TOWER— In a dramatic ending to a marathon session of the Tower City Council on Monday, Mayor Orlyn Kringstad announced he had forwarded his findings on intrusions into his city email account to the St. Louis county attorney for possible prosecution.

He said two deputies from the St. Louis County Sheriff’s Office, including one with cyber-security experience, have since been assigned to investigate the case.

Just two weeks ago, the city council had authorized Kringstad to look into what appeared to be systematic intrusions into his password-protected city email account. Kringstad had been able to capture some of the instances through screen recordings and videos taken with his cellphone.

Kringstad revealed that during his decade-long career at Honeywell, he had served as the head of the company’s information technology security and he drew on a member of his former team, Kjell Mathiesen, who went on to teach Internet systems and security in Norway. With Mathiesen’s help, Kringstad reported he had been able to use Internet access codes, known as IP addresses, to zero in on the intruder or intruders. After eliminating IP addresses reflecting times that he accessed his own email from various locations, he was able to determine that at least one other IP address had accessed and downloaded his email— the IP address serving Tower City Hall.

“One must know the account password to be able to log in and download email,” Kringstad said, noting that he and Tower City Clerk-Treasurer Linda Keith are the only ones he knows for sure have his password. He added: “I am simply explaining the information, not making any accusations.”

Yet the implications of his comments were unmistakable, and throughout his presentation, Keith remained silent, keeping her head down, while appearing to make occasional notes on an agenda.

Kringstad laid it out clearly: “Someone with knowledge of my password has used the network at city hall to access my email. More that 50 emails were retrieved during this period,” he said, noting that the access logs he obtained ran from mid-February to March 13. He noted that the last time his email was improperly accessed was on the evening of March 11, right after the city council meeting when Kringstad first announced the email intrusions. “After the last council meeting was adjourned, the break-ins have ceased to happen,” said Kringstad.

Kringstad noted that he had never used the Internet system at city hall prior to last week, when he accessed the system to confirm the IP address matched the one indicating intrusions to his email account.

It’s not clear how many people might have been involved in the email break-ins, but Kringstad said some of his emails were accessed and downloaded from at least one other IP address, and possibly a third one, in the Tower-Soudan area. That means more than one person could be implicated in the scheme.

Confirming the identity of those addresses, however, would likely require access to the perpetrator’s email account, which might necessitate a subpoena.

That’s why Kringstad said it was time to hand the matter off to law enforcement.

“I can’t carry this any further at this point,” he said.

Kringstad said he had contacted city attorney Andy Peterson to determine next steps, and said it was Peterson’s advice to forward the matter to the county attorney. He said county attorney Mark Rubin had asked him to spread the word that anyone who accessed his email should not attempt to remove his email data from their computer, since taking such steps could now be considered obstruction of justice.

Kringstad said he is willing to make all the results of his own investigation available to anyone requesting it. That includes screen recordings, download logs, and a listing of IP addresses involved.

Other issues under investigation

Meanwhile, the St. Louis County Sheriff’s Office is also investigating a criminal complaint filed last month over the falsification of city records, particularly the terms of individuals serving on city commissions and committees.

Those terms are maintained on an official roster under the control of the city clerk-treasurer. The alterations of terms, as previously reported in the Timberjay, appear to have included nearly a dozen individuals on at least three committees, including the Planning and Zoning Commission, the Gunderson Trust Board, and the Tower Economic Development Authority.

Falsification of official city records could run afoul of criminal statutes, particularly Minn. Stat. 609.43, Subd. 4, which makes it a gross misdemeanor for a public official to knowingly produce an official document having knowledge that it is false in any material way.

The alteration of Marshall Helmberger’s term on TEDA, however, is the primary subject of the criminal investigation. In that case, it appears the city clerk-treasurer altered Helmberger’s term on TEDA to make it possible for former Mayor Josh Carlson to remove Helmberger without due process required by law for members of economic development authorities. Under state law, members of an EDA cannot be removed without legitimate cause, which is limited to neglect of duty or malfeasance.

In the case of Helmberger, Carlson and the city council voted to remove him in apparent retaliation for news reporting and editorials in the Timberjay that angered city officials.

City records confirm that, in 2017, the city council had appointed Helmberger to a three-year term expiring at the end of 2019. But Helmberger’s term was later switched to one year in order to make it appear that his term had simply expired, making it possible to remove him without required due process.

The criminal complaint on the matter, filed by Helmberger in early February, cites violations of Minn. Stat. 609.43, Subds. 2, 3 and 4, as well as a possible violation of Minn. Stat. 609.175, Subd. 2, which relates to criminal conspiracy.

Under the law, any coordination between individuals in the furtherance of a separate violation of the criminal code constitutes conspiracy. If city officials coordinated their actions in order to remove Helmberger from TEDA, it could constitute a second criminal act in addition to the falsification of records.

City investigation likely

The city council is also weighing its own investigation into the actions of the city clerk-treasurer.

That revelation, which had been considered private data before Monday’s meeting, came from council member Kevin Fitton, who blurted it out during a discussion of his own request for an investigator to look into Kringstad’s actions (see separate story). “Right now, the city is looking for investigators to investigate the claims against the clerk-treasurer,” he said.

Councilor Rachel Beldo, apparently realizing the sensitivity of Fitton’s comment, immediately steered the conversation away from the subject, but the comment was the first confirmation that the council has discussed hiring an investigator during a series of closed sessions that the council has held in recent weeks.

The revelation is significant because it could prohibit the city council from holding any more closed sessions over the clerk’s performance issues. If what Fitton said is true, the council has almost certainly gone beyond preliminary consideration of performance or allegations.

According to the Minn. Stat. 13D.05, Subd. 2 (b), requires that once a council determines that some form of discipline “may” be warranted, which the decision to hire an investigator would strongly suggest, further meetings related to those charges or allegations, held after that conclusion is reached ,“must be open.”