From a corporate career to IT crisis
Johnson, who left Intel job to work for the city, faces ransomware’s aftermath
As a top salesman at computing giant Intel, Frank A. Johnson was involved in deals worth hundreds of millions of dollars with some of the biggest businesses around the globe.
Then, taking a significant pay cut, he left the corporate world and stepped into a far humbler one: Baltimore’s struggling information technology office.
“It was time to start giving back,” Johnson said in an interview with The Baltimore Sun. He quickly rolled out a strategic plan and said he planned to use his skills to “digitally transform the entire community.”
But almost two years into an already difficult job, the 57-year-old Johnson is in the midst of a major crisis.
On May 7, hackers using ransomware crippled the city’s dated computer systems and demanded payment to unlock them. As Johnson’s team has struggled to bring services back online over the past seven weeks, he has become the face of the city’s response and at a recent
Democratic Councilman Eric Costello, co-chairman of a new committee set up to review the city’s response to the attack, questioned whether Johnson pursued the right priorities in the months leading up to the incident. Costello said it didn’t appear the IT department had a disaster recovery plan beforehand.
“He’s been there for a year and a half, and the key things that have not been completed are more important than the things he’s been working on,” said Costello, who previously worked as an IT analyst at the U.S. Government Accountability Office.
“If the CIO doesn’t have the ability to keep the organization running dur
Johnson said he has a recovery strategy, although a spokesman for the mayor’s office said Tuesday a written plan for recovering from an attack hadn’t been developed and Mayor Bernard C. “Jack” Young has asked for one.
Nonetheless, Johnson said, the ransomware attack wouldn’t halt progress on implementing his strategic plan for updating the city’s IT system — and might even speed it up.
“What we’re doing now is having the opportunity to accelerate some of the basic infrastructure upgrades that need to be done,” he said.
Many of the city’s computer systems are out of date and scattered across different agencies. And the city depends heavily on contract workers because it struggles to attract high-quality employees, who have better options in private industry.
To lead the city forward, Johnson announced the city’s first strategic plan for IT in March 2018.
In the fiscal year that begins Monday, Johnson’s office will have a budget of $40 million — up from $24 million when he took over. He’s authorized to have a staff of 150, growing from 122 positions in the 2018 budget year. The city’s spending board also approved the use of contractors from 13 staffing firms in a three-year deal worth up to $30 million.
Johnson acknowledged that his route to the city job overseeing all that was not traditional. But, he said, while someone who’s worked their way up through an IT office might have been involved in a handful of transformative projects, his career at Intel meant “I was fortunate to work through hundreds.”
Johnson began his career working in government, coming to Maryland from his native Ohio to work at the National Security Agency for several years — a job he says gave him “a passion for information security.”
Then in 1990, as computers and the internet were on the verge of transforming daily life, he joined Intel Corp. The company makes processors, the brains of computers, and Johnson described harnessing a prediction by Intel co-founder Gordon Moore that computing power would grow at regular intervals.
“I’ve had an unbelievable run at one of the most well-respected companies on the planet,” he said. “Nothing happens in this industry without Intel Corporation and ‘Moore’s law.’?”
Former colleagues describe Johnson as a talented leader, one comfortable talking strategy with corporate executives and one who could set out a vision that inspired large teams to get to work.
Paul Morris, who worked with him at Intel for a decade, said Johnson also could talk to technologists on their level.
“Frank was very proud of his technical acumen,” Morris said. “He wasn’t afraid to show people that his propellers still spun pretty fast.”
Then-Mayor Catherine Pugh, a Democrat, recruited Johnson to Baltimore as he prepared to retire from Intel.
He arrived in September 2017 to lead an agency bedeviled by turnover at the top — Johnson is the fourth permanent director since 2012. The city’s computer systems suffered “decades of neglect and under investment,” he said, and he wasn’t interested in serving as a caretaker. He wanted to launch an overhaul.
Jim Smith, a senior aide to Pugh who helped hire Johnson, said he was impressed by Johnson’s career at Intel.
“He knew it all,” Smith said. “He was a great communicator. He was a great team builder.”
Johnson now reports to Young, like Pugh a Democrat. Johnson earns $250,000 a year — the city government’s highest salary. Smith said Pugh balked at paying that much until Smith pointed out Baltimore County’s IT boss makes the same amount.
Johnson declined to say how much he was paid at Intel. Young’s spokesman, James Bentley, said “the pay cut was significant.”
Steve Harris, senior vice president and general manager of a Dell Inc. group that works with the federal government, is a board member at the Greater Baltimore Committee. He pitched the Baltimore job to Johnson when he heard he was leaving Intel. Harris said Johnson was interested in a way to serve his community and spend less time on the road.
“My hat was off to him for making that move,” Harris said. “I know that this has probably ended up being one of the most challenging moments of his life and his career.”
The ransomware attack took down employees’ email, brought the city’s real estate market to a standstill and stopped the city from issuing water bills. Officials developed workarounds for some processes — creating temporary Gmail accounts and a manual system for completing property sales — but many systems remain offline. Officials say the recovery could take months.
The attack was the second of its kind to hit the city in a little over a year. Johnson said he took steps to bolster the city’s defenses after attacks in March 2018 on both
But officials have declined to say how Baltimore fell prey to hackers this time or what vulnerabilities the new attackers used to break in, so it’s impossible to assess how much of a difference those measures made.
The New York Times reported that a tool developed by Johnson’s former employer, the NSA, was involved in the hack, but the agency told members of Congress that’s not the case. Bentley said Johnson couldn’t comment on any potential NSA connection.
The city has been reluctant to share even basic information. Asked about the city’s process for installing software upgrades that can fix security flaws, Johnson declined to comment because the investigation is ongoing.
“I absolutely do know,” he said. “I just can’t comment on that right now.”
Frank Baitman, a former IT chief in the federal government, said Johnson has asked him for advice about public sector work. He’s told Johnson to keep his hands off procurement decisions (interference in that area can lead to ethical problems); hire the best people he can but be aware that they’re going to need training; and be prepared for public scrutiny.
“Recognize that you’re always going to be under a microscope,” Baitman said. “People are always going to be second-guessing you in a way that doesn’t happen in private industry.”
Johnson faced that when he went before a City Council committee June 7 to present his budget for the coming year. Several council members criticized his handling of the aftermath of the ransomware attack, saying too little information was shared with the public and others in city government. Johnson apologized.
More scrutiny is coming: City Council President Brandon Scott created the special committee to review the ransomware attack, and the
Scott questioned how well Johnson has made the transition from the technology industry.
“Coming from the world with his previous employment and the world he was coming from, municipal government is significantly different from that,” Scott said. “That has been a tremendous learning experience for him.”
PREVIOUS ARTICLE
