DHS creates Cybersecurity Service similar to DOD’s Cyber Excepted Service
The Department of Homeland Security has created the DHS Cybersecurity Service, a new way to hire and manage cybersecurity professionals outside of traditional civil service requirements.
DHS announced the Cybersecurity Service as part of its long-awaited Cyber Talent Management System in an interim final rule published Thursday in the Federal Register.
Personnel hired to the DHS-CS will take what the department is calling qualified positions — excepted service roles with their own qualification requirements and that are not subject to the appointment, pay, and classification rules of traditional competitive service positions, based on special hiring flexibilities. The Department of Defense has its own Cyber Excepted Service initiative based on similar hiring flexibilities to make itself more competitive and quick in hiring and managing civilian cybersecurity talent to its forces.
“The goal of the DHS-CS is to enhance the cybersecurity of the nation through the most effective execution of the DHS cybersecurity mission,” the rule says. “DHS will use [the Cyber Talent Management System] to hire, compensate, and develop DHS-CS employees to reinforce the values of expertise, innovation, and adaptability.”
DHS was granted the authority to create a new personnel system for cybersecurity in 2014. What came out of that was the Cyber Talent Management System, an “agile and innovative personnel system” that better equips DHS to “compete for cyber talent with the private sector — speeding up the hiring process, attracting talent from non-traditional educational backgrounds, using innovative tools to assess applicants, and offering more flexible performance-based compensation.”
When finalized, the rule will allow DHS to hire cybersecurity personnel at salaries based on their skills, up to $255,800 —the vice president’s salary. That, however, can be overridden in special circumstances, with an “upper limit of 150 percent of EX-I ($332,100 in 2021),” the rule says.
“To invoke the extended range for specific DHS-CS employees, the Secretary must determine based on the CTMS compensation strategy, that the employee’s qualifications, the employee’s mission impact, and mission-related requirements warrant adjusting the employee’s salary beyond the standard range,” says the rule.
On a new recruitment webpage, DHS also touts the Cybersecurity Service’s career development approach. “DHS Cybersecurity Service employees are encouraged to keep their skills sharp and remain aware of emerging technology and threats through regular training opportunities,” it says, adding that employees will “participate in a range of classroom and on-the-job learning activities based on their current responsibilities, skills, interests, and career goals.”
DHS received $62 million between fiscal 2014 and 2021 to design and build the Cyber Talent Management System and Cybersecurity Service. For fiscal 2022, it has requested $16 million to finally launch and administer the programs. The department also hopes to hire 150 cyber professionals using the system.
The interim final rule officially takes effect Nov. 15 and is open for public comment until Dec. 31.
Other organizations including the Partnership for Public Service are working on improving the pipeline of cybersecurity talent into federal government. Earlier this week the nonprofit announced the second cohort of participants in its cybersecurity talent initiative, which aims to improve knowledge sharing between the private and public sector.
Note: This article was updated to include details of the Partnership for Public Service’s cybersecurity talent initiative.
Polaris paves the way for Aurora exascale supercomputer at Argonne
Argonne National Laboratory plans to pave the way for its first exascale supercomputer with a testbed system, Polaris, announced Wednesday.
The “stepping stone” supercomputer will afford staff and users early access to hardware and technologies that will be available when Aurora delivery begins in 2022, giving them time to prepare, Ti Leggett, Polaris project director, told FedScoop.
Aurora will be one of the first large-scale deployments of yet-to-be-released technology from Intel, so Polaris will employ a similar architecture in the meantime.
“It’s a different architecture than our systems currently run, that our users have been familiar with for many years,” Leggett said. “Polaris will fill the gap for hybrid computing with GPUs, the Slingshot, as well as preparing their data on the Eagle and Grand file systems.”
Polaris will be a hybrid central processing unit-graphics processing unit (CPU-GPU) system based off Hewlett Packard Enterprise’s (HPE) Slingshot interconnect, just like Aurora. Both supercomputers will have the same HPE Cray programming environment and system software stack.
The new architecture used by HPE Cray exascale supercomputers is designed to handle massive modern analytics and artificial intelligence workloads.
Despite both sporting a unified memory architecture, the systems’ biggest difference will be between their CPUs and GPUs. Polaris will use NVLink, while Aurora will use Intel Xe links. Still CPUs will connect to GPUs via PCIe, and GPUs will employ high-bandwidth memory in both cases.
The first of the Argonne Leadership Computing Facility’s (ALCF) users to benefit from Polaris, and later Aurora, will be those on Early Science Program research teams.
“We work with key projects with aspirations for running on the next machine as soon as possible and help us stress the machine and give feedback to the vendors on the design,” Leggett said. “So some of the first users we wanted Polaris to support were those Early Science Program users.”
Aurora will support not only ModSim science codes but artificial intelligence, machine learning and data-intensive workflows, and Polaris will be able to do that with the same architecture.
The Department of Energy, of which Argonne is a part, also has the Exascale Computing Project preparing scientific codes for the new architectures.
“We’ll be working with them to get them early access as well and continued access on Polaris through the end of the ECP project, in order for their codes and applications to make their deliverables,” Leggett said.
Argonne has a formal project with its own director for both the Polaris and Aurora system acquisitions for budget and delivery purposes. Susan Coghlan directs the Aurora project, and Leggett is her deputy.
Both projects will go through an acceptance period where the hardware is stress-tested and vetted for functionality, performance and stability, followed by Critical Decision 4, the project closeout date. Leggett declined to give date specifics.
“Those dates have been set and we’re marching to those and we should have the system deployed and accepted ahead of that,” he said.
The expectation is that Polaris will be available to the first users early in the first quarter of 2022, before going into production for the wider INCITE and ASCR Leadership Computing Challenge (ALCC) allocation programs soon after. While the Frontier exascale computer at Oak Ridge National Lab is being installed now, Aurora is next up with delivery in 2022 and production in 2023. Lawrence Livermore National Lab‘s El Capitan exascale computer is also due for delivery in 2022.
Polaris will leverage all of ALCF’s existing infrastructure, namely the 200-petabyte Eagle and Grand file systems deployed last year. They combine for 1.5 terabytes-per-second bandwidth, which will be leveraged for campaign storage.
The Eagle file system also has novel community sharing via Globus sharing that will remain available for Polaris users to generate end data and share it with the wider research community.
All systems will be supported by an InfiniBand Sand fabric and backend infrastructure including Theta, the current, Core-based Intel Knights LANDING CPU system Aurora is replacing.
Once Aurora is on the ALCF floor, Polaris will remain a production resource for ML, AI and data-intensive workflows.
Argonne also wants to use Polaris to explore integration with other experimental facilities, starting with several on site like the Advanced Photon Source and Center for Nanoscale Materials that can be incorporated “rather easily,” Leggett said.
“We’re going to use Polaris as a way to explore how we can connect these traditionally ModSim, high-performance computing resources with more on-demand, urgent computing that is required for those kinds of experimental facilities,” Leggett said.
OMB setting up program management office for interagency collaboration tool
The Office for Management and Budget is establishing a program management office for a new interagency collaboration tool, the deputy federal CIO has said.
Speaking on Wednesday at Fedscoop’s FedTalks, Maria Roat outlined the next steps for the pilot program, adding that interagency programs and partnerships are “laying the foundation” for future of the federal government.
The tool is officially known as the CIO Council Interagency Collaboration Tool and includes a chat function and the ability for staff from different agencies to share documents.
“[Next] we are standing up a project management office to manage the rollout and continue to bring on other agencies and departments and integrate multiple platforms as part of the long-term vision on this,” said Roat.
OMB has been working to launch such a collaboration tool for over a decade, but previous attempts have failed, in part because of the need for agencies to sign onerous data sharing agreements for every separate aspect of data sharing projects.
This latest pilot project is different, according to Roat, because it includes a single data agreement for all participants. Federal departments involved in the pilot project so far include the Small Business Administration, the Department of Education, the National Science Foundation, and NASA.
The launch of the scheme has been spearheaded with support from the CIO Council, which last year took on the task of helping to set up a cross-government employee collaboration tool.
I have been after this for a long time – for the ability to chat with someone not in my department,” added Roat.
Program management offices have been used by federal agencies since about the early 2000s. The concept originated in the private sector and is typically used to manage services that are shared across multiple business units of an organization.
Telehealth rates won’t fade after pandemic, VA CIO says
After struggling for years with clinicians and patients reluctant to use virtual appointments in lieu of in-person medical visits, the Department of Veterans Affairs believes telehealth is finally starting to stick as an option for veterans seeking care.
Even as Department of Veterans Affairs medical facilities have re-opened to in-person visits, veterans are still choosing to use telehealth options at rates similar to those during the early days of the COVID-19 pandemic, acting VA CIO Dominic Cussatt told FedScoop during an interview Wednesday at FedTalks.
“This is going to be a permanent state for us at the VA,” Cussatt said. “Telehealth helps us reach so many people in very remote areas that have a hard time getting to our medical centers.”
Before COVID-19, the VA conducted roughly 40,000 telehealth visits a month. “Now we routinely conduct 40,000 per day,” Cussatt said.
“And we know that’s not going to go away, that we’re gonna we’re seeing that volume level off,” he said. “Even with facilities reopening and people getting back out to more face-to-face experiences, we’re seeing our numbers kind of stay level. So there’s definitely the demand out there.”
As of early August, the VA had conducted 11.8 million telehealth visits since the start of the pandemic, Cussatt said. “The pandemic really forced our hand,” he added.
That scale of telehealth support wouldn’t have been possible if not for the cloud, he said. “We quintupled our telehealth capability by upgrading our on-prem IT systems and expanding further into the cloud. So we were able to work with our vendor partners to very quickly turn around some site-specific upgrades and technology upgrades to accommodate this huge spike in telehealth use so that we can use the capability to the greatest extent we could.”
The VA had already made the move to the cloud prior to the pandemic, so “we were able to scale up to face the anticipate unanticipated needs of the pandemic with very little prior planning because the platforms were already there. And the capabilities were there, we just needed to scale up,” Cussatt said.
It also helps that veterans, who tend to be older, have had to become more in tune with modern tech during the pandemic.
“The veterans are really embracing this technology, learning how to use it,” Cussatt said. “And I think that’s going to keep them doing so for the long haul. So … if there’s any silver lining in the pandemic, it really helped us to expand our ability to reach more veterans and in farther reaches than we ever did before.”
GAO report identifies 10 government agencies researching facial recognition
At least 10 U.S. government agencies are undertaking research and development work into facial recognition technology, according to a new report by the Governmental Accountability Office.
The study, which was published on Tuesday, identified a range of projects across government currently underway, from experiments with new forms of enhanced staff identification to research on the impact of race and aging on the accuracy of the technology.
Out of 24 agencies surveyed by GAO, 19 reported using facial recognition technology. The most common uses for it were digital access and domestic law enforcement.
Among the most prolific users of such systems are the departments of Defense and Justice, which according to the report use facial recognition for domestic law enforcement, physical security, and also national security.
At the DOJ, the FBI uses a platform called Next Generation Identification Interstate Photo System to generate leads during investigations by comparing photos of unknown individuals suspected of criminal activity against a repository of photos of known individuals.
According to the report, agencies also access commercially owned facial recognition systems as part of criminal investigations or to assist in identifying a missing person or victims of crimes, such as exploited children.
It found also that the Department of Homeland Security has entered into facial recognition technology-related agreements – which are known as project arrangements – with the British and Australian governments. DHS also reported transactions with the Mexican government and Guatemalan government.
NASA uses facial recognition technology to verify the identities of individuals being issued ID cards and also to demonstrate how such technology works in educational settings.
The latest report comes as lawmakers in the House and Senate consider legislation that could potentially halt the use of facial recognition and biometric data collection tools by federal law enforcement.
It follows a prior study from GAO, published in July, that called for agencies and Congress to consider improving standards, training and transparency around forensic algorithms.
Pandemic has TSA developing tech that detects threats while reducing physical contact
The Transportation Security Administration is taking advantage of reduced travel during the pandemic to accelerate deployment of technologies that increase airport security while reducing physical contact that could spread disease.
Travel remains down 20% compared to pre-pandemic levels, which made it easier for TSA to upgrade its computed tomography (CT), advanced imaging technology (AIT) and credential authentication technology (CAT) systems without disrupting travelers.
“These capabilities are providing better threat detection, which is really part of our fundamental mission, but interestingly — the convergence we’ve been trying to do through the pandemic — ensuring that we’re also providing health protection,” Stacey Fitzmaurice, executive assistant administrator for operations support at TSA, told FedScoop during FedTalks on Wednesday.
TSA is focused on ensuring pilots of the new technology are transparent. The agency hopes that the systems effectively identify threats, while also preserving privacy through opt-ins and promoting better public health.
CT is 3D imaging technology that screens passengers’ luggage at checkpoints and allows TSA agents to rotate the resulting image to view a bag from all angles — reducing the number that need to be physically opened for closer inspection. TSA is also considering how to integrate UV sanitation systems with X-ray and CT systems, so they sanitize the reusable bins.
AIT looks for metallic and nonmetallic threats on peoples’ bodies, and enhancements will eliminate the need for travelers to pose with their hands up in favor of a more relaxed posture during screening.
CAT handles identity management, and the process for authenticating the validity of travelers’ IDs is being automated. The CAT system links to TSA’s Secure Flight vetting system in real time to verify a person’s identity, ensure they’re not high risk and speed them through checkpoints.
TSA wants to add a biometric capability to CAT that uses a person’s physical features to facilitate airport access. To that end the agency is piloting one-for-one and one-to-many match systems.
One-for-one systems see travelers approach a CAT machine, have them insert ID such as a driver’s license and take a live photo for comparison — assuming the person has opted in.
One-to-many systems cater to travelers who have pre-enrolled in programs like TSA PreCheck and have a camera attached to a CAT machine take a live image of a person and compare it to an existing gallery.
TSA is also working with companies to potentially incorporate digital identities — driver’s licenses or passports kept on travelers’ phones for scanning by a CAT system. The Department of Homeland Security Science and Technology Directorate is a partner in testing such systems to eliminate bias.
While TSA is “closely tracking” the national conversation around vaccine passports, whereby a traveler would verify they’ve received a COVID-19 vaccine, the agency has no current plans to require them, Fitzmaurice said. TSA is still interested in vaccine passport development though and ensuring only the information necessary for that use case is accessed, valid and protected.
New capabilities need to have cybersecurity built into their IT backbone, and TSA is ensuring multi-factor authentication, constant monitoring, and robust cyber training and awareness for all employees, Fitzmaurice said.
TSA must also ensure its partners — airlines, airports, surface transportation companies, and pipeline operators — also have appropriate cyber protocols in place.
Since the Colonial Pipeline ransomware attack in May, TSA and the Cybersecurity and Infrastructure Security Agency have improved communication with pipeline operators regarding industrial control systems and operational technology.
“We’ve been working with the pipeline operators to implement some new requirements for cybersecurity to ensure that we can help protect against the rising cyber threats and better protect both the national and economic security of the U.S.,” Fitzmaurice said.
DOD to establish new zero trust management team this fall
The Department of Defense is standing up a new portfolio management team to oversee the implementation of zero trust architecture, acting CIO John Sherman announced Wednesday.
Sherman said the team would be up and running by the fall and be overseen by the chief information security officer, Dave Mckeown. According to Sherman, the new team will help boost a new approach to security, which he says is a top priority.
“You don’t just buy zero trust, it’s not a tool or a technology, it really is a new strategy,” he said during FedScoop’s FedTalks conference. “We have got to run a new … defense, and zero trust is going to be it.”
Zero trust requires both a technical and cultural change to cybersecurity protocol, where administrators assume there are already adversaries in a network and the goal is to stop their movement instead of just trying to defend the perimeter.
“I am very serious about this being a priority,” he added.
The new team will also work closely with the Defense Information Systems Agency (DISA). The military IT agency has its own zero trust efforts in its Thunderdome program. Sherman added that DISA will work closely with the new portfolio management team.
DISA is also working on a critical piece of tech to implementing zero trust, an enterprise-level identity, credentialing and access management (ICAM) tool. Sherman said this will be critical to the new framework, and that the tool should be ready by early next year.
“This is a dynamic, tough problem .. but we have the military department’s commitments on this and we have a number of pilots underway,” he said.
Zero trust has become a topic of interest not just for the DOD, but across government. A recent executive order from President Joe Biden called on all agencies to develop plans to shift to a zero trust security model following the SolarWinds breach.
Another cybersecurity priority is improving the workforce in DOD defending networks. Sherman said he is working on a full review of the workforce to find a way to support those working in cyber.
Sherman also announced a deadline for a new cyber workforce strategy that will need to be complete by early next year. The strategy will aim to boost the always thinly stretched cyber work force by recruiting, retaining and reskilling cyber talent.
“The women and men who make up the core of our civilian and uniform workforce are going to be critical in this,” he said.
Centers of Excellence program looks to add smaller agencies to portfolio
The Centers of Excellence plan to increase work with smaller federal agencies, after concluding their three-year digital transformation partnership with the U.S. Department of Agriculture.
Part of the General Services Administration‘s Technology Transformation Services, the CoE program has expanded its agency partnerships threefold since starting with USDA in early 2018 but wants to diversify its portfolio.
USDA represented a full CoE engagement where all the centers operating at the time — Cloud Adoption, Contact Center, Customer Experience, Data & Analytics, and Infrastructure Optimization — were activated, but it wasn’t just the large agency that profited.
“The smaller agencies are really the ones who benefit a lot from the work that we’ve done with large agencies because, A, they don’t have the budget to replicate that kind of work and, B, they’re looking for folks to come in with the expertise to just hit the ground running,” Jennifer Rostami, acting executive director of the CoE program, told FedScoop. “And that’s what we bring to the table.”
The CoE program doesn’t just want to work with USDA and the Pentagon’s Joint Artificial Intelligence Center but also agencies like the Eunice Kennedy Shriver National Institute of Child Health and Human Development (NICHD), which became the eighth of 10 partners in May 2020.
CoEs created a roadmap covering the different aspects of USDA’s modernization that remain in use and publicly available to agencies large and small.
“The roadmap we created in partnership with GSA is being used successfully across the federal government,” said Gary Washington, chief information officer of USDA, in a statement. “This creates not only a new customer-focused environment but also ensures we continue to save millions of dollars in duplicative and antiquated systems each year.”
USDA saved $42.5 million by closing 31 of 37 data centers, when its goal had only been $18.7 million.
Closing data centers allowed the CoEs to set up an enterprise cloud offering, the Centralized USDA Cloud Office, allowing agencies at various stages of cloud adoption to purchase solutions within a multi-cloud environment. Infrastructure was developed in a way that allows agencies to choose different cloud providers that meet their needs.
Data duplication is a big challenge across governments, and the CoEs helped USDA mitigate the problem by standing up a centralized data repository and data lake for another $10 million in savings. CoEs ensured USDA had a secure data catalog and ingest process that allowed for more than 100 dashboards in all program areas to receive actionable information from more than 150 sources in real time.
The CoEs also created a detailee program where client agencies, in this case USDA, identify employees they want to see develop modernization and leadership skills to pick up where the program leaves off. One USDA detailee even embedded with the CoEs and received specialized training at each center — on lessons learned, working with cloud providers and applying AI to data analytics — before returning to the department. That person helps run USDA’s customer experience office now that the CoEs’ work is done.
“Our mission is to be part of a period of time for an agency but then also to exit,” Rostami said. “But in order to exit, we need to make sure there are folks on the ground who know how to do the new things that we’re doing together.”
The CoEs also helped USDA:
- consolidate 15 online contact centers under the AskUSDA website,
- modernize the department website,
- increase public approval of the Farm Loan program by 3.5% in one year, and
- train 3,000 employees to use dashboards and visualizations.
“This first-of-its-kind collaboration is already yielding significant benefits: expanding access to USDA loan programs for farmers and ranchers, making it easier for USDA customers to get the answers and information they need, while avoiding burdensome costs,” said Robin Carnahan, GSA administrator, in a statement.
The CoEs remain open to working with USDA again in the future, but they have plenty on their plate in the meantime.
An Innovation Adoption Practice was launched by the CoE program in July to facilitate change management, learning and development, and internal communication within agencies the centers are working with.
“We figured out that people are the biggest challenge within technology,” Rostami said. “And so this really gives our client agencies the opportunity to focus on people and what they need — training and all sorts of stuff to master innovation.”
Kendall merges Air Force acquisition offices to support Space Force
New secretary of the Air Force Frank Kendall said he is moving the service’s Space Acquisition Directorate into the Space Acquisition and Integration Office, he announced Tuesday.
The announcement, which he said was effective immediately, is meant to bolster the nascent acquisition enterprise of the Space Force, which sits under the larger Department of the Air Force. Kendall said that it was a needed step to support acquisition capability within the newest branch of the military.
“One area where we have not done enough yet is in the acquisition capacity of the Department of the Air Force,” he said during the Space Foundation’s Space Symposium.
Space Force leaders had promised that its acquisition enterprise would be “agile” and not allow the traditionally slow bureaucratic process of the military to hamper its ability to buy tech and space assets. So far, some members of Congress have expressed disappointment over the service’s progress.
Kendall also named an acting leader for space acquisition, Brig. Gen. Steve Whitney, who currently oversees space development and purchasing within the Office of the Secretary of the Air Force.
Congress created a new space acquisition civilian role to lead a more agile approach for purchasing the tech that the new force will need to operate in space. While Kendall has not named someone yet for that role, he said he is reviewing several candidates and a nomination could come soon.
Shawn Barnes has been leading space acquisition in an acting capacity but will “move on to another leadership position” soon, Kendall said.
Langevin teases bid protest reforms coming from Congress
Changes may be coming to the federal bid protest process to ensure that losing bidders cannot derail a government procurement, a top lawmaker on the House Armed Services Committee said Tuesday.
Rep. Jim Langevin, D-R.I., said during an interview at FedTalks that the committee is “looking at” reforms to the federal procurement process and “a company’s ability to hold up defense programs for years.” He said he “hopes to see some positive changes” in the near term, possibly as soon as in the forthcoming fiscal 2022 National Defense Authorization Act, which is set to be passed later this fall.
Langevin expressed his frustration with the current state of federal bid protests in relation to the Pentagon’s beleaguered and now canceled Joint Enterprise Defense Infrastructure (JEDI) cloud contract, which has since been reborn as a multi-cloud acquisition known as the Joint Warfighting Cloud Capability (JWCC). He called the JEDI saga a “source of frustration” for himself and his committee as they continue to see procurements, many in the IT space, “getting bogged down in the protest after protest.”
It seems likely that Congress will have to take some sort of action “to stop big protests from being essentially a matter of routine in the course of action,” he said.
“I want to see us have a fair and open bid process, want there to be transparency. That’s going to be the rule … that those elements have to be in place,” said Langevin, chair of the committee’s Cyber, Innovative Technologies, and Information Systems Subcommittee. “You know, I have deep reservations about the bid process right now and the protest process right now and a company’s ability to hold up defense programs for years. We’re hurting our national security when we do that. We’re hurting the warfighter at the end of the day.”
Langevin acknowledged that the failure of JEDI has put the Department of Defense even further behind in acquiring an enterprise cloud capability, making it imperative that the department gets it right this time with JWCC.
“We were behind the curve when JEDI started,” he said. “And you know, we’re four years further behind now. And so we really need to work harder to get this right with this new JWCC plan that DOD is going with. This is a particular capability that we can’t continue to delay — we need to get this right for the warfighter.”