The official leading those efforts is Dana Deasy, the Defense Department’s chief information officer. The former top IT executive at JPMorgan and BP, Deasy is leading what some might call a transformation at the Pentagon to modernize enterprise IT and better arm the war fighter for the future fight.

He spoke recently with Jill Aitoro, executive editor of C4ISRNET and its sister brand Defense News, about the tech priorities for the department — and how that Amazon protest of the department’s enterprise cloud contract award impacts his plans.

C4ISRNET: Since you’ve started, what areas have needed your undivided attention?

Dana Deasy: It started way back when I first interviewed with Secretary Mattis, and then Deputy Secretary Shanahan. They kept referring to this national defense strategy and gave me a copy of it to read. There was something that was going to need to be done obviously around the lethality space.

I realized, “Hey, cloud was going to need to be a substantial part of our future.” It could handle the need for speeding up the speed of procurement of infrastructure.

The other thing I noticed was the way that we were building software was very much the way that we had been building software for the last 25, 30 years. Cloud really forces you to think differently about how you want to build applications. So I saw, hey, there was an opportunity for speed of procurement. There was an opportunity for speed of delivering applications. Then finally, it really hit home for me when I took my first trip out to Afghanistan. I always knew that cloud could impact the tactical edge, but it wasn’t until you went out to the tactical edge and you sat down with the war fighter and they showed you what they had to do and the various systems, the data that they had to pull together.

I came home from that trip and basically said, “We have to double down on cloud. We have to do this as fast as possible.” The fourth reason I thought cloud was going to be important, and I kind of went back to my private sector days, for AI, artificial intelligence, for it to really work, it needs three fundamental things. It needs massive compute power. It needs the right data, and you need to have the right algorithms.

As I looked across Department of Defense, it became very clear there was no large scale infrastructure that was available for all the services to quickly take advantage of that they could start to port either experimentation of AI onto, or fielding AI onto.

C4ISRNET: So how disruptive is the current state of your cloud procurement JEDI?

Deasy: We’ve obviously been through this very long drawn out process now with the protest. We’ve gone from GAO to federal claims court, to the IG. In all cases, we’ve come out in a very positive position, which we always felt very strongly we would. It has been really exciting now to finally be able to focus on [starting] to build the cloud capabilities. We recognize that we have to do this alongside of the protest that’s going on with Amazon right now. I’ve told my team, “Let’s not get distracted here.” We have a set of people that are focused on working on the protest, and we have a set of people that wake up every day now and are just getting ready to stand up our unclassified environment, which we hope will be ready by mid-February.

Then our secret environment is approximately six months thereafter. Then our top secret … a lot is going to depend on not only how the protest plays out, but how well and quick and smoothly the unclassified comes up and then the secret comes up.

C4ISRNET: What I’m hearing from you is more, “We need to grasp it now and we need to figure out where it fits and how it can be rolled out in an appropriate way.” Kind of kicking the tires.

Deasy: We are spending a lot of time now getting ready to stand up our first “unclassified” JEDI environment. It’s going to have a whole variety of services. What do we need, what’s the bare minimum we need to be able to stand up a real capability that the services can use come mid-February, but it won’t be the full complement. We will add on more and more services as time goes on. This is a really good example of not waiting until you have a whole complement of services done, but let’s get a capability out there that the services and the co-comms can start to use. We’ll learn about what they need second, third order, fourth order. AI’s the same way. We are putting out there first generation, second generation solutions where the data’s going to get more refined. We’re going to bring in better data and we’re going to refine the algorithms but we’re not trying to get the high degrees of perfection. That is new for the department.

C4ISRNET: I think there’s been confusion in terms of how JEDI ultimately will be used, and whether this is primarily enterprise technology or also for military on the ground. What’s your vision?

Deasy: What the Department of Defense has never had is an environment where you can stand up, unclassified, secret, top secret data. This will be the first and only environment inside the Department of Defense. It’s not three distinct environments. We’re building what’s called cross-domain solutions, and this is the ability to move data, ensure it sits in its right classification. Remember that problem, what I saw in Afghanistan, where they were trying to bring in secret data, unclassified data, top secret data from these disparate standalone siloed solutions? To the war fighter, all they want is what it takes for them to make a decision.

C4ISRNET: Were there any lessons learned?

Deasy: People grabbed hold of [the claim] that this was a 10-year, $10 billion contract. Which has never been the case. This was a two year initial contract of which the only money we put out initially is $1 million. The rest is all dependent on how fast Department of Defense starts to consume the capability.

I’ve seen cloud technology in the last 10 years dramatically change every two to three years. It became very clear to me we needed these breakpoints in the contract to be able to reevaluate.

By the summer of 2018, we [released] the DoD Enterprise Cloud Strategy, which said all of this mess, all of these individual clouds were not a winning hand. I have said from day one we are a multi-cloud environment and we will continue to be a multi-cloud environment.

C4ISRNET: How will there be opportunities for other companies?

Deasy: There is no such thing as one technology that can serve all the diverse needs of the Department of Defense. So there are cloud contracts that have been stood up already inside the Department of Defense. Navy has one for their SAP environment. Air Force has one that they call Cloud One. There are ones that we’re evaluating right now with other vendors that we’ll be making awards on that will all be serving specific needs. We are going to need more than one cloud provider to satisfy the needs of our unclassified environment. It’s too big, it’s too broad for any one vendor to handle.

C4ISRNET: What’s your role in having a more productive relationship between the tech community and DoD?

Deasy: Over the years, we’ve seen a tremendous acceleration of innovation take place in the private sector, to the point where the DoD clearly recognizes that this is not something that we can do on our own, ignore the outside world and just build great innovation.

[The Joint Artificial Intelligence Center] is working with R&E, working with the academic world, working with large established technology firms, and working with small startups.

If you look at the projects that we have underway right now, some of the origins of the algorithms come from the academic world. Some come from small startups, and some of them come from the larger technology players. So I think AI is going to be a space that’s going to accelerate and help to mature how we bring all of this together.

C4ISRNET: Rather than a lot of the small business contracts, can’t DoD put more money into fewer? Invest in 10 rather than 50, for example, but give them bigger contracts to build on?

Deasy: That could be a little shortsighted, because as soon as you start to do that, you may be ignoring three or four or five brand new ones that are coming up that could be doing something really special that the DoD could truly leverage.

The things that government as a whole needs to learn how to do better is how do you bring in small startups. How do you in the procurement processes make sure that you don’t find yourself in these elongated protest periods? How do you get them in the door, on the books so to speak, and allow them to start to innovate? Then finally, even if we could bring them in quicker, and we can set up the right environment for them to innovate faster, we have to solve for how quickly we can field. And field the next and the next. AI is going to force us to solve for that, because you don’t roll out a solution to the field and then walk away and go to the next thing. You are going to constantly reiterate with new data and new algorithms. Small companies are very, very good. They are very adapted to this highly automated rollout, and we’re going to have to learn from them more and more.

C4ISRNET: Can we go back to what you saw in the National Defense Strategy?

Deasy: Inside the NDS is a really interesting statement that says artificial intelligence could change warfare. Under Dr. Griffin in R&E, they are doing some amazing things in basic research of AI. So are a lot of the services. But when you look across the DoD as a whole, what you didn’t see was fielding being done other than in small pockets. There was no attempt to do fielding at large scale and to take that fielding and be able to scale it up across multiple services.

So that is why we created JAIC. If the department is really going to be serious about building and being a world leader on AI, then we have to practice and learn how to accelerate fielding of AI and be able to do that at scale.

C4ISRNET: How is that moving along?

DEASY: We’ve gone from an organization that you could count on two hands to about 110 people today. That is now delivering its second and third sprints, meaning its second and third iterations of the HADR and the preventative maintenance that we talked about before. We are ready to start our first lethality project in the joint war fighter targeting space. We’re looking to do something in the health space as well.

C4ISRNET: Can you give any kind of preview on what we might see or expect to come out of the IT budget for the Pentagon?

Deasy: The spend is about $47 billion. What we’ve done this last year is we’ve put out guidance for the first time that specifically called out the digital modernization program and said in the matter of cloud, AI, C3, and cyber, these are specific things that we want you to put money aside on.

That’s been delivered to the field agencies. That’s been delivered to the services, the combatant commands. So it’s really exciting, because now for the very first time [we are talking] a common language about delivering against a comprehensive strategy.

C4ISRNET: Can you give an update on what DoD is doing to fortify security in the supply chain?

Deasy: When we find companies that we have clear evidence that they’re problematic from an adversary standpoint, we have the ability today to have them stand down. We are starting to take advantage of that. There is this whole complicated problem: how do ensure as you move from your first tier to your second tier- down that chain. Is there technology we can apply to that? I know that this is work that folks like DARPA are looking at. We’re in constant conversations with the NSA. How do we use their tools and their art craft to help us evaluate? We don’t have all the answers. This is the space that I think we’re going to have to spend a lot of time iterating and get smarter and smarter on.

C4ISRNET: There has been talk about DoD embracing more of an agile approach to technology. But others say procurement doesn’t necessarily reflect it. Have you made progress?

Deasy: For years, we have had this very well thought out rigorous process of how you define requirements, how you prototype, how you build, how you test, and how you deploy. When you start using the term and the phrase “agile” all that comes together in a much more compressed set of sprint approaches. It is a different mindset and it is a different set of technical skills you have to be able to use to deploy that.

We have great examples inside Navy Research, inside, for example, Kessel Run over in the Air Force, where we’re starting to show that we can move from small pockets to start to do this at a lot larger scale. We’re going to have to also solve for how can we test and field faster. So for me it’s a procurement issue, it’s infrastructure, t’s culture, it’s training. All these things have to be brought together.

C4ISRNET: Can you talk about the potential for 5G in supporting DoD infrastructure?

Deasy: This is now the third leg of the digital modernization command and control and communications. What you’re really trying to solve for is if the fight needs to occur and you’re bringing together all the services and the right assets, that you have to make sure we’re going to be able to fight through. If we’re spoofed, if we’re jammed, if you’re fighting through a highly contested environment, how do you make sure that’s going to happen? And how do you make sure that as you’re using new technologies where you’re going to use full motion video, where you’re going to use AI, where you’re going to use massive amounts of data, you’ve got to push that out to the tactical edge. You not only need secure, robust communications, but we’re going to need bandwidth.

This is why people are so excited about 5G. It’s the potential of improved throughput and bandwidth, but we’ve got to get the security right. But the use cases are really exciting, and this is why the work that R&E’s been leading through Dr. [Lisa] Porter [to define] the right way to start our experimentations [is so important]. So the work that we’re going to be doing with dynamic sharing, which is one of the pilots, and the work we’re going to be doing with the warehousing, really will start to allow us to understand — can we truly deliver on all the promises of 5G? What if any limitations are going to exist? What new type of security are we going to have to wrap around it that may be very different than we’ve used before?

C4ISRNET: Is there anything else that you feel is important to mention?

Deasy: Every time I talk about the digital modernization, people tend to focus on a part of it. Like the cloud or the AI or the cyber. I truly believe that people will look back on it and say it was truly the integration. It was the fact that we had the foresight to think about massive computing through a cloud, that we knew that AI was going to be a very powerful and very much a game changing technology. All of that doesn’t matter if you cannot get it out to the war fighter. So this next generation, command control communication through things like 5G is really important.

And we can never lose sight that we have a lot of technology that we have used for 20, 30 years that was never designed around a cyber world.

In a perfect world, we would’ve done cloud years ago. We would’ve had an enterprise cloud already in place. But we don’t, so now we’re needing to stand up an enterprise cloud while at the same time learning how to do AI at scale, while at the same time doing next-generation command, control and communication. Yes, it’s risky. But I firmly believe we don’t have a choice.

In the meantime, CIO Dana Deasy confirmed to Defense News during an exclusive interview that the Department of Defense is moving full speed ahead with its choice of Microsoft to serve the Joint Enterprise Defense Infrastructure program — otherwise known as JEDI.

He also said that the first phase of the rollout — the unclassified cloud environment — should be available in February 2020.

“We’ve been through this very long, drawn-out process now. We’ve gone from GAO [the Government Accountability Office] to Federal Claims Court to the [inspector general]. In each and all cases, we’ve come out in a very positive position, as we always felt strongly we would,” Deasy said. “What was somewhat frustrating is we brought together some world-class people to create this vision of a large-scale cloud that you could provision, that you could use to develop [software] differently, that you could put out in the tactical edge and that could support AI. Those same people were constantly being pulled in to have to address all the issues around the protest.”

Indeed, the contract award was delayed for months due to a protest and court case filed by Oracle, which levied several conflict of interest allegations against competitor Amazon. Oracle’s case is currently in the U.S. Court of Appeals for the Federal Circuit, having lost in a lower court. In November, Federal Times broke the story about Amazon’s plans to protest the JEDI award to Microsoft through the U.S. Court of Federal Claims, obtaining a video of Amazon Web Services CEO Andy Jassy at an all-hands meeting with Amazon Worldwide stating that the company will “push the government to shine a light on what really happened.”

A redacted version of the AWS complaint alleges that the DoD source-selection team made several “egregious” and “unfounded” decisions during the cloud award, ultimately not complying with the contents of its own request for proposals.

The complaint also tied the decision to several disparaging statements made by President Donald Trump about Bezos, who also owns The Washington Post.

“These shifts in the DoD evaluators’ assessments of AWS’s proposal, including the significance of AWS’s security advantages, occurred as President Trump increased the intensity of his public attacks against Mr. Bezos, Amazon/AWS, and the Washington Post,” the complaint reads.

On Dec. 7, Bezos spoke during a fireside chat at the Reagan National Defense Forum, but he did not address the controversial cloud contract.

Unlike protests filed in the GAO, protests filed in federal court do not bring an automatic stay in performance. But regardless of regulatory standards, moving forward with Microsoft introduces a risk that a stay later in the process could be more disruptive.

Nonetheless, Deasy said he never considered a delay in performance.

“Never. From the beginning, the way we constructed the teams and organized how to write the RFP to where we are today, there was such deep consideration and due diligence — making sure we followed all the regulations,” he said. “I’ve told the team: ‘Let’s just not sit and wait. Let’s start to get the environment ready so when we come out of the protest, we haven’t lost any momentum.’ ”

Messaging problems

That’s not to say the Pentagon hasn’t learned from all this. Early on, JEDI became branded as a 10-year, $10 billion opportunity. The Pentagon did not do enough to stomp out that depiction, Deasy said.

“I’ve seen this over my 38 years of being involved in technology: If you don’t convey your message right, the media can start to take a message that you intend to be ‘X,’ and the next thing you know you’re sitting way over here in ‘Y’ territory,” he said. “This was a two-year initial contract, of which the only money we put out initially is $1 million. The rest is all dependent on how fast Department of Defense starts to consume the capability.”

Deasy points to what he calls “breakpoints” in the contract to be able to reevaluate, and he said the DoD is, and will remain, a multi-cloud environment. There must be more than one cloud provider to satisfy the needs of the unclassified environment in particular, he added, because “it’s too big, it’s too broad for any one vendor to handle.”

But the many disparate, individual clouds that currently exist — what Deasy described as “this mess” — was also not a winning hand. Step one was making sense of what was already in place.

“Guess what? We don’t know how to do enterprise cloud at that scale, so we need to find a partner,” he said. “We need to start with somebody.”

The DoD is now getting ready to stand up the unclassified environment, which Deasy expects will be ready by mid-February. The department will start with what he calls “the bare minimum we need to be able to stand up a real capability that the services can use.”

More and more services will be added as time goes on. Artificial intelligence components will roll in at the same time but, again, with an understanding that more will come, that data will be refined and that the initial rollout won’t have “a high degree of perfection.”

The secret environment will be ready about six months after the unclassified environment. The timeline for the top-secret environment is a little less clear, depending not only on how the protest plays out, but also how quickly and smoothly the initial two environments roll out.

“It’s not only the fact that there’s an unclassified, a secret and a top-secret environment,” Deasy said. “This is CONUS; this is OCONUS; and this is out to the tactical edge. So this is like a 3×3 dimension that we have to solve for. This will be the first time the Department of Defense will truly have that capability. That is what is unique.”

The savings were identified following a review initiated by Esper in August, soon after his confirmation.

“Within the department we are implementing aggressive reforms to free up time, money and manpower to put back into our highest priorities,” Esper said. “In just four months of work we have saved over $5 billion. By decreasing overhead, divesting legacy activities and reducing lower-priority programs, we are able to invest more in the war-fighting requirements of the services.”

The so-called fourth estate includes 27 agencies, such as the Defense Intelligence Agency, the Defense Information Systems Agency and the Missile Defense Agency. A September 2018 report from the Government Accountability Office estimated those agencies collectively have an annual budget of at least $106 billion.

Esper did note that the savings can only be realized with support from Capitol Hill.

“We can’t do this without the backing of Congress,” he said. “When our budget comes to the Hill next year, I ask you to support our proposals and enact the legislative changes needed to get these reforms across the finish line. And to be clear, this is just the beginning.”

Esper expects every leader in each military service, in the Office of the Secretary of Defense, in the Joint Staff and in the combatant commands “to review their budgets with the same rigor, and reprioritize” to support the National Defense Strategy.

“We will continue this process from a clean sheet as we start looking at the 2021 budget to ensure we make the most of every taxpayer dollar,” Esper said.

An Aug. 2 memo kicked off the departmentwide review of programs ahead of the development for the fiscal 2021 budget request. Authored by Deputy Secretary of Defense David Norquist, but clearly the marching orders of Esper, the memo articulated a goal to find savings and drive a “longer-term focus on structural reform, ensuring all [defensewide] activities are aligned to the National Defense Strategy while evaluating the division of functions between defense-wide organizations and the military departments.”

While the emphasis initially has been to find savings through the fourth estate, Esper said in late August that the review will potentially involve cutting legacy programs that are diverting money away from next-generation projects needed to combat China and Russia.

What was more telling was the manner in which Amazon Web Services CEO Andy Jassy announced the decision: boldly laying blame for the contract loss squarely at the feet of the U.S.president.

And he did this unabashedly on stage, speaking to the whole company.

“When you have a sitting president who’s willing to publicly show his disdain for a company and the leader of a company, it’s very difficult for government agencies, including the DoD, to make an objective decision without fear or reprisal.”

If President Donald Trump declared war on Amazon chief Jeff Bezos, and by extension Amazon, this was AWS declaring war on Trump.

Compare that to how traditional defense companies handle the president. When Trump tweeted about the cost of the F-35 fighter jet, causing Lockheed Martin’s stock price to tumble, CEO Marillyn Hewson called the criticism fair. She also allowed Trump to take credit for the price decrease, even though most industry experts said it would’ve happened regardless. When Trump tweeted about the costs of Air Force One under development, Boeing responded by saying: “We look forward to working with the U.S. Air Force on subsequent phases of the program allowing us to deliver the best planes for the president at the best value for the American taxpayer.” All very cordial.

And Trump aside, traditional defense companies keep most pointed commentary to themselves when protesting contract awards.

Such tactics are strategic: Handle the president with kid gloves and avoid shareholder scares, remain tempered in any competitive wrangling, and preserve potential partnerships. Don’t burn bridges.

So does Amazon not have as much to lose?

During those comments at the company meeting, which a source provided to Federal Times as a video, Jassy put it this way: “AWS is a $36 billion revenue run rate business” — referring to the company’s annual sales, if you extrapolate the current revenue over the year. “JEDI, if and when it reaches its maximum, is about $1 billion a year.”

In other words, a drop in the bucket.

Now let’s not fool ourselves — a JEDI win matters more than he seemed to imply, as evident from the fact that the company is bothering to protest. But the comments do reflect a stark difference between Amazon — a commercial giant that does some defense business — and a lot of other massive companies that live and die by Pentagon contracts. If it doesn’t win, Amazon — AWS even — will be just fine.

Congratulations — you’ve officially submitted a bid proposal. Think of it as federal contracting for millennials.

Or think of it as one of the more recent efforts among government agencies to simplify the procurement process — one that ideally will offset the very real human resources problem facing many federal contracting shops, and in theory ease the burden placed upon companies bidding for work.

It’s a tactic,” said Tom Howder, assistant commissioner of assisted acquisition services at the General Services Administration, during a panel on procurement trends held Oct. 30 at the Vision Forecast 2019 conference. “The goal is to reduce costs.”

But one attendee of the conference indicated that’s easier said than done — calling the challenges associated with cost and approach for video proposals “not trivial.”

And a quick internet search would imply that video proposals are big business for those willing to pay: One company touts success in helping customers to win $6 billion in federal contracts to date, claiming that knowing what to expect from your videography team and studio “is a must when responding to federal acquisition RFPs with video requirements.” YouTube videos for DHS proposals and GSA FEDSIM proposals on Blu-ray are among the services the company provides. Other companies tout similar services.

“Ironically, you can make these slick and spend a lot of money,” Howder said. “But we don’t want slick. We want the information,” and to find a streamlined way of delivering that information.

He said that video proposals are not much different than oral proposals, but contracting officers can look at them over and over again. And the approach is not for all contract types — Howder pointed to services that are “not extra complex.”

In some cases, both approaches are used in conjunction with one another. A solicitation from the Department of Homeland Security a couple of years ago used a two-phased approach to acquire facilities and operations support services: first bidders provided video submissions, then they participated in oral presentations. Those that received low scores on the first phase were warned that their odds of winning the contract were low to none — but still given the opportunity to continue should they so choose.

There were no paper proposals requirements, aside from price and past performance (a couple pages or so total). The reduction of time to award, as well as burden on both contracting officers and industry, translated to an “evaluation that took days, rather than months,” according to a summary of the approach posted to the GSA’s Acquisition Gateway. The acquisition was conducted under the umbrella of the DHS Procurement Innovation Lab, or PIL, which experiments with new techniques for increasing efficiencies in procurement process and institutionalizing best practices.

“This is not for every innovative technology, or right for every situation,” said Paul Courtney, deputy chief procurement officer at DHS during the panel, which was moderated by Federal Times. He added: “If it becomes burdensome, let us know.”

And it is true that the actual decision itself — to give the award to Microsoft and not Amazon — may seem to be rooted, at least in part, in squabbling of recent months. We repeatedly heard how the odds always seemed stacked in Amazon’s favor, spurring lawsuits and what some believed to be a coordinated smear campaign by Oracle. All the noise has succeeded in repeatedly delaying the program and causing Pentagon leadership to handle it with kid gloves.

So then why Microsoft? Some have pointed to President Donald Trump’s seeming disdain for Jeff Bezos properties — notably The Washington Post but by extension Amazon. Certainly his comments could pave the way for a protest. But driving the award decision? Even in this political environment, I can’t believe such disregard for federal acquisition regulations would fly.

But this much is indeed true: Amid all the legal and political wrangling around this contract, Microsoft did become a simpler choice. Perhaps strategically, the company stayed out of the fray — opting to move quietly along while other competitors led the mudslinging. Microsoft was, quite frankly, less controversial.

Of course, good behavior can’t drive contract decisions any more than politics. But again, a JEDI award is at the heart an IT contract. It calls for capabilities of which Microsoft and Amazon are each perfectly capable of providing. Either company can perform the work. Both have provided secure cloud services to government agencies in the past. So all things being pretty equal, that differentiation typically doesn’t comes from the solution itself, but rather from the price point. How thin is a company willing to go on its margins? What infrastructure is in place to support requirements?

While we don’t necessarily have specific answers to those questions, we do know that Microsoft and Amazon are technology giants that can afford to invest as needed to meet requirements and remain competitive.

So, then, why not Microsoft? That argument won’t spare the JEDI contract from being protested necessarily — a near certainty for any large contract these days, even more so for one that brought with it so much baggage. Nor will it even promise that the award won’t be overturned. Maybe Amazon succeeds in arguing a bias, or maybe any one of the onetime competitors convinces the Government Accountability Office that the procurement was flawed from the get-go. There’s a convincing argument to be made there.

But for now, I’d argue again: Why not Microsoft?

In fact, what I don’t question is industry’s ability to develop a secure, capable cloud infrastructure for the Pentagon. Both Amazon Web Services and Microsoft, the last companies standing in the $10 billion Joint Enterprise Defense Initiative, or JEDI, competition, count civilian agencies and corporations from other highly regulated markets among their customers. This is far from an insurmountable technology challenge.

What I do question is how on earth the Pentagon screwed up the competition so badly.

Consider where we’re at: Prior to the downselect, Oracle launched a lawsuit, which eventually led to an internal Pentagon ethics investigation and a pause on the program. That investigation wrapped, with the Pentagon claiming that the contract could be awarded as early as mid-July, even as critics still argued the JEDI contract is effectively tailored for Amazon Web Services.

But wait — Oracle was not done. An amended complaint released this month alleges that at least two Pentagon employees were offered jobs at AWS while working on the cloud contract, one of which helped design the requirements in a way that was favorable to Amazon after receiving “significant” job and bonus offers from Amazon.

Of course, we see conflict of interest protests with government contracts all the time — where one bidder claims another bidder has an advantage because of a particular employee who used to work at the agency; or vice versa, because a government official involved in the competition used to work for a bidder. It’s one of the complexities of that revolving door between government and industry that I’ve written a lot about lately. I’d like to think that typically such conflicts either are overstated in protests or are unintentional. There are firewalls in place to help prevent misconduct.

If the allegations here are true though, the situation is more sinister — essentially pointing to an orchestrated effort to bribe a government influencer to stack the deck for a company in exchange for a cushy position and lucrative paycheck.

But if not true, then the situation transforms from sinister to one of sheer ineptitude. With a $10 billion contract still overcoming unfortunate but not terribly unusual challenges to moving forward, why on earth did the Pentagon not pay closer attention — managing the situation to avoid even the appearance of impropriety? And if such poor oversight is happening now, who’s to say that the procurement itself was written in such a way to ensure fair competition and to meet the demands of the Department of Defense for a cloud infrastructure that can serve the needs of the war fighter?

I’m not the only one asking that question it appears. We just learned defense appropriators in the House of Representatives intend to strip funding from the Pentagon’s JEDI cloud computing program, arguing “that this approach may lock the Department of Defense into a single provider for potentially as long as ten years.”

If I was a betting person, I’d say that the acquisition strategy will likely move forward. The court will dig, the Pentagon watchdogs will inquire, and in the end the official decision-makers will say that while perhaps proper care was not taken and certain additional firewalls may need to be put in, the requirements are just and dictate that Microsoft and AWS should be the last two companies standing.

Regardless, can the Pentagon afford to be this sloppy? Should we not be concerned that enough red flags have sprouted out of this competition to warrant multiple lawsuits and program delays? It’s high time DoD and industry learn that perception is reality. In an interview with Defense News Deputy Editor Aaron Mehta, Chris Lynch, founder of the Defense Digital Service that established the requirements for JEDI said this: “Nothing comes for free. You can’t make a substantial change at the Department of Defense without pushing really hard on some things that need to be pushed.”

Fair enough, but let’s not throw due diligence out the window. As one former defense official said to me: “The optics sure suck.”

It was a mellow night.

Obviously, it’s not the hot ticket it once was. Since taking office, President Donald Trump has opted out of attending – this year ordering that no others from the administration do so either. Hollywood elite no longer shows. And this year the tradition of a comedian as headliner was scrapped, replaced by Ron Chernow, biographer of American presidents. An admirable choice – but contributing to a very different atmosphere.

Like I said, it was a mellow night.

Every journalist has an opinion on the shift. Some say it’s transformed into a true celebration of the press corps, not a red-carpet event for celebrities that fancy themselves political activists and not a platform for the hilarious but sometimes raunchy roast of politicians and cable news networks.

Others say it’s simply one more casualty of the toxic relationship between Trump and the media.

Both are right. And neither event – the pre-Trump extravaganza or the more subdued post-Trump affair – reflects what I would describe as the ideal balance of healthy tension and mutual respect. It occured to me this year that the dinner is the perfect allegory of the notoriously imperfect dynamic between the press and the White House.

I didn’t always view the relationship this way. In 2015, not long after I came on board as editor of Federal Times, I wrote a column as part of our 50-year anniversary celebration. It was called, “Media and the feds: 50 years of civility, 50 years of contention.” In that column I reflected on the shifts in the relationship over recent decades and concluded that we landed at an interesting and healthy place: where government and media have both a mutual respect and a mutual skepticism.

Four years later, that’s longer true. And using the correspondents’ dinner as a barometer, maybe it wasn’t even true then. The last dinner attended by President Barack Obama came roughly six months after I wrote that column and, while I was not there, most coverage of the dinner reflected a comradery. Liberal media and liberal comedy were, and perhaps usually are, easy on the rather liberal commander-in-chief. All was in good fun. The digs were tame. That skepticism that I thought existed was nearly absent. Everyone had a good laugh together. At least that’s the way it appeared in coverage of the dinner the next day.

Fast forward to the Trump era, where the press and the president, quite literally, can’t be in the same room together.

Neither scenario is ideal. One of my fellow editors has long found the whole concept of the correspondents’ dinner preposterous, arguing that it shouldn’t even exist. I’m not there yet. I figure, if my reporters can travel with government officials around the globe and maintain their good editorial judgement, then certainly we should be able to have a meal together.

And the whole affair doesn’t have to necessarily be quite so – mellow. But it doesn’t have to be so chummy either.

Like I said in 2015, the healthiest and most productive relationship under the circumstances would be where government and media have that mutual respect and a mutual skepticism. Unfortunately, we just can’t seem to figure out a way to get there.

What the hackers took was “the equivalent of the stealth technology for the Air Force,” said Ron Ross, a fellow at the National Institute of Standards and Technology who focuses on computer security.

“We literally are hemorrhaging critical information about key programs,” Ross said during a fireside chat I moderated at the RSA Federal Summit Tuesday. “They’re coming after you every day. They’re either going to bring down your capability, they’re going to steal stuff from you, or they’re going to plant malicious code in your systems and they’re going to come back at some point under their timetable and bring you down.”

As for the revision of those standards, it’s currently parked in the Office of Management and Budget awaiting approval, Ross said. Ideally, the Defense Department would begin to use those standards within the next 18 months to help determine whether to award a business a contract.

But will those standards solve the problem? Here’s how Ross described the challenge during our fireside chat. An excerpt of that conversation is below.

FIFTH DOMAIN: I know the Department of Defense is working with NIST to update standards used by contractors to secure data. Will that document establish requirements and responsibilities that extend to the supply chain, considering those smaller companies are often more vulnerable?

ROSS: It doesn’t. The requirements are the requirements. But the problem you described is a real one. Information that’s critical doesn’t lose value because it goes from the federal government to a prime contractor and that value stays just as high when it goes to the sub. I think the ultimate solution is you have to protect the information no matter where it is, and somebody is going to have to pay for that. There’s no free lunch. We are always talking about what’s the [return on investment] for doing all the security stuff. We never look in the rearview mirror and say what was the cost of the cleanup? And if you remember the OPM breach not that long ago, in 2015, that cleanup I believe cost over a half a billion dollars. The cleanup is an order of magnitude more expensive than it would have taken to protect the system to start.

FIFTH DOMAIN: You talk about the need to devote money to this, and yet we’ve had programs that were awarded recently by DoD where the bids were particularly low. These were for massive platforms. It begs the question of whether those trickledown cyber protections are even being considered at the front end?

ROSS: I think that there’s always a question about whether we have enough money or enough people to solve this problem. I’m going to come at this from a counter view. We developed a publication two and a half or three years ago. It’s NIST 800-160. That’s a system security engineering guideline. We took an international standard, a joint standard on systems engineering that had nothing to do with security [and used that as the basis to establish] everything you need to do in a life cycle process to make sure security is integrated into that system that you’re building.

The first couple of the steps in the life cycle are called stakeholder requirements. That’s where you sit around the boardroom, or with the war fighters, and they’re saying, “what kind of a weapon system do we need to defeat the bad guy? Or what’s our business model in a Fortune 500 company?” Then you have to say, “Okay, we are totally dependent on technology to accomplish that mission. Knowing that, I’m going to build a system with a certain set of functional requirements.” Now we have a step that says you’re required to put your security requirements right in with those functional requirements and there’s something called a trade space discussion that takes place with every system. That’s where the war fighters say, I want everything in the world, and then they say, well, you got cost, schedule and performance. You can’t have that function requirement because it costs too much. You can’t build the antigravity machine. Eventually you stabilize on a set of requirements that you build to.

That’s where we’re running off the rails now because largely those discussions don’t take place in the life cycle development. It may turn out we have plenty of money.

FIFTH DOMAIN: For years, people have criticized FISMA as being a box checking exercise. Could the expanded focus on artificial intelligence help the state of cybersecurity?

ROSS: Good AI programs, they’re just programs. They’re algorithms and those programs run on your system stack – applications, middleware, operating systems, firmware, down to the integrated circuits. So, if you’ve got a whizzbang application and you tell me it’s a trusted application, but it runs on an untrusted operating system, it’s game over. Any AI program that you’re running at the application level is totally going to be bogus information. You can’t trust it if the adversary’s already taken control of your system with a root kit.

Now, if you can build a trusted platform and take advantage of artificial intelligence, machine learning, you’ve got a great brave new world there. That’s awesome and we should be doing all of that. But you can’t hunt your way out of this problem because the attack surface is getting so large and complex and most of it’s unmanaged and most of it’s unprotected. And that’s a formula for going down in the long term.

The rationale behind the decision by the National Institute of Standards and Technology to take down its website was that workers could no longer update their resources and therefore declared current because nearly 85 percent of NIST staff members furloughed. As a result, when anyone tried to access information security documents from the NIST website during the shutdown, here’s what they saw:

“We got a lot of negative email on that,” said Ron Ross during a March 26 fireside at the RSA Federal Summit. Ross is a fellow at NIST who focuses on cybersecurity, systems security engineering, and risk management.

Indeed, the move also spurred a notable response on social media. NIST standards are used not only by government agencies but also by private sector companies, including government contractors. As one private sector chief information security officer said in a LinkedIn post, “NIST just crippled portions of the website so that we could not access the documentation that taxpayers have spent millions of dollars on.” He went on to call NIST’s decision to remove access to some of its already existing resources “infuriating to those who rely on having NIST around to help with cybersecurity progress,” spurring “powerful reaction from people who care about the state of our digital resources.”

But why would real-time access to standards be so essential? What resource could be so critical that technologists across sectors would rage over a one-month outage? Consider this scenario: another LinkedIn user pointed to his project, which involves testing software for common vulnerabilities using the National Vulnerability Database hosted online by NIST. When NIST went offline, his software broke.

Ross acknowledged the issues, and said NIST convened a committee to determine how it might function the next time a shut down might occur. One possibility, he said, is that agency leadership is considering keeping the website up, but with a disclaimer that content would not be updated until government reopened and employees returned to work.

“That makes sense to me,” Ross said. “Content has been developed, why shouldn’t you have access to it? Just because we’re shutting down doesn’t mean you have to shut down as well. There can be a big impact on private sector companies who are relying on our guidance to do their day-to-day operations. So hopefully we’ll fix that.”