Watchdog Claims Retaliation From Military After Questioning Cushy Federal IT Contracts

Special report The CEO of an independent watchdog has challenged the award of single-source federal government IT contracts worth over $300 million to AWS, Bluestaq, and VMware.

As a result of doing so, the US Air Force has launched a "debarment" inquiry to determine whether to ban John Weiler – chief exec of the nonprofit Information Technology Acquisition Advisory Council (IT-AAC) – from doing business with the US government.

"They're going after the guy trying to deliver penicillin, because I'm calling out that the belief is in bloodletting," argued Weiler in an interview with The Register.

Weiler, whose whistleblowing work contributed to the cancellation of the Pentagon's $10 billion winner-takes-all Joint Enterprise Defense Infrastructure (JEDI) contract, told us he believes US national security is imperiled by the government's broken IT acquisition process.

"That's my reason for wanting to come to the press," he explained. "We need better transparency. We need our leaders to do their job. And we need to close the revolving door."

The "revolving door" refers to the way in which people working for private companies that win government contracts get hired by the agency granting the contract. According to Weiler, two former Amazon employees joined Space Force or Space Command prior to a sole source AWS contract award.

There's nothing necessarily nefarious about this, but the practice invites questions about conflict of interest. The Defense Department has rules on such things because there's a lot of back and forth between the public and private sectors.

The "revolving door" can also refer to government employees who leave the public sector to be hired by a company they had dealt with on the government side. Indeed, former government employees have gone on to work for IT-AAC.

Background

Weiler, as head of the congressionally chartered IT-AAC, has been focused on the federal IT procurement process for the past sixteen years. Many years prior, from 1987 to 1990, he worked for Oracle, which in recent years has contributed funds [PDF] to his watchdog organization.

We need better transparency. We need our leaders to do their job. And we need to close the revolving door

Oracle, along with other cloud vendors including Google and Microsoft, pushed back against the JEDI contract, which was initially given to Microsoft, then ultimately canceled and replaced in late 2021 with the Joint Warfighter Cloud Capability (JWCC) – a multi-vendor contract vehicle for defense cloud services.

Asked about funding – because critics cite this in order to invalidate his contract criticism as astroturfed rivalry – Weiler responded, "Everyone in IT worked for Oracle at some point. I quit in 1990. I run a consortium that is funded by dozens. Our research and advocacy is all about fair and open competition regardless of who is involved. Anyone can join who commits to fair open competition. Period."

Weiler said pretty much everyone in the IT industry – except for Amazon – has funded his nonprofit, either directly or indirectly through other non-profits. That includes Google, Microsoft, and IBM. He maintains his focus is not on any one company but on the broken federal IT acquisition process.

And he emphasizes this isn't about Amazon. It would be fine, he insists, if AWS won a contract by competing fairly. But that's not what he says is happening.

Scrutiny

"I'm here to help promote fair and open competition, and to be effective in buying IT for our national security," Weiler explained. "But today we're not. We're not even close. Competition provides better value to the mission, but also better value to the taxpayer."

Weiler has been raising this issue for years, to the annoyance of some in the defense community. In 2018, for example, the deputy director of the military's Defense Digital Service wrote to Weiler asking him to "cease and desist all efforts to communicate" with DDS staff because they felt harassed by his inquiries.

Weiler responded, "Leaving messages and or trying to follow up with members who attended our briefing is not harassment. The problem might be with your team who are seeking to avoid transparency, or have a hidden agenda. We are working in the public interest, seeking to support the rule of law."

His current situation follows from ongoing concerns he has raised related to the $280 million extension of a General Services Administration contract, awarded in 2020 to Bluestaq, to build a Unified Data Library (UDL) for the US Space Force (USSF) and Missile Systems Center Data Program Management Office.

The UDL, intended to be a data repository, started in 2018 when Bluestaq received an Air Force Small Business Innovation Research (SBIR) contract. It became a joint project with the Air Force Research Laboratory (AFRL) and USSF's Space and Missile Systems Center (SMC).

According to an unreleased IT-AAC report on the project, "The UDL’s vendor, Bluestaq, failed to complete the UDL after six years of generous funding. It is not clear whether this is by intent or inability. What is clear is that the UDL's inner workings are not known to the USSF. The taxpayer has paid for intellectual property that it never received. Instead, the taxpayer has paid for intellectual property, which Bluestaq treats as its own. The legality of this is questionable at best."

Bluestaq did not respond to requests for comment.

A public affairs officer for the Air Force acknowledged The Register's questions about the readiness of the UDL and whether the Defense Department has received any intellectual property (such as source code) associated with the project, but cautioned an answer might take some time due to the need to consult with multiple offices.

The Register also asked Amazon, Google, Microsoft, and Oracle to comment. Amazon and Microsoft declined while Google and Oracle did not reply. VMware was also invited to comment and did not respond.

• Oracle, Microsoft barely compete for a quarter of their US Federal contracts
• US Veterans Affairs department didn't check with CIO for 39% of IT projects
• The Pentagon has no idea how to deal with bad cloud contracts, say auditors
• Hands up anyone happy with Uncle Sam's $50B IT mega-job. Anyone?

Bluestaq, according to Weiler, relies on AWS. He cited this dependency in a September 27, 2023 email addressed to Space Force brass, and numerous other officers.

The email represents followup on prior communication related to a recent government notice about a $50 million sole-source contract out of Launch 45 Patrick Air Force Base for AWS cloud computing services. That Blanket Purchase Agreement, Weiler wrote, had not been completed, and should have been as required by Federal Acquisition Regulation (FAR) and as outlined in an August memo [PDF] by DoD CIO John Sherman that called for transparency in all cloud acquisitions.

Weiler's letter challenges various Amazon claims in its Justification and Approval (J&A) document, which is required under FAR for sole source contracts.

He takes issue, for example, with Amazon's assertion that AWS is the only cloud service provider (CSP) capable of delivering the IaaS and PaaS services required for the contract award. "This is unsupported by the facts," insists Weiler. "All four CSPs support [these] requirements, with Google still waiting for IL5 cert."

He further claims, "The Unified Data Library (UDL) was improperly built on a proprietary AWS network fabric: The referenced CSO [chief software office] policy is only that legacy and future programs interface with UDL, it does not require the infrastructure of UDL to be used by every future program. Facts suggest that UDL lacks effective engineering oversights, and does not meet Clinger Cohen, MOSA mandate or other FAR regs. If UDL broke the law, this is not a justification for more abuses."

Weiler told The Register defense leaders have been unable to answer the email because in his view the awards to AWS and Bluestaq are unsupported by facts or evidence. "And we've learned that the contract that they've awarded can't even provide the level of classification they say is mandatory," he said.

Uncle Sam hits back

For raising this ruckus, Weiler received a letter dated October 20, 2023 from Derek Santos, Deputy General Counsel of the Air Force, challenging his behavior.

"Specifically, I have received information that you have misrepresented your interactions with Air Force leaders in your communications with Air Force officials," the letter reads.

"I am very troubled by this, as it pertains to your present responsibility. As a result, I have begun to review the information available to me pursuant to my reciprocal authorities in 2 C.F.R. 1125 (Nonprocurement Debarment and Suspension) and Subpart 9.4 of the Federal Acquisition Regulation (Debarment, Suspension and Ineligibility)."

The contract they've awarded can't even provide the level of classification they say is mandatory

Weiler answered in early November and denied any wrongdoing.

"We at the IT-AAC were extremely disappointed that our self funded efforts to support USSF long sought acquisition reforms were answered with hostility and retaliatory actions," he wrote.

"At no time did I, nor any member of my team, misrepresent our communications which were mostly in written correspondence. As a concerned citizen, a taxpayer and a non-profit competition advocate, I have an obligation to help our appointed leaders understand and uphold the rule of law."

His reply states: "We believe that the actions of our unnamed accusers were in retaliation for highly questionable sole source contracts worth over $300m to Bluestaq, AWS and VMware."

A US Air Force spokesperson told The Register, "The Department of the Air Force has been in the process of gathering information on this matter. No formal action has been taken."

"This is on the government," declared Weiler. "And actually Amazon's got a great product. But let the competitive process do its job. That's why it's there. That's why we have the FAR, not for you to bypass it." ®

Is there a story we ought to investigate? Email us in confidence or use the secure tip-off form from here.