Watchdog slams Obama-era tech initiative for poor IT practices

The General Services Administration (GSA) slammed an Obama-era technology initiative operating under its umbrella for “disregard[ing] fundamental GSA information technology security requirements and circumvent[ing] the CIO [chief information officer].” 

An inspector general’s report says that 18F, a startup-style group to provide digital products for federal agencies, failed to comply with a bevy of regulations. As a result, the department was awash in unapproved products purchased without requisite approvals.

Of 118 software “items” in use at 18F, 100 were not approved by the GSA IT review team. The CIO authorized none of the 18 information technology systems, as 18F was required to do. 18F granted itself “pre-authorization” of systems it deemed to be low risk “without completing any security assessment and authorization process.”

{mosads}The report describes this as contrary to the founding documents of 18F. A memorandum of agreement signed at 18F’s launch required that “[i]n accordance with the Federal Information Technology Acquisition Reform Act (FITARA), CIOs shall have a significant role in the decision processes for all annual and multi-year planning, programming, budgeting, and execution decisions, and the management, governance, and oversight processes related to information technology.”

The report notes that 18F also improperly replaced GSA-hired staff. 

“We also found that the 18F Director of Infrastructure appointed himself as the 18F Information Systems Security Officer (ISSO) when he became dissatisfied with the ISSOs GSA IT assigned to 18F,” reads the report. 

“According to GSA policy, the Chief Information Security Officer is responsible for appointing ISSOs, who are responsible, among other things, for implementing and enforcing GSA’s Information Technology Security Policy.”