By Therese Poletti, MarketWatch
IBM and Oracle argue that the feds are playing favorites with AWS in battle for $10 billion cloud-computing contract
Some of the biggest companies in tech are fighting with the U.S. government over questionable practices in the mysterious world of military contracts, with a lucrative prize at the end: a hefty $10 billion, multi-year cloud-computing deal.
At stake is a highly publicized but controversial contract to provide cloud services for the Department of Defense, dubbed Joint Enterprise Defense Infrastructure, or JEDI. The contract received interest from the top cloud-computing players, many of which submitted bids for the deal: Amazon.com Inc.'s (AMZN) Amazon Web Services, IBM Corp. (IBM) , Microsoft Corp.'s (MSFT) Azure and Oracle Corp.(ORCL) .
The plans call for the JEDI program to become the key component for the DOD's enterprise cloud strategy, the DOD's chief information officer, Dana Deasy, said in a letter to potential cloud partners. The JEDI cloud will serve as the infrastructure spanning from the DOD offices at the Pentagon to soldiers in the field. As opposed to a vast set of incompatible databases that they have in the field now, the deal envisions a unified cloud providing access to data through a range of devices to make decisions on the fly, using machine learning.
While the goal is admirable, the process and plans have been questioned by some contenders. Amid the acronyms and the mind-numbing jargon of both the DOD and the cloud industry, at least two cloud rivals, with the support of two members of Congress, (https://s3.amazonaws.com/fedscoopwp-media/wp-content/uploads/2018/10/23134534/Womack-Cole-JEDI-IG-Letter.pdf) have said that the request for proposal, or RFP, process appears to be flawed because it is going against industry practices by seeking only one cloud provider. They also believe that the language of the program appears to be tailored to one company alone: Amazon's AWS.
"Of particular concern are the 'gating,' or restricting, provisions and structure of the proposed contract, that seem to be tailored to one specific contractor," wrote U.S. Reps. Steve Womack. R-Ark., and Tom Cole, R-Okla., in a letter in October asking the U.S. Inspector General to look into the JEDI cloud-program process, without naming Amazon specifically. The investigation is ongoing and officials did not respond to requests for comment, possibly due to the government shutdown.
Oracle and IBM have both filed protests with the General Accounting Office. Oracle went as far as filing a lawsuit in early December, after the GOA denied its protest.
"Unfortunately, JEDI, as outlined in the final solicitation, would not provide the strongest possible foundation for the 21st-century battlefield," wrote Sam Gordy, general manager of IBM's federal business, in a blog post voicing the company's protest in October (https://www.ibm.com/blogs/policy/jedi-protest/?mhq=JEDI&mhsrc=ibmsearch_a).
Many fears about the plans focus on the use of just a single cloud-computing vendor for the length of the deal, which will span up to a decade. The government's request for a single provider of cloud services is a risky strategy that could make the DOD cloud both easier to hack and vulnerable in the event of power emergencies or an actual war, both IBM and Oracle have argued.
The argument is that using a single company to provide cloud computing and storage functions could backfire in the event of a power outage, and would give hackers one system to focus on. It is also not an industry best practice -- most companies are moving toward a multi-cloud approach.
"What the government is doing with JEDI is not in sync with what the commercial world is doing," said Brian Johnson, co-founder and CEO of Divvy Cloud, an Arlington, Va.-based venture-backed startup that focuses on cloud security. "It is just a really bad idea to pick just one provider." He added that all cloud providers have outages and noted that the need for two service providers has been a basic disaster-recovery practice since the early days of the data center.
Alphabet Inc.'s Google Cloud also believes that a multi-cloud approach is best, and did not bid for the job, in part because of the single-source requirement. In a statement, a Google spokeswoman said, " (https://www.bloomberg.com/news/articles/2018-10-08/google-drops-out-of-pentagon-s-10-billion-cloud-competition)Had the JEDI contract been open to multiple vendors, we would have submitted a compelling solution for portions of it. Google Cloud believes that a multi-cloud approach is in the best interest of government agencies, because it allows them to choose the right cloud for the right workload."
Google also received protests from some of its employees who were ethically opposed to the contract. "We couldn't be assured that it would align with our AI Principles," the Google spokeswoman said, "and second, we determined that there were portions of the contract that were out of scope with our current government certifications."
Maribel Lopez, founder and principal analyst at Lopez Research, said the single-source contract makes sense in this scenario, but only for now.
"In time, DOD will have two clouds, but I doubt they'll start that way," she said. "The real issue is the 'up to 10 years' part. One cloud for 10 years is risky and probably means that the government will take way too long to migrate to the cloud. So as the DOD's current contract stands, it is an issue."
But the DOD is instead adhering to the requirements set out in a congressional report last year, which said that the "use of multiple clouds would inhibit pooling data in a single cloud (i.e., a 'data lake'), limiting the effectiveness of machine learning." That report also said if the DOD pursued a multi-award approach, under current acquisition laws, it would prevent the department from rapidly delivering the new capabilities. Currently, the DOD maintains a decentralized system, with more than 500 separate public and private clouds, for both non-classified and secret data.
In Oracle's 97-page bid complaint filed in the U.S. Department of Federal Claims, a federal court that hears monetary claims against the government, it details how it believes the favoritism toward Amazon evolved in the government's process.
Among other issues, Oracle's complaint details the career path of one high-ranking executive named Deap Ubhi, who is currently general manager at AWS in San Francisco and previously worked at the DOD's Defense Digital Service, or DDS. In his job at the DDS, Ubhi -- who previously worked at AWS before joining the government-- was selected as the JEDI cloud manager. While he was at the DOD, Oracle contends that he sowed the seeds of favoritism toward Amazon.
"Ubhi attacked anyone who took on multi-cloud positions or advocated non-AWS solutions," Oracle said in its complaint, based on emails and Slack messages it had received through the discovery process.
Oracle also noted that his conduct raised two separate conflict-of-interest issues: Did AWS and Ubhi create an appearance of impropriety or bias in the procurement, and did AWS create a further conflict by engaging in employment discussions with Ubhi while he was employed at DDS? It noted that during his time at DDS, AWS actively negotiated with Ubhi to buy a startup he was working on and Ubhi met with other potential cloud providers for the JEDI program.
A spokesman for Amazon's AWS declined to comment on the litigation and the contract. But the conflict-of-interest question has already been addressed by the DOD. A few days before the final RFP was issued last July, the DOD stated that there were four individuals at the agency with either a financial relationship or a relationship with Amazon/AWS, but its ethics council concluded that no violation had occurred because the individuals "had not participated personally and substantially in the procurement." Ubhi joined Amazon in November 2017 after 14 months at the DOD, according to his LinkedIn profile, several months before the first "industry day" where the DOD outlined its plans for the JEDI deal for industry and academia, and a draft RFP was released.
Adding additional intrigue are plans by Amazon for its second headquarters, split between Long Island City, N.Y., and Crystal City, Va., where the company would be in a better position to work with the government and the Pentagon. This begs the question of whether Amazon executives picked the Beltway location in anticipation of, or in the hopes it would help cinch, the JEDI contract.
In the GAO's denial of Oracle's protest, it said the Defense Department has gone with the single-award approach because it is in the government's best interests, including for national security. It also said in a statement that allegations regarding conflicts of interest do not provide a basis for sustaining Oracle's protest. IBM remains on the sidelines, with its protest is dismissed for now, with claims similar to Oracle's, while Oracle goes on to fight in court.
One of the most fascinating aspects of this inside-the-Beltway deal is how much of it is playing out in the public eye, including in the courts, well before a decision is even made, all for a contract that will ultimately protect top-secret military data. The award is set to be announced sometime in April. The big tech giants do have some good points in their complaints, so if Amazon is indeed awarded the deal, it seems likely that more protests and litigation will follow.
-Therese Poletti; 415-439-6400; AskNewswires@dowjones.com
(END) Dow Jones Newswires
January 08, 2019 08:50 ET (13:50 GMT)
Copyright (c) 2019 Dow Jones & Company, Inc.