Federal IT has bridged the gap between government and citizen service during the COVID-19 pandemic. As the country takes the very first steps toward recovery, MeriTalk is chronicling the untold stories of how Federal IT is getting the job done – and lessons for the road ahead. Our latest chapter of CIO Crossroads explores IT operations at the Environmental Protection Agency.
Early Investments in Telework, Cloud Pay Off at EPA – CIO Q&A
Created 50 years ago to consolidate Federal environmental research, standards setting, monitoring, and enforcement, the mission of the Environmental Protection Agency (EPA) runs the gamut from improving air and water quality, to ensuring chemical safety and shoring up the earth’s ozone layer.
Because of the agency’s widely-spread geographic mission, many of EPA’s 14,000-plus employees spend time working in the field. In the early days of the COVID-19 pandemic, one silver lining emerged for EPA: many employees already had the tools to telework on a regular basis, and the agency knew exactly how to deploy technology to optimize its mission.
In an exclusive interview with MeriTalk, EPA CIO Vaughn Noga details the quick turn to telework, propelled by the agency’s decision years ago to maximize cloud-based services and empower mobile technologies. Rapid iterations during the pandemic included boosting Microsoft Teams users from 600 to 10,000, hiring close to 400 new employees on a no-touch basis, and leveraging real-world lessons in the drive to become a paperless agency.
Just as important, Noga explains how lessons of the pandemic provide the (clean-burning) fuel for the Feds to push IT modernization not only to the next level, but into the realm of continuous improvement by realizing that work is not where you are, but instead what you do.
MeriTalk: Can you talk about your biggest priorities during the pandemic, and what you see as the broad successes for EPA? What have you been proudest of during this time?
Noga: When this started, we had already prepared for a long time for remote work. We certainly had some scalability issues with our VPNs, but we resolved them within the first couple weeks. We had a workforce that was predominantly provisioned with laptop computers and mobile technologies. One of our goals was to ensure that our folks could continue doing their jobs, connecting with each other, using the tools we’ve deployed, and collaborating. That’s exactly what we saw in the first couple weeks.
Just prior to the COVID-19 response, the EPA implemented additional capabilities to safeguard our email messaging system from malicious attachments and links. We have detected and blocked 9,681 malicious attachments and 546 malicious links throughout the time we have been working remotely. One of the things that I take great pride in – it’s the way we measure ourselves – if the help desk phones aren’t ringing and folks aren’t opening hundreds of tickets, we know we are meeting the needs of our workforce on the technology side. I am really proud of the IT community – not just within my office, but across the agency – for responding to the phone calls and to employees’ requests for support. Working with our contractor partners to resolve the issues with the VPNs required folks to burn the midnight oil. It was an all-in approach to make sure our employees had the tools they need to get their jobs done.
MeriTalk: Is there anything that surprised you?
Noga: One of the things we saw early on was the ability for the workforce to rapidly transition into an all-telework type of environment. They adopted a new way of conducting business. Typically, the phone calls we get are because of a problem – some sort of issue with the technology or the network. But during the pandemic, we actually got phone calls from people saying, “Oh my gosh. This stuff works and we’re able to do our jobs.” We got some recognition on things that were working right and meeting employees’ needs.
MeriTalk: That’s a common theme that we’ve heard from other CIOs – genuine surprise at how quickly all employees could get right back into work, because we know there have been a lot of naysayers about telework generally.
Noga: It’s interesting, the naysayer comment. You don’t just transition to telework; you prepare for it. One of the things I’m most proud of is we’ve been working on telework for a long time. I’ve been at EPA going on 12 years, and I started as the CTO. One of the things we said then was, “work is what you do, not where you are.” And we looked at how we could start adapting and adopting technologies and capabilities to support that statement. Because even at that time, EPA had a fairly mobile workforce. We had people out in the field utilizing some of our telework flexibility. So, we needed to make sure that the tools worked wherever the people worked.
MeriTalk: Do you have any metrics you can share?
Noga: I will give you some anecdotal metrics that go back to the adoption of technologies during the midst of COVID. One of the things we were looking at doing before the pandemic was transitioning from Microsoft Skype to Teams. We had pulled together a test group of about 600 folks, and then COVID hit. We saw a rapid adoption of users on Teams – we went from 600 to over 10,000 users in the span of a couple months. What’s so nice about that is we spent a long time preparing the workforce to adopt Skype, and we did a lot of training and it was slow adoption. But what we saw with this new way of working is that the workforce rapidly adopted, and they embraced the training we provided.
I work in the mission support organization, which is not just IT. It’s resource management, HR, facilities, safety and health. The nice thing about the organization within EPA is we collaborate across organizations to make sure employees have the resources they need to be productive. Early on, we knew we still needed to onboard people, and since March we’ve onboarded 394 Federal employees. We gave them the oath of office, provisioned their IT tools remotely, and trained them remotely, and they were productive on day one. To me, that’s a huge success because we were rapidly transitioning to a different way of doing the business of onboarding employees, and it wasn’t just an IT thing.
MeriTalk: Is there one lesson learned out of this that you would want folks to know?
Noga: The lesson learned is don’t waste this opportunity. My biggest concern is that all the things we’re learning now – different ways of conducting business and doing work – will disappear once we get back to whatever normal is. We need to take this opportunity to let these lessons help us transform going forward.
I’ll give you an example. We’ve been doing this for a better part of three months now, and I haven’t printed a single piece of paper. I haven’t applied a wet signature to any documents. It’s all been done through digital signature. On the other side of this, if we go back to, “Hey, someone’s going to print a piece of paper and I need to sign it,” then we really haven’t embraced the opportunity to push for digital government. We need to continue these new behaviors. That’s one of the things we’re actively working on. We’re not printing. And we’re the EPA, so we shouldn’t be consuming a lot of those resources anyway. I think we need to capitalize on these lessons that we’re learning.
MeriTalk: If you could give yourself some advice three months ago, is there something you wish you had thought more about or done in preparation?
Noga: I don’t think there’s anything I would advise myself three months ago that would have prepared me for this. In the continuity of government operations playbook, a lot of the activity and exercises we go through are regional or headquarters based. But we’re going through an all-of-government activity now; everyone in the Federal government is teleworking. This is a new page in the playbook that we haven’t really drilled for.
This is the scenario we need to consider going forward. How are we preparing for no one coming into the office? And it’s not just how do we equip someone with telework technologies. It’s what are the things that didn’t work so well when we went through it during COVID that we need to address going forward? For us, it’s something as simple as how we interact with external stakeholders and the regulated community. We require them to sign documents and provide them to us, but we’ve identified that it’s not the easiest process. How do we fix that going forward? That’s the advice that I probably would have given myself not three months ago, but 10 years ago, in terms of transformation and modernization. What are those things we really need to focus on?
MeriTalk: Would that advice essentially be the same for the whole Federal government?
Noga: I think so. One of the things I see written about quite a bit is IT modernization. IT modernization is not as a singular event; it’s continuous modernization. One of the things we really need to pivot to is looking at systems and technologies in a continuous way to ensure they meet current and future needs. It can’t be a reaction to problems with the system. That’s where you start getting into a lot of issues because you probably waited too long to address them.
On the concept of continuous modernization, I stress to my folks that we can’t let what we’re learning now go to waste. We really need to capitalize on these lessons and apply them internally on how we modernize, not necessarily from a technology perspective, but from a business perspective. We’re examining what we’re learning about ourselves, our services, and our capabilities. And we’re asking ourselves what we need to do in the next 30/60/90 days – whether it’s the implementation of a new technology that will help us mitigate an existing issue, or something new we need to start thinking about strategically.
I charge my group to start looking at these things, because they end up becoming our future priorities. We’ve identified issues; now how are we going to remediate them so we don’t let them happen again? We want to do what we can now to improve our ability to respond in the future – whether it’s an IT or digitization requirement, or how we interact with the regulated community, with states and tribes. What do we need to do now to prepare for a future pandemic?
MeriTalk: What has worked well across the Federal government with telework?
Noga: I can only speak for EPA, to say what works well are the technologies and some of the preparation that we’ve done. Certainly, cybersecurity is a concern. One of the things we learned a long time ago is that we need to be able to patch and manage an IT asset wherever it sits, whether it’s on network or off network. We implemented a lot of those technologies early on and it’s worked very well for us as we’re working through COVID.
MeriTalk: How about technology for people that can’t telework because of mission requirements?
Noga: A lot of those are folks who need to work in the field in response capacities. They certainly have the same remote technologies – they are truly teleworking. We have folks who work in labs, and I don’t think we implemented any new IT tool or technology for them as a result of COVID.
MeriTalk: What keeps you up at night regarding cybersecurity risks, or any other emerging threats you see in the COVID period?
Noga: The things that kept me up before COVID are the same things that keep me up now –making sure we have visibility into the IT assets, and making sure we’re appropriately responding to threats.
I go back to the saying, “work is what you do, not where you are.” We have our security personnel and operations folks who are still monitoring and following up on incidents. They’re still doing the same work they were doing before, but they’re doing it remotely. We’re still patching systems. We’re still identifying vulnerabilities that need to be remediated. We’re still coordinating the information security workforce across the agency to make sure we resolve vulnerabilities.
Certainly there are opportunities in the midst of the pandemic that adversaries will try to capitalize on. But our professional staff has been on top of this using the tools we put in place to make sure we’re at least keeping an eye on what’s going on and patching and remediating vulnerabilities.
MeriTalk: How has the CDM program helped you out during the pandemic?
Noga: We work closely with DHS, and I know my information security group has adopted a lot of those technologies. Certainly, the CDM program is a significant value to Federal agencies and part of that is just bringing focus, technologies, and support to Federal agencies. That has helped us improve our security posture.
MeriTalk: How would you grade intra-government collaboration and cooperation at this time? What kind of things are working well? And are there any sort of greater opportunities for more collaboration?
Noga: You can never over-collaborate. The work that [Federal CIO] Suzette Kent has done with the CIO Council and the coordination she’s provided was critical during this response. She was a focal point for the agency CIOs for information sharing and technology sharing. We are where we are as a Federal government because of a lot of the work done early on establishing those conference calls, reaching out to Federal CIOs, and setting up forums to share information across agencies.
MeriTalk: Is there anything from that process of sharing best practices that could be expanded or institutionalized?
Noga: With some of the new collaboration tools that the Federal government has adopted there is an opportunity to start federating, and be able to collaborate not through email or a file sharing service but through technologies – like chat, Teams, Skype. I think we’re getting into position to start embracing these technologies more. The real-time collaboration where you can text someone sitting in another Federal agency and have an instantaneous conversation is a good thing.
MeriTalk: Tell us about your days in the first week of the crisis and how your days have changed since then. Are you fully entrenched in the new normal? And what does that look like?
Noga: My story is no different than anybody else’s story in the first days. We were just trying to understand what was going on, trying to get arms around the issues we needed to remediate and who we needed to involve. Probably just like every other Federal agency, we convened more meetings, and we did more information sharing – as much information as there was to share at that time.
But really the focus was on going to telework, making sure we had the tools in place and that our communications were set – so it wasn’t necessarily an IT activity. We spent a great deal of time making sure we could inform the workforce on every aspect of what’s going on from telework flexibilities, to how to use technologies, to questions that will inevitably come up. That was the first several weeks of the response.
Over time, you get to a new normal. Some of that means you’ve established information sharing, and if you don’t have any more information to share, or it’s not coming as frequently, then those meetings would drop off the schedule. We’ve actually come back down to – I hate to use the word normal operations – but we’ve pivoted back to activities that we were engaged in prior to the pandemic. We still have systems that we’re modernizing. We still have technologies we’re implementing. We still have applications that need to be patched. So, we’ve kind of pivoted back to them. But we’re doing it within a new framework of telework, and so that’s been the biggest change.
MeriTalk: What systems have worked best, and can you tell us about lessons learned with IT modernization, cloud, cybersecurity, authentication?
Noga: What has worked best are the cloud technologies. We made a decision many years ago to adopt Office 365, SharePoint, One Drive, and collaboration tools like Skype and Adobe Connect. A lot of our technologies are cloud-based, and that means we don’t necessarily need to be on the VPN. That’s one of the things that probably helped us a lot – we weren’t tied to a network connection back in the agency to be able to use our technologies. As I speak with you now, I’m not connected to VPN, but I’m still able to use the technologies that EPA has provisioned on the desktop or my laptop computer.
MeriTalk: Are there any shout outs you’d like to give to your team members at EPA, or any others across government?
Noga: The shout out from me is to the entire mission support team in headquarters and across the regions. And not just IT, but resource management, facilities, and human resources. These are the folks who don’t necessarily get the kudos.
There’s an expectation that someone’s going to be hiring somebody, or your network is going to be available. But when something extreme like this happens, people have an appreciation that there’s still someone back there who’s making sure that we’re hiring and sharing HR information with employees. There are still people back there making sure that the network and VPN are available, and standing at the other end of the phone to walk you through IT problems. My shout out goes out to the entire agency.
MeriTalk: Looking at the big picture, what do you think will change in our government and in our society moving forward as a result of the pandemic? What will we do that’s new and what will we stop doing?
Noga: As far as planning goes, when we start looking at continuity of government operations, I think this is a new page in the playbook – the all-of-government situation, and how you respond to it.
What will we do that is new? I think we’ll start looking at – not that we haven’t been – those areas that we couldn’t support as well as we’d like to. Something as simple as, what do you do with mail that shows up at your building that no one can go get? We still do a lot of things through the postal service. What does that look like, what do we need to do now to remediate that in the future?
We may stop printing as we move forward with technologies for a total digital government. One of the things we’re focused on is how to truly go paperless. We started looking at digitization capabilities within the agency before COVID. We recognize we store a lot of paper, and that costs money, whether the storage is in the Federal Record Center or in one of our buildings – we pay rent on those spaces. So how we move from storing paper to a total digitized EPA, that’s one thing that will change going forward.
MeriTalk: How will you and your team function in a world without conferences as we know them, and how do you envision interacting with industry?
Noga: The week after we started teleworking full time we were supposed to have a GIS conference in the D.C. area and we pivoted quickly to an all-remote, all-virtual conference. You’re going to start seeing more of those – we’ve had several, and we have several more planned.
I think conferences will happen, but how you conduct them will change, certainly now anyway. We’re human beings and whether it’s a conference in the traditional sense or not, there is still the need for folks to engage. You can do a certain amount of engagement through a video conference, but folks still want to engage with each other, so we need to figure that out.
Read other Federal success stories from the COVID-19 pandemic.