Audit of the Executive Office of Public Safety and Security (August 8, 2024)

This is a Massachusetts State Auditor performance audit of the Executive Office of Public Safety and Security, covering July 1, 2020 through October 31, 2022.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of the Executive Office of Public Safety and Security (EOPSS) for the period July 1, 2020 through October 31, 2022.”

Auditors checked whether the agency followed state rules for sexual assault reporting, evidence kit testing, quarterly reporting, and tracking the location of evidence kits.

“The purpose of our audit was to determine the following:”

The report matters because mistakes in privacy protection, evidence review, shipping, or tracking can affect sexual assault survivors and criminal investigations.

“The lack of proper review of the PSCR forms and subsequent data has created a threat to privacy and confidentiality for survivors of sexual assault.”

For an ordinary resident, the key issue is whether Massachusetts systems protect survivor privacy and handle sexual assault evidence kits carefully, on time, and transparently.

“Survivors of sexual assault can confidentially view the location and status of their SAECKs in the Track-Kit system.”

The Auditor found four main problems: personal information appeared in records, evidence-kit reviews missed the 90-day deadline, shipments were late, and the tracking system had wrong kit locations.

“Below is a summary of our findings and recommendations, with links to each page listed.”

The Auditor recommended that EOPSS review and clean its data, improve controls and training, ship remaining eligible kits, and audit kit locations; EOPSS said it has taken or plans steps in several areas.

“Based on EOPSS’s response, it is taking measures to address our concerns regarding this matter.”

The findings are significant because delayed testing and inaccurate tracking can slow investigations, while privacy lapses can expose sensitive information about survivors or their families.

“Prolonged reviews of QLIM can result in delays in DNA testing and subsequent delays in DNA profiles being entered into the Combined DNA Index System (CODIS) database, which can prolong the process to identify potential perpetrators, prevent them from committing other crimes in the future, and hold them accountable for their actions.”

PII means personal information that could identify a sexual assault survivor; SAECK means a sexual assault evidence collection kit; QLIM means evidence so limited that testing may use it up.

“According to Section 12A1/2 of Chapter 112 of the General Laws, the PSCR form must not include any of the survivor’s personally identifiable information (PII), such as their name, address, or any other data that could confirm their identity.”