Following a major disruptive ransomware attack this summer on the City of Traverse City and Grand Traverse County, Traverse City leaders are seeking to terminate the city’s agreement with the county for IT services. City commissioners discussed the contract in closed session Monday, then publicly announced they’d be releasing a city manager memo about the contract and taking action on it at their November 18 meeting. Insurance providers for both the city and county agree separating is the right move, but doing so could take months of complex work given how intricately interwoven the two municipalities’ technologies are.

The June ransomware attack interrupted county and city services, shut down court proceedings, and impacted internal operations for both governments.  In its wake, city commissioners voted to update the city’s insurance policy – including expanded standalone coverage for cyber liability – and to hire specialized cyber legal services. County commissioners, meanwhile, voted to migrate the county’s public safety software to a cloud-hosted solution going forward.

County and city staff have since been discussing how best to proceed, talks that have occurred with each other and with their respective insurance providers. According to the newly released memo from City Manager Liz Vogel – which was sent to County Administrator Nate Alger on October 3 – recommendations from the city’s insurance carrier and cyber counsel made it “clear that the separation of IT services is a necessary and prudent step.” An attached memo from the city’s insurance carrier, the Michigan Municipal League (MML), states the city “needs to maintain sole control and full oversight of the city’s IT infrastructure...as your insurer, we believe this is the best way to position the city to ensure the city is in the position to manage prevention efforts.”

MML continued: “The city’s operations clearly have a high level of complexity and significance to providing critical service to the public. We recognize that the city has engaged Grand Traverse County for many years for IT services. However, the time has come for the city to fully manage its own IT infrastructure assets. We have come to this conclusion based upon complexities that have been discovered during the recent cyber incident.” MML emphasized its recommendation was not intended as criticism of Grand Traverse County’s IT support, “but rather a recognition of the evolution of technology and services provided by the city.”

Alger says the county’s insurance provider, the Michigan Municipal Risk Management Authority, also indicated in verbal discussions – though not yet in a formal written recommendation – that separating services would be considered a “best practice.” The county and city have a complex IT agreement going back to 2007 that lists out various rates of pay for different IT services based on an hourly fee. The salary for the county’s IT director, for example, is covered fractionally by both various county and city departments that rely on that support based on services used. Alger says the county remains the biggest user of its own IT services, and so intends to remain fully staffed heading into 2025 until the county can better ascertain what IT services will be needed solely for in-house use. That could lead to staffing or budget adjustments in the future, but Alger says that will take time to evaluate.

Alger says he previously shared Vogel’s memo with county commissioners, so the requested change will “not come as a surprise” to them. Once city commissioners vote Monday to invoke a 90-day termination clause on the contract – as they are expected to do – Alger says he’ll then bring that termination notice to his commission for further discussion.

Vogel outlined five main phases of work the city hopes to pursue over the next three months to separate services. Those include deploying a “next-generation firewall solution” and wireless access points to various city sites at the Governmental Center, followed by migrating the city’s active directory to a new city virtual environment. Once the “core infrastructure network is in place,” the city will migrate its financial and enterprise management system and then its GIS infrastructure and databases, according to Vogel’s memo. In the final phase of the initial separation, the city will migrate all shared drives and other data over to the city’s new infrastructure.

Separating IT services for law enforcement will likely be a tricker process – one Vogel is recommending holding off on for now. “Given the number of shared resources at the Law Enforcement Center (pictured), we recommend treating the separation of IT services for this location as a follow-up project after the initial phases have been completed,” Vogel wrote. “This will allow us to focus on critical service continuity while allocating sufficient resources to manage the more complex IT dependencies at the LEC.”

While Alger understands the need to separate services – and supports doing so – he expresses skepticism that all five phases of separation outlined in Vogel’s memo can occur in the next 90 days. “Our IT staff is already taxed,” he says. “Their workload is heavy. To add a divestiture to that equation will tax them further.” Alger says the most important thing is to ensure that county and city services aren’t interrupted and technology resources aren’t damaged during the transition, particularly given the amount of sensitive data safeguarded by IT and the integral nature of tech functionality to many governmental functions.

“I don't want to slow the process down in any way,” Alger says, “but we need to make sure we’re very comfortable with everything we do, so that neither the city nor county are harmed in the divestiture.”