IT managers replaced after attack

2 from city department removed during recovery; 3rd employee fired, she says

Two senior managers at the city’s information technology office — including one who previously served as its acting director — have been replaced as Baltimore continues to recover from a ransomware attack that crippled its computer systems.

A third city employee, a bureau chief in the finance department who was in charge of revenue collection, said she was fired recently. She was involved in the ransomware recovery but said she was told the reason she was fired was a failure to address issues raised by constituents.

The May ransomware attack has left some city systems offline for three months. City water bills only started going out Wednesday.

Lester Davis, a spokesman for Democratic Mayor Bernard C. “Jack” Young, confirmed that Martin Okumu, the director of IT infrastructure, and Shawn Cherry, the senior manager for the IT help desk and customer service, no longer work for the city. Davis would not comment on the circumstances of their departures, saying it was a confidential personnel issue.

Asked if the IT staffing changes were made to hold people accountable for the attack, Davis said that in general no one in the city’s government is to blame.

“The cyberattackers are to blame,” Davis said.

He said it’s wrong “to suggest that any adverse employment action was taken against any city employee ‘to hold them accountable for the ransomware attack.’ ”

Without naming Okumu or Cherry, city IT director Frank Johnson informed staff of “organizational changes” in a July 26 email obtained by The Baltimore Sun. Johnson told employees to bring infrastructure issues to Art Raye, who works for a company called Skyline, which the state is paying under a contract. Johnson said people should take help desk issues to Chauncey Badgett, who is serving as acting help desk manager.

Janice Simmons, who led the finance department’s revenue collection bureau for almost a decade, said she was fired the same day Johnson sent that email.

Simmons was involved in developing a workaround to ensure property sales could restart after the ransomware left the market frozen.

She said in an interview that Finance Director Henry Raymond told her the mayor’s chief of staff decided she should be terminated because she had not properly handled constituent complaints. Simmons, who made $136,000 in 2018, said Raymond did not give her an example and she’d never heard of such an issue before she was fired.

“I should have been praised for all of the workaround plans for (the bureau) during the ransomware attack,” Simmons said. “We had to keep things going. We collect all of the money for the city. I felt like the weight of it was on us.”

Okumu declined to describe the terms on which he left his job, but said in an interview he did “extremely critical” work to help with the recovery from the cyberattack.

“They’re coming through a difficult ransomware recovery, so I want to wish them all the best,” Okumu said.

Okumu, who had a annual salary of $135,200, had worked for the city since 2016 and was among the IT office’s most senior employees. In the summer of 2017, Okumu briefly served as the IT office’s acting director until Johnson was hired that September. Okumu also represented the office at budget meetings, discussing cybersecurity preparations after a previous ransomware attack with members of the City Council during a 2018 committee hearing.

Cherry had an annual salary of $110,800 and was not listed in a June 2018 database of city employees, indicating he had been hired recently. He declined to comment.

Badgett, the acting help desk manager, was hired in 2014 and has a salary of $68,600. Patrick Mulford, a spokesman for the state IT department, confirmed Raye is a state contractor.

“The Hogan administration continues to work closely with restoration of Baltimore city’s systems and is providing state and contractual resources to do so,” Mulford said.

The ransomware hit May 7. Hackers locked up files on the city’s computer networks and demanded payment equivalent to $76,000 in exchange for the keys. The city refused to pay and set about the lengthy process of restoring the systems. The cost of hiring contractors to help and buying equipment is estimated to reach $10 million and the city’s budget planners forecast a further $8 million in lost and delayed revenue.

City Council members have expressed frustration with the IT office’s handling of the response to the attack, prompting Johnson to apologize during a committee hearing. Democratic Council President Brandon Scott has set up a special committee to review the city’s defenses and make recommendations. It is expected to start work in the fall.