Johnson described a string of potential weaknesses. The city’s email system was “running on-site on creaky old systems.” A firewall to stop intruders was being upgraded, but officials “still have a couple of years of work left.” Installing software patches — which often include important security upgrades — had to be done one computer at a time, sometimes by “dispatching a technician physically to a user.”