GAO: OMB’s Data Center Policy Puts Agencies’ Networks at Risk of Cyberattacks

Following a shift in federal policy last year that pushed agencies to focus on closing major data centers over servers in closets and under desks, the Government Accountability Office released a report Thursday criticizing the new policy for decreasing visibility into the number of data centers operating across the government and making agencies more vulnerable to cyberattacks.

The original Data Center Closure Initiative kicked off in 2010 during the Obama administration. The goal at the time was to identify and cap the explosion of data centers across the government, which had grown from 432 in 1998 to more than 2,000 in 2010. However, officials soon realized this number did not fully encompass all of the servers running throughout the government, including smaller “data centers” tucked in small rooms or otherwise maintained outside of traditional facilities.

In 2016, the initiative was revamped with a focus on anything that could conceivably qualify as a data center, resulting in a larger count of more than 5,600 data centers in August that year. The inventory peaked at 5,916 in August 2018.

Then, in June 2019, the Trump administration released the Data Center Optimization Initiative, which superseded past closure efforts.

“OMB directed agencies to stop reporting on spaces not designed to be data centers as part of their inventory,” GAO auditors wrote. The new policy redefined a data center as a “purpose-built, physically separate, dedicated space that meets certain criteria.”

“As a result, agencies are no longer required to report on about 2,000 facilities, some of which are considerable in size and will continue to operate,” the report states.

The revised count put the total number of data centers at 2,727 at the start of fiscal 2019.

Under the new metrics, agencies showed significant success in 2019, closing or on track to close 286 data centers by the end of the fiscal year.

“According to agencies’ data center inventories, almost all of the 24 agencies met or planned to meet their fiscal year 2019 closure targets,” the report states. “In addition, agencies reported that their DCOI-related activities had either achieved, or planned to achieve, the $241.5 million in total planned savings for fiscal year 2019.”

Specifically, “three agencies reported that they did not have any agency-owned data centers and had a target of zero closures; five agencies were not expected to close any of their operating data centers during the fiscal year, and their target was zero; 13 agencies reported meeting or exceeding their target closures by August 2019; and two agencies—the Departments of Defense and Veterans Affairs—reported closing a number of data centers and had additional closures planned that were expected to meet their respective fiscal year targets.”

Based on these numbers, GAO projected the total number of data centers operating across the government at the end of fiscal 2019 at 2,441.

Over the next three years, agencies reported plans to close another 37 data centers. Ten agencies told GAO they planned to shutter a combined 31 data centers in fiscal 2020; the Energy Department and Social Security Administration reported plans to close five data centers between them in 2021; and the Homeland Security Department expects to close another in 2022.

GAO auditors said, based on experience, the number is likely to grow when agencies submit their annual plans to OMB in the spring.

However, GAO was heavily critical of OMB’s new policy.

“Many of the smaller facilities that are now exempt from DCOI reporting represent what OMB has said in the past are the types of data centers that should be included in DCOI because of the risks they posed,” the report states. “Because of OMB’s decision to remove these types of data centers from DCOI reporting, agencies may lose track of the security vulnerabilities that these facilities present due to the consequent reduction in overall visibility and oversight into all data centers.”

These criticisms reflected similar concerns expressed by members of the House Committee on Oversight and Reform. At a hearing held in June of last year, GAO Director of IT and Cybersecurity Issues Carol Harris said the new policy would exempt a large number of data centers currently being counted.

“The changes will likely slow down or even halt important progress agencies should be making to consolidate, optimize and secure their data centers,” she said.

“What is it that OMB is doing in emphasizing optimizing and exempting from our audit, here, 80% of the data centers that exist?” Rep. Gerry Connolly, chair of the House Oversight Subcommittee on Government Operations, said during that hearing. “Because we’re afraid that, whatever your intent, the consequence is we won’t capture that and we will not effectuate the savings the law was intended to encourage.”

Federal Chief Information Officer Suzette Kent said that, as the data center count grew, it began to contain things that shouldn’t move to a cloud environment, such as printers, weather stations, MRI machines and “things that weren’t actually classified as a data center.”

“We also understand—and very clearly from talking with agencies—there are some reasons where we will continue to operate a data center: a supercomputer site, something that is needed for resiliency, special needs of agencies that we believe are very important,” she said. “We want to ensure that those are being operated efficiently and securely with the intent of this committee.”

GAO also warned the updated policy will create a cybersecurity risk across government, as agencies will no longer be tracking these smaller servers.

“We recognize that OMB’s data center definition and reporting revisions are an effort to focus agency closure and optimization efforts on certain types of facilities,” GAO wrote. “However, OMB’s own past guidance has acknowledged the security risks posed by the types of facilities that agencies can now exclude from DCOI. While agencies are best positioned to determine whether these locations should be closed or optimized, it is important that these facilities, previously covered by DCOI, continue to be reported on quarterly, regardless of whether they are subject to closure or optimization.”

In its response to the draft report, OMB pushed back against the assertion that decreased reporting on now-former data centers would increase the cybersecurity risk—going so far as to remove references to cybersecurity from the report entirely.

“In raising these objections, OMB’s comments stated that DCOI is focused on consolidating and optimizing the federal data center portfolio and that cybersecurity is not a primary driver of the initiative,” according to GAO’s summary of OMB’s response. “These comments noted that many other laws, policies, and procedures directly deal with the cybersecurity posture of all federal IT systems, and that OMB’s DCOI guidance does not affect the applicability of those requirements.”

OMB official also reportedly acknowledged that past guidance cited better cybersecurity as a windfall, however, “this was because agency CIOs could better allocate constrained resources across a smaller portfolio of devices.”

The full text of the response was not included in the report.

GAO also hit OMB on new reporting standards for the IT Dashboard. While in previous years the dashboard broke out annual data center totals and closures, the data now reflects “cumulative numbers of actual and planned data center closures,” the report states. “This lack of visibility into exactly how many closures the agencies expect to achieve every fiscal year jeopardizes OMB’s and Congress’ ability to effectively oversee agencies’ data center consolidation efforts.”

Ultimately, GAO made four recommendations to OMB:

• The director should require that agencies explicitly document annual data center closure goals in their DCOI strategic plans and track those goals on the IT Dashboard.
• The director should require agencies to report in their quarterly inventory submissions those facilities previously reported as data centers, even if those facilities are not subject to the closure and optimization requirements of DCOI.
• The director should document OMB’s decisions on whether to approve individual data centers when designated by agencies as either a mission-critical facility or as a facility not subject to DCOI.
• The director should take action to address the key performance measurement characteristics missing from the DCOI optimization metrics, as identified in this report.

In their response, OMB officials did not state whether they agreed or disagreed with GAO’s recommendations.

The oversight agency also made specific recommendations to three agencies, stating that NASA and the departments of Agriculture and Commerce should “take action to achieve [their] data center-related cost savings target,” and that Commerce should also “take action to meet its data center optimization metric  targets.”

All three concurred with GAO’s recommendations.