Madison County supervisors refer camera-access probe to Iowa AG and DCI, cancel Johnson Controls contract

The Madison County Board of Supervisors voted to refer an investigation into suspected unauthorized administrator logins to the county’s security camera system to the Iowa Attorney General’s office and the Division of Criminal Investigation, and directed staff to prepare cancellation of the county’s contract with Johnson Controls and seek a refund.

The chair of the Madison County Board of Supervisors said on the record that "there were 10 failed login attempts into the vendor admin login access to our security system here," and that review of vendor footage showed access by an account associated with a vendor that the board had earlier removed from authorized status. The chair said the county attorney and the sheriff also had "full access to our video server" but that the vendor-admin status would allow actions such as adding or removing users, changing passcodes and deleting footage.

A committee member who moved the referral said the additional administrator-login attempts were uncovered while reviewing an audit log requested from the county’s certified authorized vendor (Summit). That member moved that the board forward the matter to the Iowa Attorney General and the Division of Criminal Investigation for an independent review; the motion passed on a roll-call-style vote with two supervisors voting yes and one voting no.

The chair told colleagues the questioned vendor contract had not been approved by the board and said the contract was signed by a staff member using a title the chair described as not valid. The board approved a separate motion to ask staff member Michael Bull to prepare documentation to cancel the current service agreement with Johnson Controls and to request a refund; that motion also passed with a 2–1 tally.

Board members also approved a motion to update the county’s camera-system access and open-records policy to make explicit who can log in and who can authorize release of footage. Supervisors agreed the broader topic of a countywide cybersecurity policy would require additional work and legal review, and they requested a further work session to sort policy details and legal questions.

One supervisor voted against referring the matter to outside investigators and against the contract cancellation, saying they preferred handling the matter internally and continuing to pursue in-house remedies. The transcript notes board members referenced about "40 emails" circulating on the issue and said the March board resolution had named Summit as the only authorized administrator for the camera system.

Next steps recorded in the meeting included referring the access concern to the Iowa AG and DCI, directing Michael Bull to draft formal cancellation and referral paperwork, scheduling follow-up policy work on camera access, and planning a future discussion of broader cybersecurity policy. The special session then adjourned.