Someone Is Waging a Secret War to Undermine the Pentagon’s Huge Cloud Contract

As some of the biggest U.S. technology companies have lined up to bid on the $10 billion contract to create a massive Pentagon cloud computing network, the behind-the-scenes war to win it has turned ugly.

In the past several months, a private investigative firm has been shopping around to Washington reporters a 100-plus-page dossier raising the specter of corruption on the part of senior Defense Department and private company officials in the competition for the JEDI cloud contract. But at least some of the dossier’s conclusions do not stand up to close scrutiny.

The dossier insinuates that a top aide to Defense Secretary Jim Mattis worked with Mattis and others to steer the contracting process to favor Amazon Web Services, or AWS — and enrich the aide. The aim of the dossier seems clear: to prevent the deal from going solely to AWS, the odds-on favorite in part because it operates the CIA’s classified commercial cloud. Far less clear, however, is who backed its creation and distribution.

It’s an unusually hardball form of backroom maneuvering in the world of lucrative but rigidly controlled defense contracting. The firm that prepared the dossier, RosettiStarr, shopped it to various Washington reporters earlier this year. Defense One was given a copy in May. At the time, RossettiStar President and CEO Rich Rosetti declined to reveal who funded the firm’s efforts.

Former defense officials told Defense One they received inquiries about the allegations from the Wall Street Journal, the Washington Post, Reuters, and the Intercept. For months, the accusations went unaired by news outlets, including Defense One and Nextgov, sister publications in Atlantic Media’s Government Executive Media Group.

But in the past few weeks, some of the information in the dossier has surfaced in various publications. Now that the dossier’s targets have been publicly accused, they are speaking out. In exclusive interviews with Defense One and Nextgov, they vehemently deny any wrongdoing and seek to turn the spotlight on their mysterious accusers.  

A Contract and an Alleged Conspiracy

It’s hard to overstate the significance of the Pentagon’s cloud contract. Known as JEDI, for Joint Enterprise Defense Infrastructure, it will help reshape American warfare by absorbing, processing, and analyzing intelligence, sensor, and troop data, and by facilitating communications through the Defense Department’s worldwide network. The winner of the contract, should they meet stringent security and performance standards, will emerge as a front-runner for more huge cloud jobs across the government.

In June, some of the same information included in the RosettiStarr dossier appeared in a report by Capitol Forum, a private company that says it provides "investigative news & analysis on how policy affects market competition" to its paying subscribers. And in the last two weeks, similar information appeared in articles in Reuters, Vanity Fair, and the Daily Caller.

All of the reports highlight Sally Donnelly, whose consulting firm worked  for Amazon Web Services before she served as senior advisor to the secretary of defense, essentially Mattis’ right hand, during his first year on the job. They raise questions about whether she received payments from AWS for steering the Defense Department to custom-tailor the JEDI requirements.

Donnelly, Pentagon officials, and AWS representatives deny all of it.

"From the beginning, the enterprise cloud initiative has been open, transparent and fair," said Pentagon press secretary Dana White in an email while traveling in South America with Mattis. "As with any other acquisition, a team of department experts developed the requirements and solicitation, and members of that team were screened for conflicts of interest and advised on compliance with applicable procurement and ethics laws. Neither Secretary Mattis, Ms. Donnelly, nor anyone else in the secretary’s front office participated in drafting the requirements or the solicitation. Any assertion or suggestion to the contrary is false."

Donnelly declined repeated requests to comment on the record for this story, but her attorney, Michael Levy, said in a statement, "While at the Department of Defense, Ms. Donnelly had no role in acquisition or procurement. She played no role, and exercised no influence, in connection with any government contract, including – as the Department of Defense has confirmed repeatedly – the JEDI contract. To suggest otherwise not only reflects an absence of even the most rudimentary understanding of the government contracting process but also insults the dedicated career men and women at the Department of Defense who have spent countless hours developing and refining this and hundreds of other contracts with the sole purpose of protecting the safety and security of the United States.

"Ms. Donnelly was rightfully proud to serve our nation alongside the remarkable men and women of our Department of Defense," Levy continued. "In our country, everyone has a right to disagree with the approaches they may have taken, but attacking their integrity and honor is just wrong."

Donnelly’s low public profile belies her longtime status as a top trusted advisor to senior military officials. She served on the staff of Joint Chiefs Chairman Adm. Mike Mullen until his 2014 retirement, traveling with him and reporters around the world and into war zones and capitals. Then she ran U.S. Central Command’s office at the Pentagon, while Mattis was CENTCOM commander. After Mullen’s departure, Donnelly left the Defense Department and formed a consulting firm, SBD Advisors, where she helped active and retired military commanders with media outreach and shaping their post-military careers. She hired Mullen and other former Pentagon officials.

By the start of 2017, the firm was also consulting with several military commands and companies, including Amazon Web Services. SBD helped defense industry clients navigate the Pentagon bureaucracy and hone their marketing messages to government buyers, according to company spokesman Price Floyd, who was the assistant defense secretary for public affairs when Donnelly was on Mullen’s staff. When Mattis asked Donnelly to re-enter government to serve at his side, she divested her entire stake in SBD, according to government filings obtained by Defense One and Nextgov.

The RosettiStarr dossier insinuates that Donnelly kept a stake in her company so she could profit off a potential AWS win, and that she helped arrange a meeting last year between Mattis and Amazon CEO Jeff Bezos.

The dossier says one of Donnelly’s financial disclosure forms appears to show that she had sold only part of her stake in SBD Advisors before re-entering DOD, because it reports a "partial" sale and a single payment of only $390,000. In fact, she later filed forms disclosing two pre-planned payments received after she re-entered government, bringing the total sale of her stake to $1.56 million. On the second page of Donnelly's publicly-available disclosure form, she lists the value of SBD as between $1 and $5 million and indicates that she has sold it completely. A note affixed to the front page by a U.S. Office of Government Ethics inspector certifies that the entirety of the $1 to $5 million asset was sold.

The ethics office signed off on Donnelly’s financial disclosure form in August 2017, and on her final disclosure form, too, which she filed near the time she left the Defense Department in February. On it, a government officer states that "on the basis of information contained in the report, I conclude that the filer is in compliance with applicable laws and regulations." The form notes the two payments she received for the sale of SBD while at the Pentagon. Donnelly signed the final form on May 3.

Floyd, the spokesman for SBD, now rebranded ITC Global Advisors, dismissed the allegations and subsequent reporting claims that Donnelly or her firm had any influence on how the request for proposal was written or that she stood to profit further off SBD.

"The idea that she would have anything to do untoward with the drafting of an RFP is just – is just ludicrous. Plus, it’s not how it works!" he said in an interview. "That’s just crap."

The three payments Donnelly received were pre-arranged  installments of the full amount she was owed, not reward for working on the cloud contract, Floyd said. "The price of her ownership stake in SBD was set at the point of sale, not at the point of payment."

Donnelly "had nothing to do with our work," said Floyd, who also served as the State Department’s top public affairs official and later worked for defense giant BAE Systems. "We didn’t contact Sally and say, ‘Who should we meet with?’ Nothing like that happened."

"Sally did not work on the JEDI contract for Amazon when she was in government. Period. It just didn’t happen."

Arnold Punaro, former staff director of the Senate Armed Service Committee and retired 2-star Marine Corps general, said the whole process looks to be above board. "I’ve watched this one with interest from afar. I know the department extremely well. I’ve worked with the [Senate] Armed Services Committee for the past 15 years," Punaro said. "I’m very confident that the DOD and the people responsible for the RFP have adhered to the letter and the spirit of the law, dotted every ‘i,’ crossed every ‘t’ because of the intense scrutiny given to such a large and high-profile contract. These things have to go through intense review."

Since Donnelly left government in January, her old firm has gone through a series of changes that the dossier and recent reporting suggest that she and her associates could still be working to favor and profit from an AWS win of the cloud contract. Earlier this year, SBD was acquired and renamed ITC Global Advisors by ITC Secure, itself owned by C5 Capital, which primarily funds smaller companies. C5 and AWS have a few investments in common: both have stakes in a Bahrain-based cloud accelerator that invests in small businesses with a proven product, and in PeaceTech Lab, an initiative with the U.S. Institute of Peace. Neither is particularly remarkable or unusual. But they made it into the dossier.

"C5 Capital is extremely concerned to hear from a number of media sources of the distribution of erroneous and defamatory information. Neither C5 nor its subsidiaries or portfolio companies have had any involvement in the bidding for the JEDI contract," the company’s spokesperson said in a statement to Defense One and Nextgov.

C5’s spokesperson went on to say the company bought ITC Secure to "provide cyber consulting services to ITC Secure’s existing US enterprise clients by a world class team of US experts and national security leaders led by Admiral Mike Mullen, the former Chairman of the Joint Chiefs of Staff."

The spokesperson said C5 and its portfolio companies work with all the major cloud providers, "including Microsoft, Google, IBM and AWS." The company says it has nothing to hide regarding AWS. "C5 is proud of the work that our start-up accelerator is doing with AWS and our partners at the US Institute for Peace’s Peacetech Lab in Washington to grow start-ups that prevent conflict and as a result help to save the lives of US and UK war fighters."

The dossier and some subsequent media reports name several SBD associates who later took positions in government, including at the Pentagon. It implies that Donnelly strategically embedded them in key Pentagon and congressional positions. But thousands of defense officials go in and out of the revolving door of government jobs, especially as the administration changes political party.

As for Mattis’ meeting with Amazon’s Bezos, the Pentagon notes that it was part of a broader West Coast swing aimed at reaching out to key leaders in the tech community regarding how DOD could better use commercial technologies. That effort was launched by Mattis’ predecessor, former Defense Secretary Ash Carter. On the trip, Mattis also visited Naval Base Kitsap, Washington, and the office of the Pentagon’s Silicon Valley outreach program, the Defense Innovation Unit-Experimental, or DIUx, in addition to visiting the headquarters of Google and Amazon.  

Heavyweight Battle

So who is really trying to take down AWS’s chances at the $10 billion contract? RosettiStarr won’t say. Company representatives reached last week declined to comment for this story.

Capitol Forum, which first published some details that also appear in the dossier, would not reveal their initial source for them. A company spokesperson said in a statement they did their own reporting. "Our June 8 story on SBD Advisors and the JEDI contract is based on financial disclosure documents obtained through a records request to the Office of the Secretary of Defense, as well as original interviews with representatives of ITC Global Advisors (formerly SBD Advisors) and C5 Capital." They laid out their initial findings under the headline "Secretive, Influential Consulting Firm’s Close Ties to Amazon Web Services and DoD Raise Additional Questions Around JEDI Contract," and included denials of wrongdoing by the Pentagon’s White and ITC’s Floyd.

On Friday, Daily Caller writer Andrew Kerr said, "I am not going to discuss what my sourcing is. Every fact in my article is laid out clearly and attributed. If you have that dossier, I'd love to see it."

The author of the Vanity Fair report has not responded to a request for comment on the source used in the article.

Amazon Web Services is pointing the finger at its competitors for the JEDI contract.

"These types of misleading articles are fueled by old guard technology companies who have resorted to these types of unseemly tactics ‎because they’re struggling to compete effectively in open competitions in the private and public sectors," an AWS spokesperson told Nextgov and Defense One in a statement.

In April, Bloomberg reported that one technology company, Oracle, was leading an effort to "unseat Amazon as the front-runner for the multibillion-dollar deal," with participation from other contenders for the contract, including IBM and Microsoft.  

Oracle did not respond to requests for comment from Nextgov and Defense One about whether it provided funding for the dossier or RosettiStarr or was leading an effort to undermine AWS’s bid. IBM told Nextgov and Defense One it was “not involved” in the dossier. A Microsoft spokesperson declined to comment, stating the company “does not comment on active RFP processes.”

What’s clear is that there’s a broad battle among tech industry heavyweights to position themselves for JEDI. It pits traditional tech and defense contractors that have served the military and government for decades against Amazon and Google, relative newcomers to the defense space that threaten to disrupt the multibillion-dollar defense technology market. Industry groups representing some of those tech firms and others lobbied the Pentagon to award the JEDI contract to multiple cloud providers, which would have meant significant revenue streams for all winners. But the Pentagon ultimately decided a single cloud provider would best suit its needs.  

The JEDI contract calls for a cloud platform at the "tactical edge," and will put a commercial company in charge of hosting and distributing mission-critical workloads and classified military secrets to warfighters around the globe. Mattis, when asked in April by the Senate Armed Services Committee about the alleged "rush" to award JEDI, said it was needed for "lethality." The Pentagon later defended its single-award approach to Congress in a May report, claiming multiple clouds would reduce "the ability to access and analyze critical data," while the "lack of a common environment for computing and data storage" would minimize the effectiveness of new technologies like AI and machine learning for warfighters.

The Pentagon opened bidding for the contract on July 26. Industry bids  are due by Sept. 17. DOD had planned to award the contract in late 2018 and roll out initial operating capabilities by mid-2019, but delays seem likely. On Aug. 7, Oracle filed a pre-award bid protest against the Pentagon that may not be resolved until November. High-profile, lucrative defense contracts are often protested after the award, so the Pentagon almost certainly faces another legal battle once it awards JEDI.

Delays in the JEDI acquisition may give an assist to AWS’ closest competitors. According to the JEDI RFP, the winning company must meet the government's rigorous standards to host classified data within 180 days of the contract award, and meet standards to host Top Secret/Sensitive Compartmented Information within 270 days. Currently, AWS is the only cloud service provider that meets those standards, but officials from Microsoft and IBM say they’re close.