Overview
During the audit period, the Essex County District Attorney’s Office (EDAO) did not promptly revoke former employees’ access rights to the Track-Kit system. Specifically, of the 7 active user accounts for the Track-Kit system, 2 of these users were former employees. Additionally, EDAO did not complete certain data fields (i.e., the assignment of EDAO’s contact information in the system), despite this being part of the office’s role within the Track-Kit system and having the capability to do so.
If EDAO does not promptly revoke former employees’ access rights to the Track-Kit system, then there is a higher-than-acceptable risk of unauthorized access to sensitive case and survivor information. Additionally, if EDAO does not assign its contact information to SAECKs, then the Track-Kit system is not being fully used as intended. Having EDAO contact information assigned to SAECKs allows survivors to have an informed single point of contact and can streamline outreach and reduce confusion.
Authoritative Guidance
Section 18X(g) of Chapter 6A of the General Laws states, “District attorney offices shall participate in the statewide sexual assault evidence kit tracking system established in this section for the purpose of tracking the status of all sexual assault evidence kits.”
The Track-Kit User Manual states that the role of the prosecuting attorney includes the following:
- Review cases referred by law enforcement, if enabled.
- Assign [EDAO contact information] to a kit.
- Performing searches for kits available in the prosecuting attorney’s jurisdiction.
EOPSS’s “Policies and Procedures for Sexual Assault Evidence Collection Kit Tracking,” dated January 2020, requires district attorneys’ offices to develop “a policy to authorize access for new users of the system and to remove authorization from users who no longer require access, including users who have ended their employment, have been suspended, or terminated.”
Reasons for Issue
EOPSS offered voluntary trainings on the use of the Track-Kit system to district attorneys’ offices in 2019, but we did not find any evidence that EDAO staff members attended this training. EDAO management told us that they generally opt to use the Massachusetts State Police Crime Lab’s Legal Access Web-Based System, a laboratory information system, to obtain testing results for SAECKs associated with EDAO’s active cases. The law does not define the role of the district attorneys in the Track-Kit system; it just requires district attorneys to participate in the system (see Other Matters). According to EDAO management, staff members at EDAO have the discretion to use the system as they see fit.
Additionally, EDAO did not have documented policies and procedures regarding the revocation of user access to the Track-Kit system upon termination of a user’s employment.
Recommendations
- EDAO should develop, document, and implement policies and procedures for adding access authorization for new users and revoking user access to the Track-Kit system upon termination of a user’s employment. These policies and procedures should incorporate periodic access reviews (at least semiannually) to ensure that users’ access rights are limited to their individual job requirements.
- EDAO should assign its contact information to each SAECK within its jurisdiction in the Track-Kit system and should train its employees on how to use this system.
Auditee’s Response
We acknowledge our statutory obligation to actively participate in the statewide sexual assault evidence collection kit (SAECK) tracking system, known as Track-Kit. We will take immediate steps to ensure EDAO becomes fully compliant with this requirement.
We will work with the Executive Office of Public Safety and Security (EOPSS) to clearly define and standardize our role in the Track-Kit system. This will include seeking clarification about best practices and standardization for the system’s use. EDAO will also develop, document, and implement policies and procedures for adding new users and for revoking user access upon termination of employment. These procedures will incorporate periodic access reviews at least semiannually to ensure that user access rights are limited to their individual job requirements.
It is important to note, however, that the office has not experienced any discernible adverse impact on cases as a result of using the Massachusetts State Police Crime Lab’s Legal Access Web-Based System (LIMS) in place of the Track-Kit system. While this is not an excuse for non-compliance, it serves as an explanation of our past practice. We are fully committed to fulfilling our statutory obligations moving forward.
Auditor’s Reply
EDAO states in its response that it “has not experienced any discernible adverse impact on cases” from using the Massachusetts State Police Crime Lab’s Legal Access Web-Based System instead of the Track-Kit system. The Track-Kit system, like the law that implemented it, was designed to serve survivors of sexual assault, not only to serve as a case management system for district attorneys’ offices. Full participation in the Track-Kit system is necessary to meet the law’s intent and ensure consistent, survivor-centered practices across the Commonwealth.
Based on its response, EDAO is taking measures to address our concerns regarding this matter. As part of our post-audit review process, we will follow up on this matter in approximately six months.
| Date published: | November 25, 2025 |
|---|