This page is not built out yet. If you are seeing this page, please contact an administrator.

Look Who’s MeriTalking: ServiceNow’s Bob Osborn on Modernization

MeriTalk recently connected with Bob Osborn, Chief Technology Officer, ServiceNow Federal, to discuss President Donald Trump’s Executive Order (EO) for a Comprehensive Plan for Reorganizing the Executive Branch and what’s ahead for agencies charged with implementing modernization initiatives.

MeriTalk: Recently, the first draft of the Agency Reform Plans were due in response to President Donald Trump’s Executive Branch Reorganization EO. What types of recommendations do you expect to see take center stage?

Bob Osborn: The initial plans will set the tone for reorganization efforts moving forward from the White House, Office of Personnel Management, and agencies. We expect to see a tempered initial response as agencies await developments with regard to whether mandates will ultimately be funded.

MeriTalk: The EO calls for agencies to better leverage technology to improve underlying business processes–including identifying opportunities to automate processes. What types of processes represent the greatest target for automation in today’s Federal government–even after years of modernization efforts?

BO: We have seen modernization as a theme of each new administration in recent history, but the barriers to modernization have been complex. Many manual processes remain, especially when it comes to processes that cut across multiple departments. Initiating a cross-cutting, agencywide approach to service delivery is necessary but challenging, especially when we look at holistic service delivery that marshals the data stored in legacy systems. For example, automating the onboarding of personnel spans human resources, financial, and IT infrastructures and processes– many of which remain disconnected. This function, which remains largely manual today, is one example of a prospect for modernization.

MeriTalk: What role can and should cloud play in helping to align the Federal workforce to meet today’s needs and those ahead?

BO: Cloud is critical as the foundation from which we provide modern, consumer-like services–including how we make decisions and run our lives. We’ve chosen a platform–phone or tablet–that runs applications presenting information on which we base decisions. We may utilize applications like Waze for driving directions, banking apps for online banking, or Uber for transportation services. With just a point, click, and drag you can do just about anything you like. This is the expectation of the workforce today.

To deliver at work (in this case, a Federal agency) the same type of modern user experience that we have in our “consumer” life, we need a multi-instance enterprise cloud that allows systems to pull information from multiple data sources. We don’t have that today in most Federal agencies. As a result, agencies are making decisions using stale data. We believe this is an archaic way to do business, especially as we modernize and treat government services as consumer services. A multi-instance enterprise cloud is central to achieving both a modern user experience and real-time, multistream data for better decision-making.

MeriTalk: How might we expect to see the role of managed services evolve under the EO?

BO: This is clearly the way to go. Tony Scott said on many occasions: Government needs to start acting like a multi-divisional enterprise with an overarching corporate structure with independent divisions performing different functions. Shared services is one aspect of this, and managed services is a maturity of shared services. This building-block approach involves capable and agile architecture and infrastructure and easy-to-use applications. It, ultimately, results in the hosting of services that leverage workflows and business processes to deliver the right information to the right person at the right time for appropriate decision-making. We see many organizations modernizing one department within their agency first. The applications developed through DevOps allow other departments to take advantage of them quickly–this can then be expanded across the entire agency. Core functions–like human resources and financial management–are ripe candidates for managed services. I believe the GSA unified shared services model is the right direction. It has already set the framework. The challenge is that you need a common platform for these services to be delivered through.

MeriTalk: How is ServiceNow positioned to help agencies in executing on the requirements of the Reorganization EO?

BO: We have taken the necessary steps through investment in our enterprise-class cloud and gone through FedRAMP certification process, so when the time comes agencies are confident putting their information into the ServiceNow cloud. We have more than 100 customers utilizing this modern consumer experience platform delivery model. The ability to do service delivery easily and rapidly in a platform that is mobile-device aware is new. The proper visualization is there regardless of the device–collaboration and chat, analytics, governance, risk, and compliance, and portfolio risk management are all integrated right out of the box. This reduces costs and cybersecurity risk, enabling agencies to effectively move out on the EO with confidence.

MeriTalk: What best practices are you sharing with agencies as they begin this journey?

BO: I encourage everyone to do their homework. Not all clouds are created equal, and not everyone who claims to have an enterprise-class cloud and enterprise service delivery really do. The ITIL model is critical because it provides a proven solution. Agencies must not be reluctant to start small and grow. With ServiceNow, you can start in one business area or department, and since everything is native on the platform, you can grow. This is not unlike a communications service provider, like Comcast or Dish. A basic channel package exists, and then you subscribe to additional channels you want. If you want more, you simply turn them on because they’re resident on the box.

ServiceNow is subscription based, so this same model applies. Feds can start in any one area, and then everything is certified in their environment. In the future, all they need to do is subscribe to other services. The certification process is minimal compared to other acquisitions–we’re transforming IT acquisitions. Today, CIOs struggle with keeping up with new technologies. This platform approach provides constant upgrades and new technology. New functionality and new apps are always added and subscriptions are always modernized. Because we use a single data model with common application logic–they are backward compatible. Instead of upgrades being a big issue, they become non-events. Agencies can keep up with modern technology and lower cybersecurity risk all at a lower cost.

Look Who’s MeriTalking: Palo Alto Networks’ Ryan Gillis on CDM

MeriTalk recently connected with Ryan Gillis, vice president of cybersecurity strategy and global policy for Palo Alto Networks, to discuss continuous diagnostics and mitigation (CDM) implementation and how Palo Alto Networks can drive agencies to a more secure environment.

MeriTalk: What is your high-level assessment of where agencies stand in terms of CDM implementation, and specifically what are your thoughts about the prospect of dashboards being in place by the end of 2017?

Ryan Gillis: It’s hard to make a generalization across government but there are common issues as agencies implement CDM. As a baseline, CDM and EINSTEIN are the two programs through which the Department of Homeland Security provides certain complementary technologies and capabilities to each civilian agency. Additionally, each agency has the responsibility to secure their own networks, and deploys technology, people, and processes to accomplish those goals.

Agencies are trying to drive as much harmonization as possible between what they’re getting through CDM, what they’re deploying themselves, and how that all functions together. One particular goal is to go through CDM to drive cost savings. Aligning what agencies are buying through CDM and what they are buying separately is a common issue that arises as agencies move through the CDM process.

When it comes to implementation–agencies are not just sticking with one static solution–CDM has done a good job of periodically evaluating and incorporating new technologies. This is to the benefit of the agencies as they’re trying to acquire new technologies to help secure their networks. In terms of the dashboard, I think it will remain a focus; however, it remains to be seen as to whether or not they accomplish this goal. There is a lot that we’ve seen over the last 10 years in regard to CDM and EINSTEIN deployments–but there is a new set of circumstances and challenges with the turnover in personnel and ushering in of a new administration that impact the complex deadline of deploying the dashboards by 2017.

MeriTalk: The CDM program has three phases. Where have organizations faced the greatest challenges in phases 1 and 2? What are the hurdles ahead for phase 3?

RG: The first challenge in the stand-up of the CDM program relates to how we bring in the technologies to meet the initial levels of requirements for phase 1, 2, and 3. Specifically, the identification of the suites of tools that would be utilized by the program and getting agencies to purchase was the most important challenge when getting the program off the ground.

The hurdles ahead relate to: How does CDM align with what agencies have in their networks for harmonization, how does the program manage technology refreshes as the tools that accomplish the requirements for CDM continue to evolve in the private sector, and how do the CDM requirements and capabilities evolve in phase 4 and beyond.

MeriTalk: What strategies should agencies adopt for each phase to minimize the pain and accelerate implementation?

RG: The lessons learned from the OPM breach and last administration’s Cyber Sprint are now being applied through the Trump administration’s cybersecurity executive order. For example, under the new executive order, each department and agency head is being held personally responsible for their own agency’s security, and agencies are now also mandated to implement the NIST framework based on risk management. As agencies look to CDM implementation, they should focus on areas of risk that matter most. What is the highest value asset on your network, and how do you apply people, processes and technology toward securing that.

MeriTalk: How does Palo Alto Networks Next-Generation Security Platform help to ease these challenges at each phase and accelerate time to value?

RG: We can break this into two categories–there are some requirements that we help agencies fulfill directly with our solutions and others where we strategically partner to complement our core competencies. To address challenges in phases 1 and 2, our solutions deliver visibility down to the application and user level, and we partner with companies like ForeScout and Tanium to enable agencies to fulfill the spectrum of required capabilities. In phase 3, we empower users to address the network boundary protection requirements. Finally, we have strong partners, such as VMware, that enable us to collaboratively address phase 4 focus on network segmentation and software-defined networking, so that our security capabilities can be applied in a better managed environment.

MeriTalk: The original CDM blanket purchase agreement is set to expire next summer. How can agencies accelerate their implementations and avoid pitfalls to ensure that they have contracted all phases in time for the deadline?

RG: Just recently, we have seen a move toward GSA’s increased use of special items numbers (SINs). SINs make it easier for the products that are held on CDM (tools that agencies would want to buy and deploy) to be acquired and leveraged. This reduced the administrative burden and accelerated the process to acquisition and deployment. This is an acquisition and procurement move that will hopefully result in getting CDM tools into the hands of operators faster.

MeriTalk: How might the president’s cybersecurity executive order issued last month impact the future of CDM or the likeliness of its extension?

RG: I see the executive order as a continuity of policy. As discussed earlier, this EO is a reflection of the fact that cybersecurity policies have developed in a linear manner and in a nonpartisan way. It reinforces the responsibilities of agencies to secure their own networks by moving toward implementation of the NIST framework. CDM should help with that risk-based approach to securing their networks and high-value assets.

MeriTalk: How can CDM be better integrated with mobile and cloud environments? How can Palo Alto Networks solutions help to address this growing requirement?

RG: The core initial requirements within CDM are to know who and what is on your network and then protect your network boundaries. These philosophies should be applied regardless of how your network is configured–whether your data is stored in a data center or the cloud. We must tailor security solutions to this evolving environment. Agencies are going to need the same types of security to protect high-value assets regardless of where their data resides. Palo Alto Networks understands and is focused on this mission. We are also focused on prevention and stopping successful cyberattacks, an approach that is a core part of our security offerings. Our Next-Generation Security Platform employs a prevention-based approach that automatically stops threats across the attack life cycle–whether these threats are at the endpoint or in the cloud.

MeriTalk: What considerations should agencies weigh carefully when looking at solutions and partners for their CDM journey?

RG: One of the problems in the security industry is focusing narrowly on a solution that addresses a particular requirement or new attack vector and not viewing how that solution integrates into broader requirements. Customers, from the beginning, should ask their vendors, how does this solution solve the distinct problem I’m looking to address, and, as important, how does it complement my other solutions to deliver a more secure environment?

MeriTalk: One of the biggest challenges that agencies report about CDM is that there is not a “one-size-fits-all” approach. What have you seen in the agencies that you work with, and how is Palo Alto Networks uniquely prepared to work with agencies to deliver the right solution?

RG: There are some aspects of commonality, whether the focus is on CDM or corporate customers. A company like Palo Alto Networks needs to be flexible to meet the unique demands of customer sets–whether it be security in the data center, public cloud, private cloud, hybrid cloud, endpoints, or the network layer. Having a platform that works together is how we meet those goals and identify the best partners to bring in core competencies, including VMware, AWS, Verizon, and Proofpoint. These capabilities are instrumental to delivering the right solution for our customers.

Cloud Computing for the Win

How fitting that Cloud Computing (the horse) beat favorite Always Dreaming to the finish line at the Preakness this year, particularly for those of us working in Federal IT.

Just three days earlier, the Modernizing Government Technology (MGT) Act passed the House, signaling continued momentum for agencies working to reduce reliance on outdated systems and move to cloud – the foundation for digital transformation.

We need to stop managing resources piece-by-piece and building systems component-by-component. This approach isn’t fast enough for modern Federal missions, and can’t scale to manage the exponential increase in Federal data. As we look forward to the Internet of Things, machine learning, and artificial intelligence, we know we will quickly generate even more data and will have an even greater need to deploy IT services, faster.

Cloud enables IT as a service. We can put new applications in the hands of Federal teams, faster. IT becomes 100% mission focused. And, as a result, we can deliver improved service to the citizen and new ways to connect to government services, resources, and information.

And, we’re at the gate. The Dell EMC State of IT Trends 2016 Federal study found that Federal IT leaders anticipate cloud will be their most significant investment in 2017. OMB has specified that the 2018 budget requires that agencies focus on transitioning high-risk legacy IT systems to cloud and shared services.

It’s a trifecta of benefits – cost savings, improved operations, and, of course, better security. OMB has shared that, as an example, moving to a cloud-based collaboration solution can bring cost savings that range from $500,000 per year for smaller agencies to $10 million per year for a larger agency such as the Department of Justice. Lawrence Livermore National Laboratory consolidated their data centers from 63 to 18, using cloud computing to support the lab’s enterprise computing systems and enabling operational improvements through a common dashboard providing data streams to all lab employees. The OMB Breach and Wannacry shows us the cyber liabilities of outdated IT.

Unlike horse racing, we’ll never reach the finish line – but we have proven cloud success across government. As we modernize, cloud computing will help us win.

By: Steve Harris, Senior Vice President and General Manager, Dell EMC Federal

Time to Get Serious About Federal Government Cybersecurity

It is generally accepted that, as the National Institute for Standards and Technology points out, cybersecurity threats exploit the increased complexity and connectivity of our critical infrastructure systems and can potentially place the nation’s security, economy, and public safety and health at risk. Like financial and reputational risk, cybersecurity risk affects the bottom line of both companies and nation-states. It can drive up costs and impact revenue. It can harm the ability to innovate and to gain and maintain customers, as well as make it difficult to meet the needs of citizens.

To address these risks, President Obama issued Executive Order 13636, “Improving Critical Infrastructure Cybersecurity,” on Feb. 12, 2013. According to the Department of Homeland Security, this executive order directed the executive branch to do five things: develop a technology-neutral voluntary cybersecurity framework; promote and incentivize the adoption of cybersecurity practices; increase the volume, timeliness, and quality of cyber threat information sharing; incorporate strong privacy and civil liberties protections into every initiative to secure our critical infrastructure; and explore the use of existing regulation to promote cybersecurity.

Almost exactly one year later, a cyber intrusion began at the United States Office of Personal Management. This intrusion went undetected for 13 months. As the Wall Street Journal, U.S. News & World Report and other media reports noted, this intrusion was described by Federal officials as among the largest breaches of government data in the history of the United States. Information targeted in the breach included personally identifiable information, such as Social Security numbers, as well as names, dates, places of birth, and addresses. The hack even involved the theft of detailed security clearance-related background information, including more than 5.6 million sets of fingerprints.

Clearly, EO 13636 was insufficient to prevent a major cybersecurity event.

Less than a month ago, President Trump signed a new executive order, “Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure,” designed to protect American innovation and values. This new executive order, which reflects considerable analysis, opens with four findings: that the executive branch has for too long accepted antiquated and difficult–to-defend IT; that effective risk management involves more than just protecting IT and data currently in place; that known but unmitigated vulnerabilities are among the highest cybersecurity risks faced by executive departments and agencies; and that effective risk management requires agency heads to lead integrated teams of senior executives with expertise in IT, security, budgeting, acquisition, law, privacy, and human resources.

The executive order goes on to explicitly hold agency heads accountable to the president for implementing risk management measures commensurate with the risk and magnitude of the harm that would result from unauthorized access, use, disclosure, disruption, modification, or destruction of IT and data. It also mandates the use of the rigorous and recently revised Framework for Improving Critical Infrastructure Cybersecurity developed by the National Institute of Standards and Technology that EO 13636 deemed voluntary.

Will this new executive order make a difference? The answer may rest in the implementation and enforcement of the order. With parallel progress in both pattern recognition algorithms and microelectronic technology, machine learning and artificial intelligence can likely already bridge the gap between the enormous volume of government intelligence data and people capable of analyzing it, as Jason Matheny, Director of the Intelligence Advance Research Project Agency, has forecast. IBM’s Watson, for example, can understand all forms of data, interact naturally with people, and learn and reason at scale. Accordingly, the compromise of even sensitive but unclassified information when analyzed by sophisticated means could enable perpetrators to “connect the dots” and jeopardize national security.

In this environment, will “mistakes” or negligence leading to compromised information be tolerated or will they be dealt with severely? Will agency heads be held accountable or will they get a pass? Will “antiquated and difficult-to-defend IT” be tolerated or will rigorous processes and modern applications, like layered security, limitations within network security, encryption of data at rest and in motion, and policy engines used in conjunction with access restriction and auditing software be mandated, implemented, and audited?

The answers will be revealed over the next weeks and months.

The challenge is clear—a well-thought-out and rigorous policy for Federal government cybersecurity is in place, now it must be implemented and enforced. Time is not on our side; the next hack or the next serious incident due to the negligence of a government employee or contractor could happen tomorrow or the next day. It is time to get serious about Federal government cybersecurity.

The President Proposes…

…and the Congress disposes. So goes the old adage in political science and on Capitol Hill. Congress’ power of the purse, enunciated in Article I of the Constitution, is at the very heart of its authority and role in our democracy. That’s why I’m somewhat amused by all the concern, gnashing of teeth, press articles, and the like about President Trump’s recent release of his FY 2018 budget.

Why do I say that–“somewhat amused”? For several reasons; let me enumerate.

First, I’ve seen this movie before. I assumed the role as Director of the Office of Management, Budget and Planning at the Department of Commerce in the early 1980s, during the Reagan administration. The president’s budget was based on reports from the Grace Commission and proposed the elimination or drastic cutbacks of a number of programs, agencies, and so on. One could lay that list from 35 years ago against this president’s budget and find an almost complete overlap. Reagan was going to abolish the National Endowment for the Humanities, the National Endowment for the Arts, the Appalachian Regional Commission, the…well, you get the idea. As the administration, through the Office of Management and Budget, “instructed” me to reiterate this budget request year after year, I began to refer to it as my Don Quixote list. And those agencies and programs are still around.

Second, in the Federal acquisition and information technology (IT) community, we need to see the tree, not the forest. The tree, in this case, is Federal IT spending. President Trump’s budget proposes to spend $95.8 billion in FY 2018, $1.7 billion more than FY 2017 and $5.4 billion over FY 2016. Priorities remain similar to those in the Obama administration–modernization, cloud computing, cybersecurity, shared servicing, category management, and digital services to citizens. And the Congress has a history of appropriating more for IT than the administration has requested. So prospects are positive for this community.

Finally, the response to President Trump’s proposal has been…well, less than lukewarm. What have members of Congress had to say about it? Here are some comments:

“I thought Mexico was going to pay for the wall. Why is this in our budget?”

– Rep. Fred Upton, Michigan

“Taking funding away from Louisiana’s coastline is a non-starter.”

– Sen. Bill Cassidy, Louisiana

“It’s just a lot of people who don’t know what the hell is going on in farm country.”

– Sen. Pat Roberts, Kansas

“A lot of Benghazis in the making if we actually implemented the State Department cuts. So, this

budget is not going anywhere.”

– Sen. Lindsay Graham, South Carolina

“I do not support proposed cuts to the National Institutes of Health.”

– Sen. Pat Toomey, Pennsylvania

“Many of the proposed cuts to important domestic programs that many Michiganders rely on

are, frankly, non-starters.”

– Rep. Fred Upton, Michigan

“Meals on Wheels, even for some of us who are considered to be fiscal hawks, may be a bridge

too far.”

– Rep. Mark Meadows, North Carolina

“We know that the president’s budget won’t pass as proposed.”

– Sen. John Cornyn, Texas (also serves as Senate Majority Whip)

“We’ll be taking into account what the president recommended. They will not be determinative.”

– Sen. Majority Leader Mitch McConnell, Kentucky

“The proposed cuts to some Federal programs are not mere shavings, they are rather deep and

harmful to my district…”

– Rep. Hal Rogers, Kentucky, former chairman of the House Appropriations Committee

What do all these comments have in common? They are all from members of the president’s own party. Some budget proposals during the Obama administration were deemed dead on arrival. This one, as they said in The Wizard of Oz is likely:

“…not merely dead, it is really most sincerely dead.”

– Coroner, Munchkinland

Look Who’s MeriTalking: Bob Stevens on Mobile Security Risks

MeriTalk recently spoke with Bob Stevens, vice president of Federal systems for Lookout, about the unique mobile security risks facing the Federal government, where agencies are making progress, where they need to improve, and what they can do to get started. Lookout takes a mobile-first approach to security, creating mobile-first, cloud-first products for IT administrators, CISOs, and individuals.

MeriTalk: Why do mobile devices present unique security risks and challenges for the Federal government?

Bob Stevens: Mobile devices are designed for consumer use, not Federal agency use. The government has to put a lot of checks and balances in place to ensure security, but many features aren’t available out of the box. Further, the Federal government needs visibility into what exists within its mobile ecosystem. To do this, agencies need encryption, device-specific ID management, and a mobile threat protection solution for continuous monitoring of mobile applications, the device, and network to provide near real-time threat detection.

It’s also important to consider that, when it comes to the Federal government, hackers and other malicious entities targeting intelligence agencies have very different motives and processes than those targeting consumer agencies. And, the wide range of mobile risks is especially concerning for agencies due to the critical data being accessed across their networks.

At the end of the day, Federal employees are individuals, too. Just like you and me, most Federal employees interact with friends and family on social media and stay connected to the world via a mobile device. While Federal data may not be housed on a personal mobile device, an infected device could give hackers the entryway they need to access our nation’s critical data across Federal networks.

MeriTalk: Where have agencies made the most progress?

BS: In a 2015 survey, Lookout found that 40 percent of Federal employees said that rules prohibiting personal smartphone use had little to no impact on their behavior. Before 2016, mobile wasn’t even a thought for DHS top priorities, and now it’s in the top three for the department.

Rapid adoption and innovation in mobile technology has forced Federal agencies to recognize that the shift toward mobility has a direct and immediate impact on their organizations, and that mobile security should be a priority.

Each of the steps being taken to address mobile security is a sign of progress for the Federal government. Just last week, President Trump issued his executive order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, which among several provisions calls for agencies to adopt the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Furthermore, the Department of Homeland Security (DHS) Science and Technology Directorate recently released a study on Mobile Device Security. The report outlined the risks mobile devices pose to the security of the government.

One Federal entity that is leading the charge when it comes to mobile security is the U.S. House of Representatives. CISO John Ramsey is forward looking, understands the threat of the mobile ecosystem, and is taking action. The U.S. House of Representatives, for example, is focused on deploying real-time diagnostics on devices themselves.

MeriTalk: What strategies and tactics do you advise to help agencies evolve beyond simple mobile device management?

BS: Agencies need clear visibility into the mobile ecosystem. They need to know every device that is connecting to the network and know the apps on those devices. They also need predictive analytics on the devices themselves.

For true mobile protection, mobile device management (MDM) is critical, but not all encompassing. Many agencies believe their MDM solution will protect them from malicious applications. However, because users can “sideload” apps onto their phone, we consistently see malicious applications appear on our enterprise customers’ devices.

To truly protect against the wide array of mobile threats, agencies need a large portfolio of mobile defense software. Mobile application management (MAM) solutions, for example, give Federal agencies an added layer of security for devices that are Federally managed.

MeriTalk: What best practices can you offer for continuously monitoring for threats and providing enterprisewide visibility into threat intelligence?

BS: While many of the same components of risk that affect PCs also apply to mobile endpoints, mobility has introduced a new generation of risk. Simply extending current PC security controls to your mobile fleet is not a viable option. Enterprise risk management needs to evolve to address mobile risks, and security professionals must architect mobile-specific security.

When it comes to threat intelligence, it is critical that agencies have insight into both external and internal risks. Lookout developed a unique program for mobile threat intelligence. The success of Lookout’s personal and enterprise endpoint products has given Lookout visibility into over 100M mobile devices worldwide. Every month millions of devices in over 150 countries send security telemetry to the Lookout Security Cloud, ensuring that Lookout can track evolving threat actors and continue to lead the industry in novel threat discoveries such as the Pegasus spyware.

In terms of providing enterprisewide visibility into threat intelligence, most organizations find that they have very limited visibility into most mobile risks. This is because many CISOs and security teams fail to get visibility into employee behaviors and device configurations, which is the first step to enabling mobile security. Agencies and organizations that are able to gain visibility into the entire spectrum of mobile risks facing their infrastructures will be able to foster an environment that enables the safe and efficient use of mobile technology.

Another best practice when it comes to providing enterprisewide visibility is enterprise management mobility (EMM). Specifically for internal mobile security risks, EMM addresses the vulnerabilities associated with personal devices. Simply put, EMM solutions have the ability to grant and revoke access to employee devices. When used together, threat protection and EMM solutions provide the necessary defense tools needed for managing risks inside and outside of the agency.

MeriTalk: How do machine learning and contextual analytics increasingly factor into the ability to protect devices from malicious applications? Where and how is Lookout delivering innovation on this front?

BS: Mobile security is a constant, fast-moving battle between the good guys and the bad guys. New threats appear all the time and enterprises need to be able to cover them all.

Modern threat management is all about data. It’s a big data problem. The bigger the data set, the more effective a solution is at identifying and protecting against threats.

Lookout has the biggest data set in mobile security as a result of our consumer user base, which is generated from a network of over 100 million devices. Those devices acquire 90,000 apps every day, contributing to a corpus of over 40 million apps, and enabling Lookout to auto-convict over 5,000 new pieces of malware each day. Our teams leverage machine learning to be able to quickly dive into our massive data set and pinpoint potential attacks, malicious applications, and risks at scale.

MeriTalk: What is the CISO’s role in the evolving digital ecosystem and the IoT?

BS: We understand that the CISO’s job is not an easy one. From the outside looking in, the CISO’s role appears to be a very strategic juggling act. With the recent explosion in mobile technology, another ball has been thrown into the mix.

In terms of evolving the digital ecosystem and IoT, the CISO should question the security protocols currently in use. By continuously taking a step back to understand the interconnectivity of attacks, the CISO can push for new approaches to security solutions. By providing security teams with a holistic sense of what they’re facing, they can develop improved strategies for securing the digital ecosystem and IoT.

MeriTalk: What emerging threats and dangers should CIOs and CISOs be paying attention to today to avoid larger issues down the road?

BS: How quickly network infrastructure is changing and will continue to change, for one. Mobile devices—smartphones and tablets—have completely changed the security assumptions that have been baked into most enterprise networks. Instead of all of your data being inside the firewall on tightly controlled servers and PCs, it’s now distributed between cloud services and mobile devices that don’t typically have the same security controls as their on-premise counterparts.

Look Who’s MeriTalking: Steve Harris of Dell EMC on MGT, DCOI

MeriTalk sat down with Steve Harris, GM/Public Sector at Dell EMC, to discuss MGT, DCOI, and other modernization efforts.

MeriTalk: The Modernizing Government Technology (MGT) Act has just been reintroduced. What are your thoughts?

Steve Harris: We applaud Congressman [Will] Hurd for introducing the Modernizing Government Technology Act. Under MGT, agencies save by streamlining IT systems, replacing legacy products, and transitioning to cloud computing. Those savings can then be placed into a working capital fund that can be accessed for up to three years for further modernization efforts.

The Federal government needs modern IT systems that can adapt to better serve constituents. It’s encouraging to see bipartisan support. For example, as part of the effort to protect Federal networks, the cybersecurity executive order–which places specific emphasis on modernizing Federal IT systems–was just signed. In this very contentious environment, modernizing our Federal IT systems so that we can increase the efficiency of government is one thing everyone agrees on.

MT: In the interim, what advice are you giving Federal CIOs as they evaluate their current and future data center modernization strategies?

SH: CIOs should establish a strong framework to enable digital transformation.

Agency CIOs are still struggling at the crossroads of mandate and mission. They’re working to modernize data centers, but still struggling to maintain legacy systems that require maintenance and support and consume a disproportionate part of their IT budget. Re-platforming these systems is a critical piece. Open platforms will drive down the costs of maintaining infrastructure moving forward. To accelerate modernization, CIOs need two things: a comprehensive inventory of their IT assets and strong top-level communication and collaboration between mission functions and the IT teams.

MT: From your conversations with IT leaders, what are Fed CIOs’ top three priorities for modernization? Are you seeing any shift in these priorities?

SH: Security, security, security. We should see new momentum with the cyber EO signed. Modernizing applications and endpoints is critical. Many vulnerabilities lie in the user community, legacy system, and application endpoints. There is also a real sense of urgency in the shift to move faster to a modern cloud strategy and other modern interfaces–agency IT leaders are focused on cloud, mobility, data analytics, and other technologies to deliver improved mission support and new efficiencies.

Most CIOs understand that digital transformation and modernization are inextricably linked. But, CIOs have a tough job in today’s government. They want to be change agents, but it’s only recently that they’ve been given new opportunity for progress–FITARA, specifically. FITARA empowers CIOs with new responsibility for mission goals, and this is certainly driving a shift in how priorities are addressed.

MT: What is the next frontier in terms of modernization?

We are quickly moving to a state where ubiquitous mobility and connectivity are the norm, and cloud computing is the foundational core of any IT infrastructure. Agencies are already equipping themselves with flexible, software-based solutions to support tomorrow’s technology innovation while still meeting today’s mission goals. Realizing digital transformation is the next frontier as agencies continue to modernize.

MT: Are you seeing any new use cases for virtualization and flash emerging? If so, can you share your observations?

SH: Flash technology offers a great alternative for agencies that have multiple classification levels of sensitive data, some of which need to remain on prem. It’s agile, efficient, and fast. And, it has a significant impact on energy reduction in the data center. Flash storage will effectively support agencies that need to quickly access data during urgent, mission-critical decision-making activities–so DoD is a prime example, but also agencies like the department of State. We will see more Feds jumping on the flash bandwagon as they continue to address the need to meet Data Center Optimization Initiative (DCOI) mandates.

MT: Where do you see or anticipate the greatest traction for software-defined storage?

SH: Explosive data growth is overwhelming many organizations. This reality is especially profound in government given the broad scope of the mission. Software-defined storage (SDS) addresses data challenges as it offers elasticity, scale, and simplicity–with the added benefit of cost savings. Agencies working to meet the National Archives and Records Administration’s (NARA) record management mandates or evolving Electronic Health Records (EHR) requirements would be effectively served by SDS.

This said, SDS will gain the most traction supporting data center modernization and helping agencies meet the ambitious DCOI milestones.

MT: Make one prediction for the future of the hybrid cloud in Federal IT over the next three years.

SH: Integrated hybrid cloud will become the No. 1 spending priority for agencies over the next few years. We know cloud services are one of agencies’ top spending priorities. I believe hybrid cloud will quickly jump to the top of the list, given the need to modernize at a rapid pace, and the associated efficiency, cost savings, and speed benefits.

Meeting DCOI Goals with a Software-Defined Data Center

The Federal Data Center Consolidation Initiative (FDCCI) was intended to, in part, “reduce the cost of data center hardware, software, and operations […] and shift IT investments to more efficient computing platforms and technologies.” But it didn’t work – new data center construction continued. Six years after the FDCCI, the Data Center Optimization Initiative (DCOI) was introduced to impose tighter regulations, and has forced agencies to focus on meeting specific metrics to improve data center utilization and efficiency, and, ultimately, save money.

The primary DCOI deadline of September 30, 2018 is fast approaching, and agencies must do all of the following before that date:

Meet target metrics for energy metering, power usage effectiveness (PUE), virtualization, server utilization and automated monitoring, and facility utilization;
Install advanced energy meters;
Use automated monitoring and operations – no more manual collection and reporting;
Reduce data center costs by at least 25 percent, relative to the fiscal year 16 spending; and
Close at least 25 percent of tiered and 60 percent of non-tiered data centers.

As Federal agencies look at the challenge in front of them – installing new technology, optimizing infrastructure, improving performance, and reducing costs – how can they quickly achieve all of these goals?

One path forward is software-defined data centers (SDDCs). SDDCs have virtualized hardware components, deliver infrastructure-as-a-service, and are software-based. All of these components allow agencies to be flexible in the face of unknown, emerging data center demands. Federal agencies have repeatedly mentioned scalability as crucial to successfully modernizing IT – a recent Dell EMC survey found that 90 percent of Federal IT decision-makers want an IT architecture that allows them to tailor to specific application and workload needs.

That same survey found that most agencies are moving towards SDDCs. Sixty-four percent of Federal agencies said they had deployed software-defined solutions, 85 percent reported progress adopting SDDCs, and 56 percent reported being more than halfway done adopting an SDDC.

And, Federal IT managers reported the top three advantages of SDDCs are flexibility, agility, and efficiency. All of those characteristics put agencies in the best position to optimize and modernize their data centers against DCOI goals, support agency missions, and drive towards digital transformation.

As Federal agencies look to hit the DCOI bottom line, SDDCs seem to be the best path forward – increasing flexibility and efficiency, improving performance, and, most importantly, saving dollars. It’s a Federal IT win-win.

Learn more: http://i.dell.com/sites/doccontent/shared-content/campaigns/en/Documents/Future_of_data_center.pdf

By: Steve Harris, Senior Vice President and General Manager, Dell EMC Federal

Are You Rational? Prioritizing Applications to Move Modernization Forward

As more and more Federal agencies turn towards cloud as the most viable modernization method – in a recent MeriTalk study, 76 percent of Federal IT cloud decision-makers said they are evaluating cloud solutions as an integral part of their overall IT strategy – agencies have to develop a clear plan on how to consolidate data centers and make the move to cloud.

As an immediate next step, Federal agencies require an understanding of which applications are ready – and able – to move from data centers into the cloud and operate successfully once in the cloud environment. 92 percent of Federal IT managers say it’s urgent for their agency to modernize legacy applications, with the top drivers being security issues, time required to manage and/or maintain systems, and inflexibility and integration issues.

Agency CIOs must determine how infrastructure and applications interact relative to mission priorities. What’s vital, what’s duplicative, what can be retired? This process can breathe new life into the application portfolio – providing improved efficiency and security before the move to the cloud.

So how can agencies create and implement effective application rationalization plans for their upgraded systems? A few thoughts:

Create a consolidation roadmap – establishing clear guidelines from the beginning helps agencies to stick to their goals and proceed in a timely manner.
Create an application inventory – this helps agencies see what applications they have, determine which ones are necessary, and identify what applications might be duplicates or are no longer necessary. Agencies can also rank applications based on mission value.
Identify security and performance requirements for each application – how will each application fare in a transfer? Are certain apps worth re-building, or is it better to eliminate them entirely?
Map out application connections – how are certain applications connected? Do any applications share data? This ensures eliminating one app does not interfere with the execution of another app.
Consider an automated tools-based approach – can speed the application rationalization process by 50 percent, using fewer resources than manual techniques.
Look for quick wins – identify opportunities to build modernized apps quickly, driving mission value and accelerating your success.

Also, Federal IT managers estimated that 55 percent of their current legacy applications could be successfully modernized through re-platforming the existing application, leveraging architecture-driven modernization, or by remediating the existing application to extend its useful life.

Investing in application rationalization as an early step puts modernization efforts on the right path. And, with Rep. Will Hurd (R-Texas) and Rep. Gerry Connolly (D-Va.) recently re-introducing the Modernizing Government Technology (MGT) Act, there should be more funding and support for these efforts.

Learn more about how Dell EMC can help with application rationalization:

Dell EMC’s Application Profiling Services – https://www.emc.com/collarteral/serviceoverview/h15258-emc-application-profiling-services-svo.pdf

By: Cameron Chehreh, Chief Operating Officer, Chief Technology Officer & VP, Dell EMC Federal

Improving FITARA Scores: Follow the Leaders

The December 2016 FITARA scorecard revealed a number of agencies continue to rely on legacy IT systems, wasting billions each year and making it increasingly difficult to secure sensitive government information.

Many received Ds and Cs, and not one agency scored an overall A. Additionally, despite significant focus during the past several years, nearly 65% of agencies received a C, D, or F in the data center consolidation category.

These low grades reflect the complexity of the modernization challenge. Data center consolidation and optimization is a top priority for every Federal chief information officer – to reduce costs, improve efficiency, and keep data and systems secure.

The report cards bring new transparency, and provide the best, fastest way for agencies to learn from each other, evaluate their current plans, and move their IT forward. The Department of Homeland Security (DHS), for example, performed well, receiving an A in the data center consolidation category. Luke McCormack, the agency’s former CIO, says he expects the agency to have fewer than 25 data centers by fiscal year 2019. Rep. Gerry Connolly (D-Va.), also noted that DHS surpassed its data center consolidation savings goal, cutting $248 million.

Soraya Correa, chief procurement officer at DHS, was quoted in a recent article saying agencies must change the way they think about their workforce by modifying how personnel are trained and removing silos around different positions.

“If you really want to change the culture, you’ve got to change the way you train people,” Correa said, explaining that IT, procurement, and human resources personnel should all be receiving training specific to their particular positions, rather than one blanket onboarding process for all employees.

As another example, several of NASA’s scores jumped from F to C-plus on the December scorecard. Renee Wynn, NASA’s CIO, said using an internal Business Service Assessment (BSA) was a key factor in the improved scores. The BSA helped the agency restructure IT governance, update program management, and improve CIO oversight for major IT investments.

Wynn said the BSA yielded seven recommendations for the agency to streamline internal roles and responsibilities. One of the ideas that had the most profound affect was creating an IT Council comprised of senior agency officials and representatives from the ten centers that deliberate on IT investments. This strategy investment board ultimately changed the way NASA managed IT by providing recommendations and an overarching direction for the agency’s IT acquisitions – eliminating the prior, more piecemeal approach.

And that is what FITARA is all about. We can’t modernize without a hard focus on the mission, which comes from increased collaboration within each agency and between the mission owners and IT.

The next scorecard is expected out in May. We are all looking for signs of progress across more agencies, and even more examples of how we can move forward together.

By: Steve Harris, Senior Vice President and General Manager, Dell EMC Federal

The Situation Report: Retooling the Military Draft for a High-Tech Future

If you are or ever were a male between the ages of 18 and 25, then you’ve heard of the Selective Service System. For those of you who don’t know what I’m talking about, that’s the independent Federal agency tasked with managing the registration of all males eligible to be drafted into the military during times of national crisis.

But the Selective Service today is a far cry from the system that was first started in 1917 during World War I in Europe. The world has evolved from trench warfare to cyber warfare and, as a result, the guiding principles behind how the nation encourages national service and the extraordinary process of drafting military-age males into service during times of war are evolving as well.

In a virtually unnoticed message to Congress this month, President Donald Trump outlined his new guiding principles for reforming the Selective Service process, as called for by the 2017 National Defense Authorization Act. And the Trump approach calls for a renewed focus on “critical skills.”

America hasn’t relied upon the draft since the Vietnam War. For the past 44 years, the nation has benefited from the development of a professional military of all volunteers with a wide variety of professional skills and life experiences. But the world is arguably more dangerous today than at any other time during those 44 years, and the threat of miscalculation leading to a major global conflagration—from nuclear war on the Korean peninsula to major power conflicts in Europe and Asia—is increasing.

But just as the nature of war has changed, so have the needs of the military. In the unlikely event of a future draft, the Trump administration is advising the Selective Service “to create pathways through service that leverage enhanced, empowered, and experienced expertise across the spectrum of science, technology, engineering, mathematics, national security, cyber linguistics and foreign language, education, health care, and the medical professions,” according to Trump’s report.

Trump’s guidance also recommends that the Selective Service improve opportunities for individuals to access “critical education and technical training opportunities via the U.S. Armed Forces, federal and private sector.”

It’s unclear, however, if Trump’s guidance would lead to a more capable high-tech military in the event of a draft. The U.S. military is already more highly educated than the population in general, holding a higher percentage of bachelor’s degrees and high school diplomas. In addition, former Secretary of Defense Ash Carter once complained that half of the 21 million Americans aged 17 to 21 were unable to meet military entrance exam requirements.

The situation gets worse. Federal and state data shows that more than 25 percent of all college freshmen in the U.S. require some form of remedial coursework. At two-year community colleges, that percentage can be as high as 60 percent. American students just aren’t keeping up with the world around them. That may spell problems for U.S. competitiveness, but it very well may spell catastrophe for U.S. military effectiveness on the high-tech battlefields of the future.

Is there a bright spot in the government’s plan to make military service more attractive to STEM graduates? Yes. Silicon Valley is notorious for pulling jobs out from beneath the feet of young graduates. Tech companies have eliminated more than 413,000 jobs since 2012, including 96,000 just last year. Annual job growth in Silicon Valley decreased to 3.5 percent, or 26,700 new jobs, in 2016. This compares to the 6 percent annual gain of 42,300 jobs in 2015, and the 6.4 percent gain in 2014.

Of course, not all tech companies have been cutting back. IBM CEO Ginni Rometty, for example, said she plans to hire 25,000 tech pros in the next four years. But if the world keeps spiraling out of control, Big Blue may have to wait for most of those people to finish their tours of duty.

The Situation Report: What NASA Can Teach Us About Government’s Innovation Potential

The private sector innovation marketing machine is at it again. Congress should fund a new digital startup within the General Services Administration to focus solely on cybersecurity, according to a new set of policy recommendations released this week by the Information Technology Innovation Foundation.

“The goal of this initiative would be to incorporate private-sector knowledge and nongovernment culture into high-impact, high-priority federal government cybersecurity projects,” according to ITIF’s recommendation. “Members of this team could serve short-term stints based on new projects, agency needs, and available funding.”

There’s only one problem with this idea: It is based on a myth—the myth that the Federal workforce is incapable of matching the passion, ingenuity, and innovative spirit that has formed the centerpiece of the Federal contractor community’s marketing pitch for the past two decades. The government doesn’t need “nongovernment culture” to improve cybersecurity. What it needs is to recruit a workforce with a long-term vision of service and innovators driven not by the prospect of living a life of success but of living a life of meaning.

Nowhere is this example more apparent than at NASA. Take, for example, NASA’s Voyager 2 program. NASA scientists and engineers have been working on Voyager 2 for 40 years. It’s the only spacecraft to have ever visited Uranus and Neptune, and is currently making its way to interstellar space. The technical achievements recorded during missions to photograph Uranus, Neptune, and Neptune’s moons are without parallel and were done by career NASA employees.

Engineers predicted storms weeks in advance on a planet more than 2 billion miles from Earth and advised where to point the spacecraft’s cameras. They also re-coded the cameras to produce sharp images in a place with little sunlight and as the spacecraft flew by at more than 35,000 mph. And it was all done with a 160 bits per second data link operating with the equivalent power of a refrigerator lightbulb.

What Can NASA Teach Us?

There’s no denying that NASA has had its ups and downs. But there’s also no denying that its successes far outpace its failures. Taking on missions where minor mistakes could destroy years of work requires a special kind of passion, leadership, and thirst for innovation.

And there may be something to the fact that the agency continues to place at the top of the Federal Employee Viewpoint Survey and the Partnership for Public Service’s Best Places to Work in the Federal Government rankings. The agency also ranked as the No. 1 “most attractive” employer for engineering students, according to global research and advisory firm Universum, and was named the second “Happiest Company in America” by CareerBliss rankings.

“The hundreds of employee reviews on employment websites tell the stories of employees who are fulfilled by the innovative, challenging, results-driven environment,” wrote Marta Wilson, a leading expert in leadership effectiveness, organizational improvement, and transformation strategy. “The most repeated theme among the reviews is: the people. The employees, both past and present, mention the pleasure of working in teams with their co-workers and leaders.”

Edward Spear is a perfect example. He is one of the unsung heroes working behind the scenes to put John Glenn into space. He’s also the grandfather of MeriTalk reporter Morgan Lynch, who shared his story with The Situation Report.

Edward Spear at NASA, circa 1980. Spear passed away in 2016. (Photo: Morgan Lynch)

It was the night before NASA would launch the first American into orbit, and the engineer who was tasked with coding the computer chips that programmed the launch wasn’t finished. The 31-year-old, Edward Spear, had returned from serving as an engineer for the U.S. Army in Korea 10 years before and now he was serving his country again at NASA.

A couple of hours before the morning’s launch on Feb. 20, 1962, Spear was satisfied with his work. He rushed the computer chips over to the launch site, only a couple of buildings away in Cape Canaveral, Fla. He returned to his desk, leaned back and tried to fall asleep, so tired that he didn’t mind missing the historic launch. Minutes later, a friend shook him awake and dragged him to the roof of the audience building to watch the rocket take off. Spear wasn’t nervous. The launch would be successful because he and his team had done their jobs well.

“He totally geeked out on the idea of working at NASA,” said Lynch. “He had a tie with rockets and satellites on it. He thought working at NASA was the coolest job in the world. And he probably thought that getting a job at NASA was the equivalent of ‘making it.’ ”

Is cybersecurity more difficult than putting John Glenn into space and getting him home safely? Is cybersecurity more technologically challenging than controlling a spacecraft, its code, and its sensitive instrumentation from 2 billion miles away? Is cybersecurity so overwhelmingly difficult that only private sector innovators are capable of succeeding? What is it about the culture of Silicon Valley today that makes it superior to the workforce culture that produced some of mankind’s greatest technological achievements?

The answer is nothing. The private sector’s innovation superiority is a myth. NASA is proof of that. The government doesn’t need techies who view service as a sacrifice to be endured for a couple of years. What really makes NASA different is the commitment of a workforce to a lifelong mission that is measured not in stock options, but in meaningful achievement.

Those people still exist.

Look Who’s MeriTalking: Cameron Chehreh on Modernization and Data Centers

MeriTalk sat down with Cameron Chehreh, chief technology officer at Dell EMC Federal, at the MeriTalk Data Center Brainstorm to discuss how Federal IT modernization efforts will affect agency data centers and operations.

MeriTalk: How critical are the recent government IT modernization efforts to data center modernization and optimization?

Cameron Chehreh: They are completely interlinked–very critical. The government is at a pivotal point. We are spending a tremendous amount of the budget on legacy IT and what people call commodity IT, or what I call mission IT. At the end of the day, IT must support the mission. Because of the current budget strain, it’s vital that modernization happens now, and there is great opportunity due to new innovation. This isn’t just about implementing new technology–it’s also about reducing our facilities’ environmental footprint, reducing costs, and creating agility for the workforce. And, we’re fundamentally changing the IT procurement business model. Agencies can now acquire technology leveraging “as-a-service” models with operating funds versus capital funds. They can “pay by the drink” and ensure they only buy what they need to meet their mission objectives. The recent modernization efforts are critical to data center modernization and optimization.

MT: If legislation like Rep. Will Hurd’s, R-Texas, Modernizing Government Technology Act is reintroduced and passed, what does that mean for agencies? And what kinds of preparations will agencies need to do to access those funds?

CC: I would advocate for the Act, as it would give agency leaders access to the capital necessary to modernize. But, when you talk to a lot of agency leaders and people who have been in government for a long time, it’s important to understand many also have the opportunity to use working capital funds at an agency level. Congress could help agencies by giving them more flexibility in how they spend these funds. If an IT director wants to spend on, let’s say, a converged piece of infrastructure versus something else and it’s within the budgetary constraints, they should be afforded the opportunity to and empowered to make that choice.

MT: Without a legally mandated modernization fund, how much harder would it be for agencies to get these data centers optimized?

CC: Many agencies have done an excellent job, even without the fund, beginning modernization efforts. I think if we can build the proper agreement, and the right management structure, a governmentwide IT modernization fund will significantly help agencies accelerate transformation so they can reach their goals.

MT: In your experience, what are Federal agencies saying that they need the most?

CC: The first piece, I think, is about technology education. Industry partners can play an important role here, proactively educating customers on the options to meet the mission. The second piece is access to modern skill sets. We have a very interesting, dynamic workforce today. We have a young generation that’s coming into the workforce with brilliant ideas, and new expectations about how technology works. We have to be able to foster an integrated ability to take advantage of the infusion of these news ideas, against the security backdrop that our experienced workforce understands and prioritizes. So those modern skill sets are really, really vital.

The last piece requires that we take another look at a lot of the business and IT processes that support mission enablement. IT has to be highly responsive as a service provider. Many IT teams today aren’t structured to be service providers and respond effectively to requirements that depend upon that agility. As Federal IT departments pivot to be able to meet these new goals, the shared services model will grow and prove itself with the mission stakeholders.

MT: As a member of the private sector, what are you doing to help prepare and partner with government agencies to achieve this modernization?

CC: There are several things we’ve been doing at Dell EMC. First, we have significantly expanded our technology portfolio through the acquisition of EMC. We’re all living in a digital economy. Companies like Uber, Snapchat, and Airbnb are disrupting entire industries. When you recognize this, the ability to be able to transform yourself is vital. We passionately believe that at Dell EMC, so that’s one aspect.

The other aspect is that we’ve innovated and transformed our business model. Customers can still buy individual, discrete products or capabilities from us, but we’ve also moved in a bold new direction to deliver solutions and as-a-service offerings. Customers can acquire more complete offerings that they can simply and rapidly deploy, accelerating time and value. We are working side by side with our customers as they modernize and move forward.

The Weekend Reader–April 14

Industry Insider: What’s Happening in IT

MeriTalk compiles a weekly roundup of contracts and other industry activity. Stay up to date on everything that’s happening in the Federal Information Technology community. MeriTalk.com keeps you informed about the topics that mean the most to you and creates a targeted platform for cooperation, public-private dialogue, highlighting innovation, and sharing informed opinions. This week: News from CenturyLink, Level 3 Communications, Hilton Software, and more.

Global Cyber Norms Insufficient to Prevent Future Election Hacks

As the State Department works to gain international support for its cybersecurity framework, experts said that global norms and deterrence won’t be enough to convince state actors not to influence elections through cyber means in the future.

OMB Issues Agency Reform Plan Based on March Executive Order

The Office of Management and Budget unveiled its plan to reorganize Federal agencies, called the “Comprehensive Plan for Reforming the Federal Government and Reducing the Federal Civilian Workforce,” which responds to President Trump’s March 13 executive order to OMB. The plan requires agencies to take immediate action on reducing their workforce and saving money, and submit a long term plan for maximizing worker performance by the end of June. Agencies will also be required to submit an Agency Reform Plan within 180 days to modernize and streamline operations.

New Leadership Coming to VA-DoD Interoperability Office

John Short, the program executive for the VistA Evolution program at the Department of Veterans Affairs, has been tapped to take over as the acting deputy director of the DOD/VA Interagency Program Office responsible for ensuring electronic health record sharing between the VA and the Pentagon.

Geospatial-Intelligence Agency to Work With 18F to Lure Tech Talent

The National Geospatial-Intelligence Agency needs to attract new tech talent with new ideas and a desire to work on something bigger and more important than the next popular dating app. One of the ways the agency hopes to do that is by continuing to work with the government’s own in-house innovation shop, 18F.

Rethinking Shared Services in Government

The problems associated with an antiquated government infrastructure replete with duplication and redundancies of mission and support services have been well documented. A 2011 Government Accountability Office report discussed the operation of 661 information technology investments in human resources management alone. More recently, at my request as a staffer on the Oversight and Government Reform Committee, GAO surveyed the sorry state of Federal IT and recounted how, among many other examples, portions of our nuclear alert system were running upon an IBM Series 1 mainframe.

Federal agencies rely on decades-old, obsolete technologies to support critical mission programs, essential functions, and daily operations. Collectively, GAO reports that agencies are spending on average three-fourths of their operations and maintenance budgets keeping these legacy systems functional; some agencies are spending more than 90 percent. Costs are going through the roof; after all, where can you find qualified COBOL programmers anymore?

Agencies are reluctant to cede control over these services, even as cyber thefts of government and citizen data happen on a more frequent basis. Even where agencies do modernize, the issues with a cumbersome acquisition system and the lack of capable IT staff create unacceptable risks for CIO’s seeking to maintain critical business functions. IT Modernization has become a critical path for agencies seeking to improve their services to citizens, enhance government operations, and strengthen cybersecurity.

Many are of the view that government adoption of shared services is one answer to this problem. By consolidating common agency requirements under one roof, the thinking goes, and making those services available to other agencies to share the expense, government can focus more on mission IT and save money.

But how best to operationalize such a shared services vision? There are many challenges with this vision. One is the issue of scale. Government is an immense organization. Current shared services infrastructure cannot possibly meet the demand.

And what about competition and evolving IT? Shared services could result in “government monopolies” based upon a single platform vendor, with attendant data lock-in and lack of transparency. Locking agencies into existing technologies without a competitive process will ensure that agencies get obsolete-out-of-the-box solutions with uncompetitive pricing.

Because of these issues, the current hesitation with adopting shared services is completely understandable. In part, that hesitancy is well grounded, because it is based upon the poor results that shared services have achieved to date.

For example, how can agencies ensure they are getting competitively priced services from another government agency? In the absence of competition, and absent a common cost taxonomy across government for charge back purposes, how much should agencies be charged?

Existing shared services providers have had great difficulty highlighting savings successes due to limited cost data transparency and the absence of standardized performance benchmarks. In 2014, the Office of Management and Budget established shared services as a cross-agency priority (CAP) goal to address some of these concerns. The OMB enterprisewide shared services strategy includes such considerations as improving mission-support operations, strategic sourcing, smarter information technology delivery, and customer service.

What we need is a working and pragmatic shared services model with cost transparency and scalability. Government needs to step back from the old vision of large government owned data centers offering cookie-cutter, end-to-end monolithic shared services, such as financial management or ERP. This is a workable vision of shared service because such an approach will rarely map completely against the structure and culture of individual agencies, which often balk at having to adopt a sub-optimized solution. The private sector has already moved past this model to a more horizontal view of shared “micro-services”- called “Everything-as-a-Service” or XaaS.

Because many government IT systems running back-, mid-, and front-office processes have become hamstrung by accumulated technical debt and dependencies, a “leapfrog” strategy would allow widespread adoption of modular mini “app-like” XaaS offerings. This approach would allow agencies to reorient common business capabilities as a suite of micro-services that are chosen and tailored by each individual agency into broader, more customized agency service offerings.

Micro services would encompass more granular common IT building blocks, such as identity management, agile development, help desk, or IT asset management. Acquisition could occur using a governmentwide service catalogue, perhaps as part of the GSA Schedule.

Any agency with a specific expertise–for example, OPM for human resources; Treasury for Financial management; or VA for healthcare–could host “suites” of micro-XaaS service offerings tailored to their specific domains and using their existing resources. Agencies could choose which specific “app-like” micro-service offerings to build their own tailored “100% IT solution” using simple standardized interagency service-level agreements.

Agencies could charge for these XaaS micro-offerings using the Economy Act as a “fee for service” model, or else through interagency memorandums of understanding. XaaS would require broader adoption of open API’s, thereby expediting the goals of transparency and data sharing required by the DATA Act.

With a few technical upgrades and strategically deployed APIs, the customer service module in an agency’s ERP system that is used exclusively to support external customers could now be leveraged by other departments, as well as by IT for help-desk queries, HR for internal customers, and coordination for vendor support.

Micro-service based XaaS casts IT modernization in an entirely new light. What was primarily a technical process of IT Modernization could be transformed into a broader operational and business process “reform effort”–designed to create greater efficiencies and to engage citizen and agency employees in far more productive ways.

The Transformation Agenda: More Modern, More Secure

The June 2015 breach of the Office of Personnel Management’s (OPM) employee records demonstrated a real vulnerability in Federal IT. With legacy systems dominating the Federal landscape, securing sensitive government data has become very nearly impossible. Fortunately, Congress and the Trump Administration seem to be coalescing around a straightforward crisis response plan: IT systems modernization.

Last year’s stalled $3.1 billion revolving capital fund for IT modernization is once again on the radar, as Rep. Will Hurd, R-Texas, and Gerry Connolly, D-Virginia, plan to re-introduce the Modernizing Government Technology (MGT) Act. According to Hurd, there’s “widespread support” for the measure. In addition, early drafts of President Trump’s planned cybersecurity executive order show that the administration clearly views IT modernization and data center consolidation across the government as keys to improving cybersecurity.

Combine these trends with the new authorities granted to Federal CIOs under the Federal Information Technology Acquisition Reform Act (FITARA), and what you get is real opportunity for progress.

Modernizing the data center is critical to ensuring Federal agencies are prepared to handle new and emerging threats. The Software Defined Data Center (SDDC) is a good example. The SDDC gives agencies more direct control over data security by compartmentalizing the environment, so that a breach of one data group doesn’t necessarily mean a breach of all data groups.

And, the SDDC comes with security components built into the infrastructure, eliminating the IT cybersecurity operations silo and increasing visibility.

Reducing data center complexity also makes it easier to develop a strong Data Loss Prevention (DLP) strategy. A DLP strategy provides agencies with the tools they need to safeguard their data by detecting and blocking potential data leaks. It identifies where important data is stored to protect the data from threats, and ensures users are not sending sensitive information that could jeopardize the network.

As Feds optimize and modernize, new computing models and resources will be key – converged infrastructure, flash storage, hybrid cloud, and more.

Learn more about the Modern Data Center: https://www.emc.com/collateral/white-papers/emc-modern-data-center-whitepaper.pdf.

Modernizing to improve security is one thing Washington can agree on today. Let’s take the steps we need to move forward.

By: Steve Harris, Senior Vice President and General Manager, Dell EMC Federal

The Weekend Reader–April 7

Industry Insider: What’s Happening in IT

Federal Government Needs New Approach to Hiring Cyber Talent

The government needs to create and fund new hiring programs to fill Federal cyber vacancies, according to experts testifying before the House IT Subcommittee on Tuesday. During the hearing, IT subcommittee chairman Will Hurd, R-Texas, floated the idea of creating a Cyber National Guard that would pull workers from the private sector for short stints of work in the government.

Trump’s Border Wall Probably Won’t Be One Long Barrier, DHS Secretary Says

President Donald Trump ran his campaign on the promise of a wall that would run the length of the U.S.-Mexico border. While Secretary of Homeland Security John Kelly still does not know what the wall will look like, he said it will probably not resemble the single concrete partition the president discussed.

States, Broadband Providers React to Congress’ Rollback of Internet Privacy Rules

The House and Senate voted last week to repeal regulations adopted in October by the Federal Communications Commission under former President Barack Obama requiring Internet service providers to do more to protect customers’ privacy. When the FCC changed leadership during the start of the Trump administration, the agency began to cut back on Internet privacy rules, saying that broadband providers don’t need to be held to a higher standard than other online venues when it comes to consumer privacy.

Federal Standards May Obstruct Cyber Threat Info-sharing

Agencies at the state and local level need to adopt cybersecurity practices that cater to their individual needs, according to many of the experts who testified at a Senate hearing. Patricia Hoffman, acting assistant secretary of DOE’s Office of Electricity Delivery and Energy Reliability, stated that the agency does not have a single model for cybersecurity regulations, but rather recommends certain components that could contribute to a successful cyber strategy.

The Situation Report: Is the CIO Job at VA About to Lose Its Influence?

It is a truly stunning detail overlooked by most observers during the confirmation process of David Shulkin to become secretary of Veterans Affairs. The VA is going to hire a chief health informatics officer (CHIO) to lead the agency’s electronic health record strategy.

According to VA documents provided to the Senate Committee on Veterans Affairs, Shulkin’s VA is doing something truly revolutionary: Rather than rely solely on another industry CIO hotshot or a Silicon Valley parachutist, the agency is recruiting a CHIO “with extensive commercial EHR experience to help VHA craft an informed EHR strategy.”

CHIOs are often physicians, nurses with extensive IT training and experience, or longtime health industry professionals with specialized training.

All of the attention right now is on Shulkin’s planned July 1 decision on whether to replace VA’s decades-old EHR platform known as the Veterans Health Information Systems Technology Architecture, or VistA, with a commercial system. But bringing in a CHIO signals a significant shift of approach at VA, which has historically relied upon either technology policy expertise (career civil servant Stephen Warren) or technology industry expertise (former Johnson & Johnson CIO LaVerne Council) to help guide its technology decisions.

But under Shulkin—a board-certified physician who has held chief executive positions at major medical centers around the country—the biggest technology decision facing VA and its implementation will be guided not by a technology policy wonk or an industry technophile, but by a practicing physician, nurse, or IT professional with specialized health care training.

This is the result of a long-overdue acknowledgement that reforming the massive VA health care technology infrastructure cannot be accomplished through the traditional CIO office. VA’s CIO office has its hands full spending 90 percent of its budget on legacy system maintenance (compared to 60 percent in the private sector). The idea of hiring a senior CHIO to lead strategic agencywide technology decisions is a clear message from Shulkin that technology and program management expertise alone cannot solve VA’s most pressing IT problems.

A relatively new concept, the CHIO post is not unheard of in government. Karen DeSalvo, former National Coordinator for Health IT at the Department of Health and Human Services, created a new CHIO post in 2015. And the position is by no means new to VA—there are dozens of CHIOs employed at regional and local VA medical centers. And many of them are physicians.

What qualifications must a CHIO have?

Well, this isn’t your standard CxO role. VA hiring documents call for the following:

Fully licensed physician or nurse informatics executive, or an individual with a master’s degree or higher in a health care-related field or health care administration relevant to this role.

Nurse applicants must have a master’s degree or higher in a health care-related field or health care administration relevant to this role.

Degree, certification, fellowship or other formal training/academic courses in health informatics preferred.

Leadership experience in health care.

Ability to understand and bridge information technology and health care disciplines.

What does a CHIO at the VA do?

Although the job description is quite lengthy, there are two particular sections that clearly set the CHIO apart from the traditional agency CIO.

Manage complex issues and oversee programs to identify trends in clinical practice, delivery models/environments, and their interrelation with electronic health records, bar code technology, emerging health technologies, health information exchange, and health information standards programs internal and external to VHA. Devise methods and tools to monitor, on an ongoing basis, trends in clinical practice and health informatics. Determine knowledge acquisition and management requirements and provide subject matter expertise in the design and application of automated methods and tools to enhance clinical practice, veterans’ use of health technology and health data exchange.

Use clinical expertise and current knowledge of clinical aspects of health care delivery to evaluate the clinical significance and quality of information that is processed (captured, transmitted, and stored) by advanced technology systems. Evaluate outcomes of electronic health record utilization and health information exchange that impact changes in nursing/medical/clinical practice for various patient groups/populations.

Shulkin may be on to something here. Imagine—asking a a health care professional with technology chops to guide technology strategy for improving health care for veterans. If the VA had done this years ago, it might not be facing the monumental technology challenges that continue to stand in the way of real progress.

The Road to 2018: Modern, Efficient Federal Data Centers

Earlier this year, the House of Representatives unanimously passed the Energy Efficient Government Technology Act (HR 306), which requires agencies to deploy energy-efficient technology in their data centers. Under the bill, every agency must use advanced power management tools – building information modeling, energy-efficient data center strategies, and more to reduce the data center footprint.

This new Act, if passed in the Senate, will help reinforce the established Data Center Optimization Initiative (DCOI), which, among other things, requires agencies to improve power usage effectiveness in data centers by 2018.

This reinforcement could not have come at a better time. At MeriTalk’s Data Center Brainstorm in late March, Dave Powner, Director of IT Issues, GAO, said only 120 of the 4,600 agency owned and operated data centers currently have power usage monitoring technology installed. You can’t manage what you don’t measure.

To meet the 2018 DCOI targets for energy efficiency, server utilization, and other key metrics, agencies will need to make significant changes. What’s needed?

The first building block is converged infrastructure, which combines multiple data center components into a single, optimized package – reducing floor space, energy costs, numbers of servers, and more.

The second building block is a hybrid-cloud environment, with both on and off-premise workloads. After moving data points out of a physical center and into the cloud, the need for physical equipment diminishes. As the ratio of operating systems to physical servers increases, overall energy usage and rack count decreases.

The third building block is flash-based storage. Flash memory allows agencies to access their data quickly and consistently – with fewer numbers of drives than ever before. Fewer drives means less floor space, reduced energy costs cooling requirements, and improved server utilization.

All of these technology building blocks deliver significant, measurable savings – improvements in PUE, virtualization, server and facility utilization, and more – and will support Federal efforts to meet the mandated 2018 goals for Federal data centers.

Learn more about the Modern Data Center: https://www.emc.com/collateral/white-papers/emc-modern-data-center-whitepaper.pdf.

By: Cameron Chehreh, Chief Operating Officer, Chief Technology Officer & VP, Dell EMC Federal

The Weekend Reader–March 31

Industry Insider: What’s Happening in IT

MeriTalk compiles a weekly roundup of contracts and other industry activity. Stay up to date on everything that’s happening in the Federal Information Technology community. MeriTalk.com keeps you informed about the topics that mean the most to you and creates a targeted platform for cooperation, public-private dialogue, highlighting innovation, and sharing informed opinions. This week: News from Environmental Alternatives, DHS S&T, U.S. Naval Surface Warfare Center, and more.

Is FITARA Failing? Federal CIOs Still Say They Don’t Have Authority Over IT Acquisitions

More than two years after Congress passed the Federal Information Technology Acquisition Reform Act—the biggest overhaul of Federal IT acquisition in decades—most Federal chief information officers say they still don’t have the authority necessary to manage technology throughout their agencies.

FCC Changes IT Priorities Along With New Administration

The IT team at the Federal Communications Commission has been working to re-prioritize its projects to align with the goals of the agency’s new leadership, which has forced officials to make tough decisions about modernization. David Bray, the chief information officer at the FCC, and his team presented the projects that they are working on to Chairman Ajit Pai earlier this month to get his opinion on where the team should focus its efforts. Pai wants the IT team to focus on the development and back-end technology for the FCC’s actions including Mobility Fund Phase II and Connect America Fund Phase II, which serve to bring broadband to underserved areas.

Agencies Urged to Start Bug Bounty Programs

After the huge success of the Hack the Pentagon bug bounty program, members of the Department of Defense and participating organizations are calling on other government agencies to copy the DoD program to improve cybersecurity.

Trump’s Regulation Limit Hits Transportation Department Head-On

The Department of Transportation is holding off on creating new rules for automated vehicles and unmanned aerial systems because of President Donald Trump’s limit on new regulations, according to DOT officials. DOT has worked on a proposed rulemaking that would require cars to include vehicle to vehicle (V2V) communications, which would allow cars to talk to one another and avoid collisions.

The Situation Report: James Comey’s Cyber Strategy Ushering In Big Changes for Bureau

The organizational changes flowing around in James Comey’s head aren’t new or revolutionary. But they are for the FBI, and they could fundamentally alter what it means to be an FBI agent.

The changes are in line with experiments already underway at the Defense Department and the NSA—encouraging agents to spend time working in the private sector, bringing in private sector experts to perform tours of duty inside the bureau, and potentially building an internal university to develop the future cyber talent the FBI needs now and in the future.

“Should we make the barrier between us and the private sector semi-permeable?” Comey pondered during a keynote presentation Wednesday night at the Intelligence and National Security Alliance’s Leadership Dinner. “Our minds are open to all of these things.”

INSA Leadership Dinner with FBI Director James B. Comey Jr. on March 29, 2017.

With six years left in his tenure as FBI director, Comey has already kick-started a transformation effort that firmly embraces the digital changes swirling through the ranks of what is arguably one of the government’s most insular cultures. First and foremost among those transformation efforts is the way in which the bureau assigns cases. The modern digital age has completely obliterated the traditional concept of assigning cases to the nearest FBI field office. The physical manifestation of a crime or terrorist event “isn’t all that meaningful” in the age of the Internet and nation-state sponsored cyber espionage.

“We now assign computer intrusion work, whether that’s a nation-state, whether it involves a criminal syndicate, whether it involves a criminal syndicate working for a nation-state, whether it involves hacktivists or somebody else—sort of the motley crew of people engaged in intrusions—we assign it based on talent,” Comey said.

But the FBI “is not blind to physical manifestation” when it comes to criminal investigations, said Comey. Although the bureau assigns the threat to the appropriate talent, up to four other field offices are often enlisted to play supporting roles. One such office is known as a Strat office (for strategic) and the other type of office is referred to as a Tac office (for tactical).

“And then we [conduct] air traffic control from Washington,” Comey said. “This has had a great effect inside the FBI because it has fostered an intense competition among field offices to generate and demonstrate the talent against various dimensions of the threat.”

From a recruiting standpoint, the bureau may also need to open its mind to FBI agents who don’t carry weapons. Comey acknowledged the challenges the bureau faces when it searches the cyber talent pool for individuals who not only present specialized technical talent but must also be physically fit enough to “run, fight, and shoot” and be a person of high integrity.

“That collection of attributes is rare in nature,” Comey said.

“So we stare at the pool of talent and we have two reactions to the pool. We can’t compete on money. You in the private sector have more money. We acknowledge that to the people we are trying to recruit. But then we also make sure that they understand life with you is soulless and empty,” he said, to lots of laughter.

Kidding aside, Comey did raise some serious questions about what the future FBI agent might look like. “Do we really need gun-carrying agents making up an entire squad?” he asked. “Now we have squads of eight around the country. Should we instead have two special agents and six something elses?”

The Situation Report: When a Social Media Scandal Isn’t About Social Media

My Marine Corps has a problem. And it isn’t about social media, how long it will take male Marines to accept women in the ranks, or how Marines “treat each other” off the battlefield.

No, the recent scandal involving the Facebook group Marines United–a secretive, invitation-only group of current and former Marines that has shared compromising photos of female Marines without their permission—is a symptom of deep cultural bias that has always directly targeted women and has been enhanced by the rise of social media.

This is why the response of the Commandant of the Marine Corps, Gen. Robert Neller, has been so disappointing. By constantly referencing “fellow Marines” and “social media policy” instead of extreme bias against women, he deflects from the real issue.

“I mean, c’mon guys. They just want to do their job. Let them do their job,” Neller said during a Pentagon press briefing when the scandal first broke.

Today, the Commandant of the Marine Corps addressed recent allegations of cyber misconduct, and how it hurts the team. pic.twitter.com/AQifcMeUtG

— U.S. Marines (@USMC) March 11, 2017

Shortly after Neller’s appearance at the Pentagon, the Marine Corps referred to the problem as “cyber misconduct”—another clear attempt to deflect from the real, much more difficult problem of violence against women.

The deflections continued, reaching as far as the House Armed Services Committee on March 21 when the Military Personnel Subcommittee held a hearing on the “Social Media Policies of the Military Services.” For a few minutes, it appeared as if the deflection had worked. The media seating area in the committee hearing room was virtually empty. Military.com reporter Hope Hodge Seck captured the scene in a tweet from the hearing.

Press section at hearing on social media in wake of Marines United scandal. How soon they lose interest @bkesling pic.twitter.com/lCqjzCupto

— Hope Hodge Seck (@HopeSeck) March 21, 2017

But one lawmaker saw through the ruse. Rep. Jackie Speier, D-Calif., blasted the committee during her opening remarks for not tackling the real issues at stake.

“I have to say, I’m very disappointed in the topic of this hearing,” Speier said. “Framing the issue as military social media policies frankly misses the point. No one has ever gone on Facebook, looked at nonconsensually posted intimate photos, typed a rape threat, and then stopped and said, ‘Oh, I better not make rape threats! That’s against the military’s social media policy.’ ”

I asked James LaPorta, a fellow Marine and one of the journalists who helped uncover the activities of the Marines United Facebook page, what he thought about the constant deflections and what I see as an unwillingness to address the issue of violence and bias against women. His thoughtful response raises even deeper questions about the root causes of the problem now infecting the entire military.

“Social media policy is only one step to addressing this problem and let’s be realistic, this issue of exploiting women online will not completely be eradicated,” LaPorta said. “I think this issue stems mainly from decades of military culture, alienation between genders that’s more than just the debate of women in combat, but even how the different genders are tested and promoted.”

As LaPorta rightfully points out, there are a lot of issues that feed the root causes of the sexism that reared its ugly head in the form of Marines United. It is up to senior military leaders to now confront the problem head-on without deflecting the public’s attention away from the cancer that is violence and bias against women.

“I’m not sure the problem can be solved,” LaPorta acknowledged. “I hope that it could. The only thing I know is that somewhere along the way, members who engaged in the exploitation of women lost their sense of decency. Perhaps that’s a failure of leadership, a failure of institution or family, but at some point it’s the individual that needs to be held accountable.”

The latest public relations effort on Twitter by the Marine Corps involves a speech by Sergeant Major Brad Kasal that focuses on the rightful place in history earned by generations of Marines—male and female—and reinforces the ethos that stands like a steel rod behind the words Semper Fidelis.

“Can you trust your fellow Marines, and will they be there for you? That is all that matters.” — Sgt. Maj. Brad Kasal pic.twitter.com/SDmyR4kNBY

— U.S. Marines (@USMC) March 23, 2017

But let’s be honest. As much as the Marines United scandal isn’t about social media or cyber misconduct, it also has never been about the performance and faithfulness of Marines on the battlefield. It’s time to stop deflecting our attention away from the real problem.

The Weekend Reader–March 24

Industry Insider: What’s Happening in IT

Data Center Consolidation Deadline May Be Extended–But for How Long?

The deadline for Federal agencies to close all of their data centers by 2018 will probably be extended for an unspecified amount of time, according to Dave Powner, director of IT issues at the Government Accountability Office. The Federal Information Technology Acquisition Reform Act requires agencies to close their data centers by 2018. The most recent FITARA scorecard, released Dec. 6, indicates that the consolidation process is moving slowly. Twelve of the 24 graded agencies received a C or worse in the data center consolidation category.

Almost Human: IBM is Making Super-Secure, Cognitive Cloud a Reality

Big Blue is on a roll. The company on Monday announced a new data center in China, upping its cloud footprint to 51 data centers in 20 countries and signaling a continued enterprisewide push to make cloud computing a central component of its business moving forward.

House Has Qualms About FBI’s Facial Recognition Database

The FBI has been using facial recognition technology since 2010. Its Next Generation Identification-Interstate Photo System contains millions of photos of Americans, which FBI officers use during criminal investigations. The Government Accountability Office found that the database, which cost $1.2 billion to create, correctly returns matches 86 percent of the time. The National Institute of Standards and Technology requires facial recognition returns to be correct 85 percent of the time.

Data Analytics Can Rectify Soaring Fraudulent Payment Rate in Federal Agencies

Federal agencies are hemorrhaging billions of dollars every year due to fraud, waste, and improper payments, according to the Government Accountability Office. And the problem may be getting worse, with the governmentwide improper payment rate reaching $144 billion in fiscal year 2016. To put those percentages in perspective, GAO found that $44 billion of Federal improper payments in FY 2016 were caused by insufficient documentation. Another $34 billion were the result of the inability to authenticate eligibility, meaning an improper payment was made because agencies lacked databases or other resources to help determine someone’s eligibility status.

Look Who’s MeriTalking: Fighting Fraud, Waste, and Abuse With Big Data

MeriTalk recently spoke with Alan Ford, director of Teradata Government Systems. He delved into fraud, waste, and abuse in the government–why it happens and how big data and machine learning can play a role in stopping this $300 billion-a-year problem.

MeriTalk: Why do we see fraud, waste, and abuse continue to rise–especially related to Medicare and Medicaid–when reducing them has been a sustained priority?

Alan Ford: Medicare and Medicaid, specifically, are classified as high-risk programs by the Federal government as they have a greater vulnerability to fraud, waste, and abuse mismanagement. There are a couple of reasons for this. First, traditionally, the penalties in this area have been low relative to other crimes and they are nonviolent crimes, so deterrence is low. Second, the system operates in a pay-first, check-later fashion, making it more susceptible to abuse because barriers to entry are low and the perpetrators are often long gone once the fraud is discovered. Third, Medicare and Medicaid are vital programs, so any changes to make fraud detection easier have to be done without interrupting the delivery of lawful recipients’ services.

Medicare and Medicaid comprise just one area of fraud, waste, and abuse. There are many more similar use cases including Federal student loans, defense contractors, disaster relief requests, and mortgages. Many of the same issues that put Medicare and Medicaid at risk apply to these other areas as well.

MeriTalk: Where has the greatest progress been made in stopping or reducing government fraud, waste, and abuse? Are there specific programs that you can cite as best practices?

AF: The more data that is made available for analysis, the better the chances that agencies can generate adequate levels of information to drive the detection of fraud, waste, and abuse. Data sharing across Federal and state barriers enables new insight into fraudulent activity, which is difficult to achieve when data are kept siloed. Data sharing is a major opportunity for agencies to become more effective.

As an example, the Health Care Fraud Prevention and Enforcement Action Team (HEAT), a joint task force among Health and Human Services (HHS), the Department of Justice (DoJ), and the Office of Inspector General (OIG), was created to share data and information. Since its inception in 2009, it has detected and collected more than $7 billion of fraudulent monies and convicted almost 2,000 different defendants–very effective work.

Another best practice program has originated from the Centers for Medicare & Medicaid Services’ (CMS) Integrated Data Repository (IDR), one of the largest and most successful fraud and health care information repositories in the Federal government. It is based on a high-volume data warehouse, including information such as Medicare beneficiary data, provider data, contract information, and risk scores. The combination of these data sources into one integrated environment empowers organizations such as HEAT to use the data to generate new insight. Teradata has helped CMS run and operate IDR for more than 10 years with extraordinary results.

MeriTalk: What role can and must big data and analytics play in reducing the incidence of fraud, waste, and abuse–including preventing improper payments and determining accurate eligibility for and enrollment in specific Federal programs?

AF: Big data analytics are important because they create so much valuable insight from available data–structured and unstructured. We need analytical techniques that are sophisticated, but easy enough to use so analysts performing investigations can access and combine these different data types.

For example, the Social Security Administration is using disability claim information and looking at medical taxonomies and expected diagnoses to re-create decision-making processes to assist in identifying fraudulent claims. They could benefit from techniques and systems to transform raw, unstructured claim data into meaningful and useful information.

MeriTalk: Much of the focus has been on looking backward to identify instances that have already occurred. What types of technologies are helping agencies to identify and prevent fraud and abuse before it happens?

AF: Agencies need to act predictively rather than reactively. Many organizations are focused on determining what happened in the past and why. Predictive tools are available today that give agencies this ability.

Agencies need to combine today’s predictive analytic technologies with near-real time data ingest to determine what is happening now or is likely to happen in the near future. Tools that allow for individuals to provision new data sets without significant IT intervention and combine unstructured and traditional data are required to move agencies into being predictive, agile, and proactive. Again, the technology exists now.

MeriTalk: How is machine learning factoring into fraud, waste, and abuse identification and prevention initiatives? What’s next for machine learning in this area?

AF: Wherever the capabilities exist to integrate sensor data and Internet of Things (IoT) data for analytical work, there is an opportunity to leverage machine learning as well. Machine learning is great at sifting through enormous data sets and looking for outliers and insight we cannot get elsewhere as quickly or effectively.

For example, we need to apply machine learning to activities like modern aircraft maintenance. A fighter jet may have thousands of sensors collecting data in microsecond intervals resulting in a terabyte or two of data from just one flight. Machine algorithms can sift through huge data sets collected across an entire fleet and flag relevant outliers for a human to investigate. Applying advanced analytics to this data can identify operational trends and circumstances that can predict part and equipment failure before it happens. Engaging in this “condition-based maintenance” can prevent inefficient and wasteful use of repair and inventory resources and head off catastrophic failures before they occur.

MeriTalk: What hurdles remain in achieving real-time identification of suspect transactions or behaviors? How can agencies best address them, especially in this time of doing less with more?

AF: There are three big hurdles. First is reducing the lag between an event and detection of the event. To remove the hurdle, analysts need better, quicker access to important data.

Second is opening the world of advanced analytics to the people who are doing the investigations–fraud analysts. They need access to advanced analytical tools with pre-existing complex algorithms that enable them to plug parameters into them, rather than having to know how to write the algorithms themselves. These tools exist, but agencies have to identify them and get them into the hands of their analysts.

Third is enabling the ability to reach across various data platforms to combine data sets with greater ease. We need solutions that enable users to access and combine data regardless of where they reside and the disparate platforms involved. Again, these tools exist, but agencies need to procure and employ them.

MeriTalk: How are Teradata and its solutions helping Federal agencies attack the fraud, waste, and abuse challenge?

AF: Teradata has been helping government agency customers for more than 20 years with traditional techniques like data warehousing to combine data across multiple subject areas into a single integrated data model, enabling greater insight. We have health care solutions across the Federal and state government, such as CMS and its IDR. Several states use data warehousing tax solutions to identify tax fraud, mistakes in filings, and more. And finally, we support an enterprise data warehouse at the Postal System to help the organization run its operations more efficiently.

We also have leading-edge solutions involving advanced analytics of nontraditional data. For example, USTRANSCOM has a data warehouse that helps with materiel logistics, but also employs advanced analytics for optimizing cargo transport across available transport vehicles in the military. USTRANSCOM uses its system to marry cargo needing transport with partially loaded flights or even empty training missions to reduce the overall number of flights and optimize the efficiency of planned trips.

The Air Force and Navy use advanced Teradata analytics for pre-emptive maintenance in identifying precursor conditions of equipment failures. For example, if sensor data identifies excessive vibration in a turbine, it could indicate an imminent bearing failure. Proactive repair of the vibration or proactive replacement of affected parts helps to prevent a future broader failure.

Today and in the near future, Teradata increasingly plays a major IT and analytics consulting role, leveraging valuable intellectual property and innovative solutions from thousands of customer engagements. The technology landscape has become so complex that few organizations can operate at peak effectiveness without expert consulting guidance.

The Weekend Reader–March 17

Industry Insider: What’s Happening in IT

Trump’s Budget Cuts ‘Low-Value’ Programs, Seeks Tech Results

The proposed budget cuts civilian agency spending by 5 percent and would lead to a drastic reduction in the size of the Federal workforce. But a more telling aspect of the budget blueprint is its focus on accountability and performance. Federal IT programs (and all other programs, for that matter) will need to demonstrate measurable return on their investments if they want the Trump administration to continue funding them.

Russian Intelligence Officers Among 4 Indicted for Yahoo Email Hack

The Department of Justice released an indictment of four men involved in the 2016 hack of Yahoo email accounts, two of whom were acting in their capacity as Russian intelligence and security officers. “The defendants include two officers of the Russian Federal Security Service, an intelligence and law enforcement agency of the Russian Federation, and two criminal hackers with whom they conspired to accomplish these intrusions,” said U.S. acting assistant attorney general Mary McCord.

Trump’s Pick For White House Cyber Post Faces Growing Industry Distrust

President Donald Trump picked a National Security Agency official to lead White House cybersecurity policy issues during a time when NSA surveillance powers are up for discussion and bad blood exists between the NSA and industry. Rob Joyce began serving as the chief of the National Security Agency’s Tailored Access Operations organization in April 2013 and will work for the Trump administration on managing cybersecurity efforts, according to multiple reports.

FAA Airs Concerns About Privacy, Drone Regulation

The Federal Aviation Administration has not established any rules for commercial companies that collect and retain personal information, according to Earl Lawrence, director of the FAA’s Office of Unmanned Aircraft Systems. Several commercial companies have added unmanned aircraft systems, or drones, to their delivery fleets. These devices, furnished with cameras, have the ability to photograph people and their possessions. For example, a drone could photograph the license plates of cars at a health clinic and sell the information to insurance companies.

The Situation Report: Inside Trump’s New Cybersecurity Framework

The Situation Report’s Rhode Island Avenue listening post has picked up strong signals that President Donald Trump’s executive order on cybersecurity may still be weeks, if not months, away from hitting the street in final form.

After leaking two draft versions in rapid succession (the first of which was not even close to being ready for prime time), the White House finds itself struggling to define the metrics it will use to hold agency leaders accountable. After 15 separate reports and 175 detailed recommendations, the metrics that will be used to determine agency adherence to the National Institute of Standards and Technology’s Cybersecurity Framework remain “something that we’ll know when we see them,” according to Thomas Bossert, the assistant to the President for Homeland Security and Counterterrorism.

The building blocks for those metrics will be increased reporting by agency heads on how they are applying the NIST Framework to manage their risk.

“We’re going to go through a thoughtful approach that requires Federal departments and agencies to adopt and implement the cybersecurity framework developed by NIST and any subsequent iteration of that document,” Bossert said, speaking at an event Wednesday sponsored by the Center for Strategic and International Studies in Washington, D.C. “Reporting your known and unmitigated risk will be a requirement moving forward.”

Agencies will be required to submit a report through the Department of Homeland Security and the Office of Management and Budget that will detail their progress leveraging the NIST framework. “The idea there is to collectively render determinations on the adequacy of those mitigation strategies as management tactics, but also then it’s going to have to be done in some way that it [provides] a scorecard,” Bossert said.

But unlike the reports agencies currently generate under the Federal Information Security Management Act (FISMA), the new NIST framework scorecards will “probably not” be made public, according to Bossert. “The idea is to defend our crown jewels from a national security perspective and that will inherently be something that we don’t want to reveal to the public or our enemies.”

Although the metrics do not yet exist, Bossert pointed to the Office of Personnel Management as an example of how Federal cybersecurity will not be handled. “We all now know that an antiquated hardware system and an antiquated database software system holding millions and millions of important records to our national security was a bad approach,” Bossert said. “That was known and unmitigated risk, contemplated through the lens of one agency who had responsibility for their enterprise. It now needs to be looked at through the lens of the security of our nation and it has to be examined in addition to each agency…it has to be examined at a White House level to make sure that we’ve got a collective.”

According to Bossert, DHS will play a central “managed service provider role” as it works with agencies to identify risks, enforce standards, and deploy security protections across the government. And that will mean a greater reliance on private sector contractors and services.

“They’re going to have to reach out and get those resources from private industry and be receptive to that revolving door to some degree,” Bossert said.

“We can’t have resident in 190 or more Federal agencies the same level of zeal, passion, capacity, and capability that we can have in centralized places that provide managed services. I don’t think we would have the right money, the right skill set, and I think it would probably be a mistake for a lot of reasons,” he said. “So with DHS and with OMB helping us assess risk, we will then task back out to the departments and agencies, and we will rely heavily on private industry. I think that’s the only way to get and retain talent.”

Look Who’s MeriTalking: Yogesh Khanna

MeriTalk recently spoke with Yogesh Khanna, chief technology officer at CSRA, to discuss the roles of Federal CIOs and CTOs, the impact of the political landscape, and pivotal IT investments and strategies. CSRA brings together government IT professionals, emerging technologies, and cutting-edge industry advisers to deliver a broad range of innovative, next-generation IT solutions, and professional services.

MeriTalk: Recent years have brought significant expansion to the realm of Federal IT decision-makers. How are you seeing the roles of Federal CIOs and CTOs change? How might these roles continue to evolve or transform in the Trump administration?

Yogesh Khanna: Historically, the CIO’s role has been to focus internally and show that the enterprise has the necessary IT agility, security, and economics to run its business and support its mission. The CTO, on the other hand, has usually focused on bringing the most compelling technologies and innovations to clients. I don’t expect to see these distinct roles change under the Trump administration, but based on policies and executive orders, their priorities will most certainly change.

MeriTalk: Consolidation appears to be an important theme in the new administration. The latest draft of the president’s cybersecurity executive order calls for transitioning all Federal agencies to shared services for email, cloud computing, and cybersecurity. Another executive order in the works would direct agency heads to quickly develop plans for reorganizing their agencies with an eye toward privatization and eliminating redundancy through consolidation. What should agencies and their IT leaders be doing today to prepare for this new era?

YK: Consolidation is not new for Federal IT. That said, there are a few steps that IT leaders should take to prepare for future initiatives. First, have an inventory of current assets–hard assets and the software and applications that run on top of that infrastructure. As you pivot from a consolidated environment into cloud or a shared environment, you must have a governance structure, know the security posture of every workload, and determine what makes sense to put in a cloud versus what does not.

Second, develop the right strategy for leveraging the consumption-based market and understand where the market is going and where the competitors are so you can buy the right solution and services at the right cost.

Third, once you decide that you want to buy, focus on performance metrics. You’re essentially going from a CapEx [capital expenditures] model to an OpEx [operating expenses]; for the latter, you must have a solid definition of service and your SLA [service-level agreement].

Finally, create and make a complete catalog of available services visible to internal buyers. The CIO is the focal point that enables people to buy services, but the idea is to push the mechanics of acquisition to the end consumers of those services.

MeriTalk: Speed and agility are also administration priorities. What IT investments and strategies should agencies embrace to boost both capabilities?

YK: Go with cloud, but ensure you have the mechanisms to exit a specific cloud, as well. That’s the only way you’re able to take advantage of the rates available from multiple cloud environments. Having the exit strategy up front results in greater agility.

MeriTalk: What are your predictions for the Modernizing Government Technology Act? (What changes might be made upon reintroduction to address the Congressional Budget Office score awarded in December? What do you predict for timing of the signed act?)

YK: Since last year we’ve been working closely with Rep. Will Hurd, R-Texas, Rep. Gerry Connolly, D-Va., and other key leaders in this space to support the Modernizing Government Technology Act and we have big hopes that this will be the Congress that passes it into law. The Federal government is sitting on a lot of legacy–legacy of infrastructure, platforms, networks, and application services that run on top of old infrastructure. The reality is that it costs taxpayers dearly to maintain something that is not very well supported by the vendor community.

CSRA strongly supports the Modernizing Government Technology Act, as does the industry at large. This act is good for the government and for the taxpayer as it is the fiscally responsible thing to do.

MeriTalk: What is the single best investment that an agency can make today to jump-start the creation of a future-ready infrastructure?

YK: To me, a future-ready infrastructure is something that is highly virtualized, automated, and secure and can scale up or down to meet the varying requirements of a particular agency. These key attributes fundamentally equate to cloud.

Our guidance to our clients to be able to effectively deliver the right services to their stakeholders (whether internal or external) is to consider the flexibility and agility they need, while keeping in mind that their longer-term requirements might be unknown. Going with cloud is the best single investment an agency can make to ensure it is future-ready.

MeriTalk: What are you advising Federal agency IT leaders in terms of strategies for success and how is CSRA positioned to help them succeed?

YK: The evolving IT landscape will present a lot of options to our clients. We believe there is a power of choice that our clients must retain. There is a very healthy marketplace that has emerged and services are becoming less differentiated because they’ve gone the path of commoditization. Because of that competition, services are constantly being improved–becoming more secure and stable, and less expensive.

Our role as a systems integrator is to deliver the power of that choice and allow agencies to consume the best performance at the best price with a hybrid IT environment, leveraging multiple providers and benefiting from the healthy competition and innovation. We can give them that flexibility while also affording them the ability to have a single view of their entire enterprise where workloads may be running in multiple IT environments or clouds, including their own private environment that sits behind their firewall.

MeriTalk: I understand that last fall CSRA launched a new Integrated Technology Center. What is the role of the center and what unique advantages does it deliver to Federal agencies and their IT leadership?

YK: We built an integrated technology center in Bossier [City], La., that is part data center, part service center, and part development center. The data center can host a set of services, servers, and platforms that can serve as the underlying infrastructure for us to deliver shared services to many of our clients. The service center is where we have our network operations and security operations center–people monitoring our clients’ infrastructure and delivering help desk services. The development center is where we’re leveraging the university ecosystem in the south-central region to bring high-level talent that can develop the next generation of services and applications.

Bringing together these resources in one place enables us to deliver a set of services that are very competitive, highly secure, and are at a price point that is appealing to Federal agencies.

MeriTalk: What would you suggest as required reading for today’s CIOs?

YK: On my reading list is Be the Business by Martha Heller. It is a set of anecdotes from CIOs and CTOs of leading Fortune 500 companies and enterprises that highlight the need for leaders to understand technology and business, as well as have financial and legal acumen.

I also plan to read Disrupt You by Jay Samit. The book is about transforming yourself. How do you master your own personal transformation both in life and in business?

The Eightfold Path to Data Analytics Enlightenment

The Buddhist Eightfold Path offers eight guides to achieve spiritual enlightenment and cease suffering. With due respect to Buddhism, I offer eight paths to reach an enhanced, enlightened state for your data analytics efforts–a state that eases suffering, and provides deeper, more impactful experiences, both today, and with ever-increasing data volumes.

We hear a great deal about big data and the exponential growth in data resulting from social media, email, Twitter, machine logs, and IoT devices. Recent estimates from IBM state that 90 percent of the data in existence today is less than two years old and that we are creating 2.5 quintillion bytes of data per day.

The hard truth is that today’s data analytic systems are struggling just to keep up with their traditional, structured data streams. And they have not yet begun to leverage the exponential growth in semi-structured data.

Legacy issues caused by an overload of traditional batch Extract, Transform, and Load-Data Warehouse-Business Intelligence (ETL-DW-BI) architectures for structured data analytics include:

Slow data loading and data transformation;
Multiple data stages from landing to staging to target, with slow data movement and costly replication;
Heterogeneous and uncooperative database formats;
Long delays in adding and leveraging new data; and
Brittle target data models that support existing reporting, but limit addition of new reports and analytics.

But it is possible to ease this suffering and achieve a higher level of data analytics capability–perhaps even nirvana. Herewith, the Eightfold Path to Data Analytics Enlightenment:

Share the load. Disrupt legacy IT ecosystems with distributed processing frameworks. Reduced costs and performance gains of distributed clusters are undeniable. The intelligence community was an early adopter of distributed processing and an active contributor to the Apache Hadoop ecosystem. Overloaded data ingestion, ETL, and transformation streams are now being improved with distributed Apache Spark solutions at the Defense Intelligence Agency, Centers of Medicare and Medicaid Services, and the Department of Homeland Security.
Jump in the Lake. Exploit emerging Data Lake (NoSQL) architectures in harmony with structured data stores–to land and exploit more data, more quickly. Early euphoria around HDFS and NoSQL stores improperly proposed replacing the data warehouses. The best practice is to complement your data warehouse with Data Lakes. This architecture rapidly lands data that users explore with serverless database query services, using “schema-on-read” tools like AWS Athena, without building metadata. The DHS Neptune Data Framework implements this design pattern to speed time to insight and feed more data stores in classified settings.
Lease Cloud Services. Leverage the growing collection of cloud Platform-as-a-Service (PaaS) offerings in addition to cloud IaaS to jump-start your analytics. Many analytic cloud services are elastic, lowering overall cost when not in use. Services include the core services needed for a traditional ETL-DW-BI solution including managed relational databases, NoSQL repositories, and data warehouses; serverless data preparation and data query; and BI reporting and dashboards. FINRA uses AWS analytic cloud services to ensure the integrity of financial markets and to protect investors. And 17 intelligence agencies use C2S, an AWS cloud platform that provides storage, compute, and elastic analytic services.
Move up the Analytics Value Chain. Extend your reporting and dashboards with predictive analytics to forecast outcomes, embed analytics in decision-making processes, and apply prescriptive analytics to initiate actions for more desirable outcomes. Federal agencies that distribute large benefits have successfully used both predictive and prescriptive analytics to detect and prevent fraud: IRS prevents income tax fraud, CMS detects Medicare insurance fraud, and USDA SNAP reduces food benefit trafficking. All agencies can benefit from these tools for fraud detection, budget forecasting, financial management, safety, risk assessment, compliance, and scientific research.
Provision and Empower Everyone. Invest in self-service data preparation, data analysis, and data visualization tools to reduce the time to insight. The days of large, specialized teams of ETL developers, data modelers, data architects, data scientists, and BI developers are dwindling. Agencies need to provision business analysts, executives, data analysts, researchers, and subject matter experts of all abilities. Users need access to data and tools–according to their abilities and need to know. This pervasive leverage of data resources will result in significant mission impacts. The U.S. Census Center for Applied Technology created such a culture of data exploration and entrepreneurs.
Curate your Data. Adopt data governance policies and data management tools to capture, share, and leverage metadata. Support informal exploration of your Data Lake resources with tools that track lineage and manage access–but do not impose structure because different users may impose a different schema for a different analytical purpose. DHS, law enforcement, and the intelligence community all use rigorous data lineage to ensure data veracity in legal, investigative, and security operations.
Discover Your Data. Supply your team with discovery tools that leverage statistical analysis, artificial intelligence, data visualization, and geospatial display to find patterns and meaning in data. Exploratory analysis by end-users can identify interesting patterns that extend BI reports and dashboards. A new category of automated discovery tools is emerging with the potential to find patterns of value automatically. Extend your ETL-DW-BI platform with these Modern BI tools. FAA, VA, DHS, and U.S. courts all use modern BI tools like Tableau, Microsoft PowerBI, and QlikView to explore and visualize data.
Commit to Open Source. Embrace Open Source tools like Apache Hadoop and Spark that have created disruptive improvements to data analytics. For example, Accumulo provides high-speed access to big data stores. Adopt open source data science algorithms and packages like R and Python, and data platforms. Become active in the open source community; your agency can even launch its own open source project like the NSA did with Accumulo.

These eight paths may improve the data analytics suffering seen in large ETL-DW-BI projects. No project needs to adopt them all to achieve improvements, but the adoption of any path will benefit every project. Each of these eight paths offers opportunities to improve performance, optimize, innovate, and achieve real mission impacts with data analytics.

The Weekend Reader–March 10

Industry Insider: What’s Happening in IT

Messaging App Used at White House Had Critical Vulnerabilities, Report Finds

A cybersecurity firm found critical vulnerabilities in a messaging application used by White House staffers, which could have allowed malicious hackers access to their conversations. IOActive began conducting its investigation into Confide’s vulnerabilities in February and found that hackers could impersonate another user by hijacking an account session or guessing passwords, learn the contact information of all or specific Confide users, become an intermediary in a conversation and decrypt messages, and alter the contents of messages and attachments.

92% of Federal Websites Fail to Meet Standards, ITIF Report Finds

Ninety-two percent of the most popular Federal websites fail to meet standards in either security, speed, mobile friendliness, or accessibility, according to a study released Wednesday by the Information Technology and Innovation Foundation. But industry experts say agencies can do better by moving to the cloud.

WikiLeaks Unlocks Alleged Vault of CIA Hacking Secrets

According to the leaked documents, the CIA has the ability to hack iPhones, Android devices, smart vehicles, and Samsung smart televisions. The agency’s method of hacking smart TVs was developed in tandem with the United Kingdom’s MI5. Labeled “Weeping Angel,” this type of hack can turn on a smart television’s audio system and record someone’s conversation while he or she thinks the machine is off. “Weeping Angel” also suppresses the device’s LED lights to improve the look of the “Fake-Off” mode.

2017–The Year Blockchain Takes on Health Care

Major innovations in blockchain for health data are likely to happen this year with the help of Federal agencies, industry experts say, even though applications for the technology have yet to reach mass markets. A blockchain is a data structure that can be time-stamped and signed using a private key to prevent tampering. It was most popularly used to create the digital currency Bitcoin but is increasingly expanding into other industries.

The Situation Report: Why the CIA Is Not Spying on Your Television

Let’s face it, any leak of classified information that reveals a new electronic surveillance capability of the U.S. intelligence community is almost immediately met with a chorus of weeping angels decrying the evil tendencies of intelligence apparatchiks bent on violating the privacy of average Americans.

As a former intelligence officer, I always chuckle listening to the news reports (I’m listening to one by CNN’s Jake Tapper right now as I type this) warning Americans that the private details of their lives are at risk from the horde of three-letter agencies in and around Washington, D.C. I laugh because of the absurdity of thinking that the CIA or any other agency of the U.S. government has the manpower, time, or interest in spying on you while you watch a movie in your living room.

The other reason I laugh—and this is much more important—is because there is very little thought ever given by mainstream journalists or pundits as to the significance of the devices being targeted. As a former intelligence professional, the first thing I ask is, “what intelligence target would hacking such a device give me access to?” Well, the answer I’m looking for in this case is pretty simple. And no, the CIA doesn’t care what Jake Tapper is watching on television late at night when (on the rare occasion) he’s not actually on TV.

For example, since the news broke that WikiLeaks published thousands of documents detailing the CIA’s hacking arsenal targeting iPhones, driverless cars, and smart TVs, has anybody wondered why the CIA would focus on iPhones and Samsung Smart TVs? Let’s look at where the data leads us.

Smart TV shipments worldwide by region. (Source: Statista.com)

You don’t have to be an intelligence officer to know that China is Apple’s most important market when it comes to iPhone sales. Sure, sales in China recently tanked, but that doesn’t mean our intelligence agencies should ignore the fact that Apple sold nearly 45 million iPhones in China last year. And the rumored major redesign of the iPhone is directed squarely at taking more of the market share in China.

You also don’t need to be the CIA director to know that Samsung dominates the smart TV market, especially in Europe and China. The latest sales figures indicate that smart TV manufacturers shipped more than 11 million smart TVs to China—nearly three times the number sold in the U.S.

News Flash: The United States has a vital national interest in spying on China. They are among our most important potential adversaries on the world stage. I just hope the CIA is working on similar exploits for smartphones manufactured by OPPO, Huawei, and Vivo, and China’s newest smart TV players like Xiaomi, Alibaba, Hisense, and Baidu. Because Chinese politicians and senior Army officers are surely busy disposing of their Samsung TVs right about now.

« Previous 1 … 5 6 7 8 9 … 20 Next »

Cookie	Duration	Description
AWSALBCORS	7 days	Amazon Web Services set this cookie for load balancing.
cookielawinfo-checkbox-advertisement	1 year	Set by the GDPR Cookie Consent plugin, this cookie records the user consent for the cookies in the "Advertisement" category.
cookielawinfo-checkbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
CookieLawInfoConsent	1 year	CookieYes sets this cookie to record the default button state of the corresponding category and the status of CCPA. It works only in coordination with the primary cookie.
JSESSIONID	session	New Relic uses this cookie to store a session identifier so that New Relic can monitor session counts for an application.
PHPSESSID	session	This cookie is native to PHP applications. The cookie stores and identifies a user's unique session ID to manage user sessions on the website. The cookie is a session cookie and will be deleted when all the browser windows are closed.
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
_pxhd	1 year	PerimeterX sets this cookie for server-side bot detection, which helps identify malicious bots on the site.

Cookie	Duration	Description
lidc	1 day	LinkedIn sets the lidc cookie to facilitate data center selection.
li_gc	5 months 27 days	Linkedin set this cookie for storing visitor's consent regarding using cookies for non-essential purposes.
UserMatchHistory	1 month	LinkedIn sets this cookie for LinkedIn Ads ID syncing.
__cf_bm	30 minutes	Cloudflare set the cookie to support Cloudflare Bot Management.

Cookie	Duration	Description
AWSALB	7 days	AWSALB is an application load balancer cookie set by Amazon Web Services to map the session to the target.
_gat	1 minute	Google Universal Analytics sets this cookie to restrain request rate and thus limit data collection on high-traffic sites.

Cookie	Duration	Description
AnalyticsSyncHistory	1 month	Linkedin set this cookie to store information about the time a sync took place with the lms_analytics cookie.
CONSENT	2 years	YouTube sets this cookie via embedded YouTube videos and registers anonymous statistical data.
ln_or	1 day	Linkedin sets this cookie to registers statistical data on users' behaviour on the website for internal analytics.
pardot	past	The pardot cookie is set while the visitor is logged in as a Pardot user. The cookie indicates an active session and is not used for tracking.
UID	1 year 1 month 4 days	Scorecard Research sets this cookie for browser behaviour research.
vuid	1 year 1 month 4 days	Vimeo installs this cookie to collect tracking information by setting a unique ID to embed videos on the website.
_ga	1 year 1 month 4 days	Google Analytics sets this cookie to calculate visitor, session and campaign data and track site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognise unique visitors.
_ga_*	1 year 1 month 4 days	Google Analytics sets this cookie to store and count page views.
_gcl_au	3 months	Google Tag Manager sets the cookie to experiment advertisement efficiency of websites using their services.
_gid	1 day	Google Analytics sets this cookie to store information on how visitors use a website while also creating an analytics report of the website's performance. Some of the collected data includes the number of visitors, their source, and the pages they visit anonymously.
__gads	1 year 24 days	Google sets this cookie under the DoubleClick domain, tracks the number of times users see an advert, measures the campaign's success, and calculates its revenue. This cookie can only be read from the domain they are currently on and will not track any data while they are browsing other sites.

Cookie	Duration	Description
anj	3 months	AppNexus sets the anj cookie that contains data stating whether a cookie ID is synced with partners.
bcookie	1 year	LinkedIn sets this cookie from LinkedIn share buttons and ad tags to recognize browser IDs.
bscookie	1 year	LinkedIn sets this cookie to store performed actions on the website.
GoogleAdServingTest	session	Google sets this cookie to determine what ads have been shown to the website visitor.
IDE	1 year 24 days	Google DoubleClick IDE cookies store information about how the user uses the website to present them with relevant ads according to the user profile.
li_sugr	3 months	LinkedIn sets this cookie to collect user behaviour data to optimise the website and make advertisements on the website more relevant.
muc_ads	1 year 1 month 4 days	Twitter sets this cookie to collect user behaviour and interaction data to optimize the website.
personalization_id	1 year 1 month 4 days	Twitter sets this cookie to integrate and share features for social media and also store information about how the user uses the website, for tracking and targeting.
test_cookie	15 minutes	doubleclick.net sets this cookie to determine if the user's browser supports cookies.
uuid2	3 months	The uuid2 cookie is set by AppNexus and records information that helps differentiate between devices and browsers. This information is used to pick out ads delivered by the platform and assess the ad performance and its attribute payment.
VISITOR_INFO1_LIVE	5 months 27 days	YouTube sets this cookie to measure bandwidth, determining whether the user gets the new or old player interface.
YSC	session	Youtube sets this cookie to track the views of embedded videos on Youtube pages.
yt-remote-connected-devices	never	YouTube sets this cookie to store the user's video preferences using embedded YouTube videos.
yt-remote-device-id	never	YouTube sets this cookie to store the user's video preferences using embedded YouTube videos.
yt.innertube::nextId	never	YouTube sets this cookie to register a unique ID to store data on what videos from YouTube the user has seen.
yt.innertube::requests	never	YouTube sets this cookie to register a unique ID to store data on what videos from YouTube the user has seen.
_mkto_trk	1 year 1 month 4 days	This cookie, provided by Marketo, has information (such as a unique user ID) that is used to track the user's site usage. The cookies set by Marketo are readable only by Marketo.
__gpi	1 year 24 days	Google Ads Service uses this cookie to collect information about from multiple websites for retargeting ads.