GAO: OMB’s Data Center Policy Puts Agencies’ Networks at Risk of Cyberattacks

Gorodenkoff/Shutterstock.com

The administration pushed back hard against the assertion, going so far as to request GAO remove cybersecurity from its latest report.

Following a shift in federal policy last year that pushed agencies to focus on closing major data centers over servers in closets and under desks, the Government Accountability Office released a report Thursday criticizing the new policy for decreasing visibility into the number of data centers operating across the government and making agencies more vulnerable to cyberattacks.

The original Data Center Closure Initiative kicked off in 2010 during the Obama administration. The goal at the time was to identify and cap the explosion of data centers across the government, which had grown from 432 in 1998 to more than 2,000 in 2010. However, officials soon realized this number did not fully encompass all of the servers running throughout the government, including smaller “data centers” tucked in small rooms or otherwise maintained outside of traditional facilities.

In 2016, the initiative was revamped with a focus on anything that could conceivably qualify as a data center, resulting in a larger count of more than 5,600 data centers in August that year. The inventory peaked at 5,916 in August 2018.

Then, in June 2019, the Trump administration released the Data Center Optimization Initiative, which superseded past closure efforts.

“OMB directed agencies to stop reporting on spaces not designed to be data centers as part of their inventory,” GAO auditors wrote. The new policy redefined a data center as a “purpose-built, physically separate, dedicated space that meets certain criteria.”

“As a result, agencies are no longer required to report on about 2,000 facilities, some of which are considerable in size and will continue to operate,” the report states.

The revised count put the total number of data centers at 2,727 at the start of fiscal 2019.

Under the new metrics, agencies showed significant success in 2019, closing or on track to close 286 data centers by the end of the fiscal year.

“According to agencies’ data center inventories, almost all of the 24 agencies met or planned to meet their fiscal year 2019 closure targets,” the report states. “In addition, agencies reported that their DCOI-related activities had either achieved, or planned to achieve, the $241.5 million in total planned savings for fiscal year 2019.”

Specifically, “three agencies reported that they did not have any agency-owned data centers and had a target of zero closures; five agencies were not expected to close any of their operating data centers during the fiscal year, and their target was zero; 13 agencies reported meeting or exceeding their target closures by August 2019; and two agencies—the Departments of Defense and Veterans Affairs—reported closing a number of data centers and had additional closures planned that were expected to meet their respective fiscal year targets.”

Based on these numbers, GAO projected the total number of data centers operating across the government at the end of fiscal 2019 at 2,441.

Over the next three years, agencies reported plans to close another 37 data centers. Ten agencies told GAO they planned to shutter a combined 31 data centers in fiscal 2020; the Energy Department and Social Security Administration reported plans to close five data centers between them in 2021; and the Homeland Security Department expects to close another in 2022.

GAO auditors said, based on experience, the number is likely to grow when agencies submit their annual plans to OMB in the spring.

However, GAO was heavily critical of OMB’s new policy.

“Many of the smaller facilities that are now exempt from DCOI reporting represent what OMB has said in the past are the types of data centers that should be included in DCOI because of the risks they posed,” the report states. “Because of OMB’s decision to remove these types of data centers from DCOI reporting, agencies may lose track of the security vulnerabilities that these facilities present due to the consequent reduction in overall visibility and oversight into all data centers.”

These criticisms reflected similar concerns expressed by members of the House Committee on Oversight and Reform. At a hearing held in June of last year, GAO Director of IT and Cybersecurity Issues Carol Harris said the new policy would exempt a large number of data centers currently being counted.

“The changes will likely slow down or even halt important progress agencies should be making to consolidate, optimize and secure their data centers,” she said.

“What is it that OMB is doing in emphasizing optimizing and exempting from our audit, here, 80% of the data centers that exist?” Rep. Gerry Connolly, chair of the House Oversight Subcommittee on Government Operations, said during that hearing. “Because we’re afraid that, whatever your intent, the consequence is we won’t capture that and we will not effectuate the savings the law was intended to encourage.”

Federal Chief Information Officer Suzette Kent said that, as the data center count grew, it began to contain things that shouldn’t move to a cloud environment, such as printers, weather stations, MRI machines and “things that weren’t actually classified as a data center.”

“We also understand—and very clearly from talking with agencies—there are some reasons where we will continue to operate a data center: a supercomputer site, something that is needed for resiliency, special needs of agencies that we believe are very important,” she said. “We want to ensure that those are being operated efficiently and securely with the intent of this committee.”

GAO also warned the updated policy will create a cybersecurity risk across government, as agencies will no longer be tracking these smaller servers.

“We recognize that OMB’s data center definition and reporting revisions are an effort to focus agency closure and optimization efforts on certain types of facilities,” GAO wrote. “However, OMB’s own past guidance has acknowledged the security risks posed by the types of facilities that agencies can now exclude from DCOI. While agencies are best positioned to determine whether these locations should be closed or optimized, it is important that these facilities, previously covered by DCOI, continue to be reported on quarterly, regardless of whether they are subject to closure or optimization.”

In its response to the draft report, OMB pushed back against the assertion that decreased reporting on now-former data centers would increase the cybersecurity risk—going so far as to remove references to cybersecurity from the report entirely.

“In raising these objections, OMB’s comments stated that DCOI is focused on consolidating and optimizing the federal data center portfolio and that cybersecurity is not a primary driver of the initiative,” according to GAO’s summary of OMB’s response. “These comments noted that many other laws, policies, and procedures directly deal with the cybersecurity posture of all federal IT systems, and that OMB’s DCOI guidance does not affect the applicability of those requirements.”

OMB official also reportedly acknowledged that past guidance cited better cybersecurity as a windfall, however, “this was because agency CIOs could better allocate constrained resources across a smaller portfolio of devices.”

The full text of the response was not included in the report.

GAO also hit OMB on new reporting standards for the IT Dashboard. While in previous years the dashboard broke out annual data center totals and closures, the data now reflects “cumulative numbers of actual and planned data center closures,” the report states. “This lack of visibility into exactly how many closures the agencies expect to achieve every fiscal year jeopardizes OMB’s and Congress’ ability to effectively oversee agencies’ data center consolidation efforts.”

Ultimately, GAO made four recommendations to OMB:

  • The director should require that agencies explicitly document annual data center closure goals in their DCOI strategic plans and track those goals on the IT Dashboard.
  • The director should require agencies to report in their quarterly inventory submissions those facilities previously reported as data centers, even if those facilities are not subject to the closure and optimization requirements of DCOI.
  • The director should document OMB’s decisions on whether to approve individual data centers when designated by agencies as either a mission-critical facility or as a facility not subject to DCOI.
  • The director should take action to address the key performance measurement characteristics missing from the DCOI optimization metrics, as identified in this report.

In their response, OMB officials did not state whether they agreed or disagreed with GAO’s recommendations.

The oversight agency also made specific recommendations to three agencies, stating that NASA and the departments of Agriculture and Commerce should “take action to achieve [their] data center-related cost savings target,” and that Commerce should also “take action to meet its data center optimization metric  targets.”

All three concurred with GAO’s recommendations.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.