in violation of Civil Service Law §75-b, nor shows that she does not have a cause of action premised upon this basis (see Lilley v Greene Cent. Sch. Dist., 168 AD3d 1180, 1181).

November 11, 2021

In an appeal to the Commissioner of Education the petitioner has the burden of demonstrating a clear legal right to the relief requested and establishing the facts upon which he or she seeks relief

In this appeal to the Commissioner of Education the Petitioner [Doe]* sought the removal of a member of the Board of Education of School District [Respondent], alleging that the Respondent violated Doe's right to gainful employment and his right as a public employee to “engage in political discourse” on several occasions, including during [a] board meeting. Doe "generally claims that Respondent "has harassed him since he was elected president of a local branch of the National Association for the Advancement of Colored People in 2015 and referenced several incidents between July 2018 and the spring of 2019 which allegedly demonstrate [Respondent's] disparate treatment of African American employees.:

In addition, Doe argued that Respondent “intentionally and wrongfully” divulged confidential information learned in an executive session [of the Board] while the executive session was ongoing."

For relief, petitioner requests that respondent be removed as a trustee. Petitioner also requests that respondent be ordered to comply with board policies, the New York State Constitution, and her oath of office.

Addressing a number of procedural issues, the Commissioner opined:

1. Most of Doe's claims "must be dismissed as untimely", explaining that an appeal to the Commissioner must be commenced within 30 days from the making of the decision or the performance of the act complained of, unless any delay is excused by the Commissioner for good cause shown, citing 8 NYCRR §275.16.

2. An appeal to the Commissioner pursuant to Education Law §310—or, in this instance, Education Law §306—is not an appropriate forum to adjudicate claims of unlawful employment discrimination and retaliation and such claims “are more appropriately resolved by a fair employment practice agency or a court of competent jurisdiction,” citing Appeal of Moss and Sealy, 60 Ed Dept Rep, Decision No. 18,001.

Turning to the merits of Doe's appeal, the Commissioner said a member of a board of education, as a public officer, takes an oath of office to uphold the law and faithfully discharge his or her duties and a board member must not “disclose confidential information acquired by him [or her] in the course of his [or her] official duties or use such information to further his [or her] personal interests." Further, noted the Commissioner, "It is well settled that a board member's disclosure of confidential information in violation of General Municipal Law §805-a (1) (b) may constitute grounds for such board member's removal from office pursuant to Education Law §306, citing Application of Bd. of Educ. of the City Sch. Dist. of the City of Buffalo, 57 Ed Dept Rep, Decision No. 17,147 and other Decisions of the Commissioner of Education.

That said, the Commissioner noted that in a removal application or an appeal to the Commissioner, a petitioner has the burden of demonstrating a clear legal right to the relief requested and establishing the facts upon which he or she seeks relief. Doe, said the Commissioner, did not meet his burden of proving that Respondent disclosed confidential information learned in the course of her duties as a board member.

* Given the confidential nature of the Part 83 referral [Moral Character Actions] described herein, Petitioner has been assigned a pseudonym, Doe. [See Appeal of Doe, 56 Ed Dept Rep, Decision No. 17,109.]

Click HERE to access the opinion of the Commissioner.

November 10, 2021

Challenging Adverse Personnel Decisions -

A 766-page E-book focusing on appealing penalties imposed following disciplinary action, adverse performance ratings, probationary terminations and the denial of unemployment insurance benefits initiated by officers and employees of New York State as an employer and its political subdivisions. For more information about this electronic handbook click HERE.

CAUTION

Subsequent court and administrative rulings, or changes to laws, rules and regulations may have modified or clarified or vacated or reversed the information and, or, decisions summarized in NYPPL. For example, New York State Department of Civil Service's Advisory Memorandum 24-08 reflects changes required as the result of certain amendments to §72 of the New York State Civil Service Law to take effect January 1, 2025 [See Chapter 306 of the Laws of 2024]. Advisory Memorandum 24-08 in PDF format is posted on the Internet at https://www.cs.ny.gov/ssd/pdf/AM24-08Combined.pdf. Accordingly, the information and case summaries should be Shepardized® or otherwise checked to make certain that the most recent information is being considered by the reader.

NYPPL Blogger Harvey Randall served as Principal Attorney, New York State Department of Civil Service; Director of Personnel, SUNY Central Administration; Director of Research, Governor’s Office of Employee Relations; and Staff Judge Advocate General, New York Guard. Consistent with the Declaration of Principles jointly adopted by a Committee of the American Bar Association and a Committee of Publishers and Associations, the material posted to this blog is presented with the understanding that neither the publisher nor NYPPL and, or, its staff and contributors are providing legal advice to the reader and in the event legal or other expert assistance is needed, the reader is urged to seek such advice from a knowledgeable professional.