While the IC’s research organization looks into adding security to cloud environments, in the here and now, intelligence agencies are sharing more data.
David Bray got his first government IT job when he was 15, seeking a work permit so he could program computers for the Energy Department.
After an impressive and varied career, in which he worked with everyone from the Department of Defense to the Centers for Disease Control, Bray answered an online job posting — to be chief information officer for the Federal Communications Commission. His reaction to the nine months it took to go from USAJOBS.gov to the FCC CIO position?
He’s created a fast-track fellowship program at the FCC to bring in talent and expertise much more quickly.
Bray spoke to FedTech Managing Editor Brad Grimes about “intrapreneurship” and encouraging his IT colleagues to think outside the box.
BRAY: Definitely the mission. The mission is changing exponentially, as opportunities are changing too. Technology just enables the art of the possible; basically, how we achieve the mission or defend against whatever threats there might be. I obviously track IT, and I’m passionate about IT, but I see it as simply changing the way we accomplish our mission, similar to policy.
BRAY: Yes, at the FCC we date back to 1934, and even before that, we were the Federal Radio Commission. Today, I see my job as twofold. One is to be a digital diplomat across all the different components of the FCC. The other is to be a flack jacket, because I am really asking people to experiment and try new things.
Saying “That’s how we did something last year” is just an excuse for not thinking in our period of exponential change. I am trying to attract both government and contractor staff who are willing to take measured risks, recognizing that as long as it’s intentional and we’re focused, then I’m willing to take the bullets for them.
Throughout my career, I have always been told get back in my box. But I like being out of my box. So I’m trying to provide an environment that people find rewarding — where they can feel free to come up with better and new processes by which technology might help the FCC work faster, better or more transparently.
BRAY: I am a big believer in the entrepreneurial spirit. And I came to the FCC about a month before Chairman [Tom] Wheeler, who is an entrepreneur himself. So one of the things I launched was “intrapreneurs” — entrepreneurs on the inside.
In a large organization, it takes so many people to get something done, and they are all focused on their own individual pieces. Here, intrapreneurs will pick specific topics or problems, such as how we can improve our auction process or modernize our licensing systems. Intrapreneurs are able to pull together the appropriate people to help solve the problem. I give them the boundary conditions, but how intrapreneurs get from A to Z is at their discretion. They will work with the bureaus and offices to understand their narratives and issues, but then they’re given much more autonomy than you might normally find in a large organization.
BRAY: There’s probably one third of the base that’s extremely charged and optimistic. I’m finding people both within and outside the FCC who say, “I am pumped, and I like to work with you.” There is another third that’s more cautious.
And then there’s the last third. They are not necessarily resistors, but, for example, I had one person say to me, “I do have one beef. It’s something that happened 18 years ago….” Of course, I just started, but I said, “Let’s see what we can do about it now.” Overall, though, there is a palpable sense of energy as we progress along the adoption curve of early adopters to more mainstream adopters of the idea.
BRAY: One of the things that I have found at the FCC is that we still are very paper-intensive, very manual process–intensive. For example, right now, if you have a complaint for the FCC, we will mail you 18 different forms. You will figure out which is relevant to your complaint, mail it back to us, and then we will scan it and enter it into the system. That is a process for which technology might offer a new way of doing things through a web-first approach.
An online form could adapt to the nature of the complaint. Is it something with radio? Is it something with television? Either way, a custom-tailored form should be presented to the user. Even better, if the person wants to check the status of their complaint, through some means of online identification, they could. And then, more broadly, the public and our partners, as well as Congress, could see aggregate, anonymous information about complaints.
BRAY: Partly, it comes from being an 80-year-old organization. But also, historically, there hasn’t been an enterprise view across the commission. There are 18 different bureaus and offices, and there may have been cases when they stood up similar systems. Part of what I am trying to do, with the support of the FCC chairman, is work across the bureaus and offices.
So if this bureau needs a tracking system, and so does this bureau and this one here, why don’t we build or buy one platform? There can still be custom workflows that are unique to each. When I first engage a bureau on a new effort, I say, “We can work with you. In fact, we will provide the talent to do what you want if you will storyboard and map out your current workflows. The goal is to begin to visualize what you’re doing now and think about the future state.” We can be much more agile as a result.
BRAY: I think it’s about a three-year journey. I would love to be able to say in three years that the FCC doesn’t have 207 different systems, but rather we have 207 different workflows on a single platform hosted in the cloud. The platform would include a very thin user interface and very custom business logic that can change on the fly.
What’s common across this platform would be how we identify users and handle access control. Plus how we search across all our data. That should be consistent, so if I want to search for all instances of a license — whether for ham radio, TV or airplane — I can do it across what has historically been 207 different systems that are now on the same platform.
BRAY: Because we’re moving to this common platform, we want to make sure that at the very beginning stages, even before we write any code, we are thinking about where we’re putting security and privacy controls into anything we do. We can think about that in the workflow; then, when we start writing the code, we should make sure we’re doing user identification and access control at the code level and the data layer. So, even if someone is able to penetrate our user interface, even if someone is able to penetrate our business code, there is still access control at the data layer, as well as strong encryption.
If I can specify how the systems should work, I can also specify how systems shouldn’t work and be able to fire off alerts to our security folks when something odd is going on. It could be the servers have a problem, or there’s a software bug, or someone is trying to do something malicious. Regardless, the world we are going into has so many applications and so many different ways someone can attack you that if you don’t tip off a human to pay attention, they might miss what’s going on.
BRAY: We want to get there. I’d love to be able to say, again, in three years, that we don’t host anything physically here at the FCC. It’s not our business. Our business should be to focus more on the mission and let IT be taken care of by experts outside.
BRAY: Putting systems in the cloud helps. But you have to be very explicit about where you’re storing data and what you’re doing in the cloud. We need cloud providers to feed us information in real time about what they’re seeing in terms of transactions and audit logs so we can better monitor the cloud.
I am a big supporter of FedRAMP [the Federal Risk and Authorization Management Program], but it’s just a start. For example, we should be doing continuous diagnostics and monitoring in the cloud, and we need more insight into the cloud systems themselves. You can guess that if anything started slowing down or something was offline, I’ll get an immediate phone call from the FCC Chairman’s office. With the proper monitoring and cloud insight, we can say what’s going on and how we will fix it.
BRAY: When I got here, there was limited virtual private networking and old mobile machines. The good news is we are rolling out virtual desktops, which will allow people to access their Windows desktops anywhere, on any device, including a device they choose themselves. We are also purchasing iPads with keyboards. I fully expect a day in which we say, “I no longer need a desktop.”
BRAY: We’ve piloted informally and are planning to launch formally an FCC Ambassadors Program to bring in short-term contractors — not your typical D.C. contractors — for 120 to 180 days, with the option to renew. In the pilot phase we’ve brought in three ambassadors.
We also piloted a Fellows Program. The difference is that ambassadors are more like contractors and fellows are government hires on detail or term appointments. When I think of the months of interviews before I was on board at the FCC, that’s good and should happen for many jobs. With our fellowships, we want to ramp up quickly and build a team with smart people who maybe weren’t considering public service as a long-term career.