Giant Military Contract Has a Hitch: A Little-Known Entrepreneur
nytimes.com
nytimes.com
To get an idea of what companies comprise a fair chunk of the DoD general enterprise IT landscape, see the agreements here[3].
For once, the DoD looks to be on track towards infrastructure that has a good chance of not absolutely sucking hind tit right out the gate.
[1] https://www.fbo.gov/index?s=opportunity&mode=form&id=7a17a56...
[2] https://www.fbo.gov/utils/view?id=6cd8017d52d2b832855c41fb74...
> He wanted to use his skills not “to make a search engine more performant, or help a box of stuff get to a customer faster; but rather towards service of the American people,
Then, after the contract looked like would be going through, his love the the American people waned and he joined Amazon again
> At the end of October 2017, Mr. Ubhi recused himself from JEDI, saying Amazon and his restaurant start-up, Tablehero, “may soon engage in further partnership discussions.” Two weeks later, he resigned and then rejoined Amazon
It feels dirty saying it but maybe Oracle has a point here. Though in general this is how the game works in Washington.
But they are also lacking gov certifications and have a weaker history with government contracts than Amazon or Microsoft, which is important because government procurement processes can be pretty arcane.
From the article:
> The Pentagon released the JEDI request for proposals nine months after Mr. Ubhi recused himself.
> Amazon has countered that the Pentagon identified 72 people substantially involved in developing the contract and its requirements, and that Mr. Ubhi worked on JEDI for only seven weeks, in the early stages.
Which one would you rather believe:
Some random noob, one of 72, works for 7 weeks, and magically has such a major impact that it's still felt 9 months later?
Or
Amazon, which has been the leader in Cloud for about a decade, is just the better (safer) option?
Not sure. I clicked this link https://www.nytimes.com/2019/03/20/technology/military-contr... which one did you click?
> Some random noob, one of 72, works for 7 weeks, and magically has such a major impact that it's still felt 9 months later?
9 months is not a lot of time in government land. Before the request for proposal is sent out, often, a pick is already made informally. In fact the best time to lobby is exactly that time to ensure the bid is written to one company's specifications (even though it is illegal). And surprise, the company is the company this person used to work for, and also surprise, surprise advocating its use to other companies. After he quits, then promptly goes back to the same company.
This is not unusual and pretty sure Oracle would be doing the same thing, it just they missed the boat, so now are happy to "expose the corruption".
In isolation, sure, this seems weird. But remember that around that time (Obama admin), a lot of techies were being invited to join the government in the "Digital Service". Many of them took leaves of absence (I know a couple) to work 6 months or a year in the government, fixing their systems, and when done, rejoined their previous companies. So, in context, it's not that unusual.
See, for example: https://www.cio.com/article/3288924/us-digital-service-recru...
Then of course my favorite Oracle bit is from Bryan Cantrill https://www.youtube.com/watch?v=-zRN7XLCRhc&t=33m
And to a larger point, can anyone elaborate on whether what I've heard is true? Has litigation or sunlight through advocacy against the government worked in those cases?
The usual term for this is "single-sourcing", and it applies to much more than vendor selection in RFPs. You can single-source materials, vendors, locations, or anything else, and it's routinely done in legislation.
When a specification is written specifically for a single vendor, it's not called single-source; although the end-user probably advocated for single-source during negotiations with the procurement department. Not surprisingly, this is a constant source of friction for procurement departments. End-users almost always want to buy their preferred solution, and especially in IT. There are often good reasons, but I digress.
In some contexts, the single-source procurement strategy is simply not available; usually due to procurement law. This is when you most commonly see manipulation of specification. However, competing vendors can challenge the procurement in court through a procedure usually called a "bid protest". That's not exactly what's happening here, but it's similar.
1: The person who will ultimately use/implement the purchased goods/services.
2: Usually a separate department responsible for ensuring that goods/services are "responsibly" procured.
...this isn't accurate. Intentionally writing a specification that only one party can meet is in fact called single-sourcing.
This happens any time any government entity goes through the RFP>RFQ> process; local schools, city government, municipal water departments, state agencies, the FBI, etc
I onced snipped an almost million dollar deal at the department of justice. HP tape guys thought they had the deal zipped up as the spec called for only equipment they could provide.
Well they forgot[1] that they oem'ed all their tape hardware and software to the company I worked for and we had no non compete clause in our contract with them. I found the deal on FedBid, under bid them by like 70K with their own hardware that matched the spec 100%, won the deal and took the rest of the month off.
Dont even get me started on the dirty tricks that can be done around deal registration. Enterprise IT sales more shady than a used car lot.
[1] So they didnt forget as much as the fact that HP Gov sales is an entirely different division than the OEM team with essentially no communication between the two.
I learned about this working on election integrity.
After spending years learning the laws, rules, regulations, principles, policy, tech stack... it really just came down to who's getting paid.
I don't know how to mitigate this. More eyeballs?
Regulation isn't sufficient and susceptible to capture.
Sunshine laws aren't sufficient. FOIA is a step forward, but you're always two steps behind (don't even know what questions to ask).
Whistleblowers are routinely stomped, so less likely to speak up over time.
Few can afford to do investigative journalism any more.
So I was big fan of Obama's data.gov initiative. Publish all (non-sensitive) data by default. Calendars (hearings), procurement process, contracts, appropriations.
Wishful thinking?
The billionaire is dressed best.
However it is truly amazing and frightening that a crappy node.js website could be neighbored with the Pentagon's logistics control software or something even more important.
Equally, governments are notoriously incompetent and it wouldn't surprise me that some ill configured IAM profile or security group causes mayhem.
Cloud is brilliant but scary!
As for IAM profiles, security groups, and the other, they're all security tools that can be used, but they're only as good as the admin who wields them. But the same can be said for on-premise (non-cloud) workloads that are internet facing. The times I'd found SSH (or egads, telnet!) ports exposed to the internet on a boundary router were too many to mention. It's not a cloud-specific problem, but a IT training problem.
The good thing about cloud in this aspect is that when a customer is all in on say, AWS, you can enforce a high level of consistency in what those security controls should look like, which makes it easier to identify deviations. You can then pair that with features like AWS Config to automatically detect when you say, have an IAM profile that's been changed from the secure baseline.
So cloud can actually make your environment more secure, because you have security tools built into all of your services, they're consistent, and you benefit from all of the engineering and research that AWS puts into them, instead of having to design solutions for everything yourself or manage lots of differing products that all require their own training, runbooks, configuration, etc.
But regardless of the solution you choose, it will always come down to training your personnel to use those tools properly, because bad configurations can occur anywhere. Cloud can help minimize the occurrences of that, but only training will eliminate it.
Disclaimer: I'm a TAM with AWS.
The public's conception that there is a competitive bid process in the federal government is laughable. Sole source justification is the magic phrase and trillions of dollars of government contracts have been awarded under this auspice.
Back when I worked in the Beltway it was called FAR-12 evasion and you paid for quality counsel to advise you on all of the legal ways and means to have lunch with GSA employees for purposes of being awarded with sole source justification contracts under FAR-12.