[joe_the_user]

Article: The platform, known as NATO’s Service-Oriented Architecture and Identity Access Management (SOA & IdM) Project, is one of four core projects of NATO's IT modernization efforts.

So this expresses what "modernization" is - fob as much work as possible unto a job-shop/meat-grinder operation and watch things like this happen. I don't even know whether to laugh or be appalled, the Snowden leaks happened due to contracted-out sys admins, after all.

[hereforphone]

I contracted for US government agencies for a long time. At every single job the contractors were doing the "work" (they had the knowledge) and the government employees were acting as managers. I have not met a government employee with an unusually high level of technical skill (though obviously many do exist). As far as I can tell (and I worked over a decade in this environment, in many countries) government employees exist to attend meetings and task contractors.

[karlmdavis]

Technical government employee here. :waves:

Your observation is, in general, quite correct! Back in the 80s or thereabouts, the conservative administrations started a MASSIVE shift towards outsourcing of federal government work. This was for all of the usual, largely shortsighted and inaccurate “cost saving” and “efficiency” reasons.

The worst part of it is that they outsourced ALL of the technical expertise in many agencies, leaving them without the expertise needed to effectively manage the work being outsourced.

This is starting to shift, thanks to recent efforts like the USDS, 18F, and such but it’s the work of decades to really change. Come join us!

[cafard]

Former employee of a government contractor here.

Contracting worked on the Charlie Sheen principle: don't pay them to come around, pay them to leave.

Also, it is a much more efficient way to distribute patronage.

[sandworm101]

That would be the plan. If it is a government contract then the government is the customer. The customer manages the project and the hired contractors do the heavy lifting.

Look to the people who actually use these systems. Once it is up and running they will all be government employees. The real work, the thing the system is designed to do, starts after the IT infrastructure is up and running. The vast majority of people reading and handling classified informatiom are government employees ... most of them in uniform.

FYI, this system is apparently mean to protect "NATO Secret" material. That isnt a very high classification. I'd call it entry level, the sort of thing that nearly everyone in uniform is cleared to see.

[joe_the_user]

I'd just note there are problems besides information leakage when your secret information system is hacked - the system being used to attack more secret systems, information about the users being gotten, information possibly being changed, denial-of-service.

[nicholasbraker]

NATO Secret is one of the highest and you definitely need to have had extensive background checks and clearances to have access to this data. From my experience this is not the type of data your typical employee (uniformed or civilian) would be in contact with.

[pbronez]

Per NATO's security guidance [0], NATO SECRET is the second-highest of ~5 classification categories It " is applied to information the unauthorized disclosure of which would cause serious damage to NATO."

In decreasing order of sensitivity, the categories are:

COSMIC TOP SECRET

NATO SECRET (NS)

NATO CONFIDENTIAL (NC)

NATO RESTRICTED (NR)

NATO UNCLASSIFIED (NU)

[0] https://www.act.nato.int/images/stories/structure/reserve/hq...

[sandworm101]

Those NATO levels are all just the start. Every NATO member runs many of their own layers. Over and above NATO come levels that are country-specific. In the US that means things like "five eyes" or US-only, which are technically secret (ie not TS) but are still above NATO. Remember that anything NATO is going to be seen by a large number of countries, including Turkey and Greece.

[hereforphone]

The vast majority of people reading and handling classified information are government employees? That's not the case. I was cleared at TS/SCI + polygraph and many many contractors work in that environment.

[sandworm101]

In the office where you worked. In the office where I work there are zero. Classification levels don't really matter. It is about the nature of the information. Some is simply never shared with non-employees. Some isn't shared with people not wearing uniforms. Well, excepting one or two non-uniforms but they are still government employees.

[hereforphone]

I was military first then worked for defense contractors for a decade or so. In the areas I worked (several countries including war zones), at the levels I worked (secret, TS/SCI), in the agencies I worked with (DoD, special operations groups, intelligence organizations), I did not experience what you're claiming.

[sandworm101]

If you were American and in war zones then you were probably handling operational intelligence rather than strategic.

[leto_ii]

> the Snowden leaks happened due to contracted-out sys admins, after all

But that's a good thing, right? It's good that everybody found out that the government unlawfully collected their data etc.

Snowden was not an attacker asking for money, he was an honest guy with a conscience and a whole lot of courage.

[ALittleLight]

It's good and bad. The bad news is they're evil, but the good news is they're incompetent. That's better than competent evil, but I'd prefer competent good.

[southerntofu]

Who can be good in a position of power? Arguably, "power corrupts" as the saying goes. I believe you could take the 500 best person on Earth to try and form the perfect parliament, and you'd still have an unjust system.

Abolishing the structures of domination/exploitation is the only way to have a good outcome, because it's the only way to ensure citizens will behave as decent neighbors, and not try to control and manipulate their peers. At least, that's what we anarchists believe and practice on a daily basis.

[leto_ii]

> The bad news is they're evil

Agreed, but this is really bad news, given the amount of power three letter agencies (and the deep state in general) have.

> the good news is they're incompetent

Here I disagree. I think the NSA are about as competent as such an agency is ever likely to get. We shouldn't be happy that they still have weaknesses, rather we should be horrified at how few of them there are.

Most of the spying programs had been in place years before Snowden blew the whistle. Countless other contractors and deep state employees could have done what Snowden did had they had either the courage or the moral clarity. Quite possibly many tried and were stopped before leaking to the public.

[viro]

> the government unlawfully collected their data etc.

How did the ANT catalog leaks do that? Did you not notice Russia suddenly got more aggressive (annexing Crimea etc.) after the Snowden incedent?

[flatline]

Nearly everyone who does real work like this for the government is a contractor anymore. The government employees manage the contracts.

[noobermin]

It really is one of the dumbest things in government work. Politicians want to "shrink government" so they don't want many actual employees that would probably be well paid, stable, but someone needs to do the work. Thus, enter the I-too-want-to-shrink-the-government politicians who agree but then farm it out to contractors, some whom they might work for one day (or even come from in some cases in the US!). And so the actual government employees are few and far in between while everything else is farmed out to contractors, some who are good and many who do fly by night jobs on grants and have no incentive to do better otherwise.

[pydry]

Dumb? Who did you think owned these companies that the work gets contracted out to?

"Shrink government" shouldnt be taken at face value.

[eru]

Do you think projects run and implemented by people directly employed by the government have a better track record?

[raesene9]

For the sake of debate, lets assume an equal level of incompetence between contractor run projects and government run projects.

In that case at least

a) There's no need to pay extra for the profit margins of the contractor companies (and the inevitable sub-contractors they use)

and

b) The incentives of the people doing the work are likely to be closer to the original project, in that the people doing the work are in the same organization as the project.

For me, outsourcing makes sense if the organization doesn't have enough of the specific type of work to have a fully staffed internal team, so specialist services, or if they are obliged to get an external opinion (e.g. auditing/pen testing). Otherwise you're just adding more layers of profit seeking middle-people...

[eru]

Profit is a small part of costs. See https://slatestarcodex.com/2017/02/09/considerations-on-cost...

I'm not so sure about incentives. The incentives aren't necessarily great in either situation. See also https://en.wikipedia.org/wiki/Public_choice

[jvanderbot]

"Overhead" is a large part of costs, and profit is often contractually limited in government contracts. But much of the profit is hidden in the markup, which can sometimes be 50%, meaning you pay $1.50 for $1.00 of supplies, labor, etc.

[noobermin]

https://en.wikipedia.org/wiki/Apollo_11

[chha]

Not sure what you're trying to say with this.

The Apollo program was run by NASA, who had lots of government employees, but at the same time all the hardware and much of the software was built by contractors. The Apollo program was behind schedule and over budget for most of the project period.

NASA originally estimated the cost to somewhere between 7 and 12 billion USD; NASA Administrator increased this to 20 billion USD in 1961, but it ended up costing more than 25 billion USD in 1973 dollars.

[eru]

Believe it or not, the Space Shuttle was an even worse disaster in terms of bang for buck.

[jon-wood]

When allowed to do the job well, yes. The UK’s Government Digital Service led the way in this, and have massively improved the online experience of everything from finding information about the current Parliament to booking vaccinations. Their entire approach is focused on “what does the user need” as opposed to “what does the thousand page spec doc say”. The USDS was founded on the same basis and from what I’ve heard are similarly impressive.

[eru]

That's heart-warming to hear, but alas cherry-picking examples won't sway anyone much?

Have a look at eg the outsourced Danish firefighters. Seems to work just fine, but would be unthinkable in most countries, including the US. (Btw, Americans have more firefighters per capita than about anywhere else.)

[QuarterReptile]

Let me offer an alternative version of why people take the presumably-government roles and do them as private contractors: avoidance of byzantine requirements and cynical implementations of laws aimed at preventing fraud, waste, and abuse (FWA). People drastically overestimate FWA because they commonly describe or conceive as FWA government projects which they don't like. A couple examples:

It's relatively hard to get any work done at my job during the month of April, because about half the building is 85-88F (in a temperate mid-atlantic climate). That means that people will work in other cooler offices (problem when no one carries a cell phone) or just find reasons to leave early. I used to battle about this, but then I learned that it was for the unmovable ideal of economizing. Unfortunately, I'm a victim of economizing a 1970s building with huge plate glass windows that don't open.

Second example:office supplies. A supervisor asks me to have a room set up for a meeting. After determining that what I need is not kept on hand, I try to buy them through the government catalog as I'm supposed to. My internet connection fails, so I reboot my desktop (roughly 20-30 minutes). When it fails again, I lament that I probably have a dozen faster computers at home, ranging from 10 year old tablets to a raspberry pi, and with that I take the opportunity to step away from my office (low 80s in the summer, when this takes place, because the AC can't keep up.) I go down to my car where I can use my own air conditioning and my phone to look at the same website. The supplies aren't on the catalog, so I just order them for $10 on Amazon. Fast forward one week, when my supervisor asks how I have it ready so soon, and I get criticized for buying the supplies outside of the supply system with my own money. I place too high a value on my sanity, apparently.

Edit: I should mention that most people at this office are paid quite well relative to the area

[noobermin]

This isn't an alternative version, this is what I mean about the horrible requirements which are aimed at FWA but just off-loading it to a contractor doesn't make it disappear.

[lotsofpulp]

It is also nice to have an entity to throw under the bus if necessary.

[eru]

And that's actually a benefit for the tax payer!

It's notoriously hard to fire public servants, or shut down underperforming departments.

It's comparatively easier to shut down an outsourced project, or switch suppliers.

(Alas, not easy enough; and the organizational skills required to win government bids are different from those required to actually deliver quality.)

[joe_the_user]

Sure, the states of the world have decided that security isn't one of their core competencies - computer security, yes, but the point remains.

I find this mind-boggling but that's how it is.

[DaiPlusPlus]

> The government employees manage the contracts.

How long before that's outsourced to Accenture too?

[nerbert]

No no, the companies executing the contracts are the experts, they know what’s best to put in them. It comes as free consult.

Edit: if only this was a joke.

[sandworm101]

I'm a government employee. I work with a few dozen people across multiple locations doing actual work. Not one of us is a contractor. Zero contactors are involved in any real work. The few we have are in support positions. We have some contracted IT people who manage some of our computer systems but don't have any access to what those computers actually do. We have contacted security guards at the front gate. And I think the cleaners are contracted out but as they have NEVER cleaned my office I don't see them much.

I think there is some observational bias going on in this thread.

[JackFr]

When I was a defense contractor it always struck me as weird that the guardhouse at USMC HQ at the Navy Annex was staffed by $12/hr private security guards.

On the other hand the commander of the group I was doing work for pointed out that a fully trained Marine private was far to costly an asset to waste checking visitor ids.

[jvanderbot]

"Industry can handle it better"

[hereforphone]

Exactly. They also get the credit and retirement checks.

[dragonelite]

paying double if not triple if they would be internal worker.

[zcw100]

Robert Hanssen was a government employee after all. It's incredibly naive to think that your employer makes any difference. https://en.wikipedia.org/wiki/Robert_Hanssen

[orbifold]

In Germany this kind of task would land in the lap of T-Systems, SAP (who already do logistics / storage management and probably more for the Army) or one of these consultancies Delloite. You can't expect politicians to be competent.

[raxxorrax]

So you mean there are positive sides to it? Might also be true in this case since I believe they would host surveillance data on citizens.