Trending
CHARLESTON – A new contract between West Virginia and Google for cloud-based communications and productivity services could open the state up to security issues when transmitting sensitive information, according to our neighbor to the east.
The Virginia Information Technologies Agency's Supply Chain Management Division put together an overview in May regarding the commonwealth's messaging environment. The agency expressed concerns about the security of using Google for secure messaging. The document was obtained through a Freedom of Information Act request.
"The messaging environment is not approved by the commonwealth's security office to transmit sensitive data," the report stated. "This often becomes challenging for our customers to find alternative solutions."
Virginia made an agreement with the Colorado-based IT management firm Tempus Nova in 2016 to use Google's G Suite service, including the Gmail for messaging as well as other Google services. Previously, VITA had a 12-year contract with defense contractor Northrup Grumman for Virginia's entire IT infrastructure, which included Microsoft products. The commonwealth left that contract two years early after an audit recommended switching to multiple vendors for individual IT needs.
Despite the original goal of switching to Google services from Microsoft services, VITA put out a request for proposals in August for tech solutions that could marry both the Google and Microsoft messaging services. Bidding closed on Oct. 20 with no awarding of the contract at this time. According to the May VITA overview of messaging services, tech officials stated it would be less disruptive to use both services.
"The (Google) tenant managed by Tempus Nova is expected to be carried into the next messaging contract as it would not be ideal to stand up a new G Suite tenant and migrate to it," the overview states. "Additionally, the commonwealth would like the option to use its (Microsoft) licensing for messaging purposes. Therefore, the messaging tower will consist of two messaging platforms."
Joshua Spence, chief technology officer for the West Virginia Office of Technology, said he was unaware of the VITA report and would reach out to Virginia for more information on its concerns. Spence said that unlike Virginia, West Virginia has a more centralized system for productivity that allows the Office of Technology to better handle security issues.
"Are we concerned about security? Absolutely," Spence said by phone Thursday. "This specific issue with messaging that Virginia has indicated, we will probably reach out and see if we can better understand why they made that determination and where it might apply."
The state also follows the Federal Risk and Authorization Management Program model, which provides standards for cloud products and services, including the kinds of data can be securely transmitted through the cloud. Spence said both Google and Microsoft use FedRAMP certification.
"We can kind of use (FedRAMP) as a means to help us evaluate the security of a solution," Spence said. "What they recognize is Google and Microsoft and none of these solution providers want every government entity to come to them and go, 'Hey, we need you to participate in a third-party audit.' The cost would be astronomical. Instead, they created the standard based approach and it includes the third-party assessment that then provides a view."
The state of West Virginia announced in October a multi-year deal with Google to transition the executive branch to Google Workspace, formerly known as G Suite, for $8 million. At the time, the state projected a cost savings of $11.5 million for making the switch, as well as providing "innovation and provide enhanced IT security."
"This collaboration, West Virginia and Google, is truly going to allow us to serve the people of this state better than ever, and the people should be proud of the fact that we got a great deal and will be saving millions and millions of dollars in the process," said Gov. Jim Justice in a statement announcing the deal on Oct. 15.
"It's an incredibly exciting opportunity for us to be able to work with a tech giant like Google. This is another example of how the best of the best companies are seeing all the goodness we're building in West Virginia and want to be a part of our momentum," Justice said.
Yet, just months before the Google contract was announced, West Virginia MetroNews revealed the state Office of Technology signed an extension with Microsoft to continue offering its backend tech services to the state on June 1 and continuing until May 30, 2023. Microsoft offers many of the same services as Google through its Microsoft 365 program.
"We were surprised to learn through your press release that, six weeks after awarding Microsoft a contract to provide these services, the state entered into a contract with Google for more than $8 million for services already included in the state's Microsoft contract," wrote Jamie Harper, vice president for education and state and local government at Microsoft, in a Nov. 8 letter.
"We were also surprised that, despite this duplicative spend, the state communicated this decision as a net $11.5 million cost savings," Harper continued. "In our experience, gaps in Google's service offerings will require the state to continue using Microsoft or other third-party technology tools, ultimately costing state governments more."
That's exactly what happened in Arizona, which switched over to Google in 2017 at a cost of $24 million. According to the Arizona Republic, the implementation of the new email system through Google is already $6 million over budget and behind schedule as of Nov. 2. The estimated cost to move the emails to the Google system was $3.78 million. The switch is estimated to cost Arizona $24.2 million by 2022.
Google has been in the news this week for other reasons. Earlier this week, Google experienced at least two outages of its services. According to Ars Technica, Google's authentication system crashed Monday, preventing people from signing into Gmail, YouTube, and other popular Google services. On Tuesday, Gmail users reported receiving error messages and experiencing bounced emails. As of Thursday, the Google Workspace status dashboard reported no problems.
Spence said these kinds of issues occasionally happen with cloud-based services. The alternative was having the servers and infrastructure on site, costing millions to upkeep and causing major issues and delays when equipment or software fails, he said.
"In this situation, it was just an internal outage, a result of probably a change that did go badly," Spence said. "I think it was back in September, there was a very similar one that happened on Microsoft side, where they had to roll back, I think it was about six hours of their authentication services being down. These make the news, because they're such big providers and therefore the impact is broad."
Google also is facing multiple lawsuits for alleged anti-trust activities. West Virginia Attorney General Patrick Morrisey announced Thursday he was joining a federal lawsuit filed by a bipartisan coalition of 38 state attorneys general and territories including from Virginia and Arizona to sue Google over anticompetitive practices involving its marquee product, the Google search engine.
"Big tech must be held accountable to ensure meaningful access to competition," Morrisey said in a statement. "Corporations have a right to thrive, but they must not do so at the expense of severely and unlawfully limiting consumer choice. Increased competition provides improved privacy protections, more targeted results and greater opportunities."
The search engine lawsuit is similar to one filed by the U.S. Department of Justice in October. In another federal lawsuit filed Wednesday, Texas and eight states are suing Google over its control of digital advertising. The suit accused Google of manipulating ad-buying in a way that freezes out competitors.