ACHD official accuses ITD of ‘hacking’ agency through spreadsheets
CORRECTION: A previous version of this story incorrectly identified the person who spoke to the commissioners. It was Paul Daigle, Ada County Highway District chief of staff. (Updated: 11:20 p.m. on Feb. 19, 2020)
Ada County Highway District officials say the Idaho Transportation Department used Microsoft Excel spreadsheets to hack ACHD and collect protected information from the district.
Paul Daigle, ACHD’s chief of staff, told highway commissioners Wednesday that it appeared ITD used an “embedded subroutine” in spreadsheets it gave to ACHD to gather information on the highway district’s files. A subroutine in Excel is code written into the file to do a specific task.
“They’re basically hacking us and stealing our internal data, to put it in layman’s terms,” Daigle said.
An ITD spokesman, Vince Trimboli, acknowledged in an email to the Idaho Statesman that ITD “employees built a spreadsheet that recorded the history of the asphalt quality assurance workbook.” A workbook is what Microsoft calls an Excel document that contains one or more spreadsheets.
Trimboli did not say why or when the employees built such a workbook, but he added: “ITD turned the workbooks over to the Federal Office of Inspector General for investigation in the summer of 2018.”
“We believe the workbook did not retrieve any information off Ada County Highway District servers,” Trimboli said. He did not explain further.
The code was embedded into workbooks ITD gives agencies to fill out when they are working on federally funded projects, Daigle told the Statesman.
ACHD hired outside consultants who specialize in forensic analysis to look into what was collected, Daigle told commissioners.
“We did some forensic analysis of our own, and we confirmed that the subroutine identifies … the file path, the files located on your individual machine, machine name, the authenticating server which is our main domain controllers, the ACHD domain path, who opens the file and anything that is logged in there,” Daigle told the commissioners.
The consultants are confirming that ACHD is understanding the problem correctly, he said, and lawyers would ultimately determine what was next. ACHD’s consultants are expected to turn over their analysis “in the next day or two,” he said. Then the district will turn them over to its general counsel, Steve Price.
Commission Vice President Kent Goldthorpe asked Daigle what the worst-case scenario would be if what Daigle suspected proved true. Price replied, saying the information gathering would be illegal.
Daigle told the Statesman that ACHD learned about the problem from “some other people” who had separately learned about it and told the district.
Nicole Du Bois, a spokeswoman for ACHD, said the agency had “more questions than answers” but that it would know more in the next few days.
This story was originally published February 19, 2020 at 6:23 PM.
.jpg)