It’s going to cost taxpayers much more than $2.2 million – already paid to a software company owned by the husband of one of Mayor Brandon Scott’s deputy mayors – for the redesign of the Baltimore government website.

In a recent report, BCIT, the city’s information technology office, estimated the price of the overhaul at $3.9 million, or five times above its $800,000 estimate when the mayor hailed the project as a priority task of his first-term action plan.

And yet, when the redesign is finally launched – now expected in spring 2026, according to BCIT – it will be functionally obsolete.

That’s because the system is only being upgraded to Drupal 10, even though Drupal 11, a free, open-source operating system, has been available since August 2024 and Drupal 12 is expected to replace Drupal 10 in 2026.

Which means more money will have to be spent after the launch to further upgrade the website.

Hackers and Lawsuits

Currently, baltimorecity.gov utilizes Drupal 7, a now-primitive content management system that, released 14 years ago, passed its end-of-life (EOL) date on January 5, 2025.

While the city can still operate on the system 7 version, Drupal no longer provides security updates, bug fixes or software patches for it.

This makes the system vulnerable to malware attacks – like the RobbinHood attack that crippled city services in 2019 and cost at least $18 million – phishing, spoofing, code injection, data stealing and unauthorized access by bad actors.

It also subjects the city to compliance issues and potential lawsuits because the unsupported software does not conform to HIPAA, ADA, and other federal laws and industry standards.

Inspector General Report

How the city got into this mess of high costs and repeated delays was examined in a report issued earlier this month by Inspector General Isabel Mercedes Cumming.

Her investigative team found that BCIT selected the higher of two unnamed software designers, and the mayor and Board of Estimates not only ratified the original contract, but approved two subsequent amendments that doubled the contract price from $1 million to $2.2 million.

The Brew identified the software designer as Fearless Solutions, a company founded and owned by Delali Dzirasa, the husband of Deputy Mayor Letitia Dzirasa.

According to State Elections Board records, the couple contributed $5,000 to Scott’s 2024 reelection campaign. Letitia Dzirasa says she has no ownership interest in Fearless, where she worked as its health innovation officer for three years prior to being appointed Baltimore Health Commissioner by then-Mayor Catherine Pugh.

PRIOR BREW COVERAGE:

• Board of Estimates set to spend more on software company owned by husband of deputy mayor (1/24/24)

• Deputy Mayor Dzirasa amends her ethics statement to include her husband’s contract (1/24/24)

• Millions spent on City website redesign being handled by company with close ties to Mayor Scott (7/3/25)

In a rebuttal to the Cumming report, BCIT Interim Chief Leyla Layman said the Fearless payments were not not “the result of uncontrolled spending, but rather a structured response” to “unforeseen complexities in the web environment.”

She did not disclose the overall cost of the project – $3.9 million, which The Brew found on page 19 of the “BCIT Fiscal Year 2026 Capital Improvement Program” – as well as a new completion date of March 2026.

Layman did not respond to Brew questions about why the agency was spending $1.7 million more on a website that, under Fearless’ leadership, was supposed to have been redesigned and launched already.

According to reports submitted to the Board of Estimates, the main reason why the Fearless contract was increased from $1 million to $2.2 million was to implement the website’s migration from Drupal 7 to Drupal 10.

In an exhibit dated April 2023, Fearless said four full-time engineers, plus a half-time implementation manager and web designer, would handle the migration.

The engineering team would work for 5,640 hours – at a $124.08 hourly rate – to “establish and maintain a continuous integration/delivery pipeline that integrates code quality tests and function end-to-end testing to ensure no deployment surprises.”

The cost: $699,811.20.

Another $178,032.75 would pay for the implementation manager and web designer:

More Promises

Fearless promised many other services to BCIT.

For example, a “developer sandbox” described as “a local environment (sandbox) utilizing DDEV (an open-source tool for launching PHP development environments) and docker containers that will replicate the server environment. This will facilitate code development, automated testing and maintaining consistent conditions for running Drupal CMS (content management system) and related plugins.”

And this:

“a USWDS theming framework to establish the base theming structure for the Drupal 10 version” and “front-end engineers, working with dedicated User Experience (UX) designers [to] build out the theming scaffolding before content structures can be developed.”

For an 18-month period, BCIT approved monthly bills to Fearless that totaled $2,208,646, according to Cumming. Then in June 2024, the Fearless contract ended, and BCIT was left with a website still running on Drupal 7.

Cumming said BCIT personnel had expressed concerns about the work done by both Fearless and its prime subcontractor, which The Brew identified as XCell LLC, whose office is housed at the Fearless headquarters at 8 Market Place, Baltimore.

The two companies were faulted for “inadequate preparation,” “lack of cohesive organization,” unnecessary coding” and a constant turnover of staff, Cumming wrote.

BCIT management, however, defended the company, saying that fixing a launch date was not as important as ensuring that the project realized the mayor’s goal of an enhanced user experience and easy, one-click information ranging from trash collection days to street closures.

In an interview with Cumming’s investigators, Dzirasa said the city pushed for an “all-at-once approach to content migration instead of taking an incremental approach.”

The latter, Dzirasa asserted, would have produced “some deliverables” before the Fearless contract ended.

In her written response, Layman said the scope of the project evolved from migrating the website to Drupal 9 to Drupal 10, and that change required “additional technical development services” as well as “full build-out, external feedback and site implementation.”

Despite repeated delays in the launch date – from September 2023 to January 2024 to April 2024 and now to March 2026, Layman expressed pride in her agency’s execution of Project No. 2080.

“BCIT acted in the best interest of Baltimore City residents and stakeholders, with a focus on long-term value, digital inclusion and user-centered design,” she wrote to Cumming, and the hiring of Fearless “further supported the City’s commitment to quality, equity and community investment.”