In fact, the fiscal year 2017 budget gives 77 percent of the funds for IT to operating and maintaining these old systems, systems that are soon going to be unrecognizable.

The system that helps the Internal Revenue System assess tax payments and generate refunds every tax season is 56 years old, an ancient relic in terms of the fast movement of the technology sector. Even worse, the nuclear forces are still coordinated on a system over 50 years old and relying on an eight-inch floppy disk — a device that is all but forgotten.

To help agency leaders address IT reformation throughout the government, the Partnership for Public Service and Accenture Federal Services collaborated to create a brief entitled “Leading Ambitious Technology Reforms in Government.” The brief is the second in a series and provides agency leaders various explanations and helpful tips for reforming agency IT.

Several challenges face agencies that wish to modernize their IT systems. Systems have only grown more complex overtime, and not from advanced technologies. Rather, agencies have continually patched systems together, using computers from today with those from the 1970s. These complicated systems will need to be understood — from their history to their application — before a system reformation can take place.

Furthermore, agency leaders will need to understand, and anticipate, the funding is not under their complete control. Rather, lengthy processes will require agency leaders to look into the future and attempt to account for technology that has yet to be conceived, create a budget within decimal-point-precision and follow all restrictions on the budget Congress puts forth.

Despite these challenges, the government “is on the verge of a paradigm shift … becoming completely different than operating technology in past decades,” Dave McClure, the former associate administrator at the Office of Citizen Services and Innovative Technologies at the General Services Administration, told the Partnership and Accenture.

With the American Technology Council, the Modernizing Government Technology Act and the May 2017 executive order called “Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure” building on the Federal Information Technology Acquisition Reform Act, government leaders are being given an opportunity to take concrete steps to drive bold IT reforms in their agencies.

To achieve IT transformations, an agenda of change management, busting cultures, empowering doers and garnering quick wins must be implemented. The Partnership and Accenture brief attempts to explain the fundamentals and highlight important realities of this federal IT environment to new career and political leaders who are in a position to harness the power of technology to accomplish agency goals.

The publication is an ongoing effort to produce a unified security framework throughout the government. This fifth revision incorporates two new control families focused completely on privacy and integrates other privacy controls throughout the draft — a first for any control catalog. This integration clarifies the relationship of security and privacy, improving overall control selection, and allowing agencies to address security and privacy risks in their entirety.

In addition, the new revision addresses the needs of not only the federal government but also industry and other organizations who have volunteered to take on the control catalog to increase security measures.

For example, the separation of the control selection process from the control catalog and its integration in the NIST Risk Management Framework. This action allows organizations outside the federal government to easily use NIST controls with frameworks they use, like the Cybersecurity Framework.

This newfound diversity includes the needs of groups previously left out, such as system engineers working on privacy and security, component product developers, and other industry professionals concerned with security and privacy.

Other major changes in this draft include:

• A focus on creating outcome-based structures for privacy and security controls;
• The integration of risk management and cybersecurity approaches and language, and;
  
• The incorporation of new, state-of-practice controls derived from empirical attack data and threat intelligence information.
  

Anyone with system development responsibilities, security and privacy responsibilities, oversight and risk management responsibilities and other commercial entities are encouraged to provide feedback on the new draft before Sept. 12. The final draft is set to be released in Oct. and the final version to be published no later than the end of 2017.

To read the fifth revision in full, visit crsc.nist.gov.

Looking to change this narrative, Lindsey Graham and Amy Klobuchar banded together to create and propose an amendment that will address the non-partisan issue plaguing the United States: insecurity of election systems. The proposed amendment would amend H.R. 2810 and give states the option of applying for Election Technology Improvement Grants that can be used to modernize and improve their voting systems.

To receive a grant, states must meet specific requirements, including:

• The adherence to best practices in cybersecurity and cyber-hygiene;
• The development, submission and publication of plans for election system modernization and enhancements, and;
  
• Undergo Security Risk and Vulnerability Assessments conducted by the Department of Homeland Security. 
  

In addition, there may be other requirements established by the amendment and the collaborative, federal-state commission of stakeholders.

The current election systems are “predominately amalgamations of insecure and obsolete …  technology, poorly designed black-box proprietary code, and hastily constructed applications” that “lack native security applications commensurate with the modern threat landscape,” ICIT reports.

The implementation of the proposed amendment, according to ICIT, would allow for the modernization and reformation of America’s national election cyber-culture while enabling improved transparency, communication, information sharing and oversight.

Dec. 29, the Department of Homeland Security released evidence for the tool used in the Russian hacking against the Democratic National Committee. That evidence pointed towards a malware program that was advertised on the dark web utilized by cybercriminals.

Shortly afterwards, the author, a young Ukrainian man known as “Profexer,” turned himself in to the Ukrainian Cyber Police. He admitted he wrote the malware, but did not know his customer’s intended use for it. Due to the legal grey zone, he is not under arrest but has become a key witness for the FBI, the first known to emerge and vastly impact the investigation, according to New York Times.

From this revelation, a clearer picture of the Russian cybercriminal group “Fancy Bear” has been drawn. Rather than being the military intelligence agency writing codes and malware and carries out attacks during their work hours, the group appears to operate as a place for financing and organization. The more technical work appears to be a result of a “far looser enterprise that draws on talent and hacking tools wherever they can be found,” Times reports.

There is no evidence to suggest Profexer knowingly worked for the Russian intelligence services, only that the malware he created did.

With thousands of plans and reports being produced and submitted to Congress annually, the GPRAMA helps whittle down these numbers. By identifying any outdated or duplicative reports, OMB helps Congress to prioritize and eliminate reporting requirements, ultimately allowing for more time to be put toward important and beneficial work.

According to the GPRAMA, OMB is required to review plans and reports agencies have submitted to Congress for any requests that are outdated or duplicative. Since the implementation of the GPRAMA in 2010, OMB has published three lists of proposals on a biannual basis, rather than annually, as required.

In addition, OMB did not publish the lists on the presidential annual budget, as required. Instead, they published the lists online at performance.gov and defended their decision to do so claiming that the website hosts many resources for GPRAMA. By declining to publish their lists on the presidential annual budget, however, OMB may have missed several opportunities.

“HHS’ HCCIC Takes a Quantum Leap Forward to Secure the Health Sector: A Fortunate Solution to the Rampant Risk of Minimalistic, Self-Governing Bureaucracy,” released by the Institute for Critical Infrastructure Technology (ICIT), examines why the health care sector is unable to oversee itself and why the Healthcare Cybersecurity and Communications Integration Center is essential to securing medical information.

The HCCIC would put an end to the “self-regulating, checkbox-driven security standards” that will allow healthcare organizations to “skirt liability,” the analysis declares, and allow for effective oversight and management of the health care sector’s security.

Poor security habits and cost-cutting measures have led to a multitude of damaging attacks, one of which being the February 2015 exposure of 78.8 million patients with Anthem, Inc.

This attack compromised the patients’ names, medical IDs, Social Security numbers, addresses, email, employment information, income data and more. A subsequent lawsuit against the insurance provider was settled, with Anthem agreeing to pay $115 million but refusing to admit any wrongdoing or responsibility for the harm.

This incident is not an exception, rather just one example, according to the report. The number of attacks on the health care sector have been climbing but, remarkably, the security has not followed suit.

The HCCIC would serve as a much needed supplement to the National Cybersecurity and Communication Integration Center, allowing businesses to get improved access to threat data, collaborating with programs like the Information Sharing and Analysis Organizations and the Information Sharing and Analysis Centers, and ensuring the private companies remain security conscious.

To read the analysis in its entirety, go here.

To help contractors understand and prepare, David Berteau, John Cooney, and Alan Chvotkin spoke during the Professional Services Council webinar entitled “Government Shutdown? Debt Ceiling Breach? Are You Prepared?” 

The biggest question on contractors’ minds is “will I be affected.” To answer this question, Cooney and Chvotkin explain the effects of the shutdown. According to Cooney, funding may remain available if:

• It is funded by multi-year money that is obligated already.
• Statutes authorize the continuation of your program — an example of this would be those that are essential to the protection of health and property.
  
• Your program is needed for constitutional powers of the president and/or Congress to be executed.
  
• The tasks are authorized by necessary implication from specific duties.
  
• Tasks are needed to terminate operations orderly.
  

If you receive a stop work order, Chvotkin explained, be sure you stop all work, including the work of subcontractors and vendors, identify the effect this will have on the program, mitigate costs in any way you can, and document everything that needed to change to stop working — these could help you receive recoveries later.

To finish the webinar, Chvotkin brought up the impact of not increasing the debt ceiling, as well. The debt ceiling, Chvotkin explained, is the amount of money the government can borrow. If it is breached, the government will be restricted in funds available to pay valid invoices to contractors. The best course of action, Chvotkin said, was to ensure all invoices are turned in as soon as possible, before such a breach, and to consider accelerating or deferring invoices if the debt ceiling is not increased.

Although there has never been a government shutdown while a single party held the White House and Congress, as Berteau noted, there is no guarantee that this year will follow with the tradition. Because of this, it is essential that all contractors plan for setbacks.

The most important piece of advice given by all three PSC affiliates was to talk with your contracting officer before anything happens. If a government shutdown is implemented, any federal employees will be unable to use government issued devices, and would be unable to answer your questions.

The rates will act as the cap for reimbursement to federal employees who were on official travel within the 48 continental United States. Most areas, however, remain covered by a standard rate of $144, with only 332 non-standard areas.

These rates are based off the Average Daily Rate from the local lodging costs of the past 12 months for lodging that remains in the mid-price range. To save more money, the GSA takes 5 percent off the final average daily rate of each location.

The rates will take effect Oct. 1. For details on the FY 2018 travel per diem rates, go here.

The defense contractor and their subsidiaries have agreed to pay the United States government $16 million to settle the False Claims Act allegations. These allegations accuse the Virginia-based contractor of taking part in illegal bid rigging schemes inflating and/or distorting prices, concealing the affiliation with other businesses and intentionally misrepresenting business sizes and eligibility as 8(a) qualified or service disabled in order to receive government contracts set aside for small business promotion.

According to Justice, the settlement ”ranks as one of the largest recoveries involving alleged fraud in connection with small business contracting eligibility.” 

Acting Inspector General Hannibal “Mike” Ware said in a release that these actions “deprived legitimate small businesses of valuable federal contracting opportunities,” and the Office of Inspector General “will aggressively pursue companies that, through false statements, wrongfully benefit from small business set-aside contracts.”

The settlement resolves a lawsuit that was filed under the provision of the False Claims Act that permits private parties to file suit on behalf of the United States for false claims and receive a portion of the recovery. The whistleblower will receive about $2.9 million.

U.S. Attorney Channing Phillips for District of Columbia explained that the settlement reflects government commitment to “ensur[ing] that its business partners are truthful in their dealings” with the government. Any contractors who try to misrepresent or disguise themselves to receive funding set aside for small business promotion “will be held accountable for their fraud on the public.”

The settlement resulted from coordinated and collaborative effort among the Civil Division’s Commercial Litigation Branch, the U.S. Attorneys’ Offices for the District of Columbia and the Eastern District of Virginia, the Small Business Administration’s Office of Inspector General, and the General Services Administration’s Office of Inspector General.

The claims resolved by the settlement have not been determined liable and remain only allegations.

Currently, these searches are permitted under an exception to the Fourth Amendment for routine enforcement of immigration and customs. Under the exception, digital devices that are seized by United States Customs and Border Protection agents can only have the device’s local data searched, not the cloud storage, and this is regardless of where cloud storage servers are located.

The average digital device, however, will hold much more data than ever anticipated. From documents, videos, messages, and even photos to offline emails, up-coming appointments, and more.

The information gathered from a digital device is “light years beyond the minimal information generally contained in other kinds of personal items we might carry in our suitcases,” Sophia Cope, EFF staff attorney, told Tech Crunch. She continues declaring the examination of digital devices is “highly intrusive,” not to mention the fact that data stored in the cloud can easily seem to be a part of the device’s local storage.

In addition, the EFF has referred to the creation of the border search exception. The exception is to be used for the narrow purposes of enforcing customs and immigration laws. There are questions asking how the general search of digital devices could further the purposes of CBP in a way that can justify the neglect of suspicion or warrant needed.