Baltimore IT director no longer with the city
Baltimore IT director Frank Johnson, who went on leave in September amid criticisms over his handling of the city’s recovery from a crippling ransomware attack, no longer works for the city.
Lester Davis, a spokesman for Democratic Mayor Bernard C. “Jack” Young, confirmed Monday that Oct. 1 was Johnson’s “separation date.” Davis declined to comment on the reasons for Johnson’s departure, saying it was a confidential personnel matter.
Davis said Todd Carter, the deputy IT director who stepped into the role of acting director when Johnson went on leave, is still serving in that capacity.
During a June 7 budget hearing, a month after the ransomware was discovered on city computers, Johnson apologized to City Council members for doing a poor job of sharing information with other agency leaders and residents in the aftermath of the attack.
“We will improve communications in situations like this,” Johnson said. “My sincere apologies.”
On the day of the attack, hackers demanded a ransom in bitcoins worth about $76,000 at the time, which Young refused to pay. The attack left city employees without access to their email, halted real estate sales in the city and held up water billing for months. Baltimore’s budget office estimates the attack will cost the city at least $18.2 million — a combination of direct costs and lost or delayed revenue.
Johnson was also at the helm of the IT department during a previous ransomware attack, which infected the city’s 911 systems in March 2018.
In an earlier interview with The Baltimore Sun, Johnson said he took measures to improve the city’s defenses after that incident and a ransomware attack that hit the city of Atlanta during the same month.
But in the aftermath of the latest ransomware attack on Baltimore’s computers, the city acknowledged it did not have a written plan to follow in the case of a serious incident. Nor did it have a cyber insurance policy, which has helped other cities, like Atlanta, defray the costs of recovery.