One week into her new job as Detroit’s chief information officer, Beth Niblock had to deal with a pressing issue she probably hadn’t anticipated.
A hacker froze a city database containing the personal information of 1,700 current and former employees of Detroit’s fire and EMS department, and demanded a ransom for its return. The hacker, Detroit’s mayor would later disclose, wanted 2,000 bitcoins for the effort — roughly $800,000.1
Lucky for city officials, there was a backup database, so no data was lost. “While we do not believe any personal data has been compromised, the City of Detroit is committed to protecting its workers and is offering to affected employees, at no cost, credit monitoring protection and identity theft insurance for one year,” said a March 3 letter from Niblock to employees.
It was a notable gesture for a city facing quite an odd predicament. Who would try to extort the bankrupt city of Detroit? The city never identified a suspect, and because of the redundant files, things were business as usual. But the incident left a mark on Mayor Mike Duggan, who began a four-year term Jan. 1. Last month, he told a conference on cyber issues, “It was a good warning sign for us.”
Not only was the city’s IT bad, it was exposed. As Niblock put it to Crain’s Detroit Business this year, the database was created at a time when encryption wasn’t used.
“Those databases have been there a long time, so the standards have changed,” Niblock told the newspaper. “I don’t think people thought about that.”
Detroit’s bankruptcy filing in July 2013 drew attention to an eye-popping list of problems: a nearly hourlong police response time,2 an eviscerated tax base and about 73,000 blighted structures.
But the city’s technology problems, as the vulnerable database showed, have been equally dramatic. For years, Detroit’s digital infrastructure has been a teetering mess, dependent on jury rigs of soda cans and spare change.
No, really.
Chuck Moore, a consultant for the city, described one fire station’s Rube Goldberg machine in September during testimony in Detroit’s bankruptcy trial: When an emergency alert comes in, a fax machine is triggered. This shoots out a piece of paper, which knocks over a soda can full of change, notifying those at the station of the situation. At another station, a fax comes in and bumps a door hinge, which pulls a wire and rings a doorbell.
With such a broken foundation, the city’s IT systems have been rendered effectively dysfunctional. Niblock prepared a report that was filed in the city’s bankruptcy detailing the vast problems she discovered: More than 80 percent of the city’s 5,500 computers are more than five years old, and 85 percent are equipped with Windows XP, an operating system that “by virtue of its age, is far from top of the line,” she wrote. Microsoft doesn’t even support XP anymore, and the city has been using a version of Microsoft Office that’s a decade old.
On top of that, the city has “serious” problems with the “resilience of its network,” she wrote, saying Detroit’s deficient network connections don’t allow employees to complete basic daily functions, such as accessing email. Employees can’t sync daily calendars to their smartphones.
These problems are supposed to be addressed as part of the restructuring proposal put forth by the city to emerge from bankruptcy, called a “plan of adjustment.”3 In the plan, Detroit proposed to invest $1.7 billion in city services over the next 10 years. Of that $1.7 billion, about $151 million — roughly 9 percent — will be appropriated to address some sorely needed technology upgrades.
Those upgrades will define the success of the city’s restructuring: If Detroit implements them without serious hiccups or setbacks, that will, in turn, allow the city to begin collecting and sharing the vital data it needs to function properly and efficiently. As one expert hired to determine the feasibility of Detroit’s bankruptcy-exit plan observed, the IT fixes are essential to make everything in that plan work.
Detroit has an unfortunate IT past, with technological problems that date back decades. On the finance side, the city uses a system that long ago was supposed to address a number of these issues and integrate dozens of departments into one. It was called “DRMS,” short for the Detroit Resource Management System, and pronounced as “Dreams.”
When it was introduced in the late 1990s, then-Mayor Dennis Archer touted the $48 million project as a bold step toward modernizing Detroit’s IT systems. “I have advocated a better use of technology to provide improved customer service since I took office,” Archer said in an August 1997 statement. “DRMS will raise the city’s customer service to a much higher level.”
By all accounts, it didn’t. As Moore put it, DRMS was a complete “failed implementation.”
By 1999, the project had turned into a “nightmare,” according to an article in the Detroit Metro Times, with total costs having increased to $70 million and having already resulted in as much as $15 million in unpaid vendor bills. The system has been a prolonged hassle that continues today. “The city has been using this, sort of hobbling along for the last 15 years or so, and it … has very limited functionality in what it actually can provide and do,” Moore said.
It’s limited, to say the least.
DRMS forced departments to develop their own systems to handle data, Moore said, creating a disjointed operation in City Hall. As a result, a “tremendous” number of city employees are required to perform basic tasks, because data exists on multiple systems that has to be reentered into DRMS. The system also doesn’t have the capabilities for the city to perform the simplest of tasks, such as closing its books on a monthly basis. So, the only financial results the city receives come annually, when an audit is conducted.
Even simpler tasks, such as payroll processing, became a hardship under DRMS. For example, it costs $62 for the city to cut a single payroll check (roughly $19 million per year for the total payroll), which is four times the national average. The payroll system consumes the daily work of 149 full-time employees, of which 51 are full-time police officers.
The city can’t collect arrearages on property taxes online, and its income tax system also requires a significant amount of manual input. The latter was called “catastrophic” by the Internal Revenue Service in a 2012 audit.
Detroit’s police department has basic software in place, but it lacks the capabilities of most public safety departments. Currently, the police don’t have any system to manage jails or electronic ticketing. And with some officers filing manual paperwork, the city loses desperately needed manpower on the streets.
Moreover, Moore said, the city’s 12 police precincts “don’t really talk to one another. … There’s no sharing of information between those precincts.”
“As you can probably imagine, people that commit crimes don’t stay within a particular precinct,” he said. “So, the lack of information sharing, really, it’s sort of akin to trying to do your job with one hand tied behind your back.”
The $151 million available through the restructuring would more or less help calm the chaos of Detroit’s IT problems. About $95 million will go to the city’s finance and human resources departments, Moore said. A total of $20.7 million will address the city’s police and fire departments.
For police, the expenditures would cover a fully integrated public safety IT system. That would provide police, along with the fire department and EMS, with a computer-aided dispatch that includes shared records management and reporting. That would enable “much-needed data exchanges between agencies,” according to the city’s plan of adjustment.
Some help for the city came before the bankruptcy plan was approved. In September, Rochester, New York-based Bryx offered to give Detroit’s fire department a modern-day alert system in response to the reports of the makeshift soda-pop setup. The city began to use the system last month. It’s operational within the fire and EMS departments and “alerts staff on their cellphones of a new run,” said John Roach, a spokesman for Duggan. The system provides turn-by-turn instructions to an emergency location.
Bryx donated the service to Detroit for free over the next two years. At that point, Roach said, it would cost about $900 per month to use citywide.
For the finance department, IT upgrades will include a new document management system, an enhanced security system, a data-center backup, a new planning system to replace DRMS, and basic hardware upgrades. The city projects about half of the $94.8 million allocated to address IT issues will be spent over the next few years, according to bankruptcy documents.
Now that the city’s plan of adjustment is approved, the implementation of the proposed upgrades, by all accounts, seems a certainty. There are enough backstops built into the plan to ensure the city will shake loose the $1.7 billion in total reinvestment funds and not fall astray, officials have said.
Moore, the consultant, tipped his hat to Niblock and John Hill, Detroit’s chief financial officer, for their commitment to making the best use of the reinvestment funds.
“Both of them have such a laser focus on these various reinvestment initiatives,” he said. “And that provides tremendous amounts of confidence in the ability to execute the plan.”
The plan also makes sense to Martha Kopacz, an expert witness hired by the bankruptcy judge overseeing Detroit’s case to examine its feasibility. That’s a good sign for officials such as Niblock, who want to address Detroit’s IT problems head on. Fixing the problems is a necessary first step in ensuring the city’s restructuring is successful, Kopacz said.
“The city’s IT infrastructure is so broken that, left unaddressed, it threatens the city’s ability to meet the commitments” laid out in the plan of adjustment, Kopacz, of Boston-based Phoenix Management Services, wrote in a 226-page report.
But, as Kopacz put it, the city has no room to take on new debt beyond what’s structured into the plan of adjustment.4 That means Detroit’s only source of fresh revenue to upgrade its infrastructure lies within the bankruptcy-exit plan.
“These issues will not be addressed overnight,” Kopacz wrote, “nor will they be easy.”