GSA tech chief defends 18F, says watchdog's report 'got our attention'

GSA Technology Transformation Service Commissioner Rob Cook told CyberScoop that the agency was working to reform the IT security rules which 18F's leadership flouted.

The head of the General Services Administration’s Technology Transformation Service is speaking up for 18F — the agency’s under-fire IT swat team — and vowing to change the cybersecurity rules that a watchdog accused 18F of ignoring.

TTS Commissioner Rob Cook told CyberScoop that GSA was working to overhaul the IT security rules that 18F’s leadership flouted.

“We will be pressing up very hard against these rules because we believe they are stifling … our ability to be agile, to use technology in an innovative way to deliver the best services,” he said.

Cook played down the significance of the violations uncovered by the office of GSA’s inspector general. The report found 18F management “routinely disregarded and circumvented fundamental GSA information security policies and guidelines.”

“This is more about compliance than security,” Cook said, noting that there were “no actual security breaches,” by hackers or other malefactors.

The report, “definitely got our attention,” Cook said, adding that the issues raised and recommendations made had all been addressed.

“We’ve made really significant changes in the way we work around here,” he said.

‘Startup-phase issue’

The GSA’s discipline directive lists “Failure, through simple negligence or carelessness, to observe any security regulation or order prescribed by competent authority” as a disciplinary infraction punishable on a first offense by anything between a written warning and termination.

Asked whether any staff would face disciplinary action for ignoring the rules, Cook declined to comment on individual cases, but added “My main interest isn’t in punishment, it’s in fixing things.”

The report was “more about the past than the present … It was a startup-phase issue,” Cook said, noting the evaluation period ended in December. “Some of the people [criticized in the report] have left, some are in different jobs.”

The evaluation — launched after the inspector general’s staff found IT security violations during an earlier look at 18F’s controversial business practices — found last summer that not a single one of the 18 IT systems used by 18F had a proper Authority to Operate for the whole year. Inspector general staff also found that 100 of the 116 software applications being used by 18F during the evaluation period were “not approved for use in the GSA IT environment,” and had in fact never even been submitted for approval.

In the future, “The way we want to address this is to change what compliance means, rather than not complying,” Cook said. “Respecting the rules and being in compliance with them is very important for security.”

18F was set-up in 2014 by a group of Presidential Innovation Fellows — tech executives who serve a two-year stint in government — following the disastrous roll-out of healthcare.gov. The idea was to create a team of IT experts that would help agencies fix problems using new IT deployments like cloud services and employing startup techniques like the DevOps management philosophy.

But the team — now 200 strong, according to its website — has been the center of some controversy about its business practices.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure