US agencies scrub websites, social media accounts to protect Afghan contacts

U.S. agencies continue to remove information from government websites and social media accounts that they believe could compromise contacts in Afghanistan.

The State Department, U.S. Agency for International Development and the Department of Agriculture are among the agencies understood to have so far removed photographs and information or curtailed access to webpages. Access to certain pages remained blocked as of Thursday afternoon.

It comes amid reports of Taliban fighters searching door-to-door for people who may have worked with foreign governments and amid concerns that online data may help the Taliban to identify Afghans who worked with Americans.

Details of the campaign to remove data were first reported by the Associated Press.

In a statement to FedScoop, State Department spokesperson Ned Price said: “The safety of our Afghan contacts is of utmost importance to us.”

“State Department policy is to only remove content in exceptional situations like this one. In doing so, Department personnel are following records retention requirements,” he added.

Guidance from the National Archives and Records Administration calls on agencies to follow best recordkeeping practices with social media accounts and to retain web content records in a portable format.

USCIS needs more enterprise architecture visibility to decrease technical debt

U.S. Citizenship and Immigration Services needs to improve visibility among its various IT groups in order to better address its technical debt, according to Bayne Brown, chief of strategic vendor management (SVM).

Brown’s shop handles end-to-end software asset management for USCIS but doesn’t always have line of sight into what IT groups responsible for patching products or moving the agency to a five- to six-year target state are doing.

Those linkages were lost after USCIS’s legacy enterprise architecture group, which understood how the agency’s many systems supported its business processes, took over the help desk managing all software licenses. But USCIS is working to fix that.

“We should be able to, in an optimized target state, have that sight,” Brown said, during an ACT-IAC event Tuesday. “That would put us in a better situation to be able to tackle this technical debt that we have, to ask tough questions, to get rid of things we aren’t using.”

Brown wants to know which software is associated with which systems, and if those systems are associated with USCIS’s target state, so SVM can determine which products to divest from and invest in.

The agency can answer those questions by incorporating more IT groups into the Flexera system SVM adopted to facilitate software license requests and make more informed procurements — to the tune of $90 to $100 million annually, Brown said.

Before Flexera if a software license request was above the entitlement, a procurement was triggered. Now SVM receives the request via Flexera, checks if a license is available and takes it from somewhere else, if it hasn’t been consumed in 90 days.

SVM has kept USCIS’s IT portfolio relatively flat using Flexera data to reconcile what offices want with what they use, so getting more eyes in the system would lead to better procurement planning, lower IT spend and increased cohesion.

“I can start to make procurement decisions that are in line with an optimized target state that has full awareness of the systems that are going to be a part of that target state, that are going to be decommissioned or retired,” Brown said.

Exit Interview: Former CIO Eric Olson says Treasury’s IT is in a better place

When Eric Olson took over as CIO of the Treasury Department in late 2017, the department’s IT was in rough shape.

Treasury’s FITARA Scorecard grade at the time was hovering at a D due to scoring poorly in categories of IT transparency and management, cybersecurity, and exercising CIO authorities — components of the scorecard’s namesake law, the Federal IT Acquisition Reform Act.

The department’s management of its more than $5 billion annual IT budget left something to be desired.

Flash forward nearly four years: Olson retired from government July 31, and as he did so, Treasury was fresh off of receiving a B grade for the third FITARA Scorecard in a row earlier in the month.

While there’s much, much more to being a CIO than earning a decent FITARA Scorecard grade, Olson pointed to this achievement as representative of the greater progress Treasury has made during his tenure in reforming and modernizing its IT management practices.

“I think that’s pretty significant,” Olson told FedScoop in an interview.

Modernizing Treasury’s IT 

Olson served as deputy CIO of Treasury for two years prior to taking the top IT role, so he had a strong grasp of the department’s IT operations and what foundational changes needed to be made to modernize the organization. And moving to the cloud was central to that.

“When I took the helm as CIO … we very much had an on-premise orientation to infrastructure. We were doing some stuff in the cloud. But in terms of our general approach, prior to my involvement, the thought was really more around consolidating into Treasury data centers,” Olson said. “And so we’ve really moved away from that orientation, and now have very much of a multi-cloud orientation that includes software-as-a-service and the various providers there, [as well as] infrastructure-as-a-service.”

He pointed to Treasury’s forthcoming billion-dollar T-Cloud contract as evidence of that, along with its adoption of cloud-based talent management and HR systems.

The department was also weighed down by technical debt when Olson took the CIO role, he said. While that’s not totally taken care of, he said eliminating technical debt was a big focus during his tenure, “looking around the department and writing out the most egregious technical debt, particularly from an end-user perspective.”

By technical debt, Olson is referring to the costs — in financial investments, labor and other areas — of supporting legacy IT environments, particularly those that are customized. Technical debt is often the crux of federal CIOs’ modernization efforts because while it may appear to be expensive to transition to new systems in the near term, in the long run, sticking with outdated systems is often more costly.

Olson is also a big fan of commercial, low-code and no-code software, pushing the department in that direction instead of building or buying “bespoke” solutions. He said “the vast majority” of the applications Treasury deployed to support rollout of the CARES Act and American Rescue Plan Act were low- and no-code platforms.

“We’ve really moved completely to an orientation focus on low-code, no-code platforms and software as a service,” he said, “really only pursuing bespoke development where we can’t buy it as a service or we can’t configure it as a sort of a low code module.”

On the cybersecurity front, Olson said cyber and risk management are always top concerns for any CIO, but the sweeping SolarWinds Orion breach was a “game-changer” in amplifying that. Treasury was one of several federal agencies that fell victim to the SolarWinds hacking campaign.

“It was an inflection point in the whole progression of the cybersecurity challenge,” Olson said. “There was an intensity around it.”

In his time as CIO, Olson said Treasury has taken steps forward improving its cybersecurity and developing what he calls “a first-class high-value asset program.” Treasury has built its own “in-house version of [the Department of Homeland Security’s] risk vulnerability assessment and security architecture review programs such that we’re doing that ourselves even beyond what DHS might do.”

One CIO to rule them all? Maybe not

While Olson touted his department’s improved FITARA Scorecard grade, he admitted that he’s not the biggest fan of one part of the law in particular.

FITARA’s creators wrote the law as a mechanism in large part to centralize CIO authority and IT oversight within federal departments under a single department-level CIO. One CIO to rule them all, in essence, much like massive corporations in the private sector frame the role.

But Olson doesn’t think that should be a one-size-fits-all statute.

“At the end of the day, these are enormously large organizations,” he said. “And, you know, just like we have a federal government and we have state governments, and in theory, we have some separation of duties — these organizations are so big that some manner of federation needs to exist, should exist.”

Olson called that federation and separation of duties an “optimal model” and suggested that it’s “probably time to look at [FITARA], sort of assess, maybe revisit, tweak, what have you.”

Rather than managing departmentwide IT with a heavy hand, Olson said “it’s still about governance.”

“I am supremely grateful and thankful to the bureau CIOs that I had a chance to work with at Treasury,” he said. “And it’s those relationships and trust, and having a good governance model, and working in that tension of the federation where sometimes it makes sense to do things together as a department, and sometimes it makes sense to do things individually in bureaus and working through that in a very transparent data-driven way.”

What’s next?

Olson doesn’t have a new job lined up yet, he said, explaining that he felt more comfortable seeking out his next role while not working as Treasury CIO so there are no ethical questions or misperceptions.

“I did not leave to take a specific role. I’ve been in the federal government now for 18 years … So it’s been an excellent run. But I think it’s time to do something different,” he said. “And the past 18 months have been pretty intense with remote work, the pandemic, a new administration, SolarWinds. So what I wanted to do is look at the things that I’ve learned, accomplished over the past 15, almost 20 years here in the federal government and think about where to apply those next.”

Treasury is also looking for Olson’s replacement, posting a job listing for a new CIO on USAJOBS recently. Until then, Tony Arcadi, the department’s associate CIO for infrastructure and operations, has stepped in as acting CIO.

For whoever takes the CIO job in a permanent capacity, Olson has some parting advice: Don’t get distracted by shiny objects, and don’t be afraid to borrow good ideas.

“I’ve just seen a lot of CIOs or executive technology executives in my time get distracted by shiny objects, and I fundamentally believe the job is about the essentials and the priorities,” he said. “There is so much opportunity to improve the federal technology without necessarily stepping onto the bleeding edge and taking those risks. And sort of simply adopting what are very proven best practices in other federal agencies or nonprofit domains or within private sector companies.”

Army readying a laser that can shoot down drones

The Army completed testing of a laser that can hardness directed energy to shoot down adversarial small drones, a service official told reporters Wednesday.

The tests at Fort Sill in Oklahoma this summer demonstrated the Army’s combat use of a laser it has been developing for the past two years. The laser — the Directed Energy-Maneuver Short-Range Air Defense (DE M-SHORAD) — is the first the Army has developed for countering new threats like unmanned aerial systems.

By fiscal 2022, the Army plans to have four of the lasers in use.

“This is the first combat application of lasers for a maneuver element in the Army,” Lt. Gen. L. Neil Thurgood, director for hypersonics, directed energy, space and rapid acquisition, said in a statement. “The technology we have today is ready. This is a gateway to the future.”

The weapon harnesses energy to focus a beam of photons at an oncoming object. It uses both onboard sensors and data from an array of other sensors to detect threats like drones, which are of increasing concern for Army combat operations.

One of the main advantages of using lasers in counter-UAS weapons is there is no need to reload a laser that uses energy as its ammunition.

“All the bullets are built into the system,” Craig Robin, deputy director of DE M-SHORAD, told reporters.

To develop the system, the Army has used other transaction agreements and rounds of prototypes tests — a model the service has used for other emerging tech programs, like its Integrated Visual Augmentation System (IVAS) headsets.

The system is similar to an effort the Air Force Research Lab is working on. Both use directed energy as a defense against novel threats, but the Air Force is researching the use of microwaves to stop swarms of drones. 

National AI Research Resource Task Force seeks more ‘diverse’ public responses

The task force designing a blueprint for a National Artificial Intelligence Research Resource extended the deadline to publicly comment on its work by a month to elicit more diverse responses.

A few expected respondents asked for more time, citing the depth of questions in the request for information (RFI) and summer vacation conflicts. So the deadline was moved to Oct. 1, according to a Federal Register notice posted Wednesday.

The 2021 National Defense Authorization Act directed the task force to create a roadmap for a sustainable resource that equitably meets the computational and privacy-preserving data needs of AI researchers.

“Given that we want to hear from as many folks as possible — we’d really like a broad and diverse set of perspectives among the responses — we felt it best to extend the RFI response date by a month,” Erwin Gianchandani, who co-chairs the task force as the National Science Foundation‘s representative, told FedScoop. “We believe that timeline will maximize responses while still allowing us to digest the responses and use them to inform the task force’s discussions and deliberations.”

The NAIRR blueprint is expected to outline campus, cloud, high-performance and supercomputing assets; data and data governance; educational tools and services; user interfaces; and privacy — all while ensuring researcher access regardless of gender, background, expertise or any other demographic.

By giving academics and startups, in particular, more time to respond to the RFI, the task force is ensuring that the diverse array of researchers it wants using NAIRR inform that blueprint.

“It’s not really about the big tech companies that already have lots of computational infrastructure and data,” said Lynne Parker, the other co-chair and White House Office of Science and Technology Policy representative. “I think it’s fairly easy to agree that this resource is not intended for them, even though they may indeed have some great ideas and are absolutely willing to engage to help in the design of a good resource.”

Google and IBM are still two of the four companies representing industry on the task force, along with four universities and four agencies that also include the Department of Energy and National Institute for Standards and Technology.

The task force held its first of four public meetings this year in July, with the next one scheduled for Aug. 30 and four more slated for next year. In between working groups will meet for deeper dives into specific aspects of the NAIRR blueprint.

An interim report is due May 2022 and the blueprint November 2022 to the president and Congress, though it will fall to others to actually implement the plan.

The blueprint must be scalable, easy to use, affordable — as in not cost billions of dollars — and sustainable.

“It [has to be] adaptable, in that we’re able to add new resources or keep the computational resources up to date,” Parker said. “Maybe there’s some new kinds of computation, maybe a new AI chip that we want to provide lots of people access to use and explore their research ideas on, and so we want to be able to have the resource be adaptable and have these new, different kinds of architectures.”

Census Bureau missed opportunities to avert 2020 cyberattack — report

The U.S. Census Bureau was slow to report a major cyber breach in early 2020 and missed key opportunities to limit vulnerabilities, according to the Department of Commerce’s Office of Inspector General.

An investigation published Wednesday by the oversight body found that the bureau was failing to scan its remote server prior to the cyberattack, and the failure to keep sufficient system logs hindered a subsequent investigation into the incident.

“We found that the bureau should make improvements to its cyber incident response process. Specifically, the bureau missed opportunities to mitigate a critical vulnerability, which resulted in the exploitation of vital servers,” the IG said in its report. “Once the servers had been exploited, the bureau did not discover and report the incident in a timely manner.”

The breach took place in January 2020, when hackers accessed the agency’s remote servers. None of the compromised servers were involved with the 2020 census, and the count was unaffected by the attack.

According to the report, the bureau was also operating servers that were no longer supported by the relevant vendor.

The IG has issued a string of recommendations, including that the Census Bureau’s CIO review procedures for notifying IT staff when critical vulnerabilities are publicly disclosed. These include the recommendation that the CIO review the automated alert capabilities of the bureau’s security information and event management tool.

The IG also called on the bureau’s director to ensure that the CIO incorporates periodic reviews of IT asset configurations and also updates bureau response policies to include a specific timeframe.

Earlier this year, FedScoop revealed that the Census Bureau had installed Luis Cano as its chief information officer after previously working as chief of the agency’s Decennial Contract Execution Office. He replaced Kevin Smith, who left the bureau in January to join the Federal Housing Finance Agency.

Under federal policy, the statistical agency is required to adhere to the Department of Homeland Security’s Continuous Diagnostics and Mitigation Program, which operates regular vulnerability scanning of all systems.

Jay Bonci sworn in as Air Force CTO

Jay Bonci was sworn in as chief technology officer within the Office of the Air Force CIO on Tuesday.

He is a former long-time employee of cybersecurity and cloud service company Akamai Technologies, where he held senior roles within the company’s Department of Defense and federal tech divisions, including as senior director for public sector engineering.

Bonci will oversee a vast tech portfolio in the Air and Space Forces within the office of current CIO Lauren Knausenberger. The CTO’s primary duty is to “advance the Information Technology landscape,” according to the Air Force website. He takes over from Frank Konieczny, who in February left the role to take up a private-sector post.

“My part of the mission is to empower and accelerate those on the ground by providing a cohesive enterprise architecture and service delivery strategy,” Bonci wrote on LinkedIn Tuesday.

The Air Force has two other CTOs: one at the Air Force Research Lab that focuses on emerging tech, and a science and technology CTO created in 2019 that focuses on “disruptive capabilities.” Bonci’s role is more cyber- and IT-focused, the Air Force has previously said.

Bonci added in a LinkedIn post that his priority will be developing and integrating technologies, up-skilling the workforce and monitoring investments in the tech budget.

“I hope my contributions demonstrate a massive impact in a short amount of time,” he wrote.

Network modernization strategies to support modern applications

Cloud driving ‘sea change’ in federal data utility, says State’s cloud director

The advent and ubiquity of cloud computing in the federal government has largely increased the focus of federal officials — particularly senior leaders — in leveraging data as an asset, according to Brian Merrick, head of cloud programs at the State Department.

In an interview with FedScoop, Merrick said there has recently been “a sea change” in the way officials think about data, due in large part to the shift in models from data tied to an application to one with a more openly architectured environment where data can freely flow between applications.

“Our traditional sort of system-box diagram model that we’re used to in the old sort of waterfall application world, where your data is associated with an application and you have an owner of that application, everything’s tied to that and it’s about doing an interface between this box and that box. That kind of dynamic is no longer the driver,” Merrick said of data in legacy environments. “And so that frees up people to really look at that a little bit differently when it’s not necessarily tied directly to a specific application. Often what we’re finding now is there are many applications sharing data by virtue of necessity between these different environments.”

This has placed the focus on the data as the sort of lowest common denominator and most important asset in an IT environment. “It’s really about the data,” Merrick said.

On top of this, the cloud also introduced added benefits of data integration and sharing, speed of delivery, and evidence-based decision-making, he said.

“When a senior leader comes and says, ‘Look, I want to do this thing, I need an ability to get this particular task done,’ and we go back and say, ‘Well, you know what, if we have these two or three data elements from over here and combine it over here, we can get you that in a week,’ the doors open,” Merrick said. “And all of a sudden, they’re knocking on the door of the data owner saying, ‘OK, you need to make sure that this group gets access to these data elements, and we can fix this business problem.”

Such a structure has “elevated data concepts out of the IT silo to a senior management viewpoint,” Merrick said. “They now see the value in getting access to that data, which opens the doors to that data, really from a policy and an ownership standpoint, and I think that’s been a huge change.”

And as those senior leaders get more experience using data to add new value or make better decisions, they get hooked, Merrick told FedScoop.

“Leaders have realized that … they were probably not basing decisions in the past on as good of data sources they have now. And that has really increased the awareness of it and put the emphasis on it,” he said. “And I think we’re gonna see a lot more of that as time goes on. And as we start bringing in disparate data elements we hadn’t maybe thought about before, like sensor data from the Internet of Things — a whole host of other data elements from other outside data sources — it starts to paint pictures when we’re trying to solve real-world programmatic problems. And I think we will see that start to scale even faster.”

NARA targets digitization of 500 million pages by 2026 in draft strategic plan

The National Archives and Records Administration has published the first draft of a new strategic plan that includes an ambitious target for the agency to digitize 500 million pages of government records by 2026.

In its proposed 2022-2026 strategy, the administration said it hopes to process 85% of archival holdings by the end of the period. Additionally, it will work to enhance catalog descriptions that promote equity in discovery and archival access for underrepresented communities.

“In order to achieve success in this goal, NARA must digitize millions of records we hold in analog formats, keep pace with the continuous stream of new records we receive each year, and develop new ways to help citizens find our records through the online National Archives Catalog,” the agency said in its draft strategic plan.

NARA is seeking feedback on the proposed plan, which must be submitted by Aug. 20.

The agency faces a vast challenge in cataloging existing digital and physical records that have yet to be processed. One former senior agency leader speaking to FedScoop described “literally stacks” of wooden palettes containing hard drives that have yet to be processed at the administration.

NARA also intends to deliver 95% of customer requests — including FOIA requests — on time by 2026. It is formulating the new strategy amid sustained criticism over its handling of a recent veterans’ records backlog at its National Personnel Records Center division.

House lawmakers at the end of July wrote to NARA, calling it to apply for funding from the Technology Modernization Fund to help clear unprocessed records that tallied 500,000 in July. This followed a previous letter sent by a bipartisan group of politicians, asking for the Department of Defense to intervene.