Washington County Lacks Policy on Personal Email Use for Official Business, Request Reveals

HAGERSTOWN, MD News (12/20/2024) – A recent public records request has revealed that Washington County Government appears to lack a formal policy prohibiting the use of personal email accounts for official business. A review of documents provided in response to a public records request by Radio Free Hub City revealed no explicit guidelines addressing this issue. The request sought policies regulating the use of external email services, such as Gmail or Hotmail, for official purposes, as well as rules governing the use of personal messaging applications for conducting government business.

The sole responsive document, a social media use policy, outlines expectations for employees and elected officials regarding online activity. The policy focuses on social media, although there is some vagueness which could possibly indicate that any non-county IT resource should not be used for sensitive data, although the applicability to non-social media is unclear. However, it does not address email use for official purposes (of which non-sensitive information would be considered public records) or the broader topic of electronic communication channels which are not considered social media for official purposes. The absence of such guidelines raises questions about the measures in place to ensure the security and transparency of official communications within Washington County Government.

The request also sought policies specific to elected officials, but the provided policy only included general provisions applicable to all employees, including officials, regarding social media use. Without further documentation, it remains unclear whether additional policies exist to govern other forms of communication.

Following publication of this article, Washington County Attorney Zachary Kieffer reached out with an additional responsive document from the employee handbook. While this document does not specifically prohibit the usage of private email services, it does state that county resources are for official usage only, somewhat implying that only official resources should be used for official business.

The policy does state that employees are “responsible for proper use” and “contents of communications”, but still only loosely implies that only county resources should be used for official business. It has been recommended to the County Attorney as well as the County Commissioners that the policies be strengthened to clarify, and in the process improve the county’s security posture.

The use of personal email accounts for official government business poses significant security risks and transparency challenges. Personal email services often lack the robust security measures necessary to protect sensitive information (should any be accidentally introduced into the service), increasing the risk of data breaches and unauthorized access. Additionally, the use of non-governmental email accounts can complicate compliance with public records laws, as these accounts may not be subject to the same archival and retention standards as official systems.

The request for Washington County’s email usage policy originated after Radio Free Hub City uncovered that the County Government relied on Gmail accounts for critical communications during the COVID-19 pandemic, rather than using county-managed IT resources. This reliance has also led to difficulties in fulfilling public records requests, as the county originally stated that they no longer have access to those Gmail accounts. However, after publication we were informed that the county has located the ability to obtain access to the accounts, and is in the process of archiving their contents.

A future article will explore the County’s usage of Gmail accounts during the COVID pandemic in greater depth, including the challenges it created for transparency and accountability, even though no county policy violation appears to have occurred.

This story was updated to further clarify that vagueness and ambiguity exists within the social media policy, but the policy does not prohibit usage of external email services for non-sensitive information in the course of official business. This story was further updated to reflect information provided by the County Attorney after publication clarifying the county email policies.

Associated documents for this story are available in our Public Information Archive.

Story by multiple RFHC contributors