CANTON ‒ Stark County officials say they are letting an agreement expire with the third party that maintains the Criminal Justice Information System (CJIS) after the company didn’t agree to new cybersecurity guidelines.
Stark County began contracting with Yates Technology Inc., also known as Yates Consulting, in 2009 for hosting and maintaining the CJIS system. Chris Yates of Yates Technology previously worked for the Stark County IT department from 2000 to 2005 and the clerk of courts from 2005 to 2009.
CJIS, first established with state grant funding awarded to the county in 1996, is the county’s online criminal justice portal connecting courts, clerks of courts, law enforcement and the county jail with shared information, including court documents.
In July 2024, an unauthorized person hacked the CJIS system. The data breach may have compromised personal information of nearly 300,000 people.
The county information technology department responded to the breach by creating a third-party vendor management policy to set minimum cybersecurity standards for county data contractors. Cybersecurity standards for local governments are also required by state law.
“When it comes to CJIS, we are dealing with highly sensitive criminal justice data,” county Commissioner Richard Regula said in a prepared statement. “Allowing any system with that level of importance to operate outside of modern cybersecurity safeguards would expose the county — and the public we serve — to unacceptable risk.”
CJIS had a glaring vulnerability because it is exclusively being controlled and maintained by a single individual who resides out of state, officials said. The single point of failure meant any disruption could impair access to essential justice system functions within CJIS and recovery could be difficult.
“No responsible public entity can allow a mission-critical system — especially one supporting law enforcement and the courts — to depend on a single point outside of its direct control,” Commissioner Bill Smith said in a prepared statement.
The most recent agreement with Yates Technology lasted from Nov. 1, 2023, to Nov. 30, 2025. The agreement was temporarily extended three times while the county and the company negotiated the new cybersecurity requirements.
Yates Technology declined to sign a new contract, which included the cybersecurity requirements, according to a Stark County news release.
Chris Yates of Yates Technology couldn’t be reached for comment.
The county’s agreement with the company expired May 1, 2026. Stark County is now asking all county-owned systems, data, code and access credentials be returned. Operations and maintenance of CJIS will be transitioned to the county’s control.
“Our responsibility is to the people of Stark County — not to any vendor — and not to any particular arrangement,” Commissioner Alan Harold said in a prepared statement. “We will always take the steps necessary to protect public data, maintain system integrity, and ensure that critical services remain secure and operational.”
The commissioners said they will be working with the county IT department, sheriff, clerks of court, judiciary and law enforcement to ensure a smooth transition.
Following the county commissioners meeting May 6, the prosecutor formally demanded the return of all county systems.
County Administrator Brant Luther said they will take all possible steps to maintain uninterrupted access to the system, but that will depend on the cooperation of all parties involved.
Reach staff writer Grace Springer at GSpringer@usatoday.com
This article originally appeared on The Repository: Stark County to take over maintenance of CJIS from third party
Reporting by Grace Springer, Canton Repository / The Repository
USA TODAY Network via Reuters Connect
