Federal IT’s ability to sustain delivery of vital services to citizens stands out as one of the brightest aspects of the COVID-19 pandemic. MeriTalk is chronicling the untold stories of that heavy lift, and the lessons it holds for the future as the nation embarks on the journey toward a more certain future. In the latest chapter of CIO Crossroads, we look at the U.S. Army’s IT evolution four months into the fight.
Foresight, Innovation Drive Army’s Pandemic Response – CIO Q&A
In the U.S. Army and the other military service branches, one thing matters above all others, protecting our people and executing on the mission. In the spirit of “forewarned is forearmed,” Army leadership began to take action in February to adapt operations for the pandemic gathering force beyond the horizon.
As part of the Defense Department’s Telework Readiness Task Force that enabled more than 900,000 remote work user accounts by mid-April, the Army adapted and innovated at speed. The number of soldiers using Commercial Virtual Remote (CVR)/Microsoft Teams went from zero to the current state of 348,000, while the Pentagon itself jumped from 5 percent telework to 90 percent in less than a month.
In the role of operating and defending networks, the Army’s Cyber Command/Network Enterprise Technology Command (NETCOM) unit worked to boost enterprise capacity four-fold; half of all medical interactions went virtual; and the long-sought goal of virtual training capabilities got a big jumpstart to 5,000 classrooms in 14 locations and at 33 different schools. As personnel quickly adapted to virtual technology, Army IT trained them up with plain-language cybersecurity instruction.
In an exclusive interview with MeriTalk, Army CIO Lt. Gen. Bruce Crawford says the quick pivot to a more virtual footing reflects two things that the service branch does very well: adapt and innovate. After just a few months, Army personnel have successfully worked the new tech into their battle rhythm and aren’t looking back.
MeriTalk: Please tell us about your largest priorities and greatest successes during the COVID-19 pandemic. What are you most proud of?
Lt. Gen. Crawford: In the context of priorities, Army leadership set four priorities for us back in February – protect the force, maintain readiness, support the whole of nation effort, while continuing to preserve the capability to build the future Army. These priorities were pretty powerful in setting conditions for us to be where we are right now, which is up and running, Army Strong, just like you want us to be.
The Army is big – the third largest organization of any kind in the world – and we do two things really, really well. We adapt and we innovate. I think both of those have been on display, given the Pre-COVID missions that we’ve been able to keep going. Among the things I’m most proud of – because there are many – is how quickly the Army adapted and innovated.
MeriTalk: Where do you see challenges?
Lt. Gen. Crawford: The greatest challenge, because there are several, has to do with the rapid expansion of the cyber-attack surface.
If you think about what we did almost overnight, we went from defending the traditional perimeter – post camps, stations, and the Pentagon – to literally defending the living room because of telework.
We went from probably five percent of the people teleworking to about 90 percent of the Pentagon teleworking within 30 days. In weeks, we had to go from defending the traditional perimeters – and I would argue we are the best in the world at that when you bring in NSA, Cyber Command, and each of the service cyber components – to posturing ourselves to defend the living room. It was really interesting to watch because it took a lot of education.
Another challenge, if I had to pick one, would be culture. With the Army having well over 348,000 active CVR/Microsoft Teams users and 1.2 million accounts provisioned, I would argue we are probably one of the world’s largest consumers of that particular platform. But sometimes you can show people and talk about collaboration tools and how important they are, but it’s not a part of their life. It’s not a part of their DNA. So it’s, “Yeah, yeah, yeah, when I need that, I’ll use that tool.” When I say culture, it was getting the workforce back to adapting to accept these tools. “Challenge” is maybe not the right term for it, but it was something we had to overcome, and we had to do it quickly.
They saw the value in Teams immediately, and all of a sudden overnight they were doing things with it that we never ever dreamed that they would be doing. As an example, with this collaboration tool, a young Army Sergeant Team Leader can spin-up a virtual video session with his/her team and share/edit products, or conduct a training or maintenance meeting. This tool also enables the personal interaction required to take care of each other….there is no substitute for the ability to look in the eyes of those you lead.
Now across the Army, the workforce is leveraging the tool in ways that we never thought of before.
Now the Army can’t get it away from them. I get one question every day since we rolled it out over the last month and a half, “Sir, how long are we going to be able to keep CVR/Microsoft Teams? We’ve got to let you know we can’t go back. It’s now a critical component of how we do business every day.”
MeriTalk: Are you feeling entrenched in the “new normal,” and what does it look like?
Lt. Gen. Crawford: The new normal topic is fascinating because when I think new normal, I think about what happened on 9/11. I was in the Pentagon on 9/11, and I remember overnight how new ways of doing business just started happening, and people just had to adjust. People accepted this is the way we’re going to do business for the foreseeable future, and it’s not going to change. When I think about the term new normal, I think about that.
This situation is different. The whole idea of a new normal is going to come down to probably one of two questions – and back to behaviors. Will it be that we’re just going to take the old things that we used to do, and do those same things differently in the future? Or will new things actually emerge? There will be new things, new ways of doing business, new behaviors that emerge. I think it’s going to be a combination of both.
Consider virtual training. One of the things that Gen. Paul Funk [who heads the Army Training and Doctrine Command] wants to do is get away from just brick and mortar training. Pre-COVID, his question was, “How do I get to virtual training?” Maybe not all, because there’s no substitute for human interaction, but how do I get to virtual training? And the answer was, “Oh, sir, the enterprise network will never be able to handle that.” Yet, we’re doing it. We’re doing it in over 5,000 classrooms, eight different centers of excellence. There are 14 locations and 33 schools. Those include aviators at Fort Rucker, Ala., intel at Fort Huachuca, Ariz., and cyber and signal at Fort Gordon, Ga. In the end, this Commander wants to leverage the virtual space to bring training to the soldier instead of bringing the soldier to training.
That’s just a thought on the whole new normal. There are just too many variables in the equation, and maybe it will settle in the next six to eight months. But for the foreseeable future, it’s likely to be more of a “new now” than a “new normal.”
MeriTalk: How have your days changed since the start of the pandemic?
Lt. Gen. Crawford: I’m seeing an acceptance of the virtual space that has driven us to say, “This is what I’m doing most of the day.” For instance, I’m in the Pentagon, but I won’t likely attend one in-person meeting today, although the place that we used to meet is 100 yards down the hall. Every senior leader and principal official will likely be in their office and they will be virtually in a room and communicating. It’s exactly as we probably would have done it six months ago in person. So that’s probably been the major change, actually getting used to that.
One closing point on this subject is I believe the word “telework” will soon be a thing of the past. I think it will just be work. I don’t think people will care because of this acceptance of the virtual space, and this comfort that’s developed over time with it. We won’t be calling it telework anymore because it will just be work.
MeriTalk: What are the lessons learned since the pandemic began? And, knowing what you know today, what advice would you give to yourself three months ago?
Lt. Gen. Crawford: Strategic flexibility in network design has been a big lesson learned because of what I said about the new now versus the new normal. We tend to design based on what we think is more likely to happen by assessing the multiple courses of action and directions we could go.
I’d say the number one piece of advice that I would have given myself three months ago would have to be, “Look Crawford, you all need to make sure that you’re preserving decision space for the Army senior leadership, depending on which direction things could go, and that you build in operational and strategic flexibility that doesn’t tie them to one particular course of action.”
MeriTalk: What has the Army done to ensure service members and employees practice strong cyber hygiene while working from home? Can you provide any other cybersecurity data points?
Lt. Gen. Crawford: I talked about the Telework Task Force – and congratulations to Dana Deasy for pulling this together very early on. It’s really interesting to look at what we were talking about on day one, and what we’re talking about now, and how this has actually evolved.
One of the big outcomes of the task force and one of our early concerns was that, as people started to telework, we had no idea how fast and how far this was going to go. Is it going to be a 90-day thing? Is it going to be a six-month thing? Are we going to be in this for the long haul? Nobody really knew. So, how do we educate the workforce quickly?
In the room, there were three service CIOs – Navy CIO Aaron Weis, myself, and [now former] Air Force Deputy CIO Bill Marion. There was Dana Deasy and his team, DoD Deputy CIO Pete Ranks from a cloud perspective, along with Cyber Command and NSA in the room. We collectively pooled ideas – fueled with real data on threats – that we could turn into unclassified tasks for the workforce. Not only did we have weekly meetings, we met with Dana every day for three to four hours during the first six to eight weeks.
We produced a document called “Cyber Do’s and Don’ts,” in plain English, because the first iteration was way too technical. This is a logistician we’re going to hand this to – he’s not an IT guy, he’s part of the workforce. “Cyber Do’s and Don’ts” is threat-informed and virtual so we could update it over time. We gave that to the workforce and talked to them about it. Most of my time is spent educating the workforce.
From a cybersecurity perspective, it was all about a couple things. First, it was about educating the workforce with the “Cyber Do’s and Don’ts.” And, it was about examining zero trust attributes and whether the COVID environment allows us to accelerate big ideas that we were already working on. We’re not there with zero trust. There’s a lot of work to do. But it did give us an opportunity to assess some of the key attributes of the zero trust environment and start to implement some of those in a rolling fashion.
Beyond that, on cyberattacks, we have to get it right every time and peer adversaries only have to get it right once. So, we’re at a heightened state of awareness from a workforce perspective because of it.
MeriTalk: What are some of the tools required for telework in your mission space?
Lt. Gen. Crawford: We’ve got a workforce that’s used to being on SIPRNet [the Defense Department’s Secret Internet Protocol Router Network]. They don’t have hardwired SIPRNet at their house, and the question was, “How are we going to get it to them?”
So we evolved and leveraged commercial solutions for classified technologies to get SIPR mobility tools into our workforce. The Army was able to roll out, with DISA’s help, about 800 SIPR mobile devices in a span of about two months.
MeriTalk: Do you think the pandemic will push forward the Comply-to-Connect framework?
Lt. Gen. Crawford: We don’t have Comply-to-Connect yet, but that’s another thing that we’re looking to accelerate. It’s a fully automated mechanism that’s going to assess your endpoint, know if you’re up to date or not, place you in the clean room, clean you, then put you back on the network. I think it’s going to allow us to accelerate Comply-to-Connect, which is a critical component of the zero trust environment.
Back to the unknowns – are we going to be in this environment for the next 90 days or six months? Is it going to be six years? Obviously, when you expand the attack surface, you have the potential to be a little bit more vulnerable. I’m not saying we are [more vulnerable], but because you’ve got to defend more, the laws of physics come into play. How do you do that, and how do you posture yourself to do that? Comply-to-Connect and zero trust – I’ll call them attributes – become a lot more important. Hence, we’ve got to accelerate.
MeriTalk: Can you share any additional metrics on different types of network traffic, number of attacks, and things of that sort?
Lt. Gen. Crawford: A good example is the medical community because for this entire operation, we had a surge and had to build and staff hospitals. With the medical community right now, about 50 percent of their patient engagements are virtual, leveraging the enterprise network. It was fascinating to watch that evolve because I was wondering how accepting the patients were going to be to virtual engagements.
Lt. Gen. Stephen Fogarty [head of U.S. Army Cyber Command] and Maj. Gen. Maria Barrett [commander of the Army Network Enterprise Technology Command] at NETCOM were able to expand enterprise capacity around the globe by 400 percent in less than a month.
In a span of a couple of months, the Army has gone from zero CVR/Microsoft Teams users to over 348,000. We’re averaging about 1,500 more per day, which puts us on a path to eclipse 400,000 over the next month. This includes active duty, National Guard, and Reserves. I think this has been an overwhelming success story.
And then more on virtual training – West Point has been able to train just using CVR as they are getting ready to go into recess. Because people can’t move around like they did before, they’ve been able to leverage CVR/Microsoft Teams to train over 300 instructors and get them ready for summer as we start to roll into the fall. We’ve got countless examples where virtual training has become the norm now, and there is no going back.
MeriTalk: Would you like to give any shout outs to any team members or other folks across the government for their collaboration?
Lt. Gen. Crawford: I think Dana deserves a shout out for having the foresight to pull the team together and start to bang away at this problem set. The outcomes that have been delivered have been good for the Joint Force, not just good for the Army, but for the Navy, Air Force, Marines, Coast Guard, National Guard Bureau, Cyber Command, and NSA.
It gave us unprecedented visibility, the ability to see ourselves corporately. This was all done virtually. That unprecedented visibility, I think, is going to have second- and third-order effects downstream.
A shout out to Steve Fogarty and Maria Barrett and their team in their Operate and Defend mission. All of this is for naught if there are compromises on a grand scale that we did not anticipate. It’s not just what they’re doing, but it’s their ability to anticipate the strategic impact of change that’s made the difference. There are many, many others that I could thank, but I’d just start there.
Just one other point – if you go back and read some of the headlines from February, you’d see “Army Stops Rotation to the National Training Center,” or “Army Stops or Slows This and That.” These may have not been popular decisions but our leadership had the professional courage, the foresight, to be able to look two ridgelines over and see that, “Listen, I’m not saying we’re going to stop doing business, but we do need to start to modify behaviors and we do need to educate the Army on what we see coming.”
What that allowed us to do – and I talked about the two things the Army does well, adapt and innovate – it allowed us to do that at speed, in stride, instead of “We really do have to stop.” But we still had to recruit, and we rolled out CVR/Microsoft Teams and watched how recruiters quickly adapted to it to keep recruiting growing.
A shout out to the Army leadership – Secretary of the Army Ryan McCarthy, Army Under Secretary Jim McPherson, Army Chief of Staff Gen. James McConville, and Vice Chief Gen. Joseph Martin. They had the foresight to posture the Army early on and set conditions for success. It allowed recruiting, training, and mission support so that we could do what the nation pays us to do, and that’s to be ready in the event of a crisis.
That’s a really important leadership fact, because someone’s going to write about this one day. And I think at the critical point, they made the right decision when it wasn’t the most popular decision.
Read other Federal success stories from the COVID-19 pandemic.