Town officials recently discussed rationales and plans for three IT (information technology) expenditures that elicited extensive discussion at the May 4 Annual Town Meeting before eventually being approved.
At the meeting, one resident proposed doubling the cybersecurity budget to $200,000 for remediation and modernization, while others voiced confidentiality concerns, saying that proposed security cameras would encroach on individuals’ privacy, particularly at Wayland’s public schools.
The requests were included in Article 10 (FY2027 Omnibus Budget and Enterprise Fund Capital Budgets), which were approved. The IT proposals were budget items 8, 9, and 10.
Budget item 8 requested $250,000 to fund video monitoring and management at several facilities, including but not limited to the public library and school buildings. The funds will be used for the procurement of devices, installation, and configuration with the Milestone video monitoring system. The stated purpose of the devices is to secure both facilities’ internal and external locations.
Budget item 9 sought $150,000 for the new regional emergency system to support cyber initiatives and network security modernization, including multifactor authentication and some hardware replacement.
Budget item 10 calls for procuring and implementing a new cloud-based firewall solution.
Information Systems Director Nick Lombardi, who was recuperating at home from pneumonia during the meeting, was called in to answer voters’ questions. He explained that the town’s IT systems need to be updated because some hardware and software are sunsetting, which could impact cybersecurity, and he outlined where the cameras would be placed at the schools.
The cybersecurity discussion alarmed one Town Meeting member, who proposed increasing the budget for that line item. However, Town Manager Michael McCall said that this was not an emergency and the changes could be implemented over time. The line-item budget remained at $100,000.
There was also an extensive debate about allowing cameras in public buildings, particularly in schools. Some residents approved of the request, viewing it as a safety requirement, while others thought that it was an invasion of their privacy. One woman said, “Children are immature and can make mistakes.”
No one was opposed to the system upgrades to the town’s network, which included the Public Safety Regional System upgrade. However, some Town Meeting members asked how the regional system would work and what the regional dispatcher would have access to. Although some upgrades are warranted, some of the work is for connecting Wayland’s fire and police departments to the regional dispatch center in Framingham, according to Lombardi.
Cybersecurity strategic plan In an interview following the Town Meeting, Lombardi, who was hired in July 2025, explained Wayland’s past approach to replacing equipment was reactionary — administrators waited until there was a problem to fix. However, he said McCall hired him to develop a strategic proactive plan. He said the industry practice is to replace equipment when warranties expire. According to Lombardi, the usual life span for laptops and servers is three years, although he feels that laptops can be kept for five years.
Research indicates that most enterprise servers (such as Dell, HP, or Lenovo) come with a base three-year limited hardware warranty, but many vendors offer extended service agreements. However, once a warranty expires or the hardware reaches its “end of service life,” manufacturers typically stop providing firmware updates, security patches, and replacement parts. Continuing to run out-of-warranty production servers increases security vulnerabilities and maintenance risks.
Lombardi said he reviewed the town’s current technology environment, analyzed everything from software to hardware to assorted IT configurations. He and his staff are developing a strategic plan for the town’s incident response, data recovery, and continued operations, according to Lombardi. One of his major concerns is cybersecurity. He said the town’s system is flooded with phishing emails and Captcha-based spam attempts. Ransomware, he said, could lock the entire environment.
According to The New York Times, between 2018 and 2024, 525 individual ransomware attacks targeted municipalities and government organizations in the U.S. While there is no running tally for the exact number of individual towns, hundreds of local, county, and state government networks have been severely disrupted, forcing many to revert to pen-and-paper operations during prolonged recovery periods. However, experts believe the numbers may be significantly higher since smaller municipalities are not required to publicly disclose breaches, and some prefer to quietly pay to restore the services.
“In this environment, we must understand what our posture is, any risks that we have, and remediation steps for addressing those risks,” Lombardi said in an earlier interview. “My greatest fear coming into this position is a ransomware attack, so I want to ensure that our environment is configured in a way that we are minimizing vulnerabilities.”
He praised town employees, stating that they “are good at picking up on phishing emails. However, he said he is implementing a required cybersecurity training program for all new hires and an annual refresher course for all employees.
Cameras: safety vs. privacy Security cameras are already installed outside the DPW and COA buildings, inside and outside town hall, he said. During elections, a camera is installed to record activity at the ballot box, according to Lombardi. He said they are discussing with the library and the recreational department managers installing cameras in their departments. Lombardi’s team plans to place cameras at the town beach. He said they will be installed near the gate, the parking lot, and the snack bar.
Some School Committee members expressed concern at Town Meeting about cameras at the school and appeared to be resistant to having cameras connected to the police department, even though all the other town cameras are connected to police to handle emergencies. According to Lombardi, School Committee Chair Erin Gibbons wrote a letter stating that the only individuals who will be allowed to look at the film are the school principals, and the video will be locked in a safe. Citing the Columbine shooting as an example, Lombardi said connecting the surveillance system to the police is a safety issue. However, he said he will be researching what other local schools will be doing.
In the wake of the Uvalde, Texas, shooting, many schools across the country implemented more security measures, including security cameras. Pew Research Center studies indicate that 91% of U.S. K-12 public schools reported having exterior security cameras monitoring the perimeter and entryway, and an increasing number provide local police with direct access. The Pew study said there is no exact nationwide percentage trackable by town, as school security sharing is typically decided by individual school districts rather than local municipal governments.
Broader federal data shows that roughly 43% to 48% of K-12 public schools have panic buttons or real-time communication infrastructure directly linked to law enforcement.
Many districts allow local law enforcement to access live video feeds remotely during active emergencies (e.g., active shooter situations, fires, or severe medical events) to coordinate faster, safer responses. More commonly, police request and review recorded footage retroactively to investigate incidents, property damage, or crimes occurring on or near school grounds, according to Pew.
School Committee bypassed Gibbons said in a recent interview that the School Committee’s issue with the proposal was that there was no discussion with them before the line item was placed on the warrant. She said that although she could not specify the location, there are currently security cameras outside the schools. According to Gibbons, the principals’ requests were to upgrade the cameras because some are either not working or malfunctioning and added that her objection to Article 8 was twofold. Since no one consulted with the School Committee, the town could potentially violate its own regulations and Massachusetts statutory laws regarding police involvement at schools, Gibbons said. She added that committee members wanted clarification on how the budget will be allocated.
Wayland’s policy regarding the security cameras at schools was enacted on March 13, 2017, around the same time that the original cameras were installed at the schools, according to Gibbons. She said there are limitations in both Wayland’s regulations and the state statutes regarding who can access the schools’ cameras and recordings.
The primary purpose of the Massachusetts state statute (Mass. General Laws c.71 § 37P) and Wayland regulations are to balance student safety with civil rights by establishing clear boundaries between school discipline and police authority. Gibbons said the School Committee wants to discuss with the IT department and town manager their plans to determine if the proposed system complies with state statute and town regulations, which may need to be adjusted, she said.
Budget questions The School Committee also has concerns about the budget. Gibbons said there was a similar line item in last year’s capital budget and $140,000 of it was not spent. The 2026 Town Meeting request was not approved by the Capital Improvement Planning and Finance committees, she added. Gibbons questioned if this item could impact the school budget and if the money could be used for something the schools needs more.
While the security cameras will not prevent crime, Gibbons agreed that children’s safety is a concern. The school administration purchased walkie-talkies to communicate in the event of a school crisis, she noted.
Updating the town’s IT systems and the use of cameras will be an “ongoing debate,” Lombardi said. Gibbons said the school committee welcomes further discussion with him so they can work together in developing a compliant policy. The League of Women Voters and a group of residents who are IT-level executives invited Lombardi to give presentations on these topics, he said.
