At first, the redesign of the city’s website was to cost $1 million and would be ready by June 2024. The goal, according to Mayor Brandon Scott: to improve customer service and reduce the number of clicks needed to find information.

Handed to a company owned by the husband of a high-ranking city official, the price soon jumped to $2.2 million.

Now thanks to previously unknown costs and more required staff time, the total price for revamping the baltimorecity.gov website has skyrocketed to $5.6 million, says Baltimore Inspector General Isabel Mercedes Cumming.

What’s more, whenever the redesign is finally launched – a beta version was released yesterday for testing – it will be functionally obsolete. That’s because it will run on a Drupal 10 system, whose “end of life” is next year when it will be replaced by Drupal 12.

The Montgomery County Economic Development Corp. recently got out a revamped and updated website that cost under $900,000. And San Diego spent $646,000 on the redesign of its award-winning site.

“The fact that the end result will be over $5 million should be of the greatest concern to citizens,” says Cumming, who released a report on the website’s cost overruns yesterday.

The report follows up on an IG investigation of the web redesign contract with Fearless Solutions, a software company owned by Delali Dzirasa, husband of Letitia Dzirasa, Mayor Scott’s former health commissioner and current deputy mayor of equity, health and human services.

As first reported by The Brew, the contract underwent two supplemental appropriations in 2023 and 2024, both approved by Scott and the Board of Estimates, that doubled its price from $1,079,000 to $2,216,691.

Despite those increases, the redesign was not completed when the Fearless contract ended last year and the city’s information technology department (BCIT) took over the project, Cumming’s office found.

BCIT set up two spending streams to continue the work left behind by Fearless – and, in some cases, to rewrite erroneous code by Fearless and its subcontractors, according to two sources who spoke to The Brew.

Runaway Spending

Some money came from a program set up to improve internet services at city agencies and the rest to comply with the American Disabilities Act.

BCIT earmarked $2.5 million to hire contract employees, “including a Change Manager, Project Manager, Content Editor, Developer and management oversight,” to convert data from the Drupal 7 system, Cumming wrote.

Other payments were made for web supporting tools, such as form-making software, improved ADA accessibility and enhanced search capabilities, Cumming said.

But still more money was needed to finish the redesign.

Yesterday the Board of Estimates transferred $809,522 to BCIT from the city’s “firewall” protection account (to counter future cyberattacks) and online payment portal account.

There was no public comment about the transfer from Comptroller Bill Henry or City Council President Zeke Cohen (Mayor Scott was at a conference in Savannah, Georgia).

But Cumming confirmed that the funds will be used to complete the redesign, thereby increasing the total current cost of the project to $5,680,000.

Yet when the new design is finally released sometime next year, it will be functionally obsolete. That’s because the original contract with Fearless called for upgrading the running system from Drupal 7 to Drupal 10.

Back then, Drupal 10 was state-of-the-art. Now the system is bound for the cyber scrap heap.

Outmoded Platform

On October 27, Drupal, whose content management system is used to operate Baltimore’s website, plans to release Drupal 11.3. Drupal 12 is set to follow in 2026.

The company will stop its security support of Drupal 10 this December.

Baltimore can still operate on the older system (currently it is stuck in Drupal 7), but it will no longer get critical security updates, bug fixes or software patches from Drupal.

“Why are we upgrading to a version that’s about to expire?”  – Former BCIT employee.

That makes the system vulnerable to malware attacks – like the RobbinHood attack that crippled city services in 2019 – phishing, spoofing, code injection, data stealing and unauthorized access to sensitive city records as well as to customer, employee and vendor accounts by bad actors.

It also subjects the city to compliance issues and potential lawsuits because the unsupported software does not fully conform to the HIPAA, ADA and other industrial standards and federal laws.

“More money will have to be spent in the future,” said a former BCIT employee, who asked not be identified.

“Why are we upgrading to a version that’s about to expire?” he continued. “It makes no sense except if you understand that there’s no web service staff at BCIT. The place is full of managers holding meetings, but no one is minding the technology. It’s all done by hired contract employees with no coordination or oversight.”

BCIT’s latest director, Todd Carter, left the agency in March. Interim Chief Information Officer Leyla Lehman told Cumming in a October 9 letter that the beta version released yesterday “aims to gather public feedback to identify any issues before launching the final release.”

A period of post-launch support will be needed “to address unforeseen issues and/or additional feature needs,” Layman said, requiring the latest infusion of cash to cover testing and contract staff.

She wouldn’t estimate when the public might see a live version of the completed redesign.

“The administration is committed to remaining in these phases as long as needed to ensure a high-quality product,” she said.

And regarding the final price tag, she noted that “the timespan of both periods will ultimately determine the full budget required.”