Hacking the JEDI Cloud

On October 25, 2019, the United States Department Of Defense (DoD) awarded Microsoft a firm-fixed-price, indefinite-delivery/indefinite-quantity (ID/IQ) contract. If all options are exercised, it’s ceiling value will be $10B over a period of 10 years.

The JEDI Concept

The JEDI (Joint Enterprise Defense Infrastructure) contract will implement Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) programs to support DoD commercial and missional objectives. The National Defense Budget ($716B/3.1% GDP) funds operations from 4800 defense sites in 160 nations across 7 continents.

On September 13, 2017, the DoD initiated JEDI to “aggressively accelerate the Department’s adoption of cloud architecture and services…at all classification levels.” Currently, the Pentagon operates multiple data centers, which delays mandatory software and hardware updates. This creates unnecessary security risks that increases DoD vulnerability to potential cyberattacks.

The JEDI Strategy

JEDI will unite the intelligence of all U.S. military divisions within a singular cloud data network. This enterprise cloud solution is essential to the development of intricate, data-intensive networks that will create successful business and mission operations. Since the The Pentagon currently has 500+ separate clouds, JEDI will serve as an umbrella system to rationalize that number while keeping military technology in step with with civilian technology.

The DoD still needs on-premises data center capability for applications currently unsuited for the cloud. They currently plan to transition 80% of their on-premises systems to the cloud, with JEDI accounting for 20% of the total. However, with the adoption of an enduring enterprise cloud strategy, the on-premises environment should decrease over time. Strategically, JEDI will:

• Use commercial cloud services to transform DoD data aggregation, processing, analysis, and storage to enhance technological capabilities, enable real-time decision-making, and support joint force operations.
• Acquire a worldwide, highly available, exponentially elastic, secure, resilient cloud computing and storage environment that seamlessly extends from the homefront to the tactical edge.
• Establish a DoD-wide enterprise contracting vehicle that achieves delivery of cloud computing and storage services via automated, self-service provisioning and billing.
• Enable rapid development and deployment of new applications and advanced capabilities.
• Employ the latest in commercial cybersecurity technologies.

“This is going to be more than an IT system. It’s not email, this is not cloud storage, it’s not data transfer. This is about how us and you together are going to change the way that this nation, its soldiers, its sailors, its marines and airmen fight and win…”

– Brig. Gen. David Krumm, Pentagon Deputy Director

The technical requirements for JEDI were formulated by the Defense Digital Service (DDS) – a self-described “SWAT team of nerds on tours of duty at DoD to provide the best in modern technology to strengthen our national defense” and “to drive a giant leap forward in the way the Pentagon builds, buys and deploys technology and digital services.” The projected JEDI fulfillment date is October 24, 2029, if all options are exercised.