100,000 state worker's sensitive data could have been compromised.
On March 16, 2006 Convergys and the Florida Department of Management Services admitted that personnel data for state employees wound up in India.
The state said it wants $5 million from Convergys, partly to punish the company but also to help improve its People First system for more than 100,000 workers whose sensitive data could have been compromised.
Department of Management Services Secretary Tom Lewis said," The estimate of the total number of individuals who could be affected - it doesn't mean that they were, or that half or all of them were - that might have been involved is 108,000 as of now, A thousand of them might have been involved, or 10,000 or all of them."
Convergys issued a statement from its Cincinnati headquarters saying it was "misled" by a subcontractor, GDXdata of Denver, which Lewis and Emerick said let the Florida government work slip overseas for 12 months starting in mid-2003.
Lewis told the Florida Senate Governmental Oversight and Productivity Committee: "The use of offshore services was inappropriate and unacceptable."
Lewis said Convergys knew of the violation last August, when it cut off its contract with GDXdata, but it did not tell the state until February.
Chris Emerick, Florida director for Convergys disputed that, saying the company alerted the state after receiving an anonymous letter about the India operation on July 11.
The investigation by the DMS inspector general quickly spread to include the Office of Statewide Prosecution, Florida Department of Law Enforcement and U.S. Attorney's Office
Democratic lawmakers State Senators Walter Campbell, and Les Miller pressed Convergys to disclose when and why it dumped GDXdata.
"Standing here today in hindsight, knowing what we know now, we should have pursued the investigation more aggressively," Emerick told the Senate panel. "We should have done more at that time."
He said that "for the first time, on Feb. 15," GDXdata told Convergys about the India operation. Lewis said, however, that e-mails and other documents his investigators obtained from GDXdata were "compelling evidence" that Convergys was aware last August.
Sen. Nancy Argenziano, who chairs the committee, told Lewis she will demand "all correspondence and e-mails" between GDXdata and Convergys or DMS, to find out who knew how much, and when.
Convergys has the nine-year, $350 million contract for online automation of state personnel services - Florida's biggest privatization project. The company was not accused of illegal activity.
Lewis said Convergys has agreed to provide a "one-year credit protection program" for state employees, allowing up to $50,000 coverage for losses. He said Convergys agreed to "an independent audit," if he can find a company willing to take on the job "in this post-Enron era."
Convergys will also cover the cost of notifying state employees to check their financial records.
According to Lewis, the contract with Convergys will be toughened to require state approval of all subcontractors, as well as immediate notice of any possible breaches.
The part Convergys hasn't agreed to, Lewis said, is "a $5 million cash payment to the state." He said about half that amount would cover the credit-protection plan, independent audit, notification and other safeguards he outlined - and that the other half should go for making People First "more user-friendly" and punishing Convergys.
"Through no fault of state employees, they're going to go through an emotionally concerning, possibly worrisome time," Lewis said. He said "in return for that," state workers deserve some system improvements, and Convergys needs to feel some pain.
Lewis said the People First system, plagued by errors and long waiting periods for employees seeking help, has been steadily improving in recent months.
The India, Barbados and China Connection
The situation became public Dec. 25 when the Tallahassee Democrat reported a lawsuit secretly filed early last year by two former GDXdata employees who said the company had processed Florida personnel information in India, Barbados and China. At the time, Convergys said all employee data was safely held in computers in Florida and Denver and declined to discuss its reasons for axing GDXdata.
Lewis said. "The data was all loaded in a server and then I'm at my desk in Bombay and I have a user name and a password, so I go in and access that server and pull down 50 records and I work them, and I pull down 50 more and I work them - and there are 200 people on either side of me doing the same thing."
The former GDXdata employees who filed the suit in Leon County Circuit Court alleged that the subcontractor cut indexing costs from about 6 cents to a penny per page by using services in India
Florida state employees may be due compensation