Pandemic has TSA developing tech that detects threats while reducing physical contact

The Transportation Security Administration is taking advantage of reduced travel during the pandemic to accelerate deployment of technologies that increase airport security while reducing physical contact that could spread disease.

Travel remains down 20% compared to pre-pandemic levels, which made it easier for TSA to upgrade its computed tomography (CT), advanced imaging technology (AIT) and credential authentication technology (CAT) systems without disrupting travelers.

“These capabilities are providing better threat detection, which is really part of our fundamental mission, but interestingly — the convergence we’ve been trying to do through the pandemic — ensuring that we’re also providing health protection,” Stacey Fitzmaurice, executive assistant administrator for operations support at TSA, told FedScoop during FedTalks on Wednesday.

TSA is focused on ensuring pilots of the new technology are transparent. The agency hopes that the systems effectively identify threats, while also preserving privacy through opt-ins and promoting better public health.

CT is 3D imaging technology that screens passengers’ luggage at checkpoints and allows TSA agents to rotate the resulting image to view a bag from all angles — reducing the number that need to be physically opened for closer inspection. TSA is also considering how to integrate UV sanitation systems with X-ray and CT systems, so they sanitize the reusable bins.

AIT looks for metallic and nonmetallic threats on peoples’ bodies, and enhancements will eliminate the need for travelers to pose with their hands up in favor of a more relaxed posture during screening.

CAT handles identity management, and the process for authenticating the validity of travelers’ IDs is being automated. The CAT system links to TSA’s Secure Flight vetting system in real time to verify a person’s identity, ensure they’re not high risk and speed them through checkpoints.

TSA wants to add a biometric capability to CAT that uses a person’s physical features to facilitate airport access. To that end the agency is piloting one-for-one and one-to-many match systems.

One-for-one systems see travelers approach a CAT machine, have them insert ID such as a driver’s license and take a live photo for comparison — assuming the person has opted in.

One-to-many systems cater to travelers who have pre-enrolled in programs like TSA PreCheck and have a camera attached to a CAT machine take a live image of a person and compare it to an existing gallery.

TSA is also working with companies to potentially incorporate digital identities — driver’s licenses or passports kept on travelers’ phones for scanning by a CAT system. The Department of Homeland Security Science and Technology Directorate is a partner in testing such systems to eliminate bias.

While TSA is “closely tracking” the national conversation around vaccine passports, whereby a traveler would verify they’ve received a COVID-19 vaccine, the agency has no current plans to require them, Fitzmaurice said. TSA is still interested in vaccine passport development though and ensuring only the information necessary for that use case is accessed, valid and protected.

New capabilities need to have cybersecurity built into their IT backbone, and TSA is ensuring multi-factor authentication, constant monitoring, and robust cyber training and awareness for all employees, Fitzmaurice said.

TSA must also ensure its partners — airlines, airports, surface transportation companies, and pipeline operators — also have appropriate cyber protocols in place. 

Since the Colonial Pipeline ransomware attack in May, TSA and the Cybersecurity and Infrastructure Security Agency have improved communication with pipeline operators regarding industrial control systems and operational technology.

“We’ve been working with the pipeline operators to implement some new requirements for cybersecurity to ensure that we can help protect against the rising cyber threats and better protect both the national and economic security of the U.S.,” Fitzmaurice said.

DOD to establish new zero trust management team this fall

The Department of Defense is standing up a new portfolio management team to oversee the implementation of zero trust architecture, acting CIO John Sherman announced Wednesday.

Sherman said the team would be up and running by the fall and be overseen by the chief information security officer, Dave Mckeown. According to Sherman, the new team will help boost a new approach to security, which he says is a top priority.

“You don’t just buy zero trust, it’s not a tool or a technology, it really is a new strategy,” he said during FedScoop’s FedTalks conference. “We have got to run a new … defense, and zero trust is going to be it.”

Zero trust requires both a technical and cultural change to cybersecurity protocol, where administrators assume there are already adversaries in a network and the goal is to stop their movement instead of just trying to defend the perimeter.

“I am very serious about this being a priority,” he added.

The new team will also work closely with the Defense Information Systems Agency (DISA). The military IT agency has its own zero trust efforts in its Thunderdome program. Sherman added that DISA will work closely with the new portfolio management team.

DISA is also working on a critical piece of tech to implementing zero trust, an enterprise-level  identity, credentialing and access management (ICAM) tool. Sherman said this will be critical to the new framework, and that the tool should be ready by early next year.

“This is a dynamic, tough problem .. but we have the military department’s commitments on this and we have a number of pilots underway,” he said.

Zero trust has become a topic of interest not just for the DOD, but across government. A recent executive order from President Joe Biden called on all agencies to develop plans to shift to a zero trust security model following the SolarWinds breach.

Another cybersecurity priority is improving the workforce in DOD defending networks. Sherman said he is working on a full review of the workforce to find a way to support those working in cyber.

Sherman also announced a deadline for a new cyber workforce strategy that will need to be complete by early next year. The strategy will aim to boost the always thinly stretched cyber work force by recruiting, retaining and reskilling cyber talent.

“The women and men who make up the core of our civilian and uniform workforce are going to be critical in this,” he said.

Centers of Excellence program looks to add smaller agencies to portfolio

The Centers of Excellence plan to increase work with smaller federal agencies, after concluding their three-year digital transformation partnership with the U.S. Department of Agriculture.

Part of the General Services Administration‘s Technology Transformation Services, the CoE program has expanded its agency partnerships threefold since starting with USDA in early 2018 but wants to diversify its portfolio.

USDA represented a full CoE engagement where all the centers operating at the time — Cloud Adoption, Contact Center, Customer Experience, Data & Analytics, and Infrastructure Optimization — were activated, but it wasn’t just the large agency that profited.

“The smaller agencies are really the ones who benefit a lot from the work that we’ve done with large agencies because, A, they don’t have the budget to replicate that kind of work and, B, they’re looking for folks to come in with the expertise to just hit the ground running,” Jennifer Rostami, acting executive director of the CoE program, told FedScoop. “And that’s what we bring to the table.”

The CoE program doesn’t just want to work with USDA and the Pentagon’s Joint Artificial Intelligence Center but also agencies like the Eunice Kennedy Shriver National Institute of Child Health and Human Development (NICHD), which became the eighth of 10 partners in May 2020.

CoEs created a roadmap covering the different aspects of USDA’s modernization that remain in use and publicly available to agencies large and small.

“The roadmap we created in partnership with GSA is being used successfully across the federal government,” said Gary Washington, chief information officer of USDA, in a statement. “This creates not only a new customer-focused environment but also ensures we continue to save millions of dollars in duplicative and antiquated systems each year.”

USDA saved $42.5 million by closing 31 of 37 data centers, when its goal had only been $18.7 million.

Closing data centers allowed the CoEs to set up an enterprise cloud offering, the Centralized USDA Cloud Office, allowing agencies at various stages of cloud adoption to purchase solutions within a multi-cloud environment. Infrastructure was developed in a way that allows agencies to choose different cloud providers that meet their needs.

Data duplication is a big challenge across governments, and the CoEs helped USDA mitigate the problem by standing up a centralized data repository and data lake for another $10 million in savings. CoEs ensured USDA had a secure data catalog and ingest process that allowed for more than 100 dashboards in all program areas to receive actionable information from more than 150 sources in real time.

The CoEs also created a detailee program where client agencies, in this case USDA, identify employees they want to see develop modernization and leadership skills to pick up where the program leaves off. One USDA detailee even embedded with the CoEs and received specialized training at each center — on lessons learned, working with cloud providers and applying AI to data analytics — before returning to the department. That person helps run USDA’s customer experience office now that the CoEs’ work is done.

“Our mission is to be part of a period of time for an agency but then also to exit,” Rostami said. “But in order to exit, we need to make sure there are folks on the ground who know how to do the new things that we’re doing together.”

The CoEs also helped USDA:

• consolidate 15 online contact centers under the AskUSDA website,
• modernize the department website,
• increase public approval of the Farm Loan program by 3.5% in one year, and
• train 3,000 employees to use dashboards and visualizations.

“This first-of-its-kind collaboration is already yielding significant benefits: expanding access to USDA loan programs for farmers and ranchers, making it easier for USDA customers to get the answers and information they need, while avoiding burdensome costs,” said Robin Carnahan, GSA administrator, in a statement.

The CoEs remain open to working with USDA again in the future, but they have plenty on their plate in the meantime.

An Innovation Adoption Practice was launched by the CoE program in July to facilitate change management, learning and development, and internal communication within agencies the centers are working with.

“We figured out that people are the biggest challenge within technology,” Rostami said. “And so this really gives our client agencies the opportunity to focus on people and what they need — training and all sorts of stuff to master innovation.”

Kendall merges Air Force acquisition offices to support Space Force

New secretary of the Air Force Frank Kendall said he is moving the service’s Space Acquisition Directorate into the Space Acquisition and Integration Office, he announced Tuesday.

The announcement, which he said was effective immediately, is meant to bolster the nascent acquisition enterprise of the Space Force, which sits under the larger Department of the Air Force. Kendall said that it was a needed step to support acquisition capability within the newest branch of the military.

“One area where we have not done enough yet is in the acquisition capacity of the Department of the Air Force,” he said during the Space Foundation’s Space Symposium.

Space Force leaders had promised that its acquisition enterprise would be “agile” and not allow the traditionally slow bureaucratic process of the military to hamper its ability to buy tech and space assets. So far, some members of Congress have expressed disappointment over the service’s progress.

Kendall also named an acting leader for space acquisition, Brig. Gen. Steve Whitney, who currently oversees space development and purchasing within the Office of the Secretary of the Air Force.

Congress created a new space acquisition civilian role to lead a more agile approach for purchasing the tech that the new force will need to operate in space. While Kendall has not named someone yet for that role, he said he is reviewing several candidates and a nomination could come soon.

Shawn Barnes has been leading space acquisition in an acting capacity but will “move on to another leadership position” soon, Kendall said.

Langevin teases bid protest reforms coming from Congress

Changes may be coming to the federal bid protest process to ensure that losing bidders cannot derail a government procurement, a top lawmaker on the House Armed Services Committee said Tuesday.

Rep. Jim Langevin, D-R.I., said during an interview at FedTalks that the committee is “looking at” reforms to the federal procurement process and “a company’s ability to hold up defense programs for years.” He said he “hopes to see some positive changes” in the near term, possibly as soon as in the forthcoming fiscal 2022 National Defense Authorization Act, which is set to be passed later this fall.

Langevin expressed his frustration with the current state of federal bid protests in relation to the Pentagon’s beleaguered and now canceled Joint Enterprise Defense Infrastructure (JEDI) cloud contract, which has since been reborn as a multi-cloud acquisition known as the Joint Warfighting Cloud Capability (JWCC). He called the JEDI saga a “source of frustration” for himself and his committee as they continue to see procurements, many in the IT space, “getting bogged down in the protest after protest.”

It seems likely that Congress will have to take some sort of action “to stop big protests from being essentially a matter of routine in the course of action,” he said.

“I want to see us have a fair and open bid process, want there to be transparency. That’s going to be the rule … that those elements have to be in place,” said Langevin, chair of the committee’s Cyber, Innovative Technologies, and Information Systems Subcommittee. “You know, I have deep reservations about the bid process right now and the protest process right now and a company’s ability to hold up defense programs for years. We’re hurting our national security when we do that. We’re hurting the warfighter at the end of the day.”

Langevin acknowledged that the failure of JEDI has put the Department of Defense even further behind in acquiring an enterprise cloud capability, making it imperative that the department gets it right this time with JWCC.

“We were behind the curve when JEDI started,” he said. “And you know, we’re four years further behind now. And so we really need to work harder to get this right with this new JWCC plan that DOD is going with. This is a particular capability that we can’t continue to delay — we need to get this right for the warfighter.”

GSA’s Sonny Hashmi: ‘Modern acquisition is a data challenge’

For the federal government to reform and improve the way it buys things, it must turn to data, believes Sonny Hashmi, head of acquisition at the General Services Administration.

“Getting procurement right is actually a data problem. It’s not a paperwork problem. It’s not a workflow problem,” Hashmi said Tuesday during FedScoop’s FedTalks. “I truly believe that acquisition modern acquisition is a data challenge.”

Hashmi’s background in IT — most recently as a managing director with Box, but also as CIO of GSA before that — lends itself to the thinking that acquisition relies on data, and when combined with modern technology, that can lead to greater efficiencies in governmentwide procurement.

“Throughout the acquisition process, we’re collecting data or analyzing it every day, using that data to make decisions,” he said. “Modern procurement requires understanding how systems talk to each other, and how data plays a role in doing a better analysis.”

Hashmi said that while he doesn’t come from a career in acquisition like the typical commissioner of GSA’s Federal Acquisition Service might, “over time, my passion became this idea of solving for a streamlined way to buy goods and services that matter to the mission, or maintaining the appropriate level of quality and influencing markets along the way to make positive impacts to the country,” he said.

“We need to find the right balance in acquisition between the level of checks and balances, the validations we need to do, the compliance and security of the solutions that we buy, and balancing all those requirements against customer service mission outcomes and creating a delightful experience both for our suppliers and our buyers,” Hashmi said. “We need to find pathways through innovative technologies, new entrants to the market, new ideas, and new ways to solve for the mission to identify the right products and services at the right prices that our agency partners need and the federal government relies on, and we need to do it fast.”

5G networks need to be interoperable, DOD and DHS officials say

As military and civilian agencies eye the use of fifth generation wireless tech, officials representing both agree that a key to success is ensuring interoperability between networks and devices through open standards.

So far, the Department of Defense has led the government’s effort to trial 5G by offering its bases to telecommunications companies as testing grounds for the tech. Those tests could yield new capabilities for both military operations and civilian uses, hence the need officials see to ensure the tech remains open and interoperable for agencies beyond DOD, officials said Tuesday at FedScoop’s FedTalks conference.

“Cross-communications and interoperability absolutely will be critical for all our operators,” Kathryn Coulter Mitchell, acting undersecretary for science and technology at the Department of Homeland Security, said of 5G technology.

Early versions of telecommunications networks lacked the ability for devices to be used across different companies’ networks. That’s a scenario officials want to avoid and urged both government officials and private sector companies to work together to ensure open standards.

“Today you don’t need to think, ‘am I with an AT&T phone in a Verizon network or a T Mobile phone in an AT&T network,'” said Eric Burger, a research professor and technical program director at the Next G Alliance. “It all just works.”

The DOD’s tests of 5G have focused largely on logistical operations, such as using augmented reality in warehouses or providing better wireless connectivity on bases. While the DOD hopes to eventually integrate 5G into battlefield operations, many of its current uses could be used by others.

“As we roll out 5G we will find more and more uses,” Kelly Fletcher, principal director to the deputy CIO for resources and analysis and DOD, said.

Both Mitchell and Fletcher agreed the government needs to play a role in setting open standards to ensure those uses can be shared. DHS’s Science and Technology Directorate “has always been a huge proponent of open standards,” Mitchell said.

Navy taking new steps on software development modernization

The Department of the Navy has established a team to take stock of its software tools to try and streamline its ability to write code.

A new cross-functional team will take steps that include completing an inventory of the department’s software factories, and reviewing development standards. The team will also write new policy to determine what products are best to use when developing code, according to Navy spokeswoman Sandra Gall.

The goal is to help modernize how the department creates software and implements its broader IT strategy, which is known as the DON Information Superiority Vision.

“Establishment of this team supports DON strategic intent to provide mission-driven and user-focused software that is deployed at the speed of relevance to our sailors and Marines,” Gall told FedScoop.

The Navy declined to provide a copy of the full memo that created the team, citing its designation as a document for internal use only.

The new cross-functional team will also work to update training materials on DevSecOps, a set of coding practices that aim to bake security into the development process. It remains unclear what the timeline is for the team’s work, but the new draft policy should be codified by fiscal 2022.

The Navy has been building its own DevSecOps envionrment, dubbed “Black Pearl.” Its first cohort of users joined during a soft launch in fall last year.

Federal CIO Martorana: ‘We must focus on service delivery to the American public’

Government agencies must double down on service delivery to the American public and use technology to bridge inter-departmental silos, according to Federal CIO Clare Martorana.

Speaking Tuesday at FedScoop’s FedTalks conference, Martorana said an improved user experience for citizens would in part be driven by departments adopting a more product-focused mindset.

“It’s technology, obviously informed by the massive amount of data we collect across government, that will enable us to power outstanding customer experience,” she said. “It’s not our citizens’ job to figure out how to navigate across department and agency silos to get the service they deserve. That’s our job.”

“We must focus on service delivery to the American public,” Martorana said.

Martorana also described the urgency with which cybersecurity across federal departments must be addressed and reiterated that modernization of federal IT systems remains a top priority for the Biden administration.

“By working rapidly and seamlessly, we can achieve results. And we must. Our adversaries are on the move,” she said, commenting on the need for action on cybersecurity.

The threat of cyberattacks across departments and the wider U.S. infrastructure has taken center stage since the Colonial Pipeline hack in May and a surge in ransomware attacks that began as early as the second quarter of 2019.

Martorana added that she is committed to modernizing federal IT systems and said that the $1 billion appropriated for the federal Technology Modernization Fund was a “down payment” on the myriad multi-year modernization projects that have been identified by the government.

“The faster we can adopt modern technology and cloud infrastructure, the faster we can deliver trusted services to the American public,” she added.

Since the funding was appropriated in March through the American Rescue Plan, the Technology Modernization Board has received over 100 proposals for projects, totaling more than $2 billion.

Air Force chief scientist pushes zero trust for microchips

The Air Force‘s chief scientist wants the department to take a zero trust-based approach in assessing the security of the branch’s microprocessor chips, she said Monday.

Victoria Coleman, who also is the former director of the Defense Advanced Research Projects Agency (DARPA), said taking a zero-trust approach with microchips could prevent the ripple effect that a compromised unit could have on an entire system, much like the model in cybersecurity is meant to stop the spread of attackers inside a network.

The security of the microchips is a major concern for Coleman because they run everything from computers to weapon systems for the military, she said during a virtual event Monday produced by the Hudson Institute.

“You don’t have to wait too long before another news story comes out about another vulnerability that was just discovered,” she said. “I am certain we will continue finding these things, [and] not necessarily because someone put them there … with ill intent.”

In the world of IT and cybersecurity, the zero trust architecture is a framework that starts with the premise that networks have already been infiltrated and security checks need to be placed within a system to stop attackers from moving elsewhere throughout a network. For chips, that means mitigating vulnerabilities that could spread throughout an entire system, Coleman said.

But it’s a tall order due to the centrality of microprocessors to computers and most other tech, she said. “We really have our work cut out for us.”

To mitigate both adversarial attacks and inadvertent vulnerabilities in chips, the Air Force could also take a lesson from how rigorously safety-critical systems are examined for all their possible points of failure, often with life-or-death consequences.

The Department of Defense previously used a “trusted foundry” model to work with manufacturers to certify how they made chips and ensure their reliability. It was a system that focused on validating the process of manufacturing, not necessarily testing each product. But that system did not provide enough vetting, Coleman said.

“We need to replace faith in process with faith in products,” which comes from more rigorous testing of the chips themselves, she said. And in turn, that would increase the reliability of the processes or systems they are built upon.

Coleman is not the first to push the idea of using the principles of zero trust in chip procurement for DOD. Others IT leaders across the department have stressed the need to have secure building blocks for all of its tech, pointing to zero trust as one way to get there.