Air Force budget: Congress dealt ABMS a blow, but experts see progress | Army budget: Proposed modernization increases show Army sees joint operations as ‘top priority’ | Navy budget: Classified Navy JADC2 budget plan has a few spending hints

WASHINGTON — The Pentagon’s new budget plan provided a first look at how the military is building investment in its signature future war-fighting strategy, pumping money into linking networks and processing data for a connected force.

On one hand, experts said the fiscal 2022 proposal is a marker for Joint All-Domain Command and Control that shows shifting priorities and encouraging signs after 18 months of spending on the plan for U.S. superiority against highly capable adversaries such as China or Russia.

But the budget left many details murky, with chunks of classified spending, no top-line figures and much of the funding mixed in larger programs, raising questions with insiders on issues including whether command and control will get enough money or how the services will combine separate efforts.

By one conservative estimate, a national security expert expects the Pentagon to spend more than $1 billion on JADC2 next year. Observers predict funding will ramp up in budgets to come, with the Joint Chiefs of Staff already asking Congress for future JADC2-specific modernization money and the project’s top leader proclaiming “delivery time” has arrived now that Defense Secretary Lloyd Austin signed a formal strategy.

“It’s great to see money going toward better networking, resilient communications and more adaptable communications. Those are critical things for the DoD, but they are not, in and of themselves, command and control,” said Eli Niewood, vice president for intelligence and cross-cutting capabilities at Mitre, which runs federally funded research centers for government technology development. “What we think really needs to happen for JADC2 is better capabilities within decision-making [and] within sense-making. It’s much harder to find that money than it is to find the money going into networks and radios.”

Under the Defense Department’s JADC2 vision, the military could take data collected from anywhere, process it with artificial intelligence to target potential threats, and push that information to the relevant weapon system or war fighter over emerging networks in near real time.

Experts expect future budget projections, when they’re eventually released, will provide a stronger picture of how the investments might change and grow. Air Force and Army demonstrations, which will take place again later this year, have shown progress at the ground level to link sensors and shooters at unprecedented speed. Still, accountability is hard to gauge because the services do not outline clear milestones and timetables for those events.

Some of what’s unknown about JADC2 investment stems from the fact that the money is spread across many programs that feed the services’ so-far disconnected individual efforts: the Air Force’s Advanced Battle Management System, the Army’s Project Convergence and the Navy’s classified Project Overmatch. Further muddying the waters, only ABMS has a budget line as the sole program of record in the bunch.

Additionally, billions for service modernization efforts contribute indirectly.

But some spending insights can be found. A conservative estimate from Travis Sharp, a research fellow at the Center for Strategic and Budgetary Assessments, is that the Defense Department is requesting at least $1.2 billion in FY22 for programs that directly support JADC2. That number could underestimate the total “perhaps significantly,” he said.

Sharp searched for JADC2-specific terms, such as “Project Overmatch” or “fully networked command and control,” and he didn’t include programs that only partially support the concept. The bulk of the $1.2 billion is in requests from the Office of Secretary of Defense, which runs several joint command and control research programs, and for the Space Development Agency, which is developing a new space-based mesh network to connect sensors and shooters all over the world via satellite.

The challenge in estimating a total price tag is “due to the difficulty of assigning dollar values to programs that indirectly support JADC2,” Sharp said.

For example, the Navy noted that a broad proposed information warfare increase would help Project Overmatch.

After the services listed several JADC2-enabling programs on their unfunded priority wish lists to Congress, Marine Corps Lt. Gen. Dennis Crall, the chief information officer/J6 of the Joint Chiefs, tried to assuage any concerns that the services won’t have enough money for JADC2. “I firmly believe we are adequately resourced to get done with the experimentation phase we’re talking about,” Crall said at an early June press conference.

At an Army event that same week, Brig. Gen. Robert Parker, head of the JADC2 Joint Cross-Functional Team, said military leaders have had “encouraging” conversations with lawmakers about adding JADC2-specific funds to incentivize modernization and adopt promising prototypes.

“The critical thing is what is being invested in terms of a JADC2 capability versus what the services are investing in to modernize their force and to close some critical gaps within the force,” said Scott Lee, cross-cutting priority lead for JADC2 at Mitre.

The lack of clarity reflects broader issues with the JADC2 development structure. While the services have taken steps toward collaboration, it’s not clear how the independent efforts fit together. The Joint Chiefs are working toward a top-down plan, but for now each service has a unique approach with varying levels of transparency.

“Regarding JADC2, the issues go beyond funding. It’s much more important that the services are aligned, that the ‘J’ in JADC2 truly be ‘joint.’ The services aren’t there yet, but they’re working to find a mutual path forward. Once that is in place, they can look at funding with a more keen eye,” said Mark Lewis, executive director of the Emerging Technologies Institute of the National Defense Industrial Association.

The Pentagon’s decision to continue defending the JEDI contract is unexpected after the department stated in January it would reassess the program if the court decided to hear Amazon Web Services’ allegations of political interference by President Donald Trump. In late April the U.S. Court of Federal Claims declined to toss out those allegations.

Documents filed Friday afternoon indicate that at least several more months of litigation are expected in the lawsuit, which AWS filed after it lost the contract to Microsoft in October 2019. Under one scenario posed by the department, the case would continue into at least October, two years after it originally awarded Microsoft the contract.

In a statement, a Pentagon spokesperson Russ Goemaere said the filing, called a Joint Status Report, was a “standard filing in any litigation.”

“The filing merely reflects the proposed schedule for further proceedings in the case, as directed by the Court’s April 28, 2021 Order,” Goemaere said. “Nothing about this procedural filing changes our previous statements regarding our commitment to establish an enterprise cloud capability for the Department — we hope through JEDI — but the DoD’s requirements transcend any one procurement.”

AWS’ lawyers proposed a slower timeline in an effort to collect more evidence of an alleged anti-Amazon bias in the award decision. AWS argued in the filings that the department is withholding Slack messages and emails that would affect the scope of the discovery process. The cloud giant states that it wants to “ensure the record is complete for a fair and full adjudication” of the case.

The DoD meanwhile argued for a faster timeline, stating that AWS’ proposal for a slower schedule does “ongoing harm to national security or continued delay in fielding these critical capabilities.”

“The passage of over 18 months since this bid protest was filed serves to increase the urgency of expeditious resolution now, not reduce it,” DoD lawyers wrote of AWS’ protest filed in December 2019.

The JEDI cloud, a contract worth up to $10 billion over a decade, has been the cornerstone of the department’s digital modernization strategy. Senior IT officials have stated for years that JEDI cloud would deliver the department the computing power to develop artificial intelligence tools broadly, as well as give war fighters access to mass amounts of data across different security classification levels on the battlefield.

AWS rebuts the DoD’s national security argument by citing numerous public statements from senior DoD officials detailing how the department worked with services and combatant commands to mitigate national security harm.

In response, DoD lawyers wrote “AWS’s attempt to leverage this noble calling for its own self-serving interests merely underscores the need for this Court to fully, fairly, and expeditiously adjudicate AWS’s allegations so that the DoD may field the tools necessary to achieve its critical mission.”

Despite Microsoft’s win in 2019, JEDI cloud implementation never started. In early 2020, the court ruled that AWS’ case had merit and placed a hold on Microsoft and Pentagon teams building JEDI, a major blow for a cloud platform that is supposed to host 80 percent of DoD systems. Last year, the department decided it would reconsider its award to Microsoft but later re-affirmed its choice.

In Friday’s filing, Microsoft backed the department’s effort to move forward with the JEDI cloud and called for a prompt decision.

“Despite the fact that it remains unclear when the case will be decided, Microsoft has continued to invest in the program, has remained ready to perform, and is incurring continuing costs, while losing anticipated revenue,” Microsoft’s lawyers wrote. “Microsoft objects to Amazon’s tactics aimed at prolonging the duration of this protest — despite the needs of our military and the significant national security interests at stake.”

The production agreement, using the Pentagon’s other transaction authority with less rigid competitive contract requirements for some technology development projects, is worth about $474 million over five years, the Defense Counterintelligence and Security Agency estimated in its announcement May 14. The agency is building its capacity to manage about 95 percent of the federal government’s background investigations. That task is made more difficult by the government’s huge backlog of checks that have slowed the security clearance process.

The award, with a one-year base and four one-year options, follows the completion of a prototype process that started in 2019, in which Perspecta developed an enterprise IT system and data analytics capability for the agency.

The production OTA will continue Perspecta’s work on developing and operating the prototype as part of a comprehensive IT system DCSA uses to manage background checks and security clearance investigations for federal employees and contractors, the announcement stated.

Defense IT contractor Peraton Inc. bought Perspecta earlier this year for more than $7 billion.

DCSA became the federal government’s primary background investigator in 2019 when an executive order from then-President Donald Trump transferred the authority from the Office of Personnel Management to the Pentagon.

The federal government’s security clearance backlog sat at 188,000 cases as of May 2020, according to a report from DCSA last June. That number was down from a peak of 725,000 active investigations in April 2018.

As part of the Defense Innovation Unit’s secure cloud management pilot, three vendors could potentially be awarded success memos that would allow them to sell secure cloud access technology to any DoD component without re-competing, providing DoD components with an easier route to access software tools over the internet at a time when the department is increasing its use of software as a service offerings. DIU will choose just one of the three vendors as its own provider.

Since last year, DIU has worked with Google, McAfee and Zscaler on prototype capabilities to protect cloud access portals and will choose one for the job, which will help eliminate a hinderance to industry-DoD coordination.

The effort kicked off in 2019 when DIU solicited proposals for its secure cloud management prototype project. The test solutions for cloud access already are easing challenges for communication and shared work with the private sector, and the technology will break down one roadblock to DoD’s work with nontraditional companies.

The Defense Department’s overall cloud access architecture inhibits the department’s ability to efficiently collaborate outside of government because it mandates the “use of a cloud access point gateway to secure and control communication between endpoints and cloud service providers,” Rick Simon, program manager for the project, told C4ISRNET.

“This gateway is composed of fixed hardware at a few locations,” said Mike Daniels, vice president of global public sector at Google Cloud. “It was not designed for a world where many DoD and non-DoD users would seek secure, controlled access to cloud services from outside the DoDIN [Department of Defense information networks].”

The underlying problem for the department is that its network isn’t cloud-ready, so cloud-based collaboration can be difficult, slow and insecure.

“The DoD-Information Network … was not built with cloud in mind,” said Drew Schnabel, vice president of federal at Zscaler.

Schnabel described the technology as similar to the idea behind devices placed in vehicles to deduct road tolls automatically, letting people avoid tollbooth lines. The cloud connections avoid user traffic bottlenecks and securely connect people to applications.

Prototype reviews by independent assessors started in February, using criteria set in collaboration with the Defense Information Systems Agency, the DoD combat IT support agency. Assessment reports evaluating vendors on security and performance are expected in May, Simon said. If their solutions are adequate, DIU will issue a vendor a success memo, which will allow the vendor to sell its technology to other DoD components.

Though DIU will choose only one vendor, Simon was hesitant to use the word “winner” to describe the selected company because the other two businesses could still sell to the rest of the Defense Department if issued a success memo.

“We have a set of characteristics that might be very different than another in the DoD,” Simon said. “For us, we will pick the one that fits our needs better.”

DIU has unique needs because it runs entirely on software as a service, meaning that all of its software is third party and accessed through the cloud. That puts DIU’s use of cloud far ahead of other DoD organizations that heavily depend on the in-house software systems. With increasing cloud use across the department, organizations need secure cloud access tools.

More than 120 DIU users are protected by one of the three prototypes. According to Simon, the proposals received “dozens” of responses from industry. In May 2020, DIU and the three vendors signed other transaction agreements, allowing prototyping outside the more stringent competitive regulations for standard procurement contracts.

“These solutions, if successful, should increase security, control, and real-time performance when accessing software-as-a-service applications directly over the internet, thereby enhancing DIU’s, and DoD’s ability to efficiently engage with non-traditional technology vendors,” Simon said.

For the prototype assessments, criteria include requirements and test cases from DISA, DoD groups working to implement zero trust cybersecurity architectures, the director of operational test and evaluation, Cyber Command, and the department’s CIO office.

“The success memos … will absolutely help jumpstart some of the projects that are already going on within the DoD itself,” said Alex Chapin, vice president of DoD and Intelligence, at McAfee. “The good work that they are doing here will definitely be able to transfer back over to the DoD.”

The COVID-19 pandemic, which forced the majority of DoD employees to work from home, has highlighted the need for people to securely collaborate from offsite locations. That requires secure cloud access.

“I don’t think the DoD will go back to its old ways,” Chapin said. “I think in the future the DoD will continue to have people work remotely, more so than ever. Being able to have access to those collaboration tools and security around that is going to continue to grow.”

The decision, released with the judge’s opinion sealed, puts the Joint Enterprise Defense Infrastructure cloud program in jeopardy after the Pentagon hinted in January in a memo to Congress that a decision in favor of the tech giant would cause the department the reassess the future of the program.

The Defense Department awarded the JEDI cloud contract, worth up to $10 billion over a decade, to Microsoft in October 2019, and the win was largely seen as a major upset. But Microsoft and the department never got the cloud program off the ground after the same U.S. Court of Federal Claims judge ordered work on the project to cease after finding AWS’ technical challenges to the award had merit.

An AWS challenge in December 2019 alleged that Trump steered the contract toward Microsoft, pointing to anti-Amazon statements he made in the White House and as a presidential candidate in 2016. The tech giant called for sworn statements from then-defense secretaries Mark Esper and Jim Mattis, as well as from former DoD Chief Information Officer Dana Deasy. For his part, Deasy has maintained in congressional testimony that the White House didn’t influence the final decision of acquisition officials.

AWS lauded the court decision in a statement.

“The record of improper influence by former President Trump is disturbing, and we are pleased the Court will review the remarkable impact it had on the JEDI contract award,” an AWS spokesperson said in a statement. “AWS continues to be the superior technical choice, the less expensive choice, and would provide the best value to the DoD and the American taxpayer. We continue to look forward to the Court’s review of the many material flaws in the DoD’s evaluation, and we remain absolutely committed to ensuring that the Department has access to the best technology at the best price.”

It’s an open question what comes next for the JEDI cloud. In a January memo to Congress, DoD warned that if the court ruled against the department, the program could be a jeopardy because political interference allegations would require rounds of depositions. At the time, the department wrote that “the prospect of such a lengthy litigation process might bring the future of the JEDI cloud procurement into question.”

In a statement, Microsoft spokesperson Frank Shaw downplayed the significance of the ruling.

“This procedural ruling changes little,” Shaw said. “Not once, but twice, professional procurement staff at the DoD chose Microsoft after a thorough review. Many other large and sophisticated customers make the same choice every week. We’ve continued for more than a year to do the internal work necessary to move forward on JEDI quickly, and we continue to work with DoD, as we have for more than 40 years, on mission critical initiatives like supporting its rapid shift to remote work and the Army’s IVAS [Integrated Visual Augmentation System].”

A DoD spokesperson did not immediately respond to a request for comment.

For several years, the Pentagon has said it has an urgent need for the JEDI cloud, which would host 80 percent of the DoD systems and give the war fighter cloud capabilities at the tactical edge. But the program has endured years of delays due to multiple protests and court challenges by industry since its inception.

With Deasy gone, the Pentagon’s top IT shop is led by acting CIO John Sherman, who in a January interview with C4ISRNET said that he wasn’t afraid to make big decisions on the JEDI program.

“My view is to work closely with DoD leadership on this, and while I’m vested with the acting role, we can’t wait, whether it’s on a big decision like that [JEDI] or other big decisions that may not be of a procurement nature,” Sherman said.

“I was just always that person that would be looking at tutorials online, trying to figure out how to do it,” Boyle told C4ISRNET. “It just helped me build my way. That went from websites to creating mobile applications to creating Android software — a whole range of variety of things before I went into the Army.”

The medic is learning platform engineering skills as one of the inaugural cohort of about 25 soldiers at the Army Software Factory in downtown Austin, Texas. Boyle is one of many soldiers with software development skills the service theorizes it has within its ranks who could help with its software coding talent shortage.

The Army — and the U.S. military at large — have a ripe need to train software creators to use the DevSecOps development process to roll out digital tools more quickly, improve them and build on them after an initial release. The Army factory, funded through a portion of $26 million allotted for cloud modernization in fiscal 2021, joins similar efforts by the Air Force, which has established more than 10 software factories across the country to prepare for the digital age.

The Defense Department pays billions for software, estimating it will spend $15 billion over five years ending in 2023 just to maintain the software it already has.

As warfare becomes more electronic, weapon systems will become more software dependent, and the military needs people to code applications faster to meet commanders’ needs.

After their training, the software developers with the Army will be able to help create applications for logistics, mission command, soldier quality-of-life and tactical mission scenarios.

By making use of talent already in the ranks, Army leaders believe a “for soldiers, by soldiers” approach will help the developers eventually deliver more useful software to users, while saving money on high-priced contractors.

The software factory, hosted by Army Futures Command, ditched the service’s hierarchical conventions to create a startup-esque culture in which ranks are largely insignificant and soldiers call their superiors by their first names.

“Jeremy comes from … one of the lowest ranks in the Army as an enlisted man, and yet he, by all accounts, could be the teacher of the platform engineering track,” said Maj. Vito Errico, the factory’s co-director.

“It goes back to that original assumption that the talent is here in the Army, and do we really care about the ranks or do we care about retaining and building the skill set?”

Prototyping a new culture

The facility in the shadows of Austin’s skyscrapers provides a contrast to spartan military bases with rigid formality standards — often located in less populated areas.

Beyond the first-name custom, the informal culture is evidenced by standing desks, open-concept workstations and meetings in cushioned chairs that look more college library than military base.

Civilian clothes are acceptable at the factory, situated next to the Texas Capitol and walking distance from the University of Texas. Officers don’t have the final say. The whole point is that the Army needs the software skills; it doesn’t matter what rank they come from.

Soldiers in the first cohort arrived in Austin in December. The service plans to keep soldiers at the facility for a three-year rotation, and they will take software development courses to learn the tradecraft and sharpen skills. After the rotation, the goal is for the soldiers to join a command and develop software solutions for that organization’s problems.

The software factory, hosted by Austin Community College, has tracks the soldiers follow: product manager, user experience and user interface designer, software engineer, and platform engineer.

They hone their practical skills with hands-on prototypes. After finishing about four months of coursework, the soldiers remain in Austin for the rest of their rotation, working one-on-one with a subject matter expert and on product development teams tasked with solving Army software challenges.

“The idea behind moving them here and putting them in one spot for three years is so that we can guarantee that we immediately utilize the skill sets that we just taught them,” Errico said. “And that’s a pretty big point to make sure that those skills don’t atrophy right away.”

1st Lt. Haley Steele, who is on the product manager track, came to Austin from Joint Base Lewis-McChord, where she was a platoon leader in a signal company. Steele, like Boyle, is an example of a soldier who had learned basic software skills. A computer science major at West Point, she helped develop an iPhone augmented reality application that taught users about the institution’s history.

Errico said he’s looking for people who “have emotional intelligence and empathy — critical skills to operate differently than everybody else, to operate in a rank-agnostic environment — and can thrive in a team.”

The work is different than any Boyle has experienced since he joined the service. In the new culture, leaders higher in the chain of command don’t view the soldiers as low-ranked grunts, but as collaborators with valued ideas.

“They sit down [and] listen to what I have to say, and they value what I have to say,” Boyle said. “It was a little bit of a culture shock and a little bit of a change, but I think it is something for us to be agile and do everything that we need successfully.”

Steele, as an officer, had a similar experience and says the culture has created an organization that is more open to innovative ideas.

“It was interesting at first, especially when you’re calling majors by their first names — that was definitely a little bit weird,” Steele said.

“But I think it’s been really great for the organization as a whole because it really puts everyone on a level playing field, where anyone’s idea can be the best idea, and then you can take that and you can run with it and come up with a solution that you wouldn’t have come up with normally, just because they’re a junior enlisted.”

The second cohort of soldiers is expected to move to the factory in July. Because of the COVID-19 pandemic, 60 percent of instruction has been virtual. First cohort soldiers would like more in-person instruction, as soon as that’s possible, Errico said.

For now, the software factory is focused on proving that its hypothesis is true: that the Army can upskill recreational software developers in its ranks. The organization wants to show that soldiers can work for commanders in product teams outside the factory, while seeking a dedicated program line in the fiscal 2023 budget.

“As we prove it to be successful that soldiers can operate independently as product teams, with the right tools and skill sets, you’ll see us begin to partner with larger commands in the field and grow their own organic capabilities, with the right commanders at the right bases under the right conditions methodically,” Errico said. “I think one of the biggest sins we can commit is trying to grow too fast.”

Stefanie Tompkins, President Joe Biden’s appointee, was sworn in Monday as DARPA director. She served 11 years in various roles at the agency, including a stint from 2017-2018 as acting deputy director.

“I am honored and thrilled to return to DARPA, where breakthrough technologies are a near-daily occurrence. Such breakthroughs could not be more consequential for our national security, economic competitiveness, and our personal lives,” Tompkins said.

She also was a DARPA program manager and deputy director of the agency’s Strategic Technology Office, which is focused on future network warfare technologies.

“Stefanie is someone who really knows and respects the agency and its importance to our national security,” said DARPA acting Director Peter Highnam, who continue at the agency as deputy director.

Since leaving DARPA in 2018, Tompkins was vice president for research and technology transfer at Colorado School of Mines, a research university. She is a former Army intelligence officer.

Now, DISA Director Vice Adm. Nancy Norton, who led the agency through it all, is retiring after three years at the helm of DISA and a 34-year Navy career. In the last year, her agency had to prepare DoD networks for a spike in remote work, helping to roll out the Commercial Virtual Remote environment for videoconferencing, file sharing and other collaboration.

“It is pretty amazing when you think about what would have happened in 2020 if any of that had come to fruition, you know, if they had started to eliminate and dismantle some of the things that DISA does,” Norton said in her last roundtable with reporters Thursday.

Norton attributes the agency’s success at staving off elimination to doing a better job of broadcasting what exactly DISA does. With so many different missions, she said, it’s difficult to get the full picture of DISA’s responsibilities, so messaging was important.

“The most important things that we did that helped to, to prevent that from really getting traction and coming to fruition [was] … telling our story, helping people to understand … what we actually do,” Norton said. “DISA is what you’ve had a personal experience with, but very few people can stand back and have the full picture of the scope and scale of the missions that DISA is responsible for and how significant that is, and how almost impossible … how difficult it would be to move many of those missions somewhere else.”

In recent years, DISA has delivered secure mobile devices to service members, became a central hub for DoD’s commercial cloud offerings, and established an enterprise email program that gave service members one email that followed them around from base to base. The agency also provides cybersecurity, spectrum, command and control services, and several other IT-related services under its $9.4 billion budget, in addition to its contracting arm.

Norton added that DISA increased its transparency to help people better understand its role. She said the agency made an effort to better explain how it works and spends resources.

“The reason why we were stood up was because we needed a joint organization to focus on joint interoperability across the services and not those unique stovepipe capabilities that are optimized for a service and a domain, but not for the joint force, which is how we fight,” Norton said.

DISA’s responsibilities have expanded further since House lawmakers tried to eliminate the agency, with the agency to become the single IT service provider for the department’s fourth estate agencies that handle business tasks. Norton said that DISA has proved itself to be a trusted partner in recent years in part because she prioritized empowering O-6s embedded with combatant commands and other DISA mission partners to be the agency’s “forward face.” The effort helps partners better understand DISA’s capabilities and lets the agency learn more about their needs.

“It’s a constant loop of ‘What are your requirements? What are the capabilities that we can deliver? How do we get that better? How does this feed into your effectiveness?’ And so that’s what’s really been important,” Norton said.

Air Force Lt. Gen. Robert J. Skinner took over Friday as the new director.

The Joint Enterprise Defense Infrastructure cloud, awarded to Microsoft in October 2019, would provide a department-wide platform needed to develop artificial intelligence and computing capabilities for war fighters at the tactical edge. But if the U.S Court of Federal Claims clears the way for Amazon Web Service’s interference allegations against former President Donald Trump over the JEDI project, the Pentagon warned that “the prospect of such a lengthy litigation process might bring the future of the JEDI cloud procurement into question,” according to the memo from the DoD CIO office to Congress.

“Under this scenario, the DoD CIO would reassess the strategy going forward,” the memo read.

AWS has stated that it wants to collect sworn statements from Trump and other current and past senior officials, including former Defense Secretary Jim Mattis. Evidence AWS cites against Trump includes public and private statements about his dislike for Amazon founder Jeff Bezos.

“These motions will be complex and elongate the timeline significantly,” the memo said.

Building the JEDI cloud infrastructure has been delayed since the Pentagon awarded the contract, valued up to $10 billion over a decade,. Shortly after the award, AWS filed a lawsuit to block the department from working to build the enterprise cloud environment, alleging political interference and technical evaluation errors by the department during the selection process.

“Regardless of the JEDI cloud litigation outcome, the department continues to have an urgent, unmet requirement,” the DoD memo said. “Specifically, the department’s need for an enterprise-wide, commercial cloud services for all three classification levels, extending from the homefront to the tactical edge, at scale. We remain fully committed to meeting this requirement — we hope through JEDI — but this requirement transcends any one procurement, and we will be prepared to ensure it is met one way or another.”

The allegations of interference by Trump add uncertainty to the JEDI cloud project under President Joe Biden’s Department of Defense. Meanwhile, some industry experts have challenged the construct of the JEDI cloud, arguing that the contract shouldn’t be a single award and instead should involve several vendors.

If the court dismisses the improper influence allegations, then the department believes that the litigation of the remaining three counts would likely take four to five months, the memo stated.

“Work on JEDI cloud would continue to be paused until the litigation process is complete, and DISA/CCPO [Defense Information Systems Agency/Cloud Computing Program Office] remains ready to resume management of the JEDI cloud work if/when the entire set of litigation is resolved in the government’s favor.”

That day, COVID-19 cases in the U.S. had soared 40 percent in 24 hours, and the California governor issued the nation’s first stay-at-home order for residents. A few days earlier, the Department of Defense began sending employees home.

To prepare for the impending national emergency, the small IT staff sprinted to enable more than 1 million employees to work remotely at once, up from 95,000 on an average day before the pandemic.

The race to set up telework for the largest employer in the U.S. — and likely the world — included increasing circuits, upgrading infrastructure, expanding virtual private networks and drastically boosting bandwidth. But the department needed a collaboration platform so employees’ work could continue uninterrupted.

The scramble led to the Commercial Virtual Remote Environment, or CVR, a platform with Microsoft Teams collaboration tools and other Office 365 products that gave employees new telework tools such as chat, video conferencing and document sharing.

In a matter of weeks, the DoD seemed to overcome all of its perennial IT challenges at once: speed, scaling and training. With CVR, the department quickly and incrementally deployed a new IT tool to meet the needs of disparate components across the globe.

The accelerated timeline was unprecedented, cutting the many months or even years often needed to adopt software to one month.

“I would argue that if we had brought in Teams and had done the normal research, testing, socialization, pilot rollouts … [it would’ve taken] the better part of a year,” DoD Chief Information Officer Dana Deasy said.

Officials shared in-depth details for the first time with C4ISRNET about what it took to roll out CVR, which boasts about 1.3 million users.

The story is one of a department overcoming typical IT contracting barriers to fast-track software development processes on a grandiose scale. DoD senior leaders and program managers who have pushed for quicker adoption herald the project as the ultimate example of the flexibility and speed capable at the department.

To hear Cloud Computing Program Office Director Sharon Woods tell it, people gave up full nights of sleep to deploy the software. Naps came intermittently throughout the day. Showers? Rare. Baseball caps covered unwashed hair. Coffee was king.

“Looking back on it, it’s almost a little surreal,” she said.

Inside the rollout

In early March, a telework task force created by Deasy’s office recognized in its daily meetings that the department needed to prepare in case the coronavirus spread widely. The issue was so important that the group included a who’s who collection of Pentagon IT leaders: all service chief information officers; senior staff from Deasy’s office; and representatives from the Joint Chiefs of Staff, Cyber Command, the National Security Agency and the Defense Information Systems Agency.

“A big part of that was, what does that mean in terms of the requirements for the workforce, if and when they need to telework in unprecedented numbers from what we’ve ever done in the past,” said Vice Adm. Nancy Norton, director of DISA, which serves as the Pentagon’s IT support agency.

DISA and the services rushed to prepare networks for increased cyber risks posed by working from home:

• Expand the virtual private network used for more secure access.

• Increase network bandwidth to handle remote traffic spikes.

• Upgrade IT infrastructure to handle more users online.

• Then, develop the employee collaboration platform.

“There was a point where we were having everybody coming after us with all kinds of requests to use just about every collaboration tool you can imagine,” Deasy said.

“I remember tasking a team literally to get together [during] a week and a weekend and sit down and come back and say: ‘Bring us the solution that, you know, we can contractually make happen quickly, will integrate well into our environments, that we know can scale to a million-plus, we know we can secure with U.S. Cyber Command.’”

IT leaders suddenly had to deliver a suite of tools to employees that differed from the ones with which they were familiar. Beyond scaling the collaboration platform to more than a million people, the next challenge became clear: training those employees to use it. Before that could happen, the IT team needed to understand the collaboration requirements of component after component.

All the top IT leaders pointed to the critical role of the meetings by the high-level coronavirus telework task force, in which participants gathered requirements for the collaboration platform — typically a prolonged process.

“Oftentimes you spend the first few years just trying to make sure that everybody clearly and completely agrees on the requirements,” Norton said. “Well, we didn’t do that for this at all.

We said: ‘OK, here are the basics for the requirements. Now let’s start building and let’s start delivering, and that’s that minimum viable product.’”

The CVR Environment on which the task force settled is a temporary platform accredited at cybersecurity impact level 2, which allows users to work with unclassified, noncritical mission information. The group decided early on to deliver the platform using a software development process that Deasy and other IT leadership have backed for years: DevSecOps, where a product is delivered with minimum capabilities, and improvements are added incrementally.

On March 17, the DoD CIO told the Cloud Computing Program Office that workers needed a collaboration platform.

“Less than 24 hours after first hearing about that, folks from my team contacted me saying: ‘Hey, we want to do this, we think we can do this, and we think we can roll it out in a matter of weeks,’” Woods said. “It’s hard to not have your initial reaction be: ‘You’re crazy. How are we supposed to do this?’”

Delivering software in record time

For the small Cloud Computing Program Office team, March 19 marked the start of a nearly nonstop push to build and roll out the collaboration platform. That workday stretched into days of around-the-clock activity.

“We worked 24 hours a day, seven days a week, and that’s not an exaggeration,” Woods said.

The minimum viable product that the CCPO introduced was a “bare bones” version of Teams, Woods said, with chat function and video conferencing. When emails introducing the software first landed in employee inboxes, a “bunch” of workers forwarded the notifications to the help desk thinking that they were phishing attacks, Woods said. One person forwarded it with the message “not today, ISIS,” referring to the militant Islamic State group.

The IT team brought the first test accounts online March 20, about 24 hours after the group started working on CVR. By March 25, the first pilot users were live. Those testers reached the highest levels of the Pentagon: flag officers, general officers and senior executives. Within a week, senior leaders cleared CVR for departmentwide use.

The department ramped up the number of users it added daily, starting with hundreds a night, growing to thousands, to ultimately adding 250,000 users in one night. As employees established more accounts, requests poured in for new capabilities, such as conference calls.

The team had a growing and flexible list of capabilities it wanted to add.

“The list got reprioritized based on the demand from the users,” Woods said.

The CVR delivery embodied the DevSecOps approach that IT officials preached for the last few years, with a continuous loop of user feedback. Every night, the CVR team combed through comments and tweaked the platform.

For example, Woods said, the CCPO team received feedback about information that would be helpful in the CVR welcome email.

“Every night, we would make small adjustments to that welcome email to provide greater clarity and understanding about what was happening,” Woods said. “Yes, it went out really quickly. There was maybe a degree of confusion amongst some of the users. But we took all of that feedback, rapidly reacted to it, and it resulted in a better product.”

As the CVR journey continued, the CCPO team added an automated self-service portal to respond to an influx of basic questions about user accounts, saving the department more than $10 million on help desk costs, according to Norton.

The delivery didn’t come without hiccups. Some agencies wanted to know when the CVR platform would reach their offices so leaders would have ample time to prepare their workforce. But because Woods’ team moved so fast, delivery sometimes came when agencies weren’t expecting it.

“Those are just some of the missteps [involved when] speed was so critical because of the urgency of the requirement,” Woods said. “And you do have these little missteps, and that’s OK. And I know that’s very uncomfortable, especially when you’re looking at the traditional way that DoD has often done IT development.

“It was so critical to why CVR was successful. Embracing some of that discomfort so that we didn’t lose speed, but that we could also react quickly to course-correct every day.”

Faster in the future?

The Cloud Computing Program Office continued to strengthen the collaboration platform throughout the pandemic spikes of the summer and fall, which kept DoD workers mostly at home. The success led the department to develop a permanent remote collaboration solution with stronger cybersecurity that will replace the first version this coming summer.

The unparalleled speed at which the department implemented CVR, along with several other projects to enable telework, raises a significant question: How does the accomplishment shift expectations for IT projects?

The experience established a playbook for faster deployment, officials said.

“CVR just obliterated the myth that it takes years for the department to deploy a capability at scale,” Woods said. “The big piece of the shift is you want speed. The question is: How do you get speed? And I think this is where authentic agile practices become so critical.”

However, it’s not feasible for department personnel and contractors to stay up all night for several days in a row to set up user accounts and deliver new tools outside of a national emergency like the COVID-19 outbreak.

But the work during the pandemic proved that the department can move faster on regular IT projects outside of all-out crisis mode if it successfully uses the DevSecOps concept.

“Anytime you’re able to clearly align all of the different enablers to understand what the focus is, then you don’t have slowdowns and barriers” caused by different offices like finance, contracting or sustainment professionals, Norton said. “When everybody’s on the same sheet of music, focused on delivery, then you can do this for any number of projects.”

Mark Valentine, general manager of Microsoft’s national security team, said developing CVR with the department left lasting lessons in the value of a close relationship between the DoD and a contractor, leading to openness about departmental challenges.

“There’s always risk in doing anything new,” he said. “And therefore I think that the trust that we had from the relationship and continued to build through the crisis was absolutely instrumental into making it a success.”

Proactive support from senior leadership was the cornerstone of the project. Executives removed identified barriers, making “hard choices” that balanced capability, security, mission and speed, cutting the timeline from months to weeks, Woods said.

“That was a really big deal, and not necessarily the way that you would expect leadership at the highest levels to engage, but they did,” Woods said. “It [the quick decision-making] let them comfort and support their communities. And then it really helped us make sure that it [the platform] was meeting the needs of the department.”

Woods pointed to the services’ desire to rapidly deploy a permanent Office 365 solution for remote work. Instead of releasing the capability as a “big bang,” IT teams are incrementally shipping out new tools as part of a minimum viable product, she explained.

“Everything that we did on the teleworking front shows that the DoD technologists could move quickly and show real creativity and out-of-box thinking like the private sector can do,” Deasy said.

From those early days in March, the uncertainty about the pandemic’s severity drove a stronger platform, a standard that should be the goal of future DoD projects, Deasy said.

“The way we built it is one word: enduring,” he said. “We didn’t stand up something that was fragile. … We always designed everything to be enduring, meaning that we didn’t know how long the pandemic would go on. But we knew that whatever we built, it had to be built in a way that could become a lasting asset for the department.”

As the pandemic still rages in the U.S., the department faces new uncertainties. Traditionally, political appointees such as Deasy, the department’s CIO, leave with a new administration. Norton’s tenure at DISA ends in a few months. Their roles in the pandemic response rewrote the expectations on future IT projects. But will the lessons they learned endure?