Lotus 1-2-3 and a $4.4 Billion Budget
When Philadelphia revealed in June 2018 that it was producing its year-end financial report with Lotus 1-2-3 and Microsoft Word, nobody laughed for long.
The software was discontinued in 2013. Most of the people using it weren’t. When the Philadelphia City Controller released her FY 2017 Report on Internal Control in June 2018, the report disclosed that city accountants were assembling the Comprehensive Annual Financial Report — the document that closes the books on a roughly $4.4 billion General Fund — out of Lotus 1-2-3, Excel, and Word files linked together. The story, as the Inquirer reported that same week, was mostly treated as municipal oddities. Ha ha, city government. Old computers. Funny.
But the details were not funny. The Controller found that the system used to produce the CAFR relied on a weak dollar-threshold authorization scheme: rank-and-file accountants could adjust accounts up to $1 million, supervisors up to $100 million, with the same spreadsheets running underneath. A modern system would require role-based access. It would log the change. It would alert when the same account was touched repeatedly. Lotus 1-2-3 did none of these things. It was a spreadsheet from 1983. It did not know what a tax obligation was.
The books balanced on software that cannot distinguish a data entry error from a deliberate withdrawal. The Controller’s word for the arrangement was “ripe for abuse.” No one had to hide an alteration. There was nothing to hide it behind. The system simply did not record who changed what.
You do not have to hack a system with no access controls. You just have to be at the keyboard.
The same fiscal fragility shows up across Philadelphia’s accountability story. The School District answered none of the 281 environmental complaints its own teachers filed in 2021; the city’s Comprehensive Annual Financial Report was being assembled in a spreadsheet that predated the IBM PC. When the books can’t be audited and the complaints can’t be answered, the same pattern runs through both — a system that does not record who changed what, and therefore cannot be held to account. Philadelphia’s research economy compounds the exposure: $1.2 billion a year in NIH funding flows through institutions whose host city cannot tell you who adjusted which account. And when the system can’t track a withdrawal, it certainly can’t push back on the fees that get layered on top of delinquent debt — see how regressive those fees are by zip code.