Watchdog says USAID must improve data privacy protections

The inspector general of the U.S. Agency for International Development has called on the agency to improve how it handles personally identifiable information.

In an audit, which was published earlier this month, the oversight body identified a range of failings, including the reliance on out-of-date data loss procedures and insufficient role-based privacy training.

The IG also identified the unnecessary retention of Social Security Numbers and failure to implement controls related to third-party websites as areas for concern. It also found multiple instances of staff handling sensitive personal information without first having completed the required training.

Guidance from the Office of Management and Budget published in 2007 states that agencies must establish a plan to eliminate the unnecessary collection and use of Social Security Numbers and provide annual updates on the progress of such plans.

USAID’s CIO is responsible for the agency’s privacy program and for the management of privacy-related risks at the organization.

The IG issued a number of concrete recommendations for improvement in its report. These include the suggestion that the agency’s CIO should develop and implement tools for the periodic testing of data loss prevention measures and also update its SSN storage reduction plan.

It recommends also that the director of web management at USAID’s Bureau of Legislative and Public Affairs take a complete inventory of the third-party websites being used by the agency.

The IG’s intervention comes three months after USAID was hit with a cybersecurity breach when Russian hackers accessed its Constant Contact email marketing service account.

Following the incident, which was revealed by Microsoft, USAID notified agencies including the U.S. Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency. When an agency has a privacy breach it is required to inform the U.S. Computer Emergency Readiness Team, which is part of CISA.

VA piloting system to find and manage AI talent

The Department of Veterans Affairs is piloting a system for assessing the development of the federal artificial intelligence workforce with more than 30 agencies and organizations outside government, according to Gil Alterovitz, director of the National AI Institute.

VA‘s Talent, Education and Assessment Management System (TEAMS) is a whole-of-government, whole-career solution helping find and evaluate AI talent and standardize training with support from the Executive Office of the President.

TEAMS builds on the VA’s Talent Management System (TMS) — established in 2012 as the official education, leadership development, learning and training record for employees — with AI talent proving especially hard to find.

“Very few people major in artificial intelligence, and even if you have a related area, let’s say computer science, you could not have any expertise in artificial intelligence,” Alterovitz said during FedTalks, produced by Scoop News Group, on Tuesday. “So how do you know if someone has the knowledge to do that?”

While VA started by targeting researchers, it quickly moved on to clinicians like pharmacists, who can apply AI in meaningful ways with the proper training, Alterovitz said.

VA is also using grant funding to attract AI talent and reskill employees as needed.

The department recently announced the winners of its latest AI Tech Sprint, many of which are now able to access production-level data. Sprints have an added bonus of helping VA develop faster mechanisms for contracting AI.

To that end, the National AI Institute is working with the Veterans Health Administration, Office of Information Technology and VA Cybersecurity and Innovation Program to use something like an other transaction authority to purchase and pilot AI quickly.

“One of the issues in working with contracting is around ensuring the security is there,” Alterovitz said. “And so we’re working with different security teams to ensure that the threat modeling for AI solutions is going to be consistent, in terms of the security controls and procedures.”

VA is also working to integrate security teams into AI development and deployment processes to secure and harden applications and create a trustworthy production baseline.

“The road to AI adoption goes through trustworthy AI that is robust and scalable,” Alterovitz said. “And the ultimate destination is standardized processes and high accuracy of the results.”

Federal judge won’t halt new task orders on $5.5B 2GIT contract

A federal judge won’t halt new task orders on a sprawling $5.5 billion IT contract, so long as the General Services Administration reevaluates Blue Tech’s bid by Sept. 14.

Court of Federal Claims Judge Edward Meyers granted Blue Tech relief, in the form of the reevaluation, after finding GSA “irrationally failed to follow its own solicitation” in rejecting the company’s Second Generation IT (2GIT) proposal, according to his opinion.

GSA made nine, five-year blanket purchase agreement (BPA) awards in February for 2GIT, a best-in-class contract developed with the Air Force to allow defense and civilian agencies and state, local and tribal governments to purchase commercial-off-the-shelf technologies from 79 companies. But GSA rejected Blue Tech’s bid to be a contractor team arrangement (CTA) lead on grounds the judge found “arbitrary and capricious.”

Still, the judge agreed with the injunction terms GSA proposed Aug. 10 — citing “national security issues” with further delaying a contract already re-awarded once — despite Blue Tech’s fears reevaluation would drag on “needlessly,” unless 2GIT task orders after Aug. 20 are halted.

“Because of the efficiency with which the government anticipates conducting its re-evaluation, the court does not think it necessary at this time to enjoin the government from continuing to place orders under the current awards,” the judge wrote in his order.

While Blue Tech belongs to three teams that won 2GIT BPAs, it would need CTA lead approval to bid on any task order it wished to fulfill for an agency. That didn’t sit well with an incumbent on 2GIT’s predecessor, the NETCENTS-2 contract.

GSA rejected Blue Tech’s proposal to be a CTA lead because the advanced secure web gateway device (ASWGD) included in the company’s quote didn’t have six terabytes of storage and 32 gigabytes of memory installed, but rather three terabytes and 24GB.

The agency used a market basket-evaluation approach, where bidders quoted their prices for frequently purchased technology products like the ASWGD, in making BPA awards. Except the solicitation merely required an ASWGD be “capable of supporting” six terabytes of storage and 32GB of memory.

Blue Tech’s initial quote for an ASWGD had eight terabytes of storage and 32GB of memory installed, but GSA warned its offered price was too high and its bid would be more competitive if it removed excesses. So the company altered its proposal, only to have it rejected.

In Blue Tech’s protest of GSA’s decision it argued its ASWGD fulfilled the agency’s solicitation requirements because it was still “capable of supporting” more storage and memory, an interpretation the judge found reasonable in siding with the company.

“In the preliminary injunction stage, the government argued that the market basket was not intended to provide for working installations. The government cannot have it both ways,” wrote the judge in his opinion. “If the solicitation truly requires quoters to quote only functional devices in their proposals, the government must exclude each of the offerors that proposed the cold standby version of the ASWGD that are not functional as quoted.”

Blue Tech and GSA did not respond to a request for comment.

How the cloud is spurring innovation in U.S. housing finance

Felipe Millon is the senior manager for housing industry within Amazon Web Services worldwide public sector financial services business.

Across the federal government, cloud computing is giving agencies the ability to experiment with new approaches and processes to accomplish their missions more effectively. These new approaches are opening doors that agencies didn’t foresee, offering them wider applications and greater benefits than agency leaders often first envision. 

We’re also seeing these results play out in U.S. housing finance. One of the best examples we’ve seen is with Fannie Mae, a mission-focused organization that enables access to mortgage financing. Fannie Mae moved to the cloud with an enterprise-level focus on gaining greater agility. However, their cloud journey has led to a wave of broader IT experimentation.

Felipe Millon, Housing Finance Lead, Amazon Web Services (AWS)

Part of this IT experimentation has involved machine learning, for example. As Fannie Mae Vice President Subra Seshadri shared at AWS’s most recent re:Invent conference, Fannie Mae sought to identify and predict which loans in its vast portfolio were most likely to slip into “trouble” within the first two years of acquisition. Because Fannie Mae’s mission is to provide stable sources of liquidity to support housing — by buying home loans, packaging them as mortgage-backed securities, and guaranteeing them — the ability to predict which loans might default is critical.

Fannie Mae had already begun leveraging AWS for a variety of storage and computing services. But as officials became more familiar with AWS’s capabilities, Seshadri’s team began testing AWS’s fully managed machine learning services — using Amazon SageMaker, AWS Lambda, Amazon DynamoDB and Amazon S3 — to build and train machine learning models and deploy them into a production-ready hosted environment. By testing a rapid succession of models inexpensively, and machine learning, Fannie Mae was able to boost its predictive “catch rate” on multifamily loan applications likely to default from 3.5% to 48%, according to Seshadri. That experiment helped Fannie Mae plan for early risk mitigation on higher risk loans. It also opened the door to exploring other cost savings opportunities at Fannie Mae and accelerated the pace of digital learning and transformation more broadly. 

Fannie Mae’s focus on innovation also illustrates how cloud services can enable “two-way door” decisions. Traditionally, when agencies make IT investment decisions, they almost always have to live with those decisions for a long time. That’s a “one-way door” decision. A two-way door decision lets you make an IT investment, and if you aren’t getting the results you want, you can easily reverse that decision. 

That’s a powerful concept in IT. The cloud is turning a lot of what once were one-way door decisions — for investing in infrastructure, applications and IT services — into two-way door decisions. Now with the cloud, a team can simply spin up a virtual server, try out a variety of applications or data analytics capabilities, and see what works. If they like what happens, they can scale it up quickly. If they don’t, they can easily shut it down, without the usual upfront capital costs and long-term expenses. 

By having much greater freedom to experiment, organizations come to a greater understanding of how to use, benefit from, and become more productive by leveraging the cloud.

Organizations also gain something even more important: By removing what we call the “undifferentiated heavy lifting” — the basic IT hardware and software that supports, but rarely distinguishes, your organization — they can focus more resources on delivering their missions.

Reducing that heavy lift has become even more important in federal and public sector organizations, where they face a steeper climb trying to assemble and retain the right IT talent. At AWS, we’re helping to make that lift even easier — not only by providing the latest turnkey tools and engineering support, but also by helping organizations train and certify their IT staffs.

We’re excited to see how these kinds of experiments are unlocking innovation across the U.S. housing finance system and throughout the federal government. The results show that, with the right leadership and empowerment, the cloud is enabling organizations to establish big goals, experiment, and push through once-intractable barriers.

Learn how AWS can help your agency capitalize on today’s cloud by visiting https://aws.amazon.com/federal/ or contacting us at USFedFin@amazon.com

Army software official says service can now see which units are downloading patches

The Army’s new software repository is giving cyber leaders insight into which units are downloading patches, the lead software official at the Army’s Communications-Electronics Command (CECOM) said.

The capability is a major step forward from CECOM’s previous method of sending patches and software updates: mailing CDs. The repository was first launched with pilot users a year ago. Now, the repository sees about 3500 downloads a month for 76 software systems, Jennifer Swanson, who leads CECOM’s Software Engineering Center, said.

“We were distributing software by mailing it … units were getting inundated with a bunch of CD’s that they didn’t know what to do with,” Swanson said of the old system during AFCEA International’s TechNet Augusta conference. “So you are always behind.”

CECOM oversees the management of the Army’s command, control, computers, communications, cyber, intelligence, surveillance, and reconnaissance (C5ISR) systems. The repository hosts patches for software that run the weapons and business systems under CECOM’s command, but it is working with other offices to expand.

One example of the new software repository working is the patch CECOM issued following the  SolarWinds breach. Once the Army got the patch for SolarWinds’ Orion network monitoring tool that was compromised by Russian hackers, it posted the new code and most units had it downloaded within a day, Swanson said.

“We were able to turn the patch around very quickly … we were able to put it right up on the repo and we were watching units downloading it,” she said.

Having that information gives cyber defenders a clearer picture of where the Army has known vulnerabilities, according to Swanson. The goal is to continue expanding the repository and improving the user interface.

Code for America management seeks extra time in union recognition talks

Code for America’s management team has requested extra time in discussions over formal recognition of a staff union, FedScoop understands.

Both sides discussed eligibility criteria for union membership late Thursday in a meeting that sources described as “amicable and constructive.”

The meeting was the latest in a round of talks between Code for America staff organizers and management in recent weeks over voluntary recognition of the union, which sources initially suggested could take place within weeks.

Leaders at the nonprofit are seeking to delay a final decision on eligibility of union membership until the beginning of October, citing a desire to ensure senior staff are adequately trained on working with a unionized workforce. They are also seeking to delay because of the absence of a senior leader currently on a six-week sabbatical.

It is understood that unionizing staff will consider whether to accept the request or to push ahead with a ballot organized by the National Labor Relations Board.

Under U.S. labor law, formal recognition of a union can be either granted voluntarily by an employer or through a secret-ballot election organized by the NLRB.

Earlier this month, staff revealed their intention to organize through the Office and Professional Employees International Union (OPEIU) Local 1010. So far, 62 people at the organization have signed union authorization cards, which is understood to represent about 77% of its workforce.

Management at the nonprofit have previously signalled their readiness to learn more about the union recognition process and readiness to engage with staff.

Code for America is among the first technology nonprofits to forge ahead with unionization. New York-based Kickstarter unionized in February 2020 over the course of about three months.

Three-quarter of private sector workers and about two-thirds of public employees have the right to collective bargaining in the U.S.

Employees inside the federal government and the wider technology sector have received a boost from the prioritization of rights to collective action under the Biden administration.

As part of its budget proposals, the administration in January proposed a pay raise for employees and said it would encourage union activity and collective bargaining.

A Code for America spokesperson said: “We support our staff having a collective voice and look forward to working together in this new space, especially as OPEIU is moving to the tech arena. We appreciate the constructive conversations we’ve just started and look forward to learning together to thoughtfully navigate this process.”

A spokesperson for Code for America Workers United said: “We are disappointed at Code for America’s decision to delay recognition until October. We also believe they are acting in good faith.”

“CfAWorkersUnited will continue to work with CfA management to push for union recognition as soon as possible,” the spokesperson added. “We don’t want to lose momentum, and postponing everything until October risks grinding that to a halt.”

Code for America is currently working on federal government contracts including the launch of a child tax credit portal for the IRS.

DHS searching for vendors to help host President’s Cup cyber competition

The Department of Homeland Security is looking for contractors capable of supporting the annual President’s Cup Cybersecurity Competition.

DHS’s Cybersecurity and Infrastructure Security Agency issued a request for information this week “to solicit information from industry that can provide President’s Cup Cybersecurity Competition (PCCC) support services.”

Launched in 2019, the President’s Cup is a national event to “identify, challenge, and reward the best cybersecurity talent in the federal workforce” based on elements of the National Initiative for Cybersecurity Education (NICE) Framework, according to CISA. The competition was created by a 2019 executive order on the federal cyber workforce, and the third iteration will run sometime this fall.

The RFI asks industry vendors to share information on their experience hosting online competitions — particularly those involving cybersecurity challenges like capture the flag events — providing cybersecurity training information, and developing video games, as well as generalized cybersecurity knowledge across their workforce.

It also asks questions about vendors’ capability to support the competition’s specific needs, like creating and testing “over 70 competition challenges within 2-3 months,” open-sourcing all content and providing 24/7 support.

Interested parties have until Sept. 8 to submit responses.

The 2020 President’s Cup ran from August 2020 to Feb. 25, 2021, hosting more than 1,400 participants and 250 teams in a virtual format. Participants competed in capture the flag challenges, as well as a so-called “Save the World” scenario, which featured mock news broadcasts about a snowstorm taking out a city’s critical infrastructure. The winning team came from the Army’s 780th Military Intelligence Brigade.

CISA hasn’t decided yet if the 2021 event will be in-person or virtual.

DOE’s $61M answer to industry’s call for practical quantum projects

The Department of Energy has awarded $61 million in funding to quantum information science (QIS) projects developing quantum devices, or paving the way for a quantum internet.

DOE awarded $30 million to projects strengthening U.S. competitiveness in QIS, $25 million to projects creating quantum internet testbeds and $6 million to projects developing quantum internet building blocks through a competitive, peer review process.

The grants come a month after private sector experts urged agencies, including DOE, to invest more of their budgets in practical quantum projects that advance the industry and a little more than a year after the department released its nationwide quantum internet blueprint.

“Harnessing the quantum world will create new forms of computers and accelerate our ability to process information and tackle complex problems like climate change,” said Secretary of Energy Jennifer Granholm in the announcement. “DOE and our labs across the country are leading the way on this critical research that will strengthen our global competitiveness and help corner the markets of these growing industries that will deliver the solutions of the future.”

Within the funding round, DOE made $30 million in awards to eight projects across its five Nanoscale Science Research Centers, which are administered by the National Laboratories. The projects aim to make breakthroughs in QIS, chemistry, materials and clean energy.

Industry experts criticized DOE for investing in esoteric, moonshot-type quantum projects — whereas foreign adversary China has seen success mobilizing its industrial and academic bases to work on more practical projects — at a Center for Data Innovation event in July.

The experts pointed to quantum infrastructure and enabling technologies like lasers and cryogenic cooling as starting points, and DOE’s latest awards include $2.8 million for projects to develop devices that send and receive quantum network traffic and another $3.2 million across research and infrastructure projects that will hopefully accelerate discoveries enabling nationwide quantum internet.

DOE’s 17 National Labs will form the foundation of a system for secure communication using quantum mechanics, the prototype for which is expected within the next decade. A three-node, 80-mile testbed connecting the Argonne National and Fermi National Accelerator labs with the University of Chicago in 2020 was just the beginning.

DOE awarded $25 million to two other regional-scale quantum network testbeds out of the Oak Ridge, Los Alamos and Lawrence Berkeley national labs. The new foundational infrastructure will lead to quantum internet stacks, hardware, operating systems, applications and networks, as well as allow for refining techniques for quantum error correction at internet scale.

“The foundation of quantum networks rests on our ability to precisely synthesize and manipulate matter at the atomic scale, including the control of single photons,” said David Awschalom, senior scientist at Argonne National Lab, back in July 2020. “Our national laboratories house world-class facilities to image materials with subatomic resolution and state-of-the-art supercomputers to model their behavior.”

New Air Force secretary voices skepticism over Internet of Things program

The Air Force’s new secretary, Frank Kendall, has cast doubt on the future of the Advanced Battle Management System (ABMS), the service’s Internet of Things program.

The service should move its focus from experimental capabilities towards technology that can be used in battle in the near future, Kendall told Defense News in an interview. The comments come after Congress slashed the Air Force’s requested $300 million in fiscal 2021 to an enacted $150 million.

An Air Force official told FedScoop that no changes have been ordered yet to the program. It is typical for new service leaders to review programs started under previous administrations.

ABMS is the Air Force’s contribution to Joint All Domain Command and Control (JADC2), the military’s framework of fighting in a networked battlefield where all sensors can be linked and all data shared. ABMS is widely seen as the farthest along in that missions of connecting everything, like linking data between planes mid-flight. The Navy and Army are developing their own programs to test the JADC2 concept.

Kendall was sworn in to office and the top civilian for the Air and Space Force July 28. He previously served as the undersecretary for acquisition, technology and logistics in the Obama administration.

ABMS’s development was concentrated in demonstrations where the Air Force brought together a host of emerging tech and tested it out in battlefield scenarios. Kendall’s comments suggest that may change and a sharper focus on tech that be fielded in the near term would be the priority. The Air Force already had to scale back its schedule of demonstrations to only two this year following Congress’s fiscal 2021 cuts to the program.

Kendall did not say if the demonstrations would be discontinued all together or what impacts could happen to the program, which is housed in the Rapid Capabilities Office.

US agencies scrub websites, social media accounts to protect Afghan contacts

U.S. agencies continue to remove information from government websites and social media accounts that they believe could compromise contacts in Afghanistan.

The State Department, U.S. Agency for International Development and the Department of Agriculture are among the agencies understood to have so far removed photographs and information or curtailed access to webpages. Access to certain pages remained blocked as of Thursday afternoon.

It comes amid reports of Taliban fighters searching door-to-door for people who may have worked with foreign governments and amid concerns that online data may help the Taliban to identify Afghans who worked with Americans.

Details of the campaign to remove data were first reported by the Associated Press.

In a statement to FedScoop, State Department spokesperson Ned Price said: “The safety of our Afghan contacts is of utmost importance to us.”

“State Department policy is to only remove content in exceptional situations like this one. In doing so, Department personnel are following records retention requirements,” he added.

Guidance from the National Archives and Records Administration calls on agencies to follow best recordkeeping practices with social media accounts and to retain web content records in a portable format.