Explanation
1. BACKGROUND
This ordinance authorizes the Director of the Department of Technology, through the City Attorney, to enter into a contract modification with Dinsmore & Shohl LLP to allow for additional funding for the firm and their named cybersecurity subcontractors (RSM US LLP, Digital Mint, Haystack, Experian, CDWG and others) for legal and incident response services in regard to the recent cybersecurity incident.
On July 18, 2024, the city's Department of Technology discovered evidence of an abnormality in its system, one that was unrelated to a co-occurring global IT outage. The city took swift action to significantly limit potential exposure, including severing internet connectivity, to reduce the threat to the city's systems. The Department of Technology worked diligently and continues to remediate this cybersecurity incident (the "Incident") and restore the city's electronic security and safety.
On July 30, 2024, Mayor Ginther executed a Mayor’s Emergency Letter and declared the Incident to be a clear and present danger to public health, safety, welfare or property. It was then necessary to enter into a legal professional services contract with Dinsmore & Shohl LLC and their named cybersecurity subcontractors (RSM US LLP, Digital Mint, Haystack, Experian, CDWG and others) for an amount up to $4,000,000.00 to provide breach counsel services in response to the Incident. The Department, through the City Attorney, chose Dinsmore & Shohl LLC, due to its being a law firm with a national reputation for data breach response excellence that also has a strong presence in Ohio. Dinsmore's Data Breach Team consists of attorneys with decades of combined experience who are dedicated solely to critical, cybersecurity incident response.
It is now necessary to modify the original contract with Dinsmore in order to add funding in the amount of $3,000,000.00 to cover additional costs that have accumulated due to the Incident. The original contract amount was based on an estimate formed at the beginning of the Incident response. As the investigation has continued, additional expenses have been incurred necessitating additional funds in the amount of $3,000,000.00 for a total contract amount of $7,000,000.00.
2. CONTRACT COMPLIANCE
The contract compliance number for Dinsmore & Shohl LLP is CC004121 and expires 9/11/2026.
3. FISCAL IMPACT:
Funding, in the amount of $3,000,000.00, is available the Department of Technology, Income Tax Set Aside Fund, Fund 1000, Subfund 100099.
4. EMERGENCY DESIGNATION
Emergency action is requested so that the Incident response can continue unabated.
Title
To appropriate funds within the Income Tax Set Aside Fund; to authorize the City Attorney, on behalf of the Director of Technology, to enter into a contract modification with Dinsmore & Shohl LLP to allow for additional funding for the firm and their named cybersecurity subcontractors for legal and incident response services in regard to the recent cybersecurity incident; to authorize the expenditure of $3,000,000.00 from the Income Tax Set Aside Fund; to authorize the expenditure of said funds for expenses incurred prior to the effective date of this ordinance; and to declare an emergency ($3,000,000.00)
Body
WHEREAS, in order to safeguard the public health, safety, welfare, and property, and Mayor Ginther executed a Mayor’s Emergency Letter dated July 30, 2024 regarding the Incident; and
WHEREAS, it was necessary for the Department of Technology, through the City Attorney, to enter into contract with Dinsmore & Shohl LLP and their cybersecurity subcontractors (RSM US LLP, Digital Mint, Haystack, Experian, CDWG and others) for legal and incident response services in regard to the recent cybersecurity Incident; and
WHEREAS, Auditor’s Certificate ACPO010964 of $4,000,000.00 was established to fund this project pursuant to the Mayor's letter; and
WHEREAS, an additional $3,000,000.00 from the Income Tax Set Aside Subfund will be used to pay for the additional services under the contract; and
WHEREAS, an emergency exists in the usual daily operations of the Department of Technology in that it is immediately necessary to authroize the City Attorney to modify the contract with Dinsmore & Shohl LLP to allow the Incident response to continue unabated thereby preserving the public health, peace, property, safety, and welfare; NOW, THEREFORE,
BE IT ORDAINED BY THE COUNCIL OF THE CITY OF COLUMBUS:
SECTION 1. That Council, pursuant to CCC Section 329.15, hereby acknowledges receipt of the Mayor’s Emergency Letter executed by Mayor Andrew Ginther dated July 30, 2024 pertaining to the Incident and included as an attachment to his ordinance.
SECTION 2. It is hereby found and determined that Council’s enactment of CCC 329.15 authorizing the Mayor, upon a declaration of a state of emergency, to authorize and direct that a contract be entered into for the procurement of materials, supplies, equipment, construction or service without complying with the provisions of Chapter 329 necessarily includes the Council’s authorization to appropriate funds pursuant to Sec. 29-31 of the City Charter for that purpose. But to remove any doubt, Council hereby ratifies the appropriations contained within the Mayor’s emergency letter dated July 30, 2024.
SECTION 3. That the City Attorney, on behalf of the Director of the Department of Technology, is hereby authorized to enter into a contract modification with Dinsmore & Shohl LLP, of 255 East Fifth Street, Suite 1900, Cincinnati, OH 54202 to extend additional funds to support the services of the law firm and their named cybersecurity subcontractors (RSM US LLP, Digital Mint, Haystack, Experian, CDWG and others) in the amount up to $3,000,000.00 to include expenses incurred prior to the effective date of this ordinance.
SECTION 4. That $3,000,000.00 is hereby appropriated in Fund 1000 (General Fund), Subfund 100099 (Income Tax Set Aside Subfund) Dept-Div 4702 (Information Services), Object Class 03 (Services), in Program CW0001 (Administration) per the account codes in the attachment to this ordinance.
SECTION 5. That the expenditure of up to $3,000,000.00, or so much thereof as may be needed, is hereby authorized in Fund 1000 (General Fund), Subfund 100099 (Income Tax Set Aside Subfund) Dept-Div 4702 (Information Services), in Object Class 03 (Services), in Program CW0001 (Administration) per the account codes in the attachment to this ordinance.
SECTION 6. Funds are hereby deemed appropriated and expenditures and transfers authorized to carry out the purposes of this ordinance and the City Auditor shall establish such accounting codes as necessary.
SECTION 7. That the City Auditor is authorized to make any accounting changes to revise the funding source for all contracts or contract modifications associated with this ordinance.
SECTION 8. That for the reasons stated in the preamble hereto, which is hereby made a part hereof, this ordinance is hereby declared to be an emergency measure and shall take effect and be in force from and after its passage and approval by the Mayor or ten days after passage if the Mayor neither approves nor vetoes the same.