Objective

To determine the extent of implementation of the seven recommendations included in our initial audit report, Controls Over Tablet and Kiosk Usage by Incarcerated Individuals (Report 2022-S-8).

About the Program

The Department of Corrections and Community Supervisor (DOCCS) provides access to tablets and kiosks at no cost to Incarcerated Individuals (or Individuals) through a contract with Securus and its subsidiary JPay Inc. (Provider). Tablets are loaned to Individuals in the general population and can be used by Individuals to access DOCCS-approved educational material; purchase DOCCS-approved music, videos, e-books, and other media; and communicate with family and friends using a fee-based secure messaging system through an account (JPay Account) created on the Provider’s website.

The objectives of our initial audit, issued in May 2023, were to determine if DOCCS provided sufficient oversight to ensure that the independent network, kiosks, and tablets used by Incarcerated Individuals were secure, and whether secure messaging accessed by these individuals complied with DOCCS directives. The audit covered the period from February 2019 through August 2022. Our initial audit found DOCCS had limited assurance of compliance with its directives. Specifically, DOCCS did not know how many Individuals opted in/out of the tablet program and did not internally monitor the number of active tablets at its facilities, instead relying on the Provider to maintain these records at both statewide and facility levels. Additionally, DOCCS did not verify the identity of community members in correspondence with Individuals through secure messaging, and its secure message content screening process did not adequately capture all the risks to Individuals and others. Further, DOCCS was not adequately overseeing the security and configurations of certain assets and did not ensure systems were maintained at vendor-supported levels required to preserve the accuracy and integrity of DOCCS information.

Key Findings

DOCCS officials made some progress in addressing the problems we identified in the initial audit report. Of the report’s seven audit recommendations, one was fully implemented, three were partially implemented and three were not implemented.

Key Recommendation

DOCCS officials are requested, but not required, to provide information about any actions planned to address the unresolved issues discussed in this follow-up within 30 days of the report’s issuance.