The Empire Strikes Back: Trump discovers $10bn JEDI cloud deal may go to nemesis Jeff Bezos, demands probe The Pentagon's $10bn JEDI mega-cloud contract may be put on hold once again, this time because President Trump has ordered a probe into the massive single-vendor deal. The White House has recently taken an interest in the proposed service agreement, and wants more information about its terms, conditions, requirements, and …
I don't agree with Trumpy about much.
But in this case, I have to say that setting up the procurement to exclude anyone who could not provide the entire contract is a bit suspect. Also single vendor lock-in is ALWAYS a bad idea. Infrastructure of this magnitude seems like something you might want to spread around.
Let the flames commence.
The reason being is if anything goes wrong, and it will, that when it comes time to fix the customer (i.e. DefenSe) can say, "Hey AWS/Azure, fix it now".
With multiple vendors when it comes time to fix (not to mention the admin, accounting and similar non-tech overheads), invariably the vendor first directed to will say, "Hey, that's the other guy's problem". We all know how that one would go down, and have experienced similar before.
I appreciate the flawed logic, but thats what it is.
On private contracts, maybe, if you are lucky.
Here, we a talking public procurement. We all know the deal will not be $10bn, more like $50bn, once finalized and in production. We already know that if Microsoft or AWS fail to deliver (they will), the Pentagon will pay whatever is asked to fix it - that is how it works.
Repeat after me, taxdollars must be spent, preferably by buying stuff from the mate at extortionate rates.
Crapita's entire business model.
"We all know the deal will not be $10bn, more like $50bn, once finalized and in production"
JEDI is primarily to address the blowouts in DoD cloud spend. Current forecast spend without JEDI over 10 years is estimated at around US$15bn-US$25bn based on current numbers and growth.
JEDI is intended to limit that spend to an average of US1bn/year over 10 years - I accept there may be some creep as more services are added, but it is likely to be significantly cheaper than the alternatives (i.e. the current method of "*sucks air through teeth* that will be multiple data centres for redundancy, acquiring land for the DC's and locking you into expensive hardware refreshes every 3-5 years, its not going to be cheap" - this is literally what IBM and Oracle proposed in their JEDI bids...more of the same, scrap the pork barrel till it is dry)
Having been trapped in the old "IBM's P8 running badly on ORACLE's WebLogic Appserver" tech support pingpong game - that only ended when I was able to get the whole kit moved to the WebSphere caboodle - I can only agree that the single vendor idea has much merit when nuthin' wurks and it's time to hold feet to the fire.
No, sir, no, sir.
You went proprietary, you cannot see who is doing what and you cannot tell who the culprit is. If you were using FLOSS solutions, you would be able to see what the problem was .... your problem was NOT multiple vendors, it was proprietary software.
Also oddly the same for buses round here would you belive.
Some parts work better when interchangeable and standardised for your infrastructure (see shipping containers, bullets, petrol). Other parts work better with different suppliers should a fundamental flaw be found (see Intel and heartbleed).
However in this instance where you're running containers on top of someone else's equipment then one supplier works better. Especially if you consider it something akin to a shipping service. More accountability, dedicated support and (hopefully) economy of scale (stop sniggering at the back, I know the last ones a stretch).
I don't think you're wrong necessarily, it's just the fact that Mr. Trump wants to look into the deal because he doesn't like Mr. Bezos that I think is wrong.
There is also the bit:
In particular, the President is unhappy that he wasn't made aware that some Republicans had written complaints about the process to the White House and the military...
which makes me wonder if he has ever paid attention.
I suppose the Republicans' mistake was to write letters. They should have gone on Fox News.
Still seems like an odd way to run a country.
Nah, he's not senile, senility would be an improvement. Hell, nvCJD* would probably be an improvement.
*Thank you so much John Selwyn "I wonder where my daughters best friend disappeared to" Gummer**.
** and I just had really bad thoughts about Bert (John) Gummer, Tremors, and a UK cabinet meeting circa 1997.
"I feel like I was denied critical, need to know, information."
Or
"I am COMPLETELY out of lies. That's never happened to me before".
I see the point in wanting multiple providers, if only to prevent the lock in issue. That's a necessary thing to consider. However, I also think we should consider the complex security landscape you would get with multiple providers that have to interlock. A single company's cloud system is complex enough and leaves ample room to misconfigure or for the provider to have bugs, but at least they are responsible for securing the whole thing and have written software designed to do just that. Not that it is guaranteed to work, but it's been tested inside the company for a while. If we created a system composed of several providers' systems put together, an attacker could break into any of them and then start attacking the newer mechanisms that connect the system. While the contract would doubtless include provisions for ensuring security of those mechanisms, there would be less existing code for doing that and the code created by the group of providers wouldn't be as well tested or as thoroughly written. This would make it easier for a security problem to arise, and to make things more irritating, each company would say that it wasn't their fault that the breech occurred because the scanning software that should have detected it was the responsibility of someone else.
I don't mean to discount the issue of lock in or the problems establishing a backup system in the event of an attack or malfunction. I think that's a very important consideration too. It's a situation where there isn't a clear right answer. I think it is useful to consider both arguments before deciding which model to do.
Agree with you that single-vendor lock-in is bad, and the contract should be spread around.
Not sure about your Trump qualifier - "I don't agree with Trumpy about much. But..." seems to imply that you agree with him butting his nose in. If anyone has concerns about this (and really they should have been red-flagged long ago), this is the job of military procurement, and their overseers (That would be Congress, not the presidency).
So, 1 upvote and 1 downvote it is!
Is military procurement part of the DoD? And who exactly is the head of our military?
The is EXACTLY the sort of issue that presidents are supposed to oversee. As I mentioned before, military procurement has ALWAYS been a major problem--starting with corrupt congresscritters, but far from limited to them. MP is one of the not-sexy issues that I was hoping this president was predisposed to attack. Doesn't look good so far.
When the commander in chief is more corrupt than the congresscritters and even the lobbyists, I'm not sure his getting involved improves the situation.
I guess the best outcome is that the whole JEDI procurement is delayed a couple years, when there will hopefully be someone else in the White House. In the meantime regardless of his motives, having extra time to be sure that the decision to go with a single provider is the correct one is not a bad thing. We know this project will end up years late and over budget no matter what, so a couple years delay in procurement isn't a big deal.
The entire idea of outsourcing is ignorant. If the military can't hire and retain their own inhouse expertise we've got a large batch of other - dangerous - problems. Setting up a single point of failure-leak is just dumb, no matter who gets the contract. The basic idea is flawed from the beginning. The cloud is in general NOT cheaper than doing it correctly yourself on prem, unless you have very elastic requirements and the cloud is capable of fulfilling those - even in a "military conflict" situation, which is laughable here.
You know there's trouble when it's so stupid even Trump sees that.
What else is the military going to want to shovel off to a vendor because they won't be competent?
Not talking about the pointy-end guys here, but desk pilots who need some water in their booze - and maybe even "learn to code" so they even understand the issues.
"If the military can't hire and retain their own inhouse expertise we've got a large batch of other - dangerous - problems"
So should the military build their own tanks, planes, carriers, subs, guns, field equipment etc etc? That would be insane! The job of the military is war* and the job of military procurement is to provide the best tools for the military to do their job. The providers might and usually do need additional security that is not needed for civilian clients, but the providers themselves are civilians.
Let's not sugar-coat this with "defense" bullshit which is just a step removed from "Ministry of Peace".
The military couldn't get a hold of and keep the level and quality of talent needed for this even if it wanted to for one simple reason: it's the military. Personnel are held to standards that disqualify many of the choice hires, whether or not those standards are relevant to the job. Outsourcing is the only way to go about this sort of megaproject.
that this article post right next to the one promoting and AWS seminar... /sic
Why is El Reg promoting a company that seems to have just one objective in the world and that is to drive everyone else out of existence?
They want to be the only place where you can buy stuff, host your cat videos and sign on to the Dole (coz that's what we'll be doing when the Amazon robots drive send all our jobs to the wall)?
I wonder if Bezos sings "When I rule the world!" in the shower?
Au contraire... I f**king love Amazon. It's where I can buy a lot of the stuff I want to buy, smirk knowingly at the existential pointlessness of the cat videos you've posted, and maybe eventually be able to watch you sign onto the dole because you've blamed your lack of employable skills on Jeff Bezos rather than taking a long hard look at the markets and yourself - and then re-skilling as maybe is neccessary.
If the system works for me it must work for everyone. If the system doesn't work for everyone then the flaw is in them and not the system because the system worked for me.
Yup, seems water tight to me! The plebs clearly need to learn to be robots.
Well Amazon does stuff better and cheaper than anyone else. For eg I went to my usual supplier of sausage making stuff and put a pack of black pudding skins in my basket then went to checkout. £5 for the skins then they want to slap £4 on top for shipping some plastic bags and string in an envelope? They had no mechanism to calculate the actual shipping cost and were slapping a one size fits all figure on everything.
I go on Amazon and find a pack with two more skins for £4 and change and Free Shipping. From one of their big competitors' Amazon store. They said they would be here on Saturday but arrived today.
Tomorrow evening I must remember to put one of the packs of frozen pig's blood in the fridge to thaw. I use a Scottish black pudding recipe and everyone who has sampled it has loved it. I want to stuff some of it under the skin of a chook and up the jacksie part where you might put sausage meat. And of course have fry-ups, with mushrooms and tomatoes mmm, mmm.
I would be surprised of Oracle get a look in. There cloud offering is generally considered to be a bag of poo run by a company that have a bad habit of running audits when they are bored solely to piss off CIO's.
I would have expected the competition to be between Microsoft and Amazon, same as it usually is for big cloud contracts. Mainly because those companies have the reputation and skills.
I dont know about IBM's offering.
I can understand why they consider single vendor a good idea in this case, even if its not usually though. The weakest part of any infrastructure is the edge where it joins to other foreign infrastructure, and i can understand them wanting to keep that to a minimum.
"Won't be surprised if either Oracle or M$ will win this.
But will be surprised most certainly if IBM do."
Oracle and IBM's bids failed for the exact same reason - they tried to provide data centers for the DoD the same way they have been for 20+ years that involves a lot of care and attention around taking every last dime out of the port barrel. And all delivered nice and slowly to ensure the customer is trapped.
Could this go to Microsoft? Possibly....but it will cause issues for the contracts targeted at MS to be given to AWS instead so the DoD don't end up with single vendor lock in with Microsoft. See the irony of the vendor lock in argument?
The DoD's IT budget is around US$18bn and growing - while a $1bn/year cloud contract over 10 years maybe large, it still allows other vendors to provide services. MS are likely to provide GovCloud Office365 and AWS providing applications that aren't tied into Office too closely.
Is trusting everything to AWS/MS a wise financial move? Look over some of the DoD's alternative vendors and it's easy to understand why they choose AWS/MS over vendors that have historically pillaged IT budgets in the hope that this time it may be different....
Sidekick: "You're the one whining about Bezos
Trump: *winces* "Don't mention that name.."
But seriously. Am I missing something. This is the Pentagon - the guys with all the secrets and arguably the most important part of government as regards foreign policy and security - and they're putting all this stuff (including probably emails about Iran (the "bunch of backward barbarians" one was particularly impressive since Iran was the site of 3 of the first 4 major empires of antiquity) into the "cloud", controlled by Amazon no less?
A Mr Harold Adrian Russell Philby, wherever he may be, must be laughing hard enough to bust a blood vessel. I wonder what happens if you die in heaven - do you get bumped up into executive class?
I predict a sudden influx at Amazon of Asiatic men in bad fitting blond wigs called Butch who seem oddly obsessed with "launch codes".
Its called encryption. They aren't going to be putting plaintext anything on the cloud, and no doubt these systems will be physically separated with private network connections and so forth in addition to the military grade encryption on all the data.
Which is more likely do you think?
1) breaking through the security to gain access to the Pentagon's cloud, THEN knowing which blob of data (out of a total stored that will be almost incomprehensible) is what you want, THEN breaking the encryption on that data.
2) finding a corruptible colonel with security clearance to access what you are you looking for, and give him a suitcase with a few hundred thousand dollars in cash?
"1. Cloud is somebody else's computer."
Almost all of the DoD's existing systems are run by third parties across almost 300 data centres. The hope is to get this down to a more managable level along the lines of AWS (multiple DC's), Azure (multiple DC's), one DC per state (management will vary) plus specialised DC's (i.e. Lockheed's F35 DC's) to significantly reduce cost/complexity. i.e.somebody elses computers happened 20+ years ago for the DoD
"2. If you store data on that cloud, unless you are vey careful and encrypt and decrypt everything on-site (iow you do NOT use the built-in encryption tools to access your data) encryption is futile."
While I won't guess at the encryption requirements within DoD networks, GovCloud was an attempt at unpicking the mess that using A LOT of different vendors with their own systems for managing/monitoring/securing DoD networks had caused and including best practice requirements for data at rest/data in transit. The publicly available information is here: https://d1.awsstatic.com/whitepapers/compliance/AWS_Logical_Separation_Handbook.pdf
It's also worth noting that GovCloud AWS is physically separate from public AWS facilities and consists of multiple facilities in each state it operates.
Completely separate conversation, but I'm curious what four empires you're thinking about when you say that three of them were located in the land that is now Iran? As I understand it, the four great empires of antiquity typically refer to Mesopotamia, Egypt, the Indus valley, and early Chinese civilization. Only one of those was anywhere near modern-day Iran, and even that was a bit west of there. Of course, Persia has been an important empire for quite a while, so I don't mean to understate the history of the area, but I wonder what your list is.
Oversight of contracts and spending is the job of the congressional budget office - as far as I can work out they have no complaint about the deal
If there is a legal challenge to the deal it should be settled in court - oh wait, the judiciary already looked into it and passed it
While the President is nominally the C-in-C of the armed forces, that role does not grant him supreme authority over all military matters (particularly, war has to be declared by congress, and congress holds the budget purse-strings)
The Presidency of the US is a constitutional position with strongly defined responsibilities and limits. And while Bush 2 and Obama started the recent trend for pushing those boundaries, Trump is considering himself to be more in the position of President of China / King of the US where he can do anything he wants. And then gets mad when he realizes he can't
"It is yet to be seen how these vendettas and relationships would impact Trump's thinking on the matter – or if they would even factor in to the President's decision making at all"
You're f***cking kidding right? Trump is the ultimate narcissistic sociopath egomaniac. EVERYTHING is about him. If you think it's even possible that he ignore his personal relationships and vendettas, and take any sort of decision by weighing the merits of the case, then you're almost as insane as he is*
*The normally accepted construction of that expression is "you're more insane than he is" bu in Trump's case that won't cut it.
for $10billion over 10 years they could put together a pretty reasonable secure environment themselves, using many smaller contractors - with multiple redundant offsite data stores (I assume that the US Military has some secure locations) - then they wouldn't need to give any one single company such a huge contract.
But everyone is obsessed with putting their data into other peoples computers, even when it may not necessarily be the best idea.
Read up on existing DoD cloud spending (2018: $1.2bn, 2019: est 1.5bn) - this is a way of controlling costs.
The DoD has tried doing infrastructure in-house before, they usually outsource it to the highest bidder who uses the tightest lock in with the longest contract length...
And check what GovCloud is - this is likely to be very different from what you imagine. i.e. multiple facilities spread over multiple states from multiple providers with a network that meets all of the DoD's security requirements.
Slightly off topic, but just looking at that picture of Trump looking smug, it strikes me that if I was producing a TV series or a movie, and wanted a character who was a total and utter arsehole, it would be hard to come up with one who was worse than Trump.
A rich kid who dodged the draft thanks to daddy's money and connections but now likes to talk tough and be rude and insulting to fellow politicians who are genuine war heros.
Someone who is a compulsive liar, a philanderer, a sexual predator and quite possibly a rapist, someone who makes racist insults against politicians opposed to him, but apparently nothing about the fact his wife is a gold digging former whore from a shithole country.
Someone who wraps themselves in evangelical christianity, despite nailing porn stars while his third wife and second mail order bride is pregnant with his child.
A guy who won't release his tax returns and produces doctor's assessments clearly written in his own twitter style.
And there are, if not a majority, a significant enough minority in the US who dont just reluctantly vote for him, but enthusiastically worship him to the point where he can become president.
It really is mind boggling. You can be the absolute antithesis of the champion of the poor that the rednecks in the US really need, but if you cover yourself in shabby racist rhetoric, it blinds them to everything else.
I am glad in the UK we'd never end up being led by a useless, floppy-haired womanizer brought up in privilege who engratiates himself with the poor simply through casual racism.
"It is yet to be seen how these vendettas and relationships would impact Trump's thinking on the matter – or if they would even factor in to the President's decision making at all."
As far as the orange fascist is able to think, his gossamer-thin skin generally seems to suggest those are the only factors ever considered when any thought process more complicated than a desire for a Coke is coaxed into life.
We all been there, problem arises company A blames company B who blames company C and nothing gets resolved.
If the solution is all done by company A, then they can only blame themselves and resolved to getting it fixed (although could be in Department A blames Department B in the one company, could be the next issue)
Not like Microsoft or Amazon are going to go out of business anytime soon, so this might actually save the American tax payer in the long run.
Remember you need an A,B and C in every congregational district and you can't kick any of them out or that senator gets a call and your next funding round gets delayed.
So you end up with one supplier actually doing all the work for 2x the money while you pay 100x to all the other suppliers to do nothing
..AWS, whose overlord Jeff Bezos also owns the Washington Post, which has run afoul of the media-obsessed tweeter-in-chief at various times since taking office.
More like made a dead set at him from the glad confident morning he broke Hillary, along with the New York Times [ owned by Carlos Slim inter alia ] shrieking like old Dublin fishwives displeased with the quality of the dung on the pavement.
They started that war, not Trump.
.
.
Still, I think this would be a good moment for Bezos to bow out gracefully: "I have enough... Let others have these crumbs."
Journalists, writing about the odious things a politician does? How fucking dare they start fights like that. They should suck at his teat and never be critical of the God-Emperor Trump. I think they should just get rid of term limits now, and turn the presidency in to a hereditary-life role - Ivanka next!
Reading some older articles concerning this project, it seems to me that this is about Amazon/Microsoft/etc. defining and building the HW/SW infrastructure for a private cloud that has 'technical parity' with the commercial cloud. It would be deployed in DoD datacenters and be maintained by the contract winner(s).
If this is the case, then it may make sense to have a single winner. It also makes sense for the finalists to be Amazon or Microsoft because they have the most mature infrastructure for this sort of thing.
Just like a fighter/drone/ship project, there will be many winners. Intel, Dell, Samsung, Cisco, Mellanox, Nvidia come to mind, not to mention the software providers whose applications and operating systems will be run on this private cloud.
"If this is the case, then it may make sense to have a single winner. It also makes sense for the finalists to be Amazon or Microsoft because they have the most mature infrastructure for this sort of thing."
Going one step further, it is likely that longer term DoD spending will split cloud between AWS and Microsoft. The current split makes sense for current systems (i.e. Office365) but as IT requirements continue to evolve, this may change.
It's also possible that Google will decide it want's to complete the certification process and join the fun.
The 'Intel' cloud was only 600 million and Amazon built a trio of datacenters in the vicinity of Dulles VA. For 3 billion what's so hard about building 3x3 datacenters (eg. Ohio, SW Virginia, Colorado) and stand up a "separate but equal" rollout of the commercial offering? It could be air-gapped to the NIPRNET or under careful access control from the Internet (NSA has been advising DISA on this for years) and that way any dumb-ass cockups don't (trivially) expose the JEDI platform to all and sundry.
That way it can be run by any of the participants. AWS and Azure(?) is the only outfit that has actually done this before. I wouldn't trust Oracle not to fk it up royally. IBM would probably be hopeless if it weren't for their RedHat subsidiary driving the show.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
