Does the IRS have a cloud strategy?

Does the IRS have a cloud strategy?

Congress and government watchdogs want to know and are concerned that agency officials are passing up efficiency and cost-savings opportunities by adopting a broader strategy for using the cloud.

An inspector general report released Aug. 7 took the IRS to task for lacking a formal plan, nearly seven years after former Federal CIO Vivek Kundra made "cloud-first" the official policy of the federal government in 2010.

According to the report, the IRS did not form a working group to examine the issue until July 2016. Meetings by the working group were said to be "informal," and by the time the Treasury Inspector General for Tax Administration had completed its fieldwork, the group had not even settled on an official definition of "cloud."

Congress has taken notice as well. A legislative report on the 2018 Financial Services and Government Appropriations bill expressed concern that the IRS "appears slow to adopt new IT strategies including transition to commercial cloud services that offer enhanced security and cost savings."

The committee report mandates IRS update the House and Senate six months after the bill's passage to provide agency plans for commercial cloud adoption, any associated security benefits and cost savings and how the agency is progressing on related goals that would leverage cloud computing technologies, such as data center consolidation.

In speaking to former top IT officials at the agency and others in government who are familiar with its IT infrastructure, a more complicated story emerges.

Terry Milholland served as CTO at the IRS from 2008 to 2016 and has been credited with leading an "IT renaissance" at the agency by officials like former Commissioner John Koskinen. Milholland told FCW he could only speak about the situation in the context of his tenure, but he rejected outright the allegation that the IRS lacks a plan for leveraging the cloud.

"When I was there, we had a cloud strategy that we articulated to the inspector general, and it was well understood within the business of how we were going to roll down old systems," he said.

He articulated the plan as moving storage of IRS data and applications to a private, federally owned cloud while utilizing a public cloud -- such as Amazon Web Services, IBM or Oracle -- for development purposes. New and non-mission-critical systems would be prioritized for deployment or migration.

To the extent that the IRS has been slow to implement this plan, Milholland placed the majority of the blame on four interrelated factors: budget cuts, the resulting loss of top-tier IT human capital at the agency over the years, an outdated legacy IT infrastructure that requires perpetual workarounds and a culture of risk aversion that has made the agency wary of moving sensitive data out onto a public cloud.

The IRS did not respond to multiple requests by email and phone to comment for this story.

Modernizing on the cheap

Budget cuts and a hostile political environment have also hamstrung the agency's attempts to modernize. Since taking over the House and Senate, Republican legislators have sought to limit spending at the agency. According to the left-leaning think tank Center for Budget and Policy Priorities, since 2010, IRS funding has dropped 18 percent after adjusting for inflation, and the agency has lost nearly 14 percent of its workforce. Last year, the House passed an appropriations bill freezing funding levels at the IRS, citing mismanagement and politically biased treatment of conservative 501(c)(4) charities.

Meanwhile, President Donald Trump's proposed budget for next year would slash funding even further. The proposed cuts seemingly go against the counsel of his own Treasury Secretary Steven Mnuchin, who told Senators during his confirmation hearing that previous budget cuts have already had a negative impact on the agency's workforce and technology priorities.

"I am concerned about the staffing of the IRS. It is an important part of fixing the tax gap, and I am very concerned about the lack of first-rate technology at the IRS, the issue of making sure that we protect the American public's privacy when they give information to the IRS," Mnuchin said.

Milholland said funding cuts have impacted the ability of the IRS to move quickly on priorities like cloud computing in two ways: by draining the agency of the resources and talent necessary to adopt newer technologies and by forcing the remaining IT staff to focus nearly all of its attention on ensuring the agency's applications are maintained and updated with the latest tax law information for filing season.

Richard Spires, who served as CIO for the IRS from 2004 to 2008, said budget concerns were hampering the agency even before the GOP-controlled Congress began freezing and cutting funding levels in the wake of the scandal related to targeting certain charities for intensive scrutiny.

"When I became CIO, so much of our energy went into making sure that deadlines around tax season were met, and so that really makes it very difficult to do significant modernization efforts," Spires said. "When you get to a situation where the IT organization is struggling to do anything but maintain what they've got, you're going to keep falling further and further behind."

An ancient legacy

There may also be internal technological complications that help explain the agency's sluggish cloud adoption. Its central data processing system dates back to the 1960s, and previous attempts to modernize or update to newer technologies have faltered in the face of numerous integration, workforce and budgetary issues.

David Powner, director of IT management issues at the Government Accountability Office, has extensive experience over the past decade reviewing the IRS' IT infrastructure. He said it would not surprise him if the agency isn't pursuing cloud adoption as aggressively as other departments and agencies, but that fact should be tempered with the reality that large chunks of its legacy IT system may not be compatible with the cloud.

"At the IRS, their applications, like the [Individual Master File] that processes tax returns, are so unique to their mission that none of their core systems are candidates to go to the cloud," Powner said. "It's an application that you're not going to find anywhere in the world other than the IRS, and it changes every year as Congress changes the tax code."

Theresa A. Pardo, director at the Center for Technology in Government at the University of Albany and research professor at the Rockefeller College of Public Affairs and Policy, said governments that still rely on older legacy IT systems tend to be particularly ill-suited to widespread adoption of newer technologies like cloud computing.

"We're expanding the diversity of the IT portfolio, and governments have systems out there that are old and trying to integrate or take advantage of newer technologies, particularly in larger government agencies," Pardo said. "The challenge is we haven't had enough de-investment or transition from these old systems."

If the agency does have a formal plan in place, it's unclear to what extent it is documented and disseminated throughout the agency. Milholland said he believes it is located in the tax agency's five-year strategic plan but said he was unsure of where it would have been published.

The Inspector General's report suggested that current officials may not be aware of established guidelines and resources around cloud adoption. It noted that the IRS did not follow established federal security or risk assessment protocols while using AWS cloud services last year to make publicly available tax documents for certain charities and tax-exempt organizations. It also did not establish a service-level agreement with AWS, potentially leaving the agency high and dry if the company decided to execute its 30-day service cancellation policy.

"At a minimum, the IRS should ensure that the service level agreement contains clearly defined terms, definitions and performance parameters, and also defines who is responsible for measuring service level agreement performance," the report stated.

The IRS disagreed with the Inspector General's recommendation, saying its deal with AWS already included a terms-of-service agreement that both parties accepted and that "it is unclear that a service level agreement would be appropriate for the free-access arrangement, for which no payment or procurement actions are authorized."

Culture shock

Former agency officials have described a culture of risk aversion and posture of protectiveness towards data as another contributing factor slowing cloud implementation.

"There was a culture when I was there where the IRS maintained its own data centers. It was very much a 'we don't let anybody in' mentality," Spires said. "I'm not surprised that they wouldn't be as advanced in cloud and the use of public cloud as much as other [agencies], because of the nature of the data they hold and the culture of what the IRS has been for the lasts 30 or 40 years."

Milholland said the nature of the IRS' work tends to attract cautious employees.

"These are very smart men and women in the IRS, but they're lawyers and accountants, two of the most risk-averse professions out there," he said. "They worry about these items and don't want somebody to wave their arms and claim everything's fine."

That caution extends to concerns around security of data, particularly around public clouds. Powner pointed to agencies like the CIA that have been able to embrace commercial cloud services.

"The one thing that's interesting, when the intelligence community went to Amazon for cloud services, the main question was concern around security. If it's good enough for the intel community, it's probably good enough for others," he said.

Spires, who pushed aggressively for cloud adoption while serving as CIO for the Department of Homeland Security, said he thinks security is not nearly the concern it was five years ago. Most of the major cloud providers have their professional reputations staked on providing services and the security that goes with it. Meanwhile, certification procedures like Federal Risk and Authorization Management Program have provided a sufficient support structure that there is little in the way of meaningful differences between an on-premise and off-premise approach.

"I think it's a fallacy to think that you're going to be doing things necessarily more secure because you have a firewall, or you're in your own data center," Spires said.

Milholland said the CIA uses a contractor known for its public cloud services, but AWS actually built a private cloud for the agency. To him, demonstrating the risks around public cloud security to akin to disproving a negative.  

"What can I say? The same people that criticize us [for not being more aggressive on cloud adoption] would criticize the hell out of us if we had a data exposure."