TRAVERSE CITY — A company helping Traverse City government offices deal with a recent cyberattack will help the city split off its computer network from one it shares with Grand Traverse County.
But who helps the city run that network in the future remains to be seen. City commissioners on Monday voted unanimously to ask for bids for information technology support services, a contract they’ll award at a later date.
Jerry Swanson, the city’s IT administrator, said city and county leaders decided to share a network in the early 1990s, in part so they could both use a mainframe computing system.
“That was really to get the city and county using a shared resource for financial software, but also really just putting the county and city in the digital age,” he said.
Since then, the city has moved toward different systems than the county uses for finance and accounting, email and more, Swanson said. And a cyberattack in June made it even more clear that the city should invest in a network it owns.
Commissioners voted 5-2 to pay Millennium Digital Technologies up to $518,634.86 to build and set up that network, with commissioners Heather Shaw and Tim Werner voting against.
Company President Ken Andrews said the total is likely to be less, as it includes a 10-percent contingency that his company never needed to spend on past projects. He explained to commissioners how the Madison Heights-based company would separate the city’s network from the county’s in two phases.
Andrews said the company worked with the city to guide it through the cyberattack’s aftermath, and figure out a way forward.
“One of the things universally recommended by everybody — your counsel, us, even the county’s insurance and city’s insurance (providers) — everybody recommended the city really needs to be in control of your own destiny here,” he said.
Once complete, the network would have several security features built in, including a segmented network that would limit any intruder access, and data backups stored both locally and remotely, Andrews said.
Swanson and city Manager Liz Vogel had suggested going with Millennium Digital Technologies to help manage the city government’s network for $127,077.48 per year — the city currently pays the county roughly $360,000 per year, according to Swanson.
But Commissioner Mi Stanley said she wanted to see what other companies offer, noting there should be time to seek and evaluate bids while the company builds the city’s network.
Shaw and Werner also wanted to ask for bids for the network buildout — Werner said good governance requires a competitive bidding process and that city administrators should’ve planned for one at some point, and Shaw argued city leaders need to show they’re doing due diligence, especially in light of what she called a recent string of issues impacting voters’ confidence.
Shaw also referred to an email raising concerns about a connection between city manager and the company’s owner. While she called it a conflict of interest, Mayor Amy Shamroe later replied that under city policy, such conflicts involve questions of financial gain, and she saw nothing suggesting that to be the case.
Vogel in an email responded to concerns over her being Andrews’ friend, acknowledging she knows him both personally and through working with his company before.
“That relationship has not influenced my decision in any unethical or untoward manner,” Vogel wrote in an email to commissioners. “It is worth underscoring that I stand to gain nothing from this decision, aside from the satisfaction of protecting our city’s data and resources in a time of unprecedented vulnerability.”
Andrews also attended Vogel’s engagement party over the summer, Vogel said. Her cousin, who hosted the party, lives next door to Andrews’ family.
Vogel also pointed the city’s purchasing policy allowing the bidding process to be waived in case of emergency, or when the public interest will be served without obtaining bids.
That June cyberattack put the city in “a really bad spot,” Vogel said prior to the meeting. So she asked Andrews for help, having worked with his company before. She likened it to her retaining the services of a labor attorney she worked with in past municipal jobs and called her professional connections an asset for the city.
Since then, Swanson has worked closely with the company, Vogel said earlier on Monday. He and other city staff told her they were comfortable in moving forward with the same contractor for the IT systems separation.
Vogel said she told city staff she knew Andrews and had worked with him before. But she didn’t believe she needed to disclose this to city commissioners before, as there was no issue of financial gain for her.
At the meeting, Stanley responded that Shaw’s accusation of a conflict of interest was a serious one, especially given the dollar amount in question. And Mayor Pro Tem Mark Wilson said previous city administrators brought in contractors they worked with before.
Shamroe echoed concerns that stopping to seek bids on the network buildout would be complicated and take months, especially given how closely Millennium Digital Technologies has been working with the city — Andrews told commissioners his company had to “work backwards” to figure out the design to build, and any other contractor would likely have to do the same.
Rather than wait, Shamroe said the safest and most efficient route would be to start getting the right hardware in place and shore up the city’s systems. The city’s been breached already, and while the “hair-on-fire” crisis point is past, there’s still enough urgency to waive the bidding process even if Shamroe’s “not a huge fan” of doing so.
“We aren’t in that much crisis right now, but I don’t think we can say safely that we are not needing to do more work to keep our data and systems safe,” she said.
Commissioners also agreed to create a technology specialist staff position, for a total cost of $60,133.72 for the first year, documents show. Swanson said the employee would work under him and help keep the city’s network running across its various buildings.
For now, both city and county still share IT services. Commissioners gave Vogel the OK to give notice of the city’s intent to terminate the service agreement, but Shamroe pointed out she won’t send it until both city and county are ready to move forward with a separation.
That moment likely will come once the city’s new network is built and tested, Andrews said.