Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Email Security topic
No spam. Unsubscribe anytime.
Manchester Housing Commission shifts commission email to shared mailbox after IT audit; commissioners raise privacy concerns
Summary
City information systems converted the Housing Commission's user account to a shared mailbox to address security and tracking issues. IT described quarantine filters and forwarding rules; a commissioner said the timing and staff review of her social media raised concerns about gatekeeping of resident messages.
The Manchester Housing Commission on April 9 heard that the commission's email account was converted from a regular user account to a shared mailbox after an audit by city information systems, a change IT described as intended to reduce security and password‑sharing risks.
Rich Martinez of Information Systems told commissioners the audit found multiple mayoral–office accounts created as user accounts that should have been shared mailboxes. Martinez said shared mailboxes cannot be used to sign in on a workstation or mobile device and are limited to about 50 gigabytes of storage. He said the change will let staff track who sends mail “as Housing Commission” and avoid the security problem of one generic password being shared and used from anywhere.
Martinez described the city's quarantine and filtering process for incoming mail: roughly 202 filter phrases and about 38 control checks are applied; suspicious messages are quarantined for human review. He said quarantined items can be released or deleted from a quarantine notification interface and recommended that IT remain the gatekeeper for releasing items to commissioners to avoid exposing commissioners' personal devices to potential malware. Martinez also suggested options such as creating a separate non‑city email account for the commission to receive forwarded mail if commissioners prefer not to use city accounts.
Commissioner Jody Brown said she believed the timing and handling of the change “smelled like gatekeeping,” expressing concern that some resident messages she considered sensitive — describing housing instability or other personal hardships — might be filtered or delayed. Brown also said two city employees had reviewed her LinkedIn profile after she posted about the email issue, which she found intrusive; she urged staff to ask questions directly instead of searching personal social media profiles.
Kate Markey, who opened the meeting, and other commissioners discussed practical effects: because most commissioners do not have city laptops or Outlook clients, forwarded messages will arrive at commissioners' personal email addresses and therefore lack the city's endpoint protections. Commissioners discussed creating a dedicated, non‑city mailbox (for example, a separate Gmail account) to collect forwarded messages without exposing personal inboxes to spam or malware.
Martinez said that, under the shared‑mailbox configuration, only authorized city employees will be able to send email that appears as from the Housing Commission; other commissioners will receive forwarded copies. He also said city staff can work with external vendors to correct DNS/SPF/DKIM misalignments if legitimate senders are repeatedly quarantined.
The commission agreed to have IT continue to manage quarantined messages and to report back about options for limiting who can release quarantined mail and whether the commission wants dedicated non‑city accounts or city accounts created for commissioners.
The meeting moved on after the email discussion.
Ending: The meeting proceeded to other agenda items after the email briefing; commissioners recorded concerns about timeliness and access to resident messages and asked for follow‑up from IT on release controls and options for dedicated commission mailboxes.
