Former Suffolk IT chief joins tech firm that had county contract

The former commissioner of Suffolk County’s Department of Information Technology has been named a top executive for a Great Neck technology firm that had been authorized for hundreds of thousands of dollars of county work, including for the Suffolk District Attorney’s Office, Newsday has learned.

Scott Mastellon has been named managing director for the public sector for SVAM International, a technology company that was engaged by the county from 2020 through 2023 on health care programming, police department gun permits and other projects, according to SVAM’s website and Suffolk County.

Michael Martino, a spokesman for County Executive Ed Romaine, said the SVAM purchase order was among millions of dollars of invoices and contracts under review.

“The Romaine administration is reviewing many contracts agreed upon by the prior administration, including the SVAM purchase order,” said Martino, who declined to elaborate. Romaine's office on Tuesday said the county had hired an outside firm to conduct a “deep-dive” audit of past contracts.

Newsday has reported on estimates as high as $27 million in spending by the Bellone administration during 16 consecutive months of states of emergency surrounding a September 2022 ransomware attack that crippled county online services, including its main website, for months. The administration, which had said that many of the purchases of new equipment were planned anyway, ended the state of emergency in December.

People familiar with the matter said the county in 2023 had an open purchase order for more than $200,000 in work hours authorized for SVAM, and tens of thousands of dollars in prior years. Some of those hours were devoted to the district attorney’s office, helping to deploy automated bots last year, they said.

The district attorney's office said it sought a recusal statement from Mastellon “to avoid any appearance of impropriety on our end in any future dealings."

“We immediately contacted SVAM to secure written assurance that Mr. Mastellon would not work on Suffolk County matters,” district attorney spokeswoman Tania Lopez said, and the district attorney's office received the assurance.

Suffolk County Comptroller John Kennedy said he’s asked the county attorney’s office for an opinion on the matter but had not received one as of Wednesday. He said it was his understanding the county's relationship with SVAM “has been terminated.” 

“It’s in my purview to say, 'Wait a minute.' To say, we have a guy who was directly involved not only in responding to the hack but lands as a highly placed individual with a firm” working for the county, Kennedy said. “At the very least how does that resonate with the ethics code?”

Mastellon didn't return voice and email messages seeking comment. He has not been accused of any wrongdoing. SVAM officials also declined to comment.

The county ethics code bars county employees from soliciting or accepting employment with any firm they are directly involved with in the course of their job. The code also requires employees to recuse themselves from prohibited activity.

The prohibition against working for an entity with which an employee was directly and personally involved applies even after the employee leaves the county, said Paul Sabatino, a municipal law expert and former counsel to the Suffolk County Legislature.

Speaking generally, Sabatino said any employee who violates the ethics code could be subject to a criminal penalty, and county officials may refer the matter to the district attorney for investigation. Penalties could include a jail term of up to one year and a fine of up to $1,000.

In any situation that requires recusal, the employee is required to contact a supervisor and submit a recusal statement, according to the ethics code.

Mastellon submitted a recusal statement to the Ethics Board on Oct. 11, according to a copy obtained by Newsday. The statement did not offer details on the conflict. It said only that the matter requiring his recusal was “dealings with SVAM and DOIT.”

The Ethics Board posts copies of all ethics opinions on its website, but redacts the names of people requesting opinions. A Newsday review of the opinions found that none of the opinions appeared to match the facts of Mastellon’s case.

Attorney Michael Raniere, who is the press contact for the Ethics Board, said in an email the board does not comment on opinions or the people who request them.

Sabatino said the wording of the recusal statement rendered it “worthless.”

“He didn’t comply with the law because the purpose of that form is to inform the ethics board and your supervisor what the conflict could be,” Sabatino said. 

The statement indicated that Mastellon notified his supervisor, former Deputy County Executive Lisa Black, who did not respond to phone calls and texts requesting comment. 

Lopez said, “We did not know he went to work for SVAM until January, and we found out informally.”

A page on the SVAM website indicates the company “deployed multiple robots” that were designed to help the Suffolk District Attorney's Office automate the process of creating subpoenas “based on customized templates” that could “properly serve them to providers,” such as AT&T, Verizon, T-Mobile and Meta. The district attorney would then “receive document responses” from those companies that could be forwarded to the proper assistant district attorney.

The company also said on its website that the SVAM team “updated internal databases and systems regularly, ensuring data integrity and quality without any manual errors.” 

But Lopez said those specific services, while discussed, were never rendered. “The project link that you sent to us was discussed as a theoretical project pre-September 2022; however, no practical steps were ever taken to program it.”

In addition, the district attorney's office said, while there was an open purchase order with the county, “there have been no recent work orders” by the district attorney's office for work with SVAM.

Past work was procured and approved by the county IT department, which also monitored and paid the contracts. “DOIT had a preexisting business relationship with SVAM,” Lopez explained.

The Suffolk County Police Department also used the purchase order to employ SVAM programmers, department spokeswoman Dawn Schob confirmed.

“The work was utilized to automate basic business processes in the Pistol License Section in an effort to streamline pistol-license applications,” Schob said in an email. The department requires contractors complete a background check, and “three SVAM employees successfully completed the background check before receiving affiliate access for the pistol license project,” Schob added. “The background check process for additional people was suspended due to the contract expiring” at year’s end. It was unclear whether any SVAM employees worked on county projects without clearance.

Asked if SVAM employees had access to data on the district attorney's files, Lopez wrote, SVAM “never had unrestricted access to SCDA files.” Instead, the district attorney's staff assembled “test cases” to provide to SVAM programmers to “assist in the initial programming of a given function.”

Public records indicate SVAM was active in contributing to county campaigns over the past decade. Between 2015 and 2023, the company donated $29,500 to then-County Executive Steve Bellone’s campaigns, and just over $12,500 to former Suffolk District Attorney Tim Sini. The company also donated to Nassau County Executive Ed Mangano, who is serving a 12-year prison sentence for bribery, wire fraud and obstruction convictions.

In addition to county contracts, SVAM has been awarded at least 13 state contracts, according to the state database. They ranged from a $73.1 million contract in 2015 for the state Office of General Services to the most recent, a $303,998 contract in January for the state Office of Information Technology. The company had just over $3 million in state contracts last year.

In addition to corporate donations, SVAM’s chief executive officer, Anil Kapoor, has also been a frequent donor. He has donated to Gov. Kathy Hochul’s campaign, including $18,000 in January and $37,100 in September of 2022. Kapoor has given $47,700 to Sini, including one $20,000 donation in June 2021. 

He has also given to former Suffolk Deputy County Executive Jon Kaiman ($8,000), county executive candidate David Calone ($10,000) and Bellone ($8,500), in 2022 and 2016. 

Sini declined to comment. Kapoor, reached while traveling overseas on Tuesday, also declined to comment. A spokesman for Hochul said, “Agency procurement decisions are made independently of the Executive Chamber and we had no involvement in the selection of this vendor.”

Bellone’s administration hired a politically active former SVAM official to take a cabinet post. Mohinder Singh Taneja, a former sales and marketing executive at SVAM, according to his web page, was appointed as Bellone’s director of diversity outreach until he left with the administration in December. He previously served as managing director for SVAM, Taneja acknowledged in a brief phone call, confirming public records. Bellone didn't respond to a request for comment. 

Taneja was among at least three county officials who took a trip to India in 2022, just one month before the cyberattack. Records provided under the state Freedom of Information Law showed Black spent $3,486 in expenses on the trip while economic development director John Schneidawin spent $3,487. There was no record of Taneja’s expenses, according to the county comptroller’s office. Taneja declined to say how his expenses were paid.

Mastellon served as Bellone’s top IT commissioner in the years and months leading up to the ransomware event, and led the response in its aftermath.

Findings in a legislative investigation have shown hackers were in place months before the attack, and the county was not able to detect the hackers even after an FBI tip of the attack in June 2022 warned of an ongoing attack, Newsday has reported. In December, expressing frustration with the administration’s handling of the FBI warning about the possible attack, Legis. Anthony Piccirillo (R-Holtsville) said during a public hearing that Mastellon and another top official should resign.

“I called for their resignation after they took no responsibility for fumbling the FBI tipoff and holding back reports from the legislature,” Piccirillo said this week. “They should have resigned.”

A draft report on the committee’s findings is due soon, pending an interview with Black, Piccirillo said. Bellone frequently commended Mastellon and top administration leaders for their work through the crisis, and blamed much of it on former county clerk IT director Peter Schlussler, who is suing Bellone and others on his team for defamation.

Piccirillo said he supports a full review of IT spending during and after the attack. “We need a full accounting of where every dollar of that money went,” he said.