On Day 8 Of Ransomware Attack, Server Restoration Remains An Ongoing Process | WYPR

On Day 8 Of Ransomware Attack, Server Restoration Remains An Ongoing Process

May 15, 2019

Baltimore's Chief Information Officer and Chief Digital Officer Frank Johnson speaks at a Wednesday news conference.
Credit Emily Sullivan/WYPR

It’s been eight days since Baltimore City servers were essentially frozen after being attacked by hackers using ransomware. Officials said during a Wednesday news conference that complete restoration remains an ongoing process. 

City IT director Frank Johnson told reporters that his staff and a team of cybersecurity experts are working “around the clock” to recover service — but he could not provide a specific timeline for that recovery.

“I know that everybody wants to know when we'll be back online,” Johnson said. “Anybody that's in this business will tell you that as you learn more those plans changed by the minute. They are incredibly fluid.”

On Monday, Mayor Jack Young said the restoration will be a “multi-week” process.

Hackers first froze up city computers on May 7, demanding a payment of roughly $75,000 in Bitcoin to release their grip. Mayor Young has said multiple times the city will not pay the ransom.

Some digital aspects of running a city are now at a standstill: government emails are down, some real estate transactions can’t be processed and many payments to city departments can’t be paid online.

“The city’s lien system is presently not available to us,” said Finance Director Henry Raymond. “As a result, there are no real property transactions being conducted in the city.”

Raymond said the Maryland Attorney General’s office is assisting in restoring the legal process that is mandatory in completing property sales. He said he hopes to have the transactions restored by late next week, adding that there are “no guarantees.”

“The people who want to buy a house in the city are very important to us,” city solicitor Andre Davis said.

Davis declined to provide details of the recovery process, citing ongoing investigations. Officials have said that the FBI and Secret Service are involved in those investigations. On Wednesday, officials said the city had contracted several additional cybersecurity firms.

They declined to identify those contractors, again citing ongoing investigations. Raymond said he authorized these contracts.

In the meantime, city departments and officials have developed workarounds including alternate email accounts and paper documentation. Several agencies, including the Department of Public Works, have suspended late fees for city residents.