Officials say municipal workers are soldiering on in the wake of the ransomware attack on Baltimore government computers, but the furrowed brows and workarounds were apparent everywhere at City Hall this week.
As spokesman Lester Davis stood outside the office of Mayor Bernard C. “Jack” Young on Monday and reassured reporters they would still get press releases (“we’re using a third party email”), a receptionist was answering the phones with a smooth apology.
“Unfortunately,” she informed the caller, “many phone lines are challenged right now.”
That conversation finished, she and another staffer discussed how to sign up for What’s App, Facebook’s messaging app (“I’m thinking you just go to the App Store”), presumably as a way to communicate while city government email remained encrypted by unknown hackers.
(What’s App suffered its own attack, announced later on Monday – a cybersecurity breach that left some users unknowingly vulnerable to spyware installed on their smartphones.)
Real Estate Crippled
Not only are phones and email service down at many city agencies, so are electronic payment systems.
This means that even with pens and paper in hand, employees can’t access the data needed to complete routine government transactions, such as recording water bills or cutting checks to vendors and contractors.
Real estate transactions have also come to a halt, Finance Director Henry Raymond said today.
“There are no real property transactions conducted in the city” because the data base is not available, Raymond told reporters. Without lien certificates from the city – verifying that there are no outstanding taxes, violations or water bills – deeds cannot be recorded and property cannot be transferred.
That was old news to the real estate community, which received from title insurers’ urgent memos like this one, sent Monday:
“Please do not close any transactions involving Baltimore city property in which you plan on issuing a First American policy until further notice,” the company’s email said.
“Like a government shutdown”
The news had real estate agents like Jessica Dailey, of Bolton Hill, tearing their hair.
“This is the worst possible time for this to happen,” said Dailey, who said she’s already lost a sale and has all others on hold.
“It’s our busiest time, May and June, when all the residents come to the universities, the new faculty. So this is just devastating.”
The limbo has been especially devastating for sellers who can’t afford to make payments on one property until they sell the other, said Dailey. “This is like a government shutdown.”
Asked when the situation will be corrected, Raymond answered with caution.
“Hopefully, we’re looking at late next week [for restoration of property transfers], but there are no guarantees.”
“We can’t address that”
Outside of Raymond’s remarks, Mayor Young and his senior staff offered little new information about the ransomware attack at the press availability.
Young said he has instructed his staff to look into “having insurance so that when things like this happen, we’re covered so we won’t be spending money.”
City Solicitor Andre Davis said it is safe for residents to look at city websites.
As to how much the cyberattack has so far cost the city – and whether it might be cheaper to pay the ransom (in Bitcoins) demanded by the anonymous hackers – Davis said such questions cannot be addressed because the attack is part of an ongoing criminal investigation.
Chief Digital Officer Frank Johnson refused to provide a time frame as to when online services may be restored.
Instead he announced, “We will be back online more safely and securely than we were before.”
When pressed about when IT expects to make visible headway, he replied:
“Anyone that’s in this business will tell you that as you learn more, plans change by the minute, they are incredibly fluid. Trust me when I tell you, there are hardworking, dedicated employees who have put their personal lives on hold because they love this city and are working hard to get us back online.”
Davis added another perspective to the IT paralysis:
“The city network was viciously assaulted by a culprit and seriously injured. But the victim is out of ICU, is healing nicely. It is a long course of physical therapy ahead for the victim, but we’ll be back, we’ll be back stronger.”
Any Backup Plan?
Johnson would not say whether the city had a backup or disaster recovery plan to cope with the latest digital attack – 13 months ago, the 911 emergency system was hacked and dispatchers were unable to use CAD (computer aided dispatch) software for nearly a day.
Davis said the law department had partially moved to the I-Cloud system and, as a result, its email system was mostly protected from last week’s attack.
Neither Davis nor Johnson would disclose what IT advisory firms the city had hired to help repair the network.
When reporters pointed out that government procurement contracts are public record, Raymond stepped in and said, “All the procurements have been authorized under my authority.”
At today’s Board of Estimates meeting, awards for motorcycle parts, automotive alternators and $200,000 worth of “destination signage” were approved, but no software security contracts came before the board.
Off to Vegas
Next week, the BOE will not be in session because Young and other elected officials will be in Las Vegas to attend the International Council of Shopping Centers RECon.
A must-stop during the mayor’s five-day trip will be the Maryland Party, a fete organized by title insurance executive Howard Perlow and other Baltimore area real estate interests.
This year’s party will be held at the Encore Beach Club of the Wynn Resort.
Young said without irony today that his mission at the convention will be “to tell the people in Las Vegas that Baltimore is open for business.”
– Fern Shen contributed to this story.