Force May Be With Amazon as Pentagon Mulls ‘JEDI’ Cloud Contract

Keep up with the latest developments and legal issues in the telecommunications and emerging technology sectors, with exclusive access to a comprehensive collection of telecommunications law news,...

By Sam Skolnik

Contractors are expressing growing concern the Defense Department may choose just one provider—a unit of Inc.—for its massive upcoming cloud computing contract.

The odds-on favorite for the Joint Enterprise Defense Infrastructure (JEDI) cloud contract—which could be worth $10 billion or more—is Amazon Web Services (AWS), they say, the sole company tapped five years ago to build a computing cloud for the American intelligence community.

Those fears have been stoked by two recent developments: the awarding of an almost $1 billion DOD cloud migration contract last week to a company with longstanding connections to Amazon, and unofficial word that the Pentagon may limit its search to companies with security classifications that only Amazon currently meets.

Pentagon officials say an official request for proposal for the JEDI contract will be issued this summer. Meantime, as DOD’s Cloud Executive Steering Group prepares to host its first “industry day” next month to hear concerns about the bidding process, an agency spokesman says the plan to pursue a full and open competition “remains unchanged.”

Close observers of JEDI remain unconvinced.

“The connection being made between the REAN contract and the big award is spot-on, because REAN will be a vehicle to that big system,” Bill Shook, a Seattle- and Washington, D.C.-based government contracts attorney who used to represent Microsoft, told Bloomberg Government.

Aligning the Systems

On Feb. 7, REAN Cloud, a Herndon, Va.-based cloud systems integrator, announced that DOD had awarded the company a five-year contract worth up to $950 million. REAN will work with defense agencies to migrate existing applications to the cloud services provider chosen through the JEDI procurement.

REAN (pronounced like “rain") notes prominently on its website that it is a “Premier Consulting Partner in the AWS Partner Network (APN) and an AWS Managed Services Partner.”

Yet REAN also has worked with several other cloud providers, such as Microsoft, Sekhar Puli, the company’s founding partner, told Bloomberg Government. He knows that his integrator “has to be cloud agnostic.”

Puli acknowledged that if DOD chooses a provider such as Oracle or IBM, as opposed to one or more companies it is more familiar with like AWS or Microsoft, it might take “a month or two of effort” to align the systems.

REAN was chosen by DOD after months working with the Defense Innovation Unit Experimental (DIUx), a Pentagon division designed to enable faster adoption of new technologies.

In the spring of last year, Puli said, DIUx reached out to about 20 companies in its beginning stages of a search for a cloud migrating service. The process eventually left only REAN standing after an oral presentation, a demonstration, and evidence of proof of concept and scalability were established, he said.

The company was chosen through the “other transaction authority” (OTA) process, increasingly used to sidestep the traditional and much lengthier federal procurement system.

Cloud Security

Concerns that AWS has gained a leg up in the process has been aided by growing word, two contractors say on background, that DOD has decided to restrict the pending JEDI competition to contractors that have met two certain “Impact Level” (IL) security classifications called IL5 and IL6.

IL levels are defined by the Information Assurance Support Environment, which is sponsored by the Defense Information Systems Agency, as “cloud security information impact levels.” IL5 accommodates controlled, unclassified information (CUI) that requires a higher level of protection; IL6 data can include that which has been government-classified as “Secret.”

AWS has IL5 and IL6 capabilities. Microsoft’s Azure Government cloud service is covered by IL5 as well, and, according a source close to the company, is close to achieving IL6 certification.

It is unclear whether any other companies possess both certifications, or are close gaining them.

‘Full and Open’

“Stripping out the Old Guard (fear, uncertainty, and doubt), the facts are that this was competitively bid and REAN Cloud won,” an Amazon spokeswoman told Bloomberg Government in a written statement. “AWS has always encouraged the government to openly consider the best options for their missions and constituents, and we will continue to advocate for open competition.”

The spokeswoman declined to answer questions on the record about whether the process is being tilted in Amazon’s favor.

In response to questions about IL5 and IL6 classifications, Defense Department spokesman Patrick Evans told Bloomberg Government in a written statement that information about JEDI requirements will be discussed at its upcoming industry day. The cloud steering group’s plan “to pursue a full and open competition remains unchanged.”

Industry day, to be held March 7 at a hotel near the Pentagon, will include representatives from the JEDI cloud program, U.S. Cyber Command, and the Defense Digital Service, among other DOD units, according to a DOD announcement.

‘Transparency and Competition’

Microsoft declined comment. But according to contracts attorney Shook, the nexus between REAN and AWS is clear from REAN’s website.

This is important to note, Shook told Bloomberg Government, because REAN will be working closely with whichever company DOD chooses as the JEDI award winner. “We have to assume that REAN has some sort of technology to convert on-premises software applications, such as cybersecurity and logistics programs, to the cloud,” he said.

DIUx’s use of the OTA process to award the REAN contract has accelerated a disturbing trend, and caused worries among would-be JEDI bidders, Shook said.

“Government innovation derives from transparency and competition, not secrecy and personal preference,” he said.

Fortune 500 Approach

Several contractor trade groups spoke out against the JEDI request for information (RFI), issued Oct. 30.

Contractors interpreted the words “solution” and “award” interspersed throughout the RFI to mean that the Pentagon is leaning toward a single cloud provider, as opposed to making multiple awards.

A single-provider approach goes against that of most Fortune 500 companies, because no one cloud solution meets the companies’ mission requirements, Trey Hodgkins, senior vice president for the public sector with the IT Alliance for Public Sector, wrote Nov. 17 to Ellen Lord, DOD’s then-undersecretary for acquisition, technology, and logistics.

“A Department cloud comprised of multiple interoperable offerings,” Hodgkins wrote, “would ensure that the Department obtains the benefits of competition to achieve best value for both warfighter and taxpayer.” (Italics in original)

To contact the reporter on this story: Sam Skolnik in Washington, D.C. at

To contact the editor responsible for this story: Paul Hendrie at

Copyright © 2018 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Tech & Telecom on Bloomberg Law