The push to modernize legacy tech

Federal agencies are increasingly deploying new technologies, such as artificial intelligence, and revamping their IT systems to improve their operations. But modernization projects can take a long time to complete, especially when it comes to the sprawling networks that underpin many of the government-run services that are deeply involved in the lives of millions of Americans. 

All too often, agencies must continue maintaining some legacy systems while they’re improving others to ensure uninterrupted access to critical services. In addition, officials are working to secure outdated systems so they can better respond to a cyberthreat environment in which bad actors and hostile nation-states are exploiting any vulnerabilities they can find. 

Some large agencies, including the departments of Transportation and Veterans Affairs, are pushing forward with massive modernization projects. Their efforts have underscored both the benefits of upgrading existing technologies and some of the complexities involved in simultaneously maintaining legacy systems. 

As the Trump administration pushes forward on several initiatives designed to inject newer technologies into agencies, officials are optimistic that further adoption of these tools will significantly improve the delivery of federal services — even if the reliance on outdated and legacy systems continues to be widespread across government.

Enhancing the security of legacy technologies

The U.S. government is notoriously slow to adopt new IT capabilities, which means officials are sometimes forced to bolster the cybersecurity of legacy systems with new approaches. Protecting critical infrastructure services from cyberthreats, for instance, requires operators to balance modern security strategies with a continued reliance on sometimes decades-old systems and devices. 

Although some lawmakers and agencies, including the Federal Communications Commission, have tried to make it easier and more cost-effective for telecommunications carriers and other providers to remove risky technologies from their networks, accomplishing such efforts across the entire country is often prohibitively expensive. 

Many of the operational technologies embedded in critical infrastructure “weren’t designed for this kind of environment from an IT perspective, but we have to lash them up to the IT systems in order to get an enterprise view of what’s our cyber posture,” said John Sahlin, vice president of cyber pursuit at General Dynamics Information Technology.

Upgrading those underlying technologies to operate securely in today’s threat environment can be difficult, he added, because it is costly to harden all the systems, and modernizing them can be a long process. “It takes a lot of time, and the threat is not a tomorrow threat, it’s not a next-year threat, it’s a now threat,” Sahlin said, adding that Iranian hackers’ recent attack on water systems in Minnesota and other activities by hostile nation-state actors underscore the danger of leaving those technologies vulnerable. 

GDIT recently launched a zero trust solution for the Defense Department that addresses some of those concerns by integrating with the agency’s existing IT services, including those that may be considered outdated. Sahlin likened this approach to attaching Lego bricks to the underlying technologies so officials can take advantage of modern cybersecurity capabilities without needing to fully replace their systems. 

Pentagon CIO Kirsten Davies voiced concerns about securing the department’s legacy systems during a talk at the Billington Cybersecurity Summit in Washington, D.C., in September. To ensure network security in an increasingly complex threat environment, “we can’t continue to throw people at the cyber problem; we have to throw technology at the cyber problem,” she said.

Although Davies noted that DOD is adopting new capabilities such as AI to manage its cybersecurity operations, the department’s use of a broad range of new and outdated IT systems presents “a complex Rubik’s Cube of problems.”

To bolster cybersecurity, she said officials have been building a technology workforce that knows how to leverage emerging capabilities. She added that when one small IT problem can have a ripple effect across the entire department, it’s important to “think about leveraging the fantastically skilled people that we have in a much more effective way.”

Davies said assistance from industry has proven to be helpful in strengthening the security of DOD systems and creating the internal technology talent she described.

Rudolf Rojas, a technical program manager at the Agriculture Department, said USDA collects a wide range of data that is stored and used across its networks, “so it’s definitely a real concern that this data stays sequestered within our [virtual private networks] and within our networks and is not hacked or vulnerable to outside activities.” He made the comments at GovExec’s Government and AI Summit in September.

He also said AI bots are increasingly and relentlessly attacking USDA’s websites. Vendors are helping USDA keep its systems and networks secure, but Rojas said human interventions are also critical when it comes to security, regardless of whether a new tool or a legacy system is being targeted by cyberattackers. 

The opportunity to rethink existing processes

Although the adoption of AI and other new capabilities can help agencies improve their overall operations, it is not a substitute for upgrading or replacing outdated technology. Fortunately, agency leaders have found that modernizing some systems can provide insights into the best way to address other outdated technologies.

For example, the State Department has embraced generative AI as a means of enhancing its overall operations. The agency released a playbook in July that details how it adopted and used the technology. The playbook focuses on the development of StateChat, an internal chatbot that employees can use for a range of tasks, including translating or summarizing documents. 

However, “there’s the risk of trying to automate or apply technology to a process that’s just a bad process and it shouldn’t be automated and it shouldn’t persist,” Erik Peterson, generative AI product owner for StateChat at the State Department’s Center for Analytics, told Nextgov/FCW. “Sometimes these technology deployments are a good opportunity to say, ‘OK, before we throw AI at this old problem and hope that the technology layer gets better, let’s ask the question fresh: Does this existing process actually do the thing the department needs to do or America’s foreign policy apparatus needs to do?’” 

If the answer to that question is no, he said agencies should “figure out the right thing to do with that [legacy] process,” which can include eliminating the underlying, outdated technology. 

The promise and peril of overhauling massive systems

Several modernization efforts have highlighted the give and take that happens when agencies must continue to rely on legacy systems during massive technology overhauls. Because the pace of change can be slow, it is critical to maintain access to older technologies and ensure their interoperability with new services.

The Department of Veterans Affairs is in the midst of overhauling its legacy electronic health record (EHR) system — known as the Veterans Health Information Systems and Technology Architecture (VistA) — with new Oracle-provided software.

Although VistA has historically received praise from clinicians and veterans alike, it relies on an outdated programming language. To modernize the EHR system and make it more interoperable with DOD’s new EHR, VA is in the process of deploying the Oracle software at 164 medical facilities.

The massive modernization project, however, has been beset by cost overruns, technical glitches and usability concerns since the first deployment went live in 2020. VA paused most deployments of the new system in 2023 to address the issues, and the department resumed the software rollouts earlier this year. 

Throughout this process, VA is still operating VistA across much of its medical network while also working to ensure the legacy system’s interoperability with the new EHR. VA officials now say they do not expect the overhaul to be completed until 2031, and the department is spending roughly $800 million a year to maintain VistA as the modernization effort continues. 

Meanwhile, the Transportation Department and the Federal Aviation Administration have undertaken a large-scale effort to modernize the nation’s outdated air traffic control system. Under the current Trump administration, the FAA is overseeing deployment of the Brand New Air Traffic Control System, with a goal of completing the overhaul by the end of 2028. 

The reliance on outdated systems, including paper-based communications and legacy control technologies, has led to an increase in flight delays and airplane accidents in the past few years. The FAA is rapidly pushing forward with the modernization project, and officials have been rolling out the new capabilities in a way that prioritizes airport-to-airport improvements to ensure controllers have uninterrupted access to the tools they need to monitor U.S. airspace.

In September, Washington Dulles International Airport became the nation’s 22nd airport to adopt electronic flight strips, which replace the paper strips that controllers previously used to track aircraft data, such as flight number, departure time and destination. Previously, those paper strips were handed from controller to controller as a flight progressed, with issues as minor as paper jams in printers potentially affecting airspace monitoring. 

An FAA spokesperson said the use of the new electronic flight strips “increases safety and efficiency by providing real-time updates and streamlining the flight-planning process.”

Even though technologies are being updated to enhance the nation’s air traffic control, Transportation Secretary Sean Duffy said officials are not in a rush to implement AI tools. “We are building all new equipment, whether it’s radar, radios [or] voice switches,” Duffy said at a National Artificial Intelligence Association event in September. However, AI adoption will be “a slow roll into the airspace.”

The fundamental importance of change management

Previous government mandates to upgrade internal tools and public-facing digital services have been slow to gain momentum, even as agencies increasingly experiment with and adopt AI tools and other technologies that can significantly enhance agency operations.

The 21st Century Integrated Digital Experience Act, which President Donald Trump signed into law during his first term, requires federal agencies to make their digital services more user-friendly and accessible. But in a 2024 report from the Government Accountability Office, the agencies that its auditors reviewed had only addressed 109 of the 192 requirements they were required to tackle.

However, more recent efforts — such as the General Services Administration’s OneGov strategy to streamline federal procurement of new technology and services — have helped agencies more quickly and cost-effectively onboard AI and other technologies. Federal officials say this type of approach will help drive governmentwide change, even with the continued reliance on some outdated systems. 

In an interview with Nextgov/FCW, GSA CIO David Shive said efforts like OneGov have “disrupted the long-standing practice of how technology is driven into the government,” with faster adoption leading to more effective customer service. But the success of modernization efforts also hinges on improving other types of outdated modalities such as organizational change management, which has historically been the biggest challenge when overhauling systems, he added. 

Earlier this year, GSA released a step-by-step guide to help agencies better incorporate emerging capabilities into their operations. The guide recommends that officials evaluate their networks for legacy systems that can, in part, be eliminated, but Shive said changing mindsets about using and deploying new technologies remains a major barrier. Although GSA’s guide largely focuses on streamlining agencies’ modernization approaches, he said, “the secondary value that we’re trying to generate is that organizational change management part — to demonstrate to our agency partners, ‘Look, this doesn’t have to be a big, bad, scary thing. It does work.’”