A decade after Kansas unveiled plans to migrate its driver’s license records from an aged mainframe to modern information technology infrastructure, the effort remains incomplete and, auditors say, troubled.
Now five-and-a-half years past the original completion deadline — a goal that has moved repeatedly — legislative auditors revealed in a report published July 31 that ongoing woes could cause the KanDrive project to miss yet another “go live” date, while also going above its original $40 million budget.
Read auditors’ most recent IT Project Monitoring Report.
Auditors fear, too, for the quality of the final IT product. They cited a February technical review that found gaps in code, limited functionality and existing features that “required workarounds to function.”
Officials at the Kansas Department of Revenue told auditors that “significant” progress has been made on fixing bugs and that they remain committed to lifting the curtain on the project at the start of 2018.
Lisa Kaspar, the department’s director of vehicles, told a panel of lawmakers receiving the audit results last month that development will be done in time to test the system this fall.
She described private contractor MorphoTrust, a company that specializes in ID services, as the project’s “main risk” and said her team is communicating with MorphoTrust weekly.
“We are holding them very accountable,” Kaspar said. “They did have some delays. We are now back on track with them. I mean, not to the original dates, but we are comfortable that we’ll still be able to go live with our system on Jan. 3.”
Related story: Computer problems crash application system for Kansas welfare benefits
The issue of accountability is a sensitive one because past reviews found the department didn’t hold another contractor, 3M, to its commitments or obtain related financial penalties from that company.
Audits indicate MorphoTrust has missed at least two major deadlines. In the most recent case, it delivered equipment “that is not working properly.”
MorphoTrust did not respond to a request for comment.
The Department of Revenue declined to make officials available for an interview ahead of this story.
“We are building strategies for the impending rollout,” spokeswoman Rachel Whitten said. “We are not ready to discuss it publicly at this time.”
‘Critical’ infrastructure
At issue, according to auditors, is one of the Department of Revenue’s “most critical systems” — a platform tracking the driving records of 2 million people that must at all times be accessible to law enforcement agencies.
Plans to migrate the Kansas driver’s license system and other records solidified in 2007 as the DMV Modernization Project. In 2009, 3M landed a contract for the work, worth $25 million of the total $40 million Kansas planned to spend. To help pay for it, the state tacked a $4 fee onto prices Kansans paid at their local treasurer’s offices for vehicle registrations.
Snags in the project began early and persisted past its 2012 deadline. Flawed work by contractors bedeviled it, but independent reviewers also found evidence of problems with project management, office culture, staffing and leadership.
And in the midst of it all, a 2014 audit found that regularly scheduled third-party reviews of the project were discontinued in violation of state policy. Quarterly updates to lawmakers were misleading and incomplete, the audit said, preventing them from knowing the extent of the problems as the project fell year after year behind.
Sen. Laura Kelly, a Topeka Democrat, called for the 2014 audit.
“I wanted to know what had gone wrong,” she recalled.
Kelly remains concerned that a pattern of poor planning and project management, combined with under-resourcing, may be dogging the state’s IT efforts. Though IT can be complex and arcane, the process deserves public scrutiny, she said earlier this month.
“So much government service now is done through technology,” said Kelly, a lawmaker since 2005 who sits on the Legislature’s audit committee. “We have no choice but to keep our eyes on it.”
Issues with other IT projects
The project isn’t the only state IT effort that has sparked concern. Glitches and delays plagued the state’s rollout of a pricey Medicaid enrollment platform known as the Kansas Eligibility Enforcement System in recent years. That system is still causing headaches, the Wichita Eagle recently reported, as the state moves to integrate welfare processing next week — years behind schedule.
Separately, the state’s aborted 2013 attempt to wean four state agencies off an IBM mainframe with an in-house IT infrastructure project called GovCloud led to millions of dollars in equipment sitting unused in the basement of Docking State Office Building.
In December, auditors released results of a three-year check into IT security at 20 Kansas agencies that store sensitive information. They found substantive problems at most of them, including unsecure websites and unpatched vulnerabilities that could open the door to hackers.
Then, this spring, hackers took advantage of a coding weakness in a data system within the Kansas Department of Commerce to gain access to 5.5 million Social Security numbers from 10 states.
The cost to taxpayers of the data breach remains unclear. Kansas is on the hook to pay for free credit monitoring for the victims, but the state has redacted pricing information from documents provided to the Kansas News Service — and hasn’t answered questions about whether it has any insurance that will help cover the expense.
Representatives of the Kansas Office of Information Technology Services, under the Office of the Governor, declined to comment on whether there are any overarching problems, such as under-resourcing or poor project management, hurting the state’s IT functions. They deferred comment to the agencies involved in the troubled projects.
However, the office’s 2016-2017 strategic plan lays out a number of issues that need to be addressed, including that IT infrastructure and support are isolated by agency and that infrastructure is out of date. The plan describes the current situation as “fraught with risk” and points to “incidents demonstrating significant data security exposures.”
History of problems
Because of the history of problems with the modernization of the driver’s license database, the Legislature’s auditing staff members now review the project on an ongoing basis, updating lawmakers four times a year.
The 2014 audit came after phase one of the DMV Modernization Project — a revamped vehicle title and registration platform — went live in 2012. That launch, 10 months behind schedule, led to hours-long lines for Kansans trying to update their tags in some counties.
Swamped county treasurers brought in extra staff or even closed doors to catch up on backlogged applications.
Rep. Don Schroeder, another member of the Legislature’s audit committee, said he could accept the delays in the implementation of the driver’s license portion of the project if the state has been fixing the bugs to ensure a solid product. The Hesston Republican wants to avoid a repeat of phase one’s rocky launch.
The 2014 audit estimated counties spent more than $2 million on overtime and other expenses triggered by the 2012 rollout — even though the state had initially predicted it would cost them nothing.
“That’s my biggest concern,” said Schroeder, a lawmaker since 2007. “Just hoping it doesn’t become something like that.”
The 2014 audit estimated counties spent more than $2 million on overtime and other expenses triggered by the 2012 rollout — even though the state had initially predicted it would cost them nothing.
Auditors turned up other concerns, too. They said Kansas paid out 90 percent of the 3M contract before finally canceling it in May 2014. The company had not delivered on key elements of the contract when the work was canceled, according to auditors. (Officials with 3M declined to speak to auditors.)
At the time, Department of Revenue officials said the remaining work would be finished in-house by November 2015, and that it would cost about $2 million.
That didn’t happen. Instead, the project was closed and relaunched as KanDrive, with a $6 million projected price tag.
After Sam Williams was appointed revenue secretary in late 2016, he ordered an independent review that found multiple problems and concluded KanDrive was at risk of missing its deadline and running out of money. The agency moved to reduce the project’s scope and restructure its team.
The project will again go through the bureaucratic hoops to be closed and relaunched with a new name: KanLicense.
In a letter to lawmakers in response to the audit, Williams signaled commitment to the Jan. 3, 2018, deadline and said he has hired a chief information officer to help.
“Although the scope was changed,” he told lawmakers, “the KanDrive project will still have major benefits provided to the Division of Vehicles.”
Auditors expressed appreciation for the department’s efforts to address the KanDrive problems, but they see continued risks for the project’s quality and for further delays.
They were concerned, too, about the project’s overall cost.
Changes to project scope and structure “made it impossible for us to evaluate whether changes in the project’s cost estimates are appropriate,” the auditors wrote.
In 2014 auditors estimated that Kansas had spent $37 million of the original $40 million budgeted for the DMV Modernization Project, including the unanticipated costs to counties in 2012.
Estimates for finishing the project range from $8 million to $10 million in their latest report.
Celia Llopis-Jepsen is a reporter for the Kansas News Service, a collaboration of KCUR, Kansas Public Radio and KMUW covering health, education and politics. You can reach her on Twitter @Celia_LJ. Kansas News Service stories and photos may be republished at no cost with proper attribution and a link back to kcur.org.
