The City of Burlington is keeping critical information technology equipment in the basement of Memorial Auditorium, a decrepit building that’s been vacant and considered unsafe for human occupancy since 2016.
If a flood, fire or vandal destroyed the equipment, it would disrupt city government and potentially create a technology blackout for thousands of businesses and residents. That’s because Burlington Telecom, once a city department and now a private company, also keeps critical network infrastructure in the graffitied Main Street relic.
While the city is beginning to implement a plan to relocate its equipment, it hasn’t found a new space yet and a move could take up to 18 months. Scot Barker, Burlington’s chief innovation officer, has requested $500,000 from the city’s unassigned fund balance to pay for it. The request is part of a fiscal year 2023 budget package being considered by the city council, which must adopt a plan by July 1.
“The physical security of these assets is threatened,” Barker wrote in a May 9 memo. “That threat grows greater as time passes.”
Despite its urgent tone, the memo hasn’t alarmed city leaders.
“You’ve shown more interest in this than any councilor has,” Mayor Miro Weinberger told this reporter during an interview on the subject. He also said the city has kept the equipment safe there for six years, even as some parts of the building have continued to deteriorate. City councilors contacted by Seven Days either knew little about the situation or weren’t concerned about it because Memorial isn’t on the verge of collapse.
“This is a significant issue. It’s gonna take a bunch of work and effort,” Weinberger said. “I wouldn’t want to be overly alarmist about the current situation, but I think it is one that we can improve … and we’re taking steps to do that.”
The city has stored IT equipment in the basement of Memorial for approximately 15 years. Built in 1927 to honor Vermonters who served in World War I, Memorial was once a central gathering space. It hosted college basketball games and big-name concerts in its heyday; Burlington City Arts was once headquartered there.
Years of deferred maintenance eventually caught up with the building. Steel beams are rusted through, the brick exterior is cracked and water-damaged, and the 50-year-old heating and cooling system is showing its age. But one of Memorial’s biggest deficiencies is the parapet, a protective wall around the roof’s perimeter. It’s in such poor repair that water has infiltrated the brick walls, causing officials to worry that the roof could cave in.
“That’s bad,” summed up Samantha Dunn, an assistant director in Burlington’s Community & Economic Development Office, which oversees Memorial. “Once that collapses, we don’t know what the domino effect would be.”
Memorial hosts the backbone of the city’s network, including routers, firewalls and other vital equipment needed to connect to the internet and ward off cyber threats. Burlington Telecom officials didn’t respond to multiple requests from Seven Days to discuss its equipment in the building, and city officials were reluctant to speak on BT’s behalf. Weinberger, though, did say the Memorial hub was the telecom’s “most significant” IT installation when the city sold BT.
The equipment is at risk of damage from leaky pipes or the building’s own sprinkler system, which could go off should a fire break out, Barker said. And while the building is locked, security cameras there routinely show unauthorized people inside. Cyber threats are an obvious concern, particularly in light of last fall’s attack on the University of Vermont Medical Center, which paralyzed operations there for a month. Barker himself isn’t allowed into the building alone because of its condition, and the city denied requests from Seven Days for a tour of the server room in the basement, citing cybersecurity concerns.
Brett Johnson, president of IT service provider simpleroute in South Burlington, said the city should have removed the equipment long ago. Not only is the vacant building structurally unsound, Johnson said, but the lack of security “is like having an open network port.”
“Could a bad actor … go plug a laptop in and then do real harm to the city? That’s a real potential possibility, given the access that exists within that facility,” Johnson said. “You would very likely have access to sensitive resources.”
Weinberger acknowledged that the situation is not ideal.
“We have found it challenging to keep the building fully secure while it’s unoccupied,” he said. “There is some greater risk than there would be in an occupied building that is contributing to the sense that it would be prudent to make a move.”
Weinberger said city officials discussed moving the IT equipment when Memorial closed in December 2016. But he said the city determined the building was generally safe for the few staffers who would need to access it.
At the time, hopes were high that the city would soon repair the structure, abating the risk to the essential equipment downstairs.
In 2018, a community survey found support for renovating and reopening the building. The momentum carried into 2019, when a city request for proposals attracted a bid from South Burlington concert promoter Higher Ground to operate an event space there. In early 2020, the city was crafting a $15 million bond proposal to support the plan. Then the pandemic hit, shelving the project.
More bad news came in late 2021, when the Burlington School District announced it would need to build a new high school after detecting dangerous airborne chemicals in its current building. The amount needed to pay for that project means the city, which shares a debt limit with the school, won’t be able to bond for more money to repair Memorial in the near future, Weinberger said.
The city does have $1 million in capital funds reserved for Memorial, which voters approved in March as part of a $10 million bond. The money will be used to shore up the roof, replace structural beams and install a new heating system to keep the building from deteriorating. But it won’t pay to relocate the network hub. Even an eventual renovation of the building, and the disruption and dust that come with it, could pose a risk to the equipment, Weinberger noted.
The $500,000 request in the fiscal year 2023 budget would pay to relocate the equipment and replace some aging hardware, including servers that are more than 15 years old. The expense is one slice of a proposed $2.4 million drawdown from the reserve fund, which currently has a balance of $10.3 million.
The city will also likely have to pay for Burlington Telecom to vacate Memorial. When the BT sale was finalized in 2019, the city signed a lease allowing the telecom to continue using the server room in Memorial through March 2024. BT can renew the lease for two more five-year periods.
But if the city broke the lease, it would be responsible for paying some of BT’s moving expenses. With between 18 and 24 months’ notice, the city would have to pony up $800,000; with 30 months or more, $600,000. If the telecom ended the lease, however, the city would be off the hook.
The cost, though, is already covered: Weinberger earmarked $800,000 of the $30.8 million proceeds from the sale to Schurz for the move.
The equipment might have been moved by now if another entity had won the bid for BT. Keep BT Local had agreed to pay the relocation costs. Toronto-based Tucows didn’t but vowed to move the equipment within 18 months of a sale. Schurz, the current owner, made no such promises.
The mayor acknowledged that it may seem like the city got a raw deal by agreeing to pay for BT’s move. But he said the city was smart to cap its liability at $800,000, since the move will likely cost much more.
“We agreed upon a reasonable price, and we were able to reserve for it because we planned for this,” he said. “I think it was fair to all parties the way we handled it.”
At this point, BT’s plans are unclear. Barker said he’s had initial discussions with the company but isn’t sure whether it will choose to vacate or when. Weinberger added that company officials have never raised concerns with the city about storing their critical infrastructure in a failing building.
The city, though, can’t afford to wait.
“The risk is too high,” said Johnson, the IT security professional. “Given enough time, the risk compounds, and it becomes guaranteed.”