Baltimore email archive still not accessible after cyber attack. What does that mean for records requests?

Thank you for supporting our journalism. This article is available exclusively for our subscribers, who help fund our work at The Baltimore Sun.

An archive of Baltimore employees’ emails still can’t be accessed after the city’s computer network was attacked in May. In this May 20, 2019, file photo, paperwork was being processed using a slower workaround at a city office handling real estate transactions.

An archive of Baltimore employees’ emails still can’t be accessed after the city’s computer network was attacked by hackers in May, a city official said Friday.


City Solicitor Andre Davis said emails older than 90 days cannot be retrieved. He said he expects the information will be recovered, but was not certain.

The ransomware attack that began May 7 brought down swaths of the city’s systems. Email access for employees has been restored, along with most electronic payments.


But the lack of access to the email archive is an indication of how the effects of the attack linger behind the scenes. Also, the issue could hamper efforts by the public to hold the government accountable.

Breaking News Alerts

As it happens

Be informed of breaking news as it happens and notified about other don't-miss content with our free news alerts.

Officials’ emails are generally public records that can be released under the Maryland Public Information Act, and the first indication of a problem with the archive came in response to a request in June by a Baltimore Sun reporter following up on a water outage at Poe Homes for communications from 2018.

“As for responsive emails of mayor’s office employees, the mayor’s office is unable to retrieve the emails that you requested due to the recent cyberattack,” a lawyer for the city wrote in response.

An official at the Department of Public Works also mentioned the cyberattack in response to a separate request for copies of agreements between the city and Baltimore County for water and sewer service.

“Many databases and the documents stored on servers remain offline,” the official wrote. “To the extent the requested documents are readily accessible, DPW will work to retrieve, assess and disclose them promptly.”

The Baltimore County executive’s office ultimately provided the agreements to the Sun.

The city’s lawyers have fulfilled several PIA requests since the attack began, supplying records on a USB stick in one case and accessing Democratic Mayor Bernard C. “Jack” Young’s calendars for a period that included dates after the hackers struck.

While their city accounts were offline, many officials turned to Gmail accounts to communicate. Those messages should be accessible under the public information law, and the Sun has filed a request for messages from some of those accounts that is being processed.