Federal CIO Martorana: ‘We must focus on service delivery to the American public’
Government agencies must double down on service delivery to the American public and use technology to bridge inter-departmental silos, according to Federal CIO Clare Martorana.
Speaking Tuesday at FedScoop’s FedTalks conference, Martorana said an improved user experience for citizens would in part be driven by departments adopting a more product-focused mindset.
“It’s technology, obviously informed by the massive amount of data we collect across government, that will enable us to power outstanding customer experience,” she said. “It’s not our citizens’ job to figure out how to navigate across department and agency silos to get the service they deserve. That’s our job.”
“We must focus on service delivery to the American public,” Martorana said.
Martorana also described the urgency with which cybersecurity across federal departments must be addressed and reiterated that modernization of federal IT systems remains a top priority for the Biden administration.
“By working rapidly and seamlessly, we can achieve results. And we must. Our adversaries are on the move,” she said, commenting on the need for action on cybersecurity.
The threat of cyberattacks across departments and the wider U.S. infrastructure has taken center stage since the Colonial Pipeline hack in May and a surge in ransomware attacks that began as early as the second quarter of 2019.
Martorana added that she is committed to modernizing federal IT systems and said that the $1 billion appropriated for the federal Technology Modernization Fund was a “down payment” on the myriad multi-year modernization projects that have been identified by the government.
“The faster we can adopt modern technology and cloud infrastructure, the faster we can deliver trusted services to the American public,” she added.
Since the funding was appropriated in March through the American Rescue Plan, the Technology Modernization Board has received over 100 proposals for projects, totaling more than $2 billion.
Air Force chief scientist pushes zero trust for microchips
The Air Force‘s chief scientist wants the department to take a zero trust-based approach in assessing the security of the branch’s microprocessor chips, she said Monday.
Victoria Coleman, who also is the former director of the Defense Advanced Research Projects Agency (DARPA), said taking a zero-trust approach with microchips could prevent the ripple effect that a compromised unit could have on an entire system, much like the model in cybersecurity is meant to stop the spread of attackers inside a network.
The security of the microchips is a major concern for Coleman because they run everything from computers to weapon systems for the military, she said during a virtual event Monday produced by the Hudson Institute.
“You don’t have to wait too long before another news story comes out about another vulnerability that was just discovered,” she said. “I am certain we will continue finding these things, [and] not necessarily because someone put them there … with ill intent.”
In the world of IT and cybersecurity, the zero trust architecture is a framework that starts with the premise that networks have already been infiltrated and security checks need to be placed within a system to stop attackers from moving elsewhere throughout a network. For chips, that means mitigating vulnerabilities that could spread throughout an entire system, Coleman said.
But it’s a tall order due to the centrality of microprocessors to computers and most other tech, she said. “We really have our work cut out for us.”
To mitigate both adversarial attacks and inadvertent vulnerabilities in chips, the Air Force could also take a lesson from how rigorously safety-critical systems are examined for all their possible points of failure, often with life-or-death consequences.
The Department of Defense previously used a “trusted foundry” model to work with manufacturers to certify how they made chips and ensure their reliability. It was a system that focused on validating the process of manufacturing, not necessarily testing each product. But that system did not provide enough vetting, Coleman said.
“We need to replace faith in process with faith in products,” which comes from more rigorous testing of the chips themselves, she said. And in turn, that would increase the reliability of the processes or systems they are built upon.
Coleman is not the first to push the idea of using the principles of zero trust in chip procurement for DOD. Others IT leaders across the department have stressed the need to have secure building blocks for all of its tech, pointing to zero trust as one way to get there.
Enabling an anywhere workforce in government
Public sector agencies are not known for their flexibility when it comes to when, where, and how employees work. The demands that come with their missions often dictate where members of their workforce need to be located as well as the IT systems they have to use. But when the COVID-19 pandemic sent Americans across the country into quarantine, public sector technology leaders were forced to deal with a massive culture change — the anywhere workforce.
By March 22, 2020, Ohio became the sixth state to declare a coronavirus lockdown. It had only been two weeks since a state of emergency had been declared. And in that time, the state’s Chief Information Officer (CIO), Ervan Rodgers, needed to shift tens of thousands of employees to remote work.
“In two weeks, we got roughly anywhere from 30,000 to 55,000 people in a work-from-home status. That’s lightning speed,” Rodgers said, speaking at the 2021 Public Sector Innovation Summit sponsored by VMware. Rodgers left his CIO post in June to take a role in the private sector, but shared the lessons he learned through that period. (Watch the full panel discussion here.)
While the pandemic would prove to be disruptive for millions of Americans, there was a silver lining in how it forced many public sector agencies to rethink how to accomplish their missions. Telework, as it was once known, no longer accurately described what was happening to the nature of work — or conveys an accurate picture of the technology landscape that is revolutionizing what it means to work in the public sector.
“State government has not necessarily been an environment where we’ve worked from home. It’s kind of frowned upon,” Rodgers said. “However, I think the pandemic not only ignited innovation, but it’s also given us an ability to prove that we’re, in some cases, much more productive.”
Government workers in Ohio weren’t alone. At the U.S. Census Bureau in Washington, D.C., — an agency perhaps best-known for its paper forms and army of pencil-toting census takers — Deputy CIO Dr. Gregg Bailey sent more than 15,000 employees home in the middle of the decennial population count.
In a weird sort of way, the changes brought about by the pandemic were “really good timing for us from a technology standpoint,” Bailey said. The bureau had been racing against the clock to overhaul its IT operations to make the 2020 census the first to be conducted primarily online.
“Because we were beginning the census, we had expanded our bandwidth dramatically. And ironically, the day we went to 15,000 teleworkers was the highest day for the self-report, internet census. “We had a huge number, over 100,000 concurrent respondents filling out the census, at the same time we had 15,000 new employees teleworking.”
Cultural implications: It’s different this time
For Bailey, it’s important for agencies to make a distinction between teleworking of the past and what is taking place post-pandemic. It goes “beyond telework” to “work from anywhere,” he said, and the new normal has significant implications for culture and security.
“We have the ability to go anywhere from a technical standpoint, and now it becomes an issue of policy,” Bailey said. “We’re working with the union and we’re working with the employees and the leadership to see what that is going to look like.”
Cameron Chehreh, Chief Technology Officer and Vice President of Pre-Sales, Engineering at Dell Technologies Federal, said whatever the anywhere workforce looks like will entail a “rethinking of work” for the public sector.
“There’s no water cooler to gather around anymore,” he said. “So how do I actually take teams of people that were used to working in an office and make them productive, in that work from anywhere situation, and make sure that we’re getting work completed, and that the mission of government and continuity is continuing to occur?”
Part of the answer is leveraging new technologies, like Virtual Desktop Infrastructure (VDI) and cloud computing, Chehreh said.
The other part of the answer, and perhaps the most important part, is culture — and ensuring employees feel connected. It’s not always as easy as it sounds, but sometimes the solutions are right in front of us.
“We found things as simple as turning the [web] camera on has been a really important solution,” said Bailey. “We were finding there were people being hired during the pandemic who wouldn’t turn their camera on. And so they literally had never met their boss visually,” he said. “Although we’re not demanding the use of cameras, we’re trying to encourage their use.”
Rodgers acknowledged that tools like Microsoft Teams and VMware have enabled public sector agencies to reshape the workplace. “It’s the future of the workplace, where you’re going to have some folks that are working from home, some folks that are in the office, and they might switch schedules,” he said. “There are folks who are reimagining the workplace, things are only going to get more exciting from a cultural perspective.”
For Chehreh, the cultural shift looks more profound this time around.
“Never forget or underestimate the power of culture,” he said. “And you have to make sure people continue to connect. If you don’t have that team environment, then you don’t have people that will run through walls for you to be able to get things done. But we can safely and securely innovate. And there’s a level of excellence in this country I haven’t seen in a long time. And it’s the pandemic that brought out the best of us.”
Learn more about “Enabling an Anywhere Workforce” and how VMware is helping to accelerate public sector innovation.
Watchdog says USAID must improve data privacy protections
The inspector general of the U.S. Agency for International Development has called on the agency to improve how it handles personally identifiable information.
In an audit, which was published earlier this month, the oversight body identified a range of failings, including the reliance on out-of-date data loss procedures and insufficient role-based privacy training.
The IG also identified the unnecessary retention of Social Security Numbers and failure to implement controls related to third-party websites as areas for concern. It also found multiple instances of staff handling sensitive personal information without first having completed the required training.
Guidance from the Office of Management and Budget published in 2007 states that agencies must establish a plan to eliminate the unnecessary collection and use of Social Security Numbers and provide annual updates on the progress of such plans.
USAID’s CIO is responsible for the agency’s privacy program and for the management of privacy-related risks at the organization.
The IG issued a number of concrete recommendations for improvement in its report. These include the suggestion that the agency’s CIO should develop and implement tools for the periodic testing of data loss prevention measures and also update its SSN storage reduction plan.
It recommends also that the director of web management at USAID’s Bureau of Legislative and Public Affairs take a complete inventory of the third-party websites being used by the agency.
The IG’s intervention comes three months after USAID was hit with a cybersecurity breach when Russian hackers accessed its Constant Contact email marketing service account.
Following the incident, which was revealed by Microsoft, USAID notified agencies including the U.S. Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency. When an agency has a privacy breach it is required to inform the U.S. Computer Emergency Readiness Team, which is part of CISA.
VA piloting system to find and manage AI talent
The Department of Veterans Affairs is piloting a system for assessing the development of the federal artificial intelligence workforce with more than 30 agencies and organizations outside government, according to Gil Alterovitz, director of the National AI Institute.
VA‘s Talent, Education and Assessment Management System (TEAMS) is a whole-of-government, whole-career solution helping find and evaluate AI talent and standardize training with support from the Executive Office of the President.
TEAMS builds on the VA’s Talent Management System (TMS) — established in 2012 as the official education, leadership development, learning and training record for employees — with AI talent proving especially hard to find.
“Very few people major in artificial intelligence, and even if you have a related area, let’s say computer science, you could not have any expertise in artificial intelligence,” Alterovitz said during FedTalks, produced by Scoop News Group, on Tuesday. “So how do you know if someone has the knowledge to do that?”
While VA started by targeting researchers, it quickly moved on to clinicians like pharmacists, who can apply AI in meaningful ways with the proper training, Alterovitz said.
VA is also using grant funding to attract AI talent and reskill employees as needed.
The department recently announced the winners of its latest AI Tech Sprint, many of which are now able to access production-level data. Sprints have an added bonus of helping VA develop faster mechanisms for contracting AI.
To that end, the National AI Institute is working with the Veterans Health Administration, Office of Information Technology and VA Cybersecurity and Innovation Program to use something like an other transaction authority to purchase and pilot AI quickly.
“One of the issues in working with contracting is around ensuring the security is there,” Alterovitz said. “And so we’re working with different security teams to ensure that the threat modeling for AI solutions is going to be consistent, in terms of the security controls and procedures.”
VA is also working to integrate security teams into AI development and deployment processes to secure and harden applications and create a trustworthy production baseline.
“The road to AI adoption goes through trustworthy AI that is robust and scalable,” Alterovitz said. “And the ultimate destination is standardized processes and high accuracy of the results.”
Federal judge won’t halt new task orders on $5.5B 2GIT contract
A federal judge won’t halt new task orders on a sprawling $5.5 billion IT contract, so long as the General Services Administration reevaluates Blue Tech’s bid by Sept. 14.
Court of Federal Claims Judge Edward Meyers granted Blue Tech relief, in the form of the reevaluation, after finding GSA “irrationally failed to follow its own solicitation” in rejecting the company’s Second Generation IT (2GIT) proposal, according to his opinion.
GSA made nine, five-year blanket purchase agreement (BPA) awards in February for 2GIT, a best-in-class contract developed with the Air Force to allow defense and civilian agencies and state, local and tribal governments to purchase commercial-off-the-shelf technologies from 79 companies. But GSA rejected Blue Tech’s bid to be a contractor team arrangement (CTA) lead on grounds the judge found “arbitrary and capricious.”
Still, the judge agreed with the injunction terms GSA proposed Aug. 10 — citing “national security issues” with further delaying a contract already re-awarded once — despite Blue Tech’s fears reevaluation would drag on “needlessly,” unless 2GIT task orders after Aug. 20 are halted.
“Because of the efficiency with which the government anticipates conducting its re-evaluation, the court does not think it necessary at this time to enjoin the government from continuing to place orders under the current awards,” the judge wrote in his order.
While Blue Tech belongs to three teams that won 2GIT BPAs, it would need CTA lead approval to bid on any task order it wished to fulfill for an agency. That didn’t sit well with an incumbent on 2GIT’s predecessor, the NETCENTS-2 contract.
GSA rejected Blue Tech’s proposal to be a CTA lead because the advanced secure web gateway device (ASWGD) included in the company’s quote didn’t have six terabytes of storage and 32 gigabytes of memory installed, but rather three terabytes and 24GB.
The agency used a market basket-evaluation approach, where bidders quoted their prices for frequently purchased technology products like the ASWGD, in making BPA awards. Except the solicitation merely required an ASWGD be “capable of supporting” six terabytes of storage and 32GB of memory.
Blue Tech’s initial quote for an ASWGD had eight terabytes of storage and 32GB of memory installed, but GSA warned its offered price was too high and its bid would be more competitive if it removed excesses. So the company altered its proposal, only to have it rejected.
In Blue Tech’s protest of GSA’s decision it argued its ASWGD fulfilled the agency’s solicitation requirements because it was still “capable of supporting” more storage and memory, an interpretation the judge found reasonable in siding with the company.
“In the preliminary injunction stage, the government argued that the market basket was not intended to provide for working installations. The government cannot have it both ways,” wrote the judge in his opinion. “If the solicitation truly requires quoters to quote only functional devices in their proposals, the government must exclude each of the offerors that proposed the cold standby version of the ASWGD that are not functional as quoted.”
Blue Tech and GSA did not respond to a request for comment.
How the cloud is spurring innovation in U.S. housing finance
Felipe Millon is the senior manager for housing industry within Amazon Web Services worldwide public sector financial services business.
Across the federal government, cloud computing is giving agencies the ability to experiment with new approaches and processes to accomplish their missions more effectively. These new approaches are opening doors that agencies didn’t foresee, offering them wider applications and greater benefits than agency leaders often first envision.
We’re also seeing these results play out in U.S. housing finance. One of the best examples we’ve seen is with Fannie Mae, a mission-focused organization that enables access to mortgage financing. Fannie Mae moved to the cloud with an enterprise-level focus on gaining greater agility. However, their cloud journey has led to a wave of broader IT experimentation.
Felipe Millon, Housing Finance Lead, Amazon Web Services (AWS)
Part of this IT experimentation has involved machine learning, for example. As Fannie Mae Vice President Subra Seshadri shared at AWS’s most recent re:Invent conference, Fannie Mae sought to identify and predict which loans in its vast portfolio were most likely to slip into “trouble” within the first two years of acquisition. Because Fannie Mae’s mission is to provide stable sources of liquidity to support housing — by buying home loans, packaging them as mortgage-backed securities, and guaranteeing them — the ability to predict which loans might default is critical.
Fannie Mae had already begun leveraging AWS for a variety of storage and computing services. But as officials became more familiar with AWS’s capabilities, Seshadri’s team began testing AWS’s fully managed machine learning services — using Amazon SageMaker, AWS Lambda, Amazon DynamoDB and Amazon S3 — to build and train machine learning models and deploy them into a production-ready hosted environment. By testing a rapid succession of models inexpensively, and machine learning, Fannie Mae was able to boost its predictive “catch rate” on multifamily loan applications likely to default from 3.5% to 48%, according to Seshadri. That experiment helped Fannie Mae plan for early risk mitigation on higher risk loans. It also opened the door to exploring other cost savings opportunities at Fannie Mae and accelerated the pace of digital learning and transformation more broadly.
Fannie Mae’s focus on innovation also illustrates how cloud services can enable “two-way door” decisions. Traditionally, when agencies make IT investment decisions, they almost always have to live with those decisions for a long time. That’s a “one-way door” decision. A two-way door decision lets you make an IT investment, and if you aren’t getting the results you want, you can easily reverse that decision.
That’s a powerful concept in IT. The cloud is turning a lot of what once were one-way door decisions — for investing in infrastructure, applications and IT services — into two-way door decisions. Now with the cloud, a team can simply spin up a virtual server, try out a variety of applications or data analytics capabilities, and see what works. If they like what happens, they can scale it up quickly. If they don’t, they can easily shut it down, without the usual upfront capital costs and long-term expenses.
By having much greater freedom to experiment, organizations come to a greater understanding of how to use, benefit from, and become more productive by leveraging the cloud.
Organizations also gain something even more important: By removing what we call the “undifferentiated heavy lifting” — the basic IT hardware and software that supports, but rarely distinguishes, your organization — they can focus more resources on delivering their missions.
Reducing that heavy lift has become even more important in federal and public sector organizations, where they face a steeper climb trying to assemble and retain the right IT talent. At AWS, we’re helping to make that lift even easier — not only by providing the latest turnkey tools and engineering support, but also by helping organizations train and certify their IT staffs.
We’re excited to see how these kinds of experiments are unlocking innovation across the U.S. housing finance system and throughout the federal government. The results show that, with the right leadership and empowerment, the cloud is enabling organizations to establish big goals, experiment, and push through once-intractable barriers.
Learn how AWS can help your agency capitalize on today’s cloud by visiting https://aws.amazon.com/federal/ or contacting us at USFedFin@amazon.com
Army software official says service can now see which units are downloading patches
The Army’s new software repository is giving cyber leaders insight into which units are downloading patches, the lead software official at the Army’s Communications-Electronics Command (CECOM) said.
The capability is a major step forward from CECOM’s previous method of sending patches and software updates: mailing CDs. The repository was first launched with pilot users a year ago. Now, the repository sees about 3500 downloads a month for 76 software systems, Jennifer Swanson, who leads CECOM’s Software Engineering Center, said.
“We were distributing software by mailing it … units were getting inundated with a bunch of CD’s that they didn’t know what to do with,” Swanson said of the old system during AFCEA International’s TechNet Augusta conference. “So you are always behind.”
CECOM oversees the management of the Army’s command, control, computers, communications, cyber, intelligence, surveillance, and reconnaissance (C5ISR) systems. The repository hosts patches for software that run the weapons and business systems under CECOM’s command, but it is working with other offices to expand.
One example of the new software repository working is the patch CECOM issued following the SolarWinds breach. Once the Army got the patch for SolarWinds’ Orion network monitoring tool that was compromised by Russian hackers, it posted the new code and most units had it downloaded within a day, Swanson said.
“We were able to turn the patch around very quickly … we were able to put it right up on the repo and we were watching units downloading it,” she said.
Having that information gives cyber defenders a clearer picture of where the Army has known vulnerabilities, according to Swanson. The goal is to continue expanding the repository and improving the user interface.
Code for America management seeks extra time in union recognition talks
Code for America’s management team has requested extra time in discussions over formal recognition of a staff union, FedScoop understands.
Both sides discussed eligibility criteria for union membership late Thursday in a meeting that sources described as “amicable and constructive.”
The meeting was the latest in a round of talks between Code for America staff organizers and management in recent weeks over voluntary recognition of the union, which sources initially suggested could take place within weeks.
Leaders at the nonprofit are seeking to delay a final decision on eligibility of union membership until the beginning of October, citing a desire to ensure senior staff are adequately trained on working with a unionized workforce. They are also seeking to delay because of the absence of a senior leader currently on a six-week sabbatical.
It is understood that unionizing staff will consider whether to accept the request or to push ahead with a ballot organized by the National Labor Relations Board.
Under U.S. labor law, formal recognition of a union can be either granted voluntarily by an employer or through a secret-ballot election organized by the NLRB.
Earlier this month, staff revealed their intention to organize through the Office and Professional Employees International Union (OPEIU) Local 1010. So far, 62 people at the organization have signed union authorization cards, which is understood to represent about 77% of its workforce.
Management at the nonprofit have previously signalled their readiness to learn more about the union recognition process and readiness to engage with staff.
Code for America is among the first technology nonprofits to forge ahead with unionization. New York-based Kickstarter unionized in February 2020 over the course of about three months.
Three-quarter of private sector workers and about two-thirds of public employees have the right to collective bargaining in the U.S.
Employees inside the federal government and the wider technology sector have received a boost from the prioritization of rights to collective action under the Biden administration.
As part of its budget proposals, the administration in January proposed a pay raise for employees and said it would encourage union activity and collective bargaining.
A Code for America spokesperson said: “We support our staff having a collective voice and look forward to working together in this new space, especially as OPEIU is moving to the tech arena. We appreciate the constructive conversations we’ve just started and look forward to learning together to thoughtfully navigate this process.”
A spokesperson for Code for America Workers United said: “We are disappointed at Code for America’s decision to delay recognition until October. We also believe they are acting in good faith.”
“CfAWorkersUnited will continue to work with CfA management to push for union recognition as soon as possible,” the spokesperson added. “We don’t want to lose momentum, and postponing everything until October risks grinding that to a halt.”
Code for America is currently working on federal government contracts including the launch of a child tax credit portal for the IRS.
DHS searching for vendors to help host President’s Cup cyber competition
The Department of Homeland Security is looking for contractors capable of supporting the annual President’s Cup Cybersecurity Competition.
DHS’s Cybersecurity and Infrastructure Security Agency issued a request for information this week “to solicit information from industry that can provide President’s Cup Cybersecurity Competition (PCCC) support services.”
Launched in 2019, the President’s Cup is a national event to “identify, challenge, and reward the best cybersecurity talent in the federal workforce” based on elements of the National Initiative for Cybersecurity Education (NICE) Framework, according to CISA. The competition was created by a 2019 executive order on the federal cyber workforce, and the third iteration will run sometime this fall.
The RFI asks industry vendors to share information on their experience hosting online competitions — particularly those involving cybersecurity challenges like capture the flag events — providing cybersecurity training information, and developing video games, as well as generalized cybersecurity knowledge across their workforce.
It also asks questions about vendors’ capability to support the competition’s specific needs, like creating and testing “over 70 competition challenges within 2-3 months,” open-sourcing all content and providing 24/7 support.
Interested parties have until Sept. 8 to submit responses.
The 2020 President’s Cup ran from August 2020 to Feb. 25, 2021, hosting more than 1,400 participants and 250 teams in a virtual format. Participants competed in capture the flag challenges, as well as a so-called “Save the World” scenario, which featured mock news broadcasts about a snowstorm taking out a city’s critical infrastructure. The winning team came from the Army’s 780th Military Intelligence Brigade.
CISA hasn’t decided yet if the 2021 event will be in-person or virtual.