The Fort Worth City Council agreed to pay $9.6 million to settle three connected whistleblower lawsuits, including one from the city’s former police chief, Joel Fitzgerald.
All three suits were filed by former city employees who claimed they were fired after reporting significant cybersecurity issues that left the city vulnerable to hacks.
The council approved the settlements in a vote during their Aug. 13 evening meeting.
Former assistant IT director Ronald Burke will receive $2 million, former IT employee William Birchett will receive $2.4 million, and former police chief Joel Fitzgerald will get $5.2 million from the city.
Get top local stories in DFW delivered to you every morning. Sign up for NBC DFW's News Headlines newsletter.
The settlements marked the end of a complex legal saga that began back in 2018.
“Involving the city’s compliance with Criminal Justice Information System regulations,” said Stephen Kennedy, the attorney for the three plaintiffs. “And they’re all connected in that way.”
Court documents obtained from a lawsuit filed by Ronald Burke against the city of Fort Worth laid out the details.
On Nov. 19, 2018, William Birchett emailed city IT department leaders to notify them the Texas Department of Public Safety’s CJIS audit had started.
CJIS is the Criminal Justice Information System, a database run by the FBI that provides police departments access to mugshots, evidence, and criminal records.
Departments must meet specific conditions to access the database, including controlling who can access it and installing the proper cybersecurity protocols.
Documents submitted as evidence in the lawsuit show that a month after the audit began in December 2018, the DPS auditor paused it and held a meeting with police department leaders and Fort Worth IT employees.
In a transcript of that meeting, a city IT employee said the city did not have proper encryption between city facilities.
The police chief said that he had been made aware the issue had been identified six years ago, saying, “This is critical mass … something needs to be done right now … I want to get something to the city manager today … saying these things need to be addressed.”
The next day, Fitzgerald emailed city manager David Cooke and then-assistant city manager Jesus Chapa to notify them, “The DPS auditor began his compliance checklist and found the third standard, point-to-point encryption, out of compliance.”
“The severity of a lack of compliance finding in this area caused the auditor to interrupt any further compliance check,” Fitzgerald wrote in the email. “The auditor shared several facts during the meeting, including prior audit failures for the same previously identified issue.”
“He communicated that city employees … intentionally deceived him when providing follow-up responses to his inquiries into the rectification of previous compliance failures,” Fitzgerald continued.
Fitzgerald also raised concerns about city employees with improper criminal histories having the ability to access the CJIS database.
“If this problem is not corrected, it is likely this jurisdiction receives an admonishment from the governor and loses access to CJIS … in effect neutering our ability to investigate crimes,” Fitzgerald wrote to Cooke and Chapa.
Chat records between city IT employees showed Ronald Burke working on a memo to city leaders to address the deficiencies. He wrote to his colleagues, “I’m going to do my best with this document and hope they don’t use it to hang me anyway.”
In a later message, another IT employee wrote, “I just can’t imagine this auditor really asking for the actual certificates or anything else … there is no way he is that smart. If he was, he would have caught us 11 years running.”
In January 2019, Fitzgerald emailed the assistant Fort Worth city manager to inform him that he was cooperating with an FBI investigation into the city’s cybersecurity.
In the following months, the city fired Ronald Burke and William Birchett.
Birchett filed a lawsuit against the city, alleging that he was fired for exposing cybersecurity issues. In that lawsuit, he claimed hackers stole more than $515,000 from the city because of compromised financial data and accessed city employees' data, including names, birth dates, and Social Security numbers.
News of the Birchett lawsuit broke on May 16, 2019. Documents show that city leaders sent a statement to the media on the same day regarding an alleged incident involving Fitzgerald.
Media outlets contacted the city, saying they had been informed of a confrontation between Fitzgerald and another law enforcement official days earlier at a public event in Washington, D.C.
The city’s then-mayor, Betsy Price, sent out a statement on May 16, saying, “I have been made aware of the situation by numerous witnesses. I have asked David Cooke and Jay Chapa to get to the bottom of this. We hold all our officers, including our chief, to a very high standard. There should be no exceptions.”
Four days later, the city fired Fitzgerald, with city manager David Cooke stating that he had offered the police chief the opportunity to resign, but he refused.
In a lawsuit he later filed against the city, Fitzgerald claimed he was fired the same day he was set to meet with the FBI about his concerns regarding the city’s cybersecurity.
Ronald Burke, William Birchett, and Joel Fitzgerald were all represented by Dallas attorney Stephen Kennedy in their cases. Kennedy said Fitzgerald’s professional reputation suffered after he was fired. He has since been working as the police chief of the rapid transit system in Denver.
“As a result of his termination, yes, he had a hard time finding another job,” Kennedy said. “But hopefully, we’re bringing all of that to a positive resolution.”
Kennedy said the city and the plaintiffs met for mediation on July 3, agreeing to the $9.6 million settlement to put the three cases to rest.
“Might not be the solution that everybody wanted to have, but it’s a solution,” said Kennedy. “So now we move forward in a positive way.”
NBC 5 reached out to the city of Fort Worth, asking for a statement on the settlement. We also asked if the cybersecurity issues alleged in the lawsuit have been addressed.
“After he was terminated, Fitzgerald sued the city under the Texas Whistleblower Act, alleging that he was terminated for reporting violations of law. The city denied all claims,” a spokesperson for the city of Fort Worth said in a statement. “The settlement includes a full release of claims against the city by Fitzgerald and no admission of liability by the city.”
