Lawyer: Malware located on drive

Says city police’s attorney sent it

A lawyer representing three Fort Smith police officers in a whistleblower case said Monday that someone tried to hack into his computer by giving him an external hard drive contaminated with malicious software.

Matthew Campbell of the Pinnacle Law Firm in North Little Rock has been representing three current and former Fort Smith police officers in the lawsuit since January 2014.

Campbell had requested emails from the Fort Smith Police Department, and Sebastian County Circuit Judge James O. Cox ordered on May 9, 2014, that they be provided to Campbell as part of discovery in the case.

Campbell said he became suspicious when Douglas Carson, the attorney representing Fort Smith and its Police Department, sent him the computer hard drive in June 2014 by Federal Express. Normally, Campbell said, the defendants had provided him with requested documents via email, the U.S. Postal Service or through a cloud-based Internet storage service.

Campbell said he sent the hard drive to his information technology expert, Geoff Mueller of Austin, Texas, who is manager of information security at the Lower Colorado River Authority.

"Something didn't add up in the way they approached it, so I sent it to my software guy first," Campbell said. "I thought 'I'm not plugging that into my computer,' so I sent it to him to inspect."

Mueller told Campbell the hard drive contained four "Trojans," one of which was a duplicate.

Trojans are programs that appear legitimate but perform some illicit activity when run, according to PC Magazine.

"One would have kept my Internet active even if I tried to turn it off, one would have stolen any passwords that I entered in, and the other would have allowed the installation of other malicious software," Campbell said. "It's not like these are my only clients, either. I've got all my client files in my computer. I don't know what they were looking for, but just the fact that they would do it is pretty scary."

In an affidavit filed with the motion Friday, Mueller stated: "Upon informing Mr. Campbell of the presence of these Trojans, he provided me with information that the Fort Smith Police Department claimed to be running a secure system with real-time virus and malware protection. In my experience, if the FSPD system is actually as described, these Trojans would not exist on the system."

Mueller said the placement of the Trojans in a subfolder named "D:Bales Court Order," and not in the root directory, "means the Trojans were not already on the external hard drive that was sent to Mr. Campbell and were more likely placed in that folder intentionally with the goal of taking command of Mr. Campbell's computer while also stealing passwords to his account."

Campbell said he doesn't know who put the malware on the hard drive provided to him.

Carson had left work early Monday because of illness and didn't return a telephone call seeking comment.

Police Chief Kevin D. Lindsey said Monday that he had seen Campbell's motion but had no comment.

"We're going to let the courts speak on that when the time comes," Lindsey said. "We'll let the courts get this worked out and let the disposition speak for itself."

In Friday's motion, Campbell said the police department deleted entire email accounts rather than turn documents over as Cox ordered last year.

"Defendants have engaged in ongoing, intentional spoliation of evidence by failing to preserve and provide deleted emails that, by their own admission, were recoverable," according to the motion.

Campbell is asking that the defendants be held in criminal contempt of court, among other sanctions. They have 14 days to respond to his motion. Also, Campbell said he has retained a lawyer to file suit regarding the attempted hacking.

"There are at least one Arkansas felony and as many as three federal felonies that stem from this," he said via email.

Plaintiffs in the whistleblower case are Don Paul Bales, Rick Entmeier and Wendall Sampson Jr. Entmeier and Sampson are current Fort Smith police officers. Bales, formerly a sergeant, was fired from the police department Oct. 20, Campbell said.

Defendants are the city of Fort Smith, city Human Resources Director Richard Jones, Lindsey and six current or former city police officers: Chris Boyd Sr., Mark Hallum, Alan Haney, Jarrard Copeland, Greg Smithson and Dewey Young.

The hard drive provided by the police department was related to Haney's computer, according to the motion filed Friday.

Campbell said he had requested some of the emails months earlier under the Arkansas Freedom of Information Act and was told they had been deleted. Sometimes deleted emails can be retrieved by forensic computer experts.

Bales, Entmeier and Sampson filed the original lawsuit under the Arkansas Whistle-Blower Act, Arkansas Code Annotated 21-1-601 through 21-1-610, after being the subject of multiple investigations over the course of about six months beginning in July 2013.

Campbell said Bales and Entmeier were targeted because they informed Lindsey that Haney and other officers had misled the chief into terminating a probationary officer July 5, 2013.

Sampson was targeted after Haney improperly accessed confidential information on the police department's computer network and learned that Sampson had informed internal affairs that Haney's wife, a former civilian employee of the Fort Smith Police Department, had illegally taken extra overtime, Campbell said.

"Since July 2013, the plaintiffs have been the target of nearly two dozen various investigations, ranging from accusations that they misspent FSPD funds to allegations that they were impugning the FSPD on Facebook," Campbell said.

Metro on 04/14/2015

Upcoming Events