Hacker News Reader

The JEDI RFP was seemingly written specifically for Amazon to win. (And there are accusations that they actually did influence it, since a former employee wrote parts of it [1]) It appeared that they were the only company that could possibly meet the technical requirements of it. The whole process looked like a formality to 'fairly' award them a new contract. And then Microsoft won the bid.

Its about cloud computing infrastructure, and Amazon is the leader in that sector still. Amazon already provides two government cloud services, GovCloud and C2S, and the government has invested billions of dollars in them too. So its not like they aren't already in the space, are inexperienced, and trying to 'steal' this contract away. They actually have more experience than Microsoft, when it comes to cloud services for restricted government environments.

A judge already agreed that there was enough issues in the winning proposal that Amazon's case had enough to pause the work on the contract. So I don't think its nothing at all. Using the political angle happens to be the most headline producing legal argument they have right now. No matter who won the $10B contract, someone was going to contest it. If Amazon had won, Microsoft and Oracle would be contesting.

However, I do think there needs to be competition in the space, and I am not at all upset that Microsoft won. It is a good thing to not have everything locked into AWS. Its not the outcome I expected, but it seems like a good thing. And I think that wanting competition in the space, may well have actually been a real reason to award Microsoft with the contract, even if they didn't have the best proposal.

[1] Oracle was also fighting against this contract too, because they want it. https://techcrunch.com/2020/09/03/oracle-loses-10b-jedi-clou...

Writing the requirements of a tender so that it can be won by a specific vendor is called “single sourcing” and it’s extremely common if you’ve ever sold to the government

Sole sourcing requires very strict guidelines though. You have to justify why that specific vendor is the exclusive one that can meet your needs and that the end result of the bid process would end up leading to them. A sole source contract for JEDI would never have been acceptable. Its way too large, you have to compete it.

I think there is some misunderstanding here in your comment and parent: I think that the parent wasn't referring to "official" sole sourcing, but rather to the (common?) phenomenon of government issuing a RFP or similar with unnecessary requirements/specifications that purposefully exclude certain possible suppliers, or are even tailored specifically to a certain product, while ostensibly allowing for a bidding process.

An example from my country in the EU: the government decided to provide schools with prototyping boards for electronics for kids to play with and maybe learn something, with a formally open procurement process. Turns out the procurement requirements were written quite tightly around the specifications of the BBC Micro Bit board, so as to disqualify other possible products (down to board width and length).

To be honest, this specific example wouldn't cause me to worry one bit, except that after learning about it I suspect that the same procurement fixing method is used for other, more important projects.

> but rather to the (common?) phenomenon of government issuing a RFP or similar with unnecessary requirements/specifications that purposefully exclude certain possible suppliers, or are even tailored specifically to a certain product, while ostensibly allowing for a bidding process.

Correct. Also incredibly common. By the time they are discovered the money is already spent and the system is implemented. Not much can be done then.

However the biggest productivity software provider doesn't need to get bigger either. The reality is that most technology is controlled by a tiny group of companies now and we need more competition at all levels of the stack.

100% agree with this.

For the amount of dollars at stake the government should have focused on creating a hybrid cloud solution than just going all in with any one provider

The government being beholden to any multinational corporation for technical expertise is a national security risk.

I've been working in the federal gov over 20 years. You can't paint a broad brush and say it's all a Microsoft shop. It really isn't. All my clients have been on Linux/unix or going to it (yes, leaving Microsoft).

There's a sizable market for non and anti Microsoft products.

JEDI is only the start of problems for Amazon in this space. For those that don't follow the government contracting world, for the last year DoD has been in the process of releasing the Cybersecurity Maturity Model Certification (CMMC). In short, any contractor seeking to do business with DoD (including subcontractors) will be required to have varying levels of security controls implemented, mostly derived from NIST 800-171 Rev. 2. Current estimates put the number of effected organizations at 300,000+. We are talking a multi billion dollar industry being created via acquisition regulations.

Most organizations are shooting for a Level 3 certification, which is almost certainly going to require Impact Level 5 authorization. Having done the research on various solutions, Amazon doesn't have anything close to the solutions Microsoft has available via GCC High and M365/Azure/Azure AD/ATP/Intune/Endpoint Configuration Management/etc.

AWS still has a place, but I have a feeling Microsoft is going to increase their market share even further.

Amazon already has IL5 certification though [1]. I have loosely been keeping an eye on all the CMMC stuff, but not in detail. What does Microsoft offer that Amazon can't here? I honestly would like to know, as it could be very useful information.

[1] https://aws.amazon.com/govcloud-us/dodsrg/

> What does Microsoft offer that Amazon can't here?

Anything to do with client device management, security, or attestation. Which matters a lot to the DoD.

Sorry for the delay responding to this. The big ones, at least for small and medium sized businesses, is going to be endpoint configuration management, Windows Defender ATP, MAM/MDM via Intune, data loss prevention, Azure AD, SSO through Azure AD, various identity management tool sets, Bitdefender, patch management, etc. On top of that, each licensed user receives a Windows 10 enterprise license, access to the entire Office desktop suite, OneDrive, SharePoint, Teams, Audio Conferencing #, etc.

Microsoft 365 (note: not O365) provides a very solid solution.

M365 on GCC makes it much much easier to implement the required security controls for FISMA, DFARs, ISO 27001, etc. and it provides it through one service/SLA. If I wanted to do the same things with Amazon, it would be a much more involved process, more complicated implementation, and almost certainly require multiple vendors.

Thanks for the reply, great info. We have definitely been looking at more things like Azure AD. (Or Okta maybe?) for the identity management stuff. Even AWS has one I think, but seems worse than other offerings.

It is an interesting idea to consider. We already are using Slack, GSuite, Chime, and such. More in one service could have some interesting security improvements.

Wow, I just looked into it they can even manage Macs. Very interesting. Most of our devices are Mac.

No problem!

I think the majority of AWS' capabilities are provided through third-party partners (e.g., Okta, like you mentioned). I don't know for certain, but I'd be surprised if those are available on GovCloud/whatever Amazon's IL5 platform is. Use of additional services also then adds in additional SLAs, potentially additional costs, increased attack surface, etc.

Also, I don't believe that Slack, GSuite, Chime, etc. are NIST 800-171/DFARs compliant, let alone authorized at IL5. The Teams in GCC is within the GCC enclave, from what I understand.

I feel like I'm starting to sound like a Microsoft salesperson (promise I'm not!), but yeah, it's definitely worth checking out.

Sorry, but this comment is misinformed.

The federal government, and specifically the "Intelligence Community," (which for the record is all the 3-letter agencies you can name and then some), are already large customers of AWS, with previous contracts. So to claim that the government is a Microsoft shop in the cloud sense is diametrically wrong.

I personally don't even like Amazon and have almost completely severed personal market ties to them, but GTFO with "investing right back".

How's that $200MM O365 performing for your enterprise, Navy? Oh, you mean you can't even reliably access email and just about everything broke post-deployment? No worries, just launch in Internet Explorer and it's sure to mostly work!

And how's that polished Teams collaboration suite treating you? A cut above with steamlined mission critical video chat that Skype hooked us up with, yeah? Oh, integrated wiki v0.1 release you say? Too bad, but thanks for the enterprise-scale beta testing, we'll be "investing right back" by providing you with an improved v1.0 release as your acquisition program office approaches a decision to exercise contract options several years from now.

And we're so sorry there's no transportability between this "Teams" and the other "Teams" deployed a few months ago...for everyone outside of your org, it's a transparent technical detail, but since these enterprise solutions are specifically tailored to your needs, just think of this roadbump as a feature!

You mean to say you needed modern source control and continuous integration capability? We're sorry, GitHub wasn't part of the contract. But hey, we know a bunch of your teams are trapped, err, voluntarily embrace our value TFS offering to process the boundless acronym soup of arbitrary work items which replaced equally arbitrary paper forms, and we know you love churning in the latest deprecated release of tfvc because git and all this command line stuff is just so inefficient. We definitely do appreciate the nice collateral revenue that all the superfluous Visual Studio licenses you've purchased through an exclusive BPA for all the managers that don't code but want to feel like they can be on point with their reports, we completely understand what it means to slowly become irrelevant. At Amazon, it's always Day 1, but at Microsoft, we understand progress and know how to get your enterprise to Day 2 and beyond!

And hey, you've got that bleeding edge SharePoint as an alternative "configuration management" tool for all your Word docs and Excel spreadsheets and PowerPoint presentations (we know you really love those) and Project files and Visio diagrams, so no real barriers there, we're here for you!

Oh, and that lean af grassroots devops team that decided it was tired of our subversive lobbying influence by making a suite of modern tools readily accessible and enable a real opportunity to flow comparable to modern agile teams, which was adopted like wildfire amongst the Pareto 20% of your engineering workforce? No worries. It's really not such a big deal that hosting on absurdly crippled AWS GovCloud puts Azure SLA in practice to shame, and it's no biggy that they were the lone entity to embrace a release of GitLab that no longer supports Internet Explorer for the sake of actual sanity and modernity. By the time your competent IT staff pushes our progressive Win10 1909 release into the wild and fixes all the network printers we recently broke, we'll have a plan in place to justify expending 9 digits of taxpayer dollars for capability that's either deficient, broken, or doesn't exist, and we'll be "investing right back" with suggestions of a new requirement that's so entrenched in our proprietary legacy baggage that no one other than us can fulfill it. Those undercompensated government engineers sacrificing career opportunities in a private industry that compensates at least 3x more for equivalent talent are just a number. We, Microsoft, are here to handle all our technical debt just for you!

I swear you can't make this stuff up.

> Amazon was never going to be able to walk in thirty years into the Federal Government / Microsoft relationship and steal this contract.

And then, just like Boeing, we have yet another state-subsidized, substandard, doesn’t need to compete, “too big/important to fail” defense vendor. (Remember who you’re supporting with each GitHub push and npm publish. Let’s not forget that the PRISM slides are PowerPoint.)

What’s the material difference between these and state-owned enterprises?

> What’s the material difference between these and state-owned enterprises?

Where the profits go.

To acquire smaller companies that the vast majority of the population are legally prohibited from investing in?

It’s turtles all the way down.

Microsoft is a public company. You too can own some of those profits.

In a state owned enterprise, the profits would generally go to the exchequer (assuming full state ownerships; otherwise dividends would be paid as normal, with the state owned portion going to the exchequer). If there were profits; in developed democracies, restrictions on state aid tend to relegate truly state owned enterprises to things like running the electricity network, which generally isn’t very profitable.

I guess you don't have a 401k.

Not everybody who pays the taxes that fund JEDI do.

We all should.

Setting aside $50 a month, no initial investment.

https://www.calculator.net/investment-calculator.html?ctype=...

$100/month

https://www.calculator.net/investment-calculator.html?ctype=...

If you can't afford that, you're not funding JEDI.

Well, the people getting evicted from their homes during a pandemic because the US spends money on JEDI instead of a social safety net are also "paying", and no, they don't have $100 for a 401k.

They're not getting evicted because the money is spent on JEDI. They're getting evicted because the State doesn't allow them to work. Ask your representatives why.

I have the local equivalent. Meaning that, yes, I personally probably benefit from these sorts of very large government contracts. I’m not sure that justifies it, though. There’s a decent argument that these mega contracts are a bad use of taxpayer money; some of them work out, but the bigger the contract, it seems, the less chance that it actually delivers in the end.

There isn’t. I am not sure there really should be. For all the claims of capitalism, the industries that the Government relies on tend to have similar characteristics regardless of who ends up owning them, regardless of country.

Should we boycott Bic if government uses their pens?

"Amazon checks boxes. Microsoft solves problems. "

Please.

"The Government is, and always has been, for better or worse, a Microsoft shop."

So MS Government Monopoly is a great reason to use MS? Really?

"And, frankly, its better this way. The biggest cloud provider doesn't need to get bigger."

This is the wrong answer.

" if not most, teams across the entire org are heads down on JEDI right now."

This is not relevant if MS doesn't have the right solution.

None of what you have said really changes the situation, other than possibly Active Directory, but I don't think so.

Amazon has made some serious claims about lack of oversight and those should be looked at.