Indications that Oklahoma Department of Veterans Affairs director Joel Kintsel may challenge Gov. Kevin Sittt in the 2022 Republican primary have spurred awkward conversations between Veterans Commission members, Stitt’s chief of staff and Kintsel, who also has requested an investigation into suspicious activities observed on an ODVA computer.
The initial alleged ODVA computer “intrusion” occurred and was reported to the Office of Management and Enterprise Services in early December after the agency’s human resources director, Jennifer Shockley, “experienced what appears to have been a breach of her state-issued laptop by an outside entity,” Kintsel wrote in a Dec. 13 email to Matt Singleton, the cyber command team leader of OMES, which operates the state’s computer systems.
“I was sitting at my desk in a meeting with my coworker and I had an Excel spreadsheet with ODVA employee’s (sic) information opened on my screen,” Shockley wrote in a Dec. 8 email to OMES. “While I was talking to my coworker, I noticed out of the corner of my eye that my curser was moving and it appeared that someone was right clicking (and) opening the option to copy and paste. I had my coworker come around to witness it as it was happening several times. I was not holding the mouse or doing anything on my keyboard. I am concerned that someone may have compromised my computer.”
The incident has become the center of a protracted dispute between OMES and Kintsel, who has questioned the integrity of how OMES handled its investigation and who told NonDoc that he is asking the FBI to get involved. With rumors swirling that Kintsel might run against Stitt in the June primary, the governor’s office has questioned whether the ODVA director is abiding by campaign laws and focusing on running the veterans agency. Meanwhile, Kintsel has even raised the possibility that the alleged attack was politically motivated by those who would oppose his potential candidacy.
‘Nothing was identified that indicated malicious activity’
By Dec. 19, OMES had upgraded its “ticket” on the matter to a “forensics investigation.” Kintsel followed up Feb. 17 to inquire about the matter, one day after Veterans Commission Chairman Larry Van Schuyver and Vice Chairman Paul Costilow met with Bond Payne, Stitt’s chief of staff, about whether Kintsel was preparing a run for governor and whether he was discussing his potential candidacy and fundraising needs at the State Capitol.
On March 2, OMES cyber command watch officer Amber Mangham emailed Kintsel about the computer inquiry.
“The forensic investigation is complete which ‘namely included that nothing was identified that indicated malicious activity had taken place, and that this may have been an error with Shockley’s wireless mouse and/or weight on the keyboard CTRL key.’ The investigator is working on typing up an official report for you,” Mangham wrote.
The next day, Kintsel sent OMES director Steven Harpe an extremely broad and exhaustive request for information under the Oklahoma Open Records Act. Kintsel requested the investigation’s results and months’ worth of remote control and remote access logs regarding the computers of more than 40 ODVA employees, as well as work tickets, OMES employee names, contractor names, computer devices, and various emails relating to the investigation and remote accessing of computers.
“There are a lot of reasonable ways of getting information. Director Kintsel, for whatever reason, felt like he needed to take this path. So be it,” Harpe told NonDoc. “We’re going to respond to the [open records] request that he sent over. It’s like all [open records] requests. Any data that we have that is theirs, we are going to give them.”
Kintsel said the OMES conclusion about the Dec. 8 incident was unsatisfactory and that he is “in the process of contacting the FBI.”
“They blame the HR director for just leaning on her keyboard and bumping her mouse. There is no way in the world that that is what happened. My general counsel was there, and my payroll manager was there as witnesses, and there was nobody leaning on anything,” Kintsel said. “There were clearly files being downloaded by someone else that was not in the building. There’s no doubt that was what was going on. It doesn’t appear that we’re going to be able to get to the bottom of this, probably without external help. I’m in the process of contacting the FBI so we can get external help.”
‘Nobody is targeting somebody at ODVA’
Harpe outlined OMES’ process for forensic investigation of potential data breaches.
“They will have a checklist of items that they go through to look for. They’ll look for malware that has been installed, or they will look for remote control abilities that could have been installed. They’ll look through browser history and things like that to see if there was some type of remote attack. Right now, the thing everyone is worried about is the ‘wiper attack’ that the Russians are doing,” Harpe said. “They have a list of things that they go through. Once they complete that, they make a determination based on, ‘Did someone actually have the ability to do this?’”
Harpe said OMES’ investigation found no evidence of an intruder accessing the ODVA employee’s computer and that its mouse could have moved owing to automatic system updates.
“In this case, an employee saw their mouse move or something to that degree, and it freaked them out. I get that, but I mean, sometimes that happens just doing a software update. It’s not uncommon for a mouse to move,” Harpe said. “I would just say this generally: I think the question we’re getting to is, ‘Do we have Big Brother looking around?’ And the answer is, ‘No.’ We don’t authorize that stuff.”
Harpe said OMES and ODVA could agree to have a third-party cyber security firm investigate the matter independently.
“We want to be rational about that. I don’t just want to waste money. But I want everyone who works in state government to feel secure about their systems,” Harpe said. “I’m just telling you flat up: We’re not looking at platforms. If there is an investigation going on, it’s in concert with Homeland Security, with the FBI. We get hit 67 million times a month, literally. So this team is sitting by 24/7/365 looking at this stuff, but nobody is targeting somebody at ODVA right now.”
Kintsel said two other computer activities have also concerned him and his staff. First, Kintsel said his staff noticed that OMES employees and even third-party vendors were temporarily listed as “owners” of an ODVA Microsoft Sharepoint folder. Second, he said the state “did a security patch that was for the whole state” on March 4, the day after he submitted his open records request. Subsequently, he said his staff told him that additional people had access to ODVA’s network.
“Something got turned on that was not turned on before, allowing broad access into our files,” Kintsel claimed.
‘I wasn’t satisfied with their answer at all’
Veterans Commission Chairman Larry Van Schuyver said the computer issues are “a major concern” and that he and other commissioners asked Kintsel to seek further information about the incidents. Now in his 10th year on the Veterans Commission, which governs ODVA, Van Schuyver minced few words when describing his reaction to OMES’ explanation of the December event.
“As a commissioner, I wasn’t satisfied with their answer at all. They said the lady was sitting there and she must have bumped her keyboard. So that’s what led to us asking our director to find out more information,” Van Schuyver said. “It’s a technical matter. We’re not throwing up a flag and saying, ‘Hey, somebody is spying on us,’ and James Bond shit. We’re just saying, ‘Tell us what is going on. Why would files be [accessed] remotely from our computer if we didn’t authorize that?’”
Complicating the matter for Van Schuyver, Harpe and others is the percolating rumor that Kintsel is planning to file as a Republican candidate for governor in April.
Asked about that rumor Monday, Kintsel said neither “Yes” nor “No.”
“I will tell you the same thing that I’ve told every other reporter who has approached me, because there’s been a bunch by now,” said Kintsel, who is a judge advocate in the Oklahoma National Guard. “If I decide to jump out of the frying pan and into that fire, I will let you know.”
Asked what factors he would weigh regarding a final decision, Kintsel declined to elaborate.
“I’m going to just stay with the statement I made,” said Kintsel, who served as Oklahoma House of Representatives parliamentarian from 2005 to 2017. “I’m not going down that road today.”
But advisors to Stitt have believed since at least late January that Kintsel is considering a challenge to the incumbent governor, and Kintsel has been featured prominently in recent press releases and marketing campaigns from ODVA.
While emphasizing that he and his colleagues are “apolitical” and “only want to help veterans,” Van Schuyver said Veterans Commission members asked Kintsel about his potential political aspirations at an “executive board meeting” prior to their official March 4 meeting.
“The director has not told us as a board that he has made a decision whether or not to run, and, until he tells us that, it’s really no concern of the board. It’s his personal choice. I would never tell anyone to run or not to run,” Van Schuyver said. “He didn’t tell us he was considering it. He told us that he would let us know if he was running. He didn’t say, ‘I’m thinking about running.’ He said, ‘If I was going to run, I would let you guys know first.’”
Harpe said he had also heard talk of Kintsel’s potential challenge to Stitt.
“I’ve heard rumors about that. I mean, I don’t have anything officially to state other than I’m hearing the same rumors that you are,” Harpe said. “And if that’s true, then at some point he will announce.”
Harpe noted that Kintsel’s records request did not allege that his agency’s computers may have been accessed by someone seeking information about his potential candidacy.
“The letter I received didn’t mention that,” Harpe said. “I don’t know if he has had those conversations with anybody else.”
Monday, Kintsel said the timing of the ODVA computer situations appears too coincidental for comfort.
“This has all happened since Dec. 1, right around the time the governor would have heard the rumor that is being spread about me potentially running for governor. We’ve never had anything like this go on prior to that time,” Kintsel said. “It could be any number of things, but that certainly is what it looks like to me. If I am perceived to be a potential political opponent, they are using the power of the government to do opposition research and politically-oriented research with another state agency. That’s not appropriate.”
Kintsel said that’s why he wants the FBI involved.
“When it’s the people that control the state’s computer network that would be supposedly the people who are helping you figure this out, that is kind of a joke,” he said.
Follow @NonDocMedia on:
‘Does he have a conflict of interest?’
Van Schuyver said Payne, who serves as Stitt’s chief of staff, has not requested a change of leadership at ODVA. But he did say Payne called a Feb. 16 meeting on the topic of Kintsel’s potential political preparations.
“We got called into the principal’s office, myself and [Veterans Commission Vice Chairman Paul Costilow.] We talked to them. We took their stuff. We went and checked it out. I couldn’t verify a lot of it, and I sent them back a response,” Van Schuyver said. “They flat asked me was he running for governor. Then they made a statement that the director was at the Capitol soliciting money. We went to legislator after legislator and could not confirm that. I will tell you, I personally thought it was a little bit BS because our director is an attorney and he was at the Capitol for years as (House) parliamentarian. He knows all the rules.”
Payne said his questions to Veterans Commission members have stemmed from a desire to make sure all rules are being followed.
“I wanted to meet with the chairman and the vice chairman to see if they had heard or if there was any truth to the rumors that [Joel Kintsel] was running for public office and, if so, how that would impact his ability to carry out his duties as director of ODVA,” Payne said. “Is he spending his full time and attention running the agency? Does he have a conflict of interest? Is he using state resources for personal gain? That could include staff of the agency that may be helping him or use of state money to run radio ads to build up his name ID.”
Payne said he has never met Kintsel, but he said the answers Kintsel provided Veterans Commission members about his potential gubernatorial aspirations felt “evasive.”
“Our job is to make sure the agencies are carrying out their work,” Payne said. “If the board has been advised, then the board is doing their job overseeing him and his activities, and I am satisfied.”
Asked what he would say to Stitt critics who might conceive of a conspiracy to review ODVA files as a way to research Kintsel, Payne said doing something like that would only raise the profile of a long-shot candidate.
“Our job is to make sure that taxpayer dollars are used wisely and in accordance with the law, and that our directors are focused on running their agencies and serving their constituencies,” Payne said. “Beyond that, we trust the boards to oversee those directors and our appointees.”
Van Schuyver said he simply wants a straight answer regarding the ODVA computer network concerns.
“We’re in a quagmire. We don’t know what happened, but to tell us somebody just bumped a computer thing — I’m slow, but I’m not that damn slow,” he said. “That’s not what occurred. Something happened, whether it’s a system error or an intentional error, something happened. But it wasn’t our employee with three witnesses with her bumping her computer. That does not make any sense.”
