IG finds no evidence of email hacking related to travel scandal
By NIKKI WENTLING | Stars and Stripes | Published: February 28, 2018
WASHINGTON — The former Department of Veterans Affairs chief of staff was the subject of email “spoofing,” investigators determined, but the incident was not related to findings that she misled an ethics official in an email last summer – a connection that was implied by the VA secretary.
On Feb. 14, VA Inspector General Michael Missal released findings that VA Secretary David Shulkin and Chief of Staff Vivieca Wright Simpson violated ethical standards on a taxpayer-funded trip to Europe last summer. One of the most egregious findings was that Wright Simpson altered an email to an ethics official to mislead her into approving travel expenses for Shulkin’s wife.
Talking with reporters the following day, Shulkin said somebody had “taken over” Wright Simpson’s email account, implying that the two issues were connected. Shortly after, Rep. Tim Walz, D-Minn., asked the Justice Department to look into it.
Shulkin later backtracked, telling Stars and Stripes on Feb. 16 that the email spoofing was an isolated incident and that he had no evidence of hacking related to emails about the European trip.
The inspector general, working with attorneys from the Justice Department, also determined this week that the two were unrelated. They took Wright Simpson’s desktop and laptop computers, iPad and iphones and gained access to her personal network to conduct the investigation.
“Given the relevance of these allegations to a central finding in our report, the OIG took them very seriously,” Missal wrote in a letter Tuesday to Walz.
Investigators discovered an email using Wright Simpson’s name was sent Feb. 14, which they found to be a phishing attempt. That same day, the head of VA’s information technology staff issued a warning to senior VA staff to be on the lookout for phishing attempts to trick them into divulging company information or private data.
Investigators didn’t find any evidence Wright Simpson’s email was compromised near the time of the July trip, according to the letter.
The Office of Inspector General “now believes that the allegations of hacking are limited to unrelated and relatively unsophisticated ‘spoofing’ of Ms. Wright Simpson’s identity through messages sent from an external, non-VA email address,” Missal wrote.
Speaking to reporters Tuesday, Shulkin said he accepts that the spoofing was “separate and unrelated to the travel incident.”
“I went to medical school, not technology school. It’s an area I don’t have as much experience in,” Shulkin said. “My assessment is that the VA system, like most major health systems and companies, is constantly being attacked and tested. We have effective cybersecurity systems, so no one has gotten under the firewall.”
It was uncertain Wednesday how the findings may affect fallout from the IG’s findings of ethical violations.
Wright Simpson announced her retirement Feb. 16. The IG — thinking her actions might have violated criminal statutes — had forwarded findings of her ethical violations to the Justice Department, which declined to prosecute.
Shulkin and major veterans service organizations believe he has the support of the White House and will keep his job as VA secretary. White House Press Secretary Sarah Huckabee Sanders said last week that administration officials needed more time to review the IG’s report.
Divisions emerged after the report was released between Shulkin and political appointees who some believe want to privatize the VA health care system. Over the past few days, Shulkin has repeatedly said he wants those in the VA with “subversive ideas” to leave.
“I’m the secretary. I set the agenda. The time of getting off of our focus is over,” Shulkin said. “I suspect people are, right now, making decisions whether they want to be part of this team or not.”
One congressman, Rep. Mike Coffman, R-Colo., has been calling for Shulkin’s immediate resignation. In a letter to President Donald Trump on Wednesday, Coffman said the VA secretary “clearly lacks the moral authority to lead.”
“When the leader of a department is seen as willing to violate or stretch to rules to personal advantage, the example set is unacceptable,” Coffman wrote. “Inevitably, employees throughout the VA will consider the example set by Secretary Shulkin as a ‘green light’ to avoid accountability.”