JOSEPH M FERGUSON INSPECTOR GENERAL
CITY OF Cl IICAGO OFFICE OF INSPECTOR GENERAL. 740 NORTH SEDGWICK STREET, SUITE 200 CHICAGO, ILLINOIS 60654 TELEPHONE (773)478-7799 FAX (773) 478-3949
VIA ELECTRONIC MAIL,
Mayor Lori E. Lightfoot
121 North LaSalle Street, 4th Floor
Chicago, Illinois 60602
Dear Mayor Lightfoot:
We write to bring to your attention concerns regarding the Chicago Fire Department's (CFD) and Chicago Police Department's (CPD) failure to utilize the biometric component ofthe City's timekeeping system. Specifically, an OIG investigation found that neither CFD nor CPD enroll their employees in the City's biometric timekeeping system. The biometric component ofthe respective electronic timekeeping systems helps ensure that an employee is physically present when he or she clocks in for work, thus reducing the risk of time falsification and absenteeism.
In contrast to CFD and CPD, the vast majority of City departments require a new employee, at or around the time of their hiring, to have their hand scanned at City Hall to enroll in the biometric timekeeping system. A three-dimensional image ofthe hand is then converted to an electronic template which is stored with the user's ID number in a database.1 Thereafter, in.order to clock in or out for a given day, an employee must swipe their ID card at a biometric hand scanner time clock ("Time Clock") or punch in their ID number on the Time Clock's numeric keypad and then place their hand on the Time Clock's hand scanner. According to the Time Clock user manual, the Time Clock compares the scanned hand "with the stored user's unique template. If the images match, the [Time Clock] records the transaction for processing." Thus, the requirement of a hand scan prevents City employees from improperly clocking in or out for each other.
Although both CFD and CPD have rules regarding timekeeping that direct their employees to place their hands on the Time Clock's hand scanner after swiping their ID cards, see CFD General Order 18-005(V)(B)(I) & CPD Department Notice D17
1 According to a "Biometric Hand Scanner Training Guide" created for the City 'The biometric hand geometiy used by l.he t irne clock contains no p; ivate info; matton and since the hand is rneasi irei I from the top down, there is no way whatsoever to collect ot stoie any fingerprint data so privacy and security is guaranteed"
OIG FILE #18-0438
CFD AMD CPD TIMEKEEPING PRACTICES
06(V)(E)(2)2, neither CFD nor CPD'enroll their employees in the biometric component ofthe City's timekeeping system by having their hands scanned when first entered into the system. As a result, following the swipe of a CFD or CPD employee's ID card or the manual entry of a CFD or CPD employee's ID number, the Time Clock will accept the scan of any hand that is placed on its scanner, even if it is not the hand of the person whose ID card was swiped or ID number was entered. Accordingly, CFD and CPD employees do not have to be physically present to successfully clock in or out.
OIG had two CFD employees separately swipe their ID cards at a Time Clock located at CFD's 3510 South Michigan headquarters. On each occasion, an OIG employee placed their hand, instead of the CFD employees', on the Time Clock's hand scanner. The Time Clock nevertheless registered the clock-ins as valid. Similarly, OIG had a CPD employee swipe their ID card at a Time Clock at CPD headquarters, also located at 3510 South Michigan. Then, an OIG employee placed their hand on the Time Clock's scanner instead ofthe CPD employee. The Time Clock still registered the clock-in as valid. Therefore, for CFD and CPD employees, the hand scan "requirement" currently serves no functional purpose and provides no meaningful deterrent to time falsification.
Based on its findings, OIG recommends that both CFD and CPD require their employees to be enrolled in the biometric component of the City's timekeeping system. Absent such enrollment, CFD's and CPD's current directives are pointless, and there is an obvious risk that does not comport with the City's expressed interest in reducing time falsification and absenteeism.
We ask that you inform us of any actions that the Department takes in response to these recommendations Any such response will be made public along with this advisory.
Joseph M. Ferguson Inspector General City of Chicago
cc: Reshma Soni, Comptroller, Department of Finance
Eddie Johnson, Superintendent, Chicago Police Department
The CPD Department Notice notes that "At this time members do not have to place their tiyht hand ON ihe card reader platform or make contact with the finger pins The readers are not capiunng any biometric data or fingerprints'
IGCHICAGOORG I OIG TIP LINE (866) 448-4754 | Tl Y (773) 478-2066
Respectfully,
OIG FILE #18-0438
CFDANDCPD TIMEKEEPING PRACTICES
Richard C. Ford II, Commissioner, Chicago Fire Department Soo Choi, Commissioner, Department of Human Resources Susie Park, Budget Director, Office of Budget and Management Tamika Puckett, Chief Risk Officer, Office ofthe Mayor Maurice Classen, Chief of Staff, Office of the Mayor
IGCI-MCAGOORG I OIG TIPLINE (866) 448-4754 | TTY (773) 478-2066
M.ISSION
The City of Chicago Office of Inspector General (OIG) is an independent, nonpartisan oversight agency whose mission is to promote economy, efficiency, effectiveness, and integrity in the administration of programs and operations of City government. OIG achieves this mission through,
• administrative and criminal investigations by its Investigations Section;
performance audits of City programs and operations by its Audit and Program Review Section;
inspections, evaluations and reviews of City police and police accountability programs, operations, and policies by its Public Safety Section; and
compliance audit and monitoring of City hiring and employment activities by its Hiring Oversight Unit.
From these activities, OIG issues reports of findings and disciplinary and other recommendations to assure that City officials, employees, and vendors are held accountable for violations of laws and policies; to improve the efficiency, cost-effectiveness government operations and further to prevent, detect, identify, expose and eliminate waste, inefficiency, misconduct, fraud, corruption, and abuse of public authority and resources.
AUTHORITY
OIG's authority to produce reports of its findings and recommendations is established in the City of Chicago Municipal Code §§ 2-56-030(d), -035(c), -110, -230, and 240.
RECEIVED #1
2020 FEB-3 AM 10*5*
CITY OF CHICAGO ¦ OFFICE OF THE MAYOR
OFFICE OF THE * -
CITY CLERK mayor lori e. lightfoot
October 3, 2019
Mr. Joseph Ferguson Inspector General City of Chicago
740 North Sedgwick, Suite 200 Chicago, Illinois 60654
Inspector General Ferguson,
This letter is in response to your September 3, 2019 Advisory regarding Chicago Fire Department (CFD) and Chicago Police Department (CPD) timekeeping. I have consulted the relevant department heads, and can provide the basis for the decision not to require biometric enrollment for CFD and CPD.
As noted in the Advisory and acknowledged in departmental notices regarding swiping, CPD and CFD are not currently enrolled in biometric scanning. This decision was made based on system limitations, and the intention is and has always been to enroll CPD and CFD members in biometric swiping once systems are upgraded to accommodate this additional capacity.
Approximately 12,000 non-public safety City employees are enrolled in biometric scanning. The system that supports this process has been in place since 2005. In 2017, the commitment was made to move CPD and CFD from a paper-based system to automated timekeeping. This added 21,000 employees to the system.
In the early stages of the rollout, the technical limitations of this aging system became apparent. As public safety employees were enrolled, there was difficulty with swipes being accepted, especially when employees were working overtime or had to swipe out from a different work location - a common necessity in the public safety departments. When swipes are not accepted, time edits need to be submitted by the employee and manually entered by timekeeping staff, potentially impacting payroll timing and integrity. The Department of Finance (DOF), which manages the payroll/swiping systems, verified these issues and determined that they were caused by system limitations related to biometric enrollment. Instead of delaying the entire public safety automated time and attendance initiative due to these issues, the City opted to accept swipes without biometrics in the immediate term
It should be noted that both departments have taken significant steps towards electronic: timekeeping. Beginning September 30, 2019, CPD requires every employee to swipe twice for each workday - once at the beginning of their shift and once at the end CPD also implemented an automated time off request
121 NORTH LASALLE STREET • ROOM 509 • CHICAGO. IL 60602
and overtime approval process in response to a previous Inspector General report. Additionally, CFD currently requires all 40-hour employees to swipe twice, and CFD is developing a workplan to transition all platoon shift employees to swiping twice. CFD will launch a pilot in one firehouse on October 16, 2019, wherein all employees will be required to swipe at the beginning and end of each work shift. The pilot will inform any operational and administrative needs for the full transition. CFD anticipates full transition of platoon shift employees to swiping twice by the first quarter of 2020.
DOF, together with the Office of Budget and Management, has begun work on the plan to purchase and implement a new time and attendance system, which would resolve many of the issues discussed above. This is a complex and multi-year project that will require sizable capital investment and significant training. In the interim, we will continue to take measured steps toward our goal of having a more effective time and attendance process across all City departments.
Maurice Classen Chief of Staff
Sincerely,