Young Kwak photo
Julie Garcia is the CEO of Jewels Helping Hands, a nonprofit homeless service provider.
On Feb. 6, Julie Garcia emailed Spokane Mayor Lisa Brown with a serious concern.
Weeks prior, Brown's administration had agreed to reimburse Garcia's homeless service nonprofit, Jewels Helping Hands, for its efforts to operate churches as warming shelters during a bitter cold snap that struck during Brown's second week in office.
Garcia's organization completed the work as promised, but the city still hadn't sent her a billing form.
"We have a completed contract we can not bill against because we can not get anyone to send us a billing form," Garcia wrote in the Feb. 6 email to Brown and other city officials. "We have emailed everyone we can and not one response... This has been the way the city has run for the last 4 years and I see no difference now. That's disappointing."
No one replied.
Garcia and her husband Jason Green, the treasurer for Jewels, grew increasingly frustrated. They sent more emails, and were met with more silence.
In a Feb. 16 email to the city, Green wrote that Jewels was floating more than $80,000 for the project and unable to get even a simple "received" email. Some Jewels employees weren't cashing paychecks they'd earned to prevent Jewels' cash reserves from being "completely decimated due to the City's delays and lack of communication," Green wrote.
The mayor had agreed to pay Garcia's organization, so why did it seem like Brown and her staff were ghosting her?
Green wrote that the lack of communication must either be the result of "a department that is so overwhelmed that they are weeks behind on even emails," or a "complete disregard for those that contract with the city."
But what if it was something else?
A copy of Garcia's Feb. 6 email was also sent to the Inlander. But when we filed a public records request asking the city to provide us a copy, the city couldn't find what we were talking about. The city's IT department said they had searched Brown and other officials' inboxes for a Feb. 6 email from Garcia with the keyword "billing form," and came back with zero hits.
That was odd. Brown's official mayoral email address was listed as a recipient, along with other officials. Washington's public records law requires that cities maintain copies of electronic communications for at least six years and, with a few narrow exceptions, provide copies to citizens when requested. If Brown and other city officials had all deleted Garcia's email from their inboxes, that would be against the law.
Turns out, Brown never received the emails in the first place. No one from the city did. Unbeknownst to anyone, a third-party security company the city contracts with had inadvertently started blocking Garcia and Green's emails in January.
Garcia — who frequently and publicly clashed with former Mayor Nadine Woodward — tested the issue in February by sending an email to a city staffer's personal email not affiliated with the city. It went through without any problems.
But when Garcia sent the same email to the staffer's email, it never arrived. Not even in the spam folder. The staffer said they weren't able to forward Garcia's email from their personal account to their city address.
Without realizing it, Garcia had spent weeks talking into a digital void.
Michael Sloon, the city's director of Innovation Technology Services, says there's no evidence that Garcia and Green's emails were blocked because of any action taken by the city.
"This blocking was not something the city did purposely," Sloon says.
The city's email accounts are hosted on Microsoft Cloud. Sloon says the IT department does technically have the ability to block email accounts, but that a request to do so would have to go through the city's legal department. And Sloon doesn't recall the legal department ever telling IT staff to block an account.
After digging into the problem this week, Sloon says his team discovered that Garcia's emails were blocked by a company called Barracuda that the city has contracted with for years for cybersecurity and spam prevention.
"The reason we do that is that we get thousands of emails a day that are spam and nefarious actors that those services block," Sloon says.
Companies like Barracuda maintain "blacklists" of thousands of email accounts. The city isn't notified when an account is added to the list.
On Wednesday, city IT staff did a search and discovered that Garcia's email account had been added to Barracuda's blacklist sometime after Jan. 23, Sloon says.
After the Inlander inquired about Green's account, IT staff did a search and found emails from Green that had also been blocked.
"We believe these were blocked because the email included/referenced Julie Garcia's email address," Sloon says.
Sloon alerted Barracuda to the problem on Thursday, March 7, and Garcia's email was removed from the blacklist. All the emails she'd sent over the past month flooded into their intended recipients' city inboxes at the same time. Green's emails followed hours later. The city's records department followed up shortly after to say they'd found the Feb. 6 email from Garcia we had requested.
It's unclear why Garcia's account ended up on Barracuda's blacklist in the first place. She's been emailing the city for years without any issues. She uses a basic Gmail account. Garcia can't think of anything out of the ordinary she sent recently that would cause her account to be flagged. The Inlander has continued to receive her emails without problems.
"[Barracuda's] effort is to limit the impact of any truly nefarious actor, the collateral is that some other legitimate emailers can get blocked," Sloon says. "It is then typically up to the entity that is being blocked to resolve."
Sloon says Barracuda uses an algorithm that analyzes a number of factors to determine if something is spam. The company keeps most details of its algorithm a secret, he says, but a single person reporting an email as spam likely wouldn't be enough to get an account blacklisted. If a large number of people reported a sender's emails, that might contribute, he says.
"I believe it takes a lot for an entity like Barracuda to block someone," Sloon says. "I believe you have to have a lot of response to a service like Barracuda in order to warrant it."
Sloon says anyone having issues with their emails getting through can contact the city so IT staff can research the issue and contact Barracuda to address it.
On Feb. 21, Green contacted the city through a separate email account associated with his other job. It worked.
Dawn Kinder, the city's Neighborhood, Housing and Human Services director, replied to the email, saying she had realized emails weren't being received during a meeting with Garcia the day before, and was working with IT to figure out the problem.
Kinder also told Green that she had been in communication with Garcia over text, and that the paperwork necessary to reimburse Jewels for the warming shelter project was working its way through city bureaucracy.
"I assure you we are acting in good faith," Kinder said.
Garcia eventually received the billing form and was able to invoice the city.
The blocking may have been a totally random technical error, but it still happened at a very inconvenient time, and threatened to fracture trust between Garcia and Brown's new administration.
"I thought they were just not responding," Garcia says. "It strains the relationship on both sides."
Green and Garcia — two city contractors who had clashed with the city on numerous occasions — were left in the dark while trying to get answers about a contract they had been awarded under a state of emergency.
"What if this is happening to other providers and nobody knows?" Garcia says.
Several weeks ago, Garcia says she sent the city a proposal to use state Department of Commerce funding to purchase a local hotel for use as a shelter. Because of the block, she says the city never received it, and the deadline for the Commerce funding passed.
"These are big issues that we have to have a way to communicate with the city," Garcia says. "It's public record."
