HENNEPIN COUNTY, Minn. – Two former Hennepin County information technology employees have been charged related to alleged theft and fraud schemes that spanned years and profited them nearly $4 million from stolen equipment and timecard fraud, charges say.
Nguyen Cong Le, 41, and Samantha Marks, 37, both of Columbus, Minn., have been separately charged in Hennepin County District Court with felony counts of theft by swindle — six against Le and two against Marks.
Charges say the theft scheme is alleged to have spanned over seven years starting in late 2012 and involved the theft and resale of “network switches,” which are computer hardware networking devices used in the transfer of data.
Cisco 3850-series switches (Cisco.com)
The timecard fraud scheme began in 2016 and revealed that Marks worked “few or no hours” over a period of years despite claiming 80 hours worked biweekly, charges say. Both schemes were perpetrated into early 2020 when both parties were terminated from their employment with the county.
The criminal complaints against Le and Marks explain that the two were in a romantic relationship with each other. Le hired Marks and was her direct supervisor responsible for, among other things, approving her timecard submissions and conducting her annual performance reviews.
Le began his employment with the county in 2006 and was promoted in 2013 to the position of IT Network Enterprise Manager. Le’s duties included ordering network equipment, including network switches, for county use.
Marks began working for Hennepin County in 2016 as a member of the “voice team” with the responsibility of helping handle issues with county telephones.
Investigation begins
Charges say an internal investigation began when questions arose from IT staff regarding Marks’ absence from work. The investigation determined that biweekly timecards submitted by Marks and approved by Le, her supervisor, in which Marks represented that she had worked 80 hours during the corresponding pay periods were routinely false.
While looking into the timecard fraud, investigating staff encountered security video showing that Le used his employee access card to enter the Hennepin County Government Center on three separate weekend days and took network access layer switches belonging to the county, collectively worth thousands of dollars, plus other unidentified equipment. Marks accompanied Le on one of those occasions.
Following the discovery of the alleged thefts, the matters were referred for a criminal investigation, which uncovered evidence that Le had been taking county network switches and selling them, over a span of more than seven years, to buyers in Oklahoma who paid Le via PayPal. During that time, Le was the county employee responsible for managing its inventory of network switches. Le’s aggregate PayPal sales to the Oklahoma buyers totaled at least approximately $3.9 million between late 2012 and early 2020.
Timecard fraud
Marks’ first day of work for Hennepin County was Feb. 2, 2016. Her timecards, which Le was responsible for reviewing and approving, reflect that she did not use a single hour of paid time off (PTO) between Feb. 2, 2016, and Jan. 31, 2020. According to her timecards, during every one of the biweekly pay periods in that time span, Marks worked 80 hours coded as regular work or some combination of regular work, comp time, and standard paid holidays. As of Monday, Feb. 3, 2020, Marks was suspended from work in connection with the internal investigation. She used PTO (along with the Presidents’ Day holiday) to be paid for the next three weeks until her employment was terminated as of Feb. 21.
Several records indicate that Marks worked few or no hours despite her reporting on her timecards. These records include access card logs showing that Marks used her employee access card to enter secured areas of county buildings (such as the secured area in which her work space was located) only twice between Dec. 1, 2018, and Feb. 19, 2020; logs reflecting that actions such as saving or deleting files in Microsoft Office products on her assigned county laptop occurred only 22 times between Sept. 23, 2019, and Feb. 19, 2020, and that the majority of those 22 actions took place during her February 2020 suspension; evidence that she had rarely sent emails from her county address, and rarely read emails sent to that address, in the months leading up to Feb. 19, 2020; records indicating that she used her county desk phone for an aggregate total of 5 minutes and 21 seconds between Sept. 4, 2019, and Jan. 31, 2020, including no use at all after Sept. 26, 2019; and call records covering 11 months between February 2019 and February 2020 showing that she used her county mobile phone primarily for non-work-related calls. Finally, records establish that one of Marks’ and Le’s children was born on Monday, Sept. 19, 2016. Marks’ timecard for the period including that date, which Le approved, reflected that Marks worked 8 regular hours on the day their child was born, and continued to work regular hours with no PTO or other leave time thereafter. (Le used PTO on Sept. 19 and 20, 2016.)
Investigators learned that Le hired Marks in 2016 without following county processes to do so. Le told IT and HR staff looking into the Marks timecard issue that he had not kept any of the paperwork regarding her hiring process, as was required, and that he did not recall who else participated on the interview panel when Marks was hired. In an interview, one of Marks’ coworkers reported that although he was on the same team as she was, he did not interact with her and saw her only at a county training event. He said he knew of one project she had worked on. That project took place between February 2016 and March 2017, according to county personnel.
Prior to Marks’ suspension in February 2020, Le was the only person who approved her timecards during her tenure at Hennepin County. Between Sept. 19, 2016, and Jan. 31, 2020, based on timecards Marks submitted and Le approved, Hennepin County paid Marks for about 7,042 reported hours at rates of about $40 or more per hour (increasing over time as she was given raises based in part on her annual evaluations from Le), totaling more than $280,000, plus benefits.
Property thefts
In early March 2020, in reviewing recent employee card access logs for Marks and Le in connection with the internal timecard fraud investigation, investigating personnel observed that Le had used his access card in the Hennepin County Government Center on three recent weekend dates — Jan. 11, Jan. 19, and Feb. 9, 2020. Investigators were able to preserve and review security video for each of these dates. The footage showed Le (with Marks’ assistance on Jan. 11, and alone on Jan. 19 and Feb. 9) taking IT equipment, loading it into his personal vehicle in the Government Center parking ramp, and driving away. The equipment included unboxed network switches, boxes readily identifiable to county IT staff as containing network switches, and other boxes with unidentified contents. Access card logs do not show Le or Marks using a card to reenter the Government Center or any other county building after taking the equipment on those three days. In total, the videos appear to show Le taking 33 network switches (boxed and unboxed) in addition to the other unidentified equipment.
An underground parking ramp at the Hennepin County Government Center. (Tony Webster/Flickr)
At the time, network switches cost the county anywhere between about $1,170 and $15,210 per switch depending on model, meaning that the total cost of the 33 switches taken by Le in 2020 on Jan. 11 (12 switches), Jan. 19 (15 switches), and Feb. 9 (6 switches) would have been between about $38,610 and $504,930. From and after sometime in 2012 through the end of his employment tenure, Le was the county employee responsible for maintaining an appropriate number of switches on hand and for ordering switches from the vendor. Working hands-on with switches was not part of his job. Le did not keep a comprehensive inventory of switches.
Investigators discovered records on Le’s county laptop indicating that he had received significant transfers of money from PayPal into a Wings Financial Credit Union savings account and subpoenaed records of PayPal accounts associated with Le and the Wings account. In response, PayPal produced records for two accounts. The accounts were in the names of “David Le” and “Nhan Nguyen.” Each was linked to a single bank account, the Wings savings account held solely in Le’s name. The “David Le” PayPal account was active only briefly, between Aug. 31, 2012, and Sept. 11, 2012. The “Nhan Nguyen” PayPal account was active between Nov. 14, 2012, and July 8, 2020. Each account was associated with an email address that contained a letter and number string similar to Le’s county email signature and was the same as the letter and number string on a professional certification available through the technology company Cisco.
Transaction records for these two PayPal accounts show that between Sept. 4, 2012, and Feb. 17, 2020, the accounts received a gross total of $1,454,635 (all but $7,350 of which was received through the longer-lived “Nhan Nguyen” account) across about 180 payment receipts in amounts generally ranging between $6,000 and $10,000 per payment. Of the total amount received, $1,387,364.20 was withdrawn from PayPal directly to Le’s Wings savings account. (The records show that the difference between the total gross received and the total withdrawn to the Wings account is primarily attributable to PayPal transaction fees.) Some transaction records included descriptive notes indicating that the items sold were Cisco Catalyst 3850 network switches (“3850 switches”). Hennepin County used and Le was responsible for ordering and maintaining the county’s inventory of that type of switch between about March 2013 and December 2019.
Investigators obtained additional bank records for Le and noted that a Wells Fargo account in his name included sizable deposits from PayPal similar to the ones received in the Wings account. A subpoena to PayPal for records of any account linked to that Wells Fargo account yielded records of another PayPal account, this one in Le’s own name, with an associated email address, which was active between Feb. 28, 2000, and July 8, 2020. This account included more and a wider variety of transactions than the “Nhan Nguyen” and “David Le” accounts, but also included about 340 additional payment receipts between May 11, 2012, and April 3, 2020, from the same customers who purchased switches from the other accounts. Many of those transactions similarly included notes indicating that the items sold were 3850 switches. The payments again often ranged from $6,000 to $10,000 each, and totaled $2,462,642.50 in gross, of which $2,175,272.11 was withdrawn to Le’s Wells Fargo account.
PayPal records indicate the customer for the overwhelming majority of the sales transactions recorded across these three PayPal accounts (including but not limited to the transactions with notes indicating they involved 3850 switches) was one of three individuals with Oklahoma addresses — R.N., J.N., and R.B. — or Oklahoma-based companies controlled by those individuals. An investigator interviewed R.N. and R.B. Each indicated that he was in the business of reselling electronic equipment, and that J.N. was R.N.’s brother and in that business as well. R.N. and R.B. both confirmed that they regularly purchased network switches from someone in Minnesota they knew as Nguyen Le, and that they paid Le via PayPal for those purchases. R.N. recalled that the equipment he purchased from Le was sometimes (though not always) new and priced close to retail. R.B. also said that some of the equipment he purchased from Le appeared new or nearly new, while some of it showed signs of being used.
An investigator interviewed Le by telephone on July 8, 2020. Le indicated that he did not recall the incidents in January and February of that year during which security video showed him removing network switches from the Government Center, but he said it would not be uncommon for him to act as depicted in the footage. He said he went to the Government Center for work “all the time,” including on weekends. He said he might well have taken network switches off-site to “restore them” or “get them ready,” and that he did occasionally bring equipment home and later bring it back “to another site or to the Government Center.” Le denied that he had ever kept or sold any switches himself.
The telephone interview, which took place before investigators obtained any PayPal records, ended at approximately 2:46 p.m. Central time on July 8, 2020. The PayPal records obtained later show that at 12:54 p.m. Pacific time — or 2:54 p.m. Central, less than 10 minutes after the interview ended — the “Nhan Nguyen” PayPal account was closed. PayPal records similarly indicate that at 12:57 p.m. Pacific the same day, the other PayPal account was closed.
An investigator interviewed a person who worked under Le and then took over Le’s role after his county employment was terminated. The person confirmed to the investigator that, in performing what used to be Le’s job, he does not work hands-on with network switches. The person told the investigator he observed that asset management was “a mess” when he took over Le’s position, and that inventory was not being tracked, managed, or monitored. The person who replaced Le recalled that while Le was employed, he would order pallets of equipment and tell his staff that the pallets were off-limits and that no one should touch the equipment.
The criminal complaint against Le states that between January 2018 and April 2020 he received various payments through PayPal totaling $1,080,784 for sales to the buyers in Oklahoma.
The criminal complaint against Marks noted that she has not responded to investigators’ attempts to interview her.
Summons
Both Le and Marks have been charged by summons, as opposed to arrest warrants, therefore, there are no booking photos to be obtained at this time, and they are not in custody.
Both Le and Marks are summoned to appear in Hennepin County court on the charges on Jan. 3, 2023. No attorneys are listed for either party at this time in the court records.
Cisco 3850-series switches (Cisco.com)
