South Carolina legislature claims treasurer risked cyberattack, didn’t disclose $1.8B in state funds

A South Carolina Senate finance subcommittee found that state Treasurer Curtis Loftis risked a cyberattack by saying he was going to post highly detailed information about the state’s financial system online, according to a report published Tuesday.

Tuesday’s report is the state’s latest attempt to uncover how $1.8 billion in unspent money ended up in an account managed by the treasurer’s office. The subcommittee found that the funds are connected to a major IT systems upgrade called the South Carolina Enterprise Information System. The funds sat in the fund without identification of agency claim or ownership since 2016, according to the report.

“Treasurer Loftis failed to disclose the existence of the $1.8 billion fund to the General Assembly and to the people of South Carolina over the last seven years, despite his explicit statutory duty to do so,” the report read.

On April 2, Loftis testified for five hours before the South Carolina Senate Finance Committee’s Constitutional Subcommittee. When questioned about his compliance with the state’s transparency laws, Loftis said he would publish a detailed report on the state’s finances to comply with the state’s transparency provisions and claimed that members of the subcommittee “reinterpreted” the law.

“That report will do nobody any good except give every Internet scammer and Caracas, Klev and Moscow a target,” Loftis said during his testimony, according to the report. “But we will be more than happy to say my discretion has been wrong and I’m the violation of the law because I didn’t put that on the internet.” 

According to the report, Loftis alerted the South Carolina Department of Administration of his plan to publish the financial report to protect the South Carolina Enterprise Information System and other financial and information systems “against the security risks created by publication of such detailed information.” The subcommittee asserted in Tuesday’s report that it made no directives to Loftis during the his testimony to publish the financial report, but instead was questioning his compliance with state statute.

“The detailed fund report proposed by the Treasurer for publication appeared to include extremely sensitive information unnecessary to fulfill the requirements of the statue,” the subcommittee’s report read. “Its release posed a significant threat of compromising the data security of the State.”

“Following the advice of independent cybersecurity experts, the Department of Administration acted expeditiously, cautioning Treasurer Loftis to reconsider the level of detail he intended to publish,” the report continued. “Additionally, the subcommittee was informed that Governor [Henry] McMaster called Treasurer Loftis and advised him against publishing the detailed financial information.”

The subcommittee members wrote in the report that they were “alarmed” by Loftis’ plan to publish the financial report online and that it reflected poorly on his judgement.

The state first launched an investigation into the matter in October, when the state’s comptroller instructed Loftis to research the origins of the $1.8 billion and determine which state entities and agencies owned the funds. Neither the general public nor members of the state’s general assembly knew about funds until the comptroller’s letter, the report states.

As a result of the report, the subcommittee recommended an independent, forensic audit of the funds and did not recommend that Loftis resign or be removed from his position. Instead, South Carolina Gov. Henry McMaster convened a task force to investigate the source of the funds and asked for Loftis’ cooperation.

The report also recommends the legislature create a constitutional amendment on the ballot to make the treasurer’s office an appointed position, rather than elected.