Complete 2012 forensic audit documents - Kansas Bioscience ...

Mr. Eisenbrandt, Thornton’s attorney, stated that he was unaware of the removal or wiping of
information from Thornton’s KBA-owned computer until notified by BKD. When interviewed
on August 24, 2011, Mr. Thornton indicated that he had removed information from KBA-owned
computer and then used wiping software to remove data from the hard drive. Mr. Thornton
indicated that he did so because he was concerned that representatives of the State of Kansas
would be involved in the review of the computer’s content and would possibly be politically
motivated to inappropriately construe or use its contents. Mr. Thornton indicated that he had
used the KBA-owned computer for his personal use and that it contained personal financial and
tax information, family photos and other information of a personal nature, some of which would
be embarrassing if made public. 81 BKD requested to analyze the USB device utilized to remove
information from the KBA-owned computer and any computer to which that device was
subsequently connected. Mr. Thornton indicated that he would consider that request. However,
as of the date of this report, the USB device and computer have not been provided.
Mr. Thornton’s computer would synchronize or “back up” to the server when connected.
However, David O’Dell of Summit Computer Solutions, KBA’s external IT provider, indicated
to BKD that the user could define or select which folders and files would automatically back up
when connected to the server. BKD reviewed the information stored on KBA server from the
last back up of Mr. Thornton’s KBA computer. The folders and files contained information
related to various KBA operations and initiatives, none of which were determined to be of an
inappropriate nature given their content. However, there is evidence on Thornton’s KBA
computer of files that once resided on the computer that are not found to be present on the server.
Therefore, BKD cannot verify that all files on the Thornton computer were backed up to the
server. It remains possible that files containing information important to the results of the
Forensic Audit were never backed up to the server and were wiped from Thornton’s computer.
In summary, Mr. Thornton resigned from KBA on April 13, 2011 and removed and/or destroyed
information stored on his KBA-owned computer prior to returning it to KBA on April 26, 2011.
KBA’s General Counsel, Tariq Abdullah, indicated that KBA does not have to comply with the
document retention requirements of the Kansas State Historical Society as the State’s record
retention laws do not apply to an “independent instrumentality of the State.” KBA’s Retention
Policy indicates that “In the event of a governmental audit, investigation, or pending litigation,
record disposal may be suspended at the direction of the CFO/COO.” According to Mr.
Abdullah, Ms. Katterhenry made an announcement at a staff meeting on April 8, 2011 that a
litigation hold was in place; however, Thornton was not in attendance at that meeting. The
written dissemination of the litigation hold was transmitted as a reminder via email on May 5,
2011, which was after Thornton had resigned and no longer had access to his email. Please see
Exhibit 40 for the described emails. 82
81 Based on BKD’s computer forensic procedures, we discovered certain file remnants and file descriptions that
could be consistent with files containing pornography. However, no pornographic images were found on the
computer.
82 KBA received a subpoena from the Johnson County District Attorney’s Office on April 20, 2011.
102