How not to buy a dustpan

If you wonder why some among us are not terribly sanguine about the idea of ceding more control and power to the Federal government, consider some of the procurement documents available at www.fbo.gov. The Federal Business Opportunities website lists nearly every contract that the feds want to bid to private business, and for those willing to wade into a swamp of stultifying bureaucratic language, it makes revealing reading. We will consider just two examples. Brave readers are invited to don their gaiters and explore for themselves.

Consider procurement FA8201-09-R-0088.
Briefly stated, folks at Hill Air Force Base in Utah were seeking assistance with the security documentation of some of their systems. That basic idea is contained in language like this:

The objective is to satisfy policy requirements of DIACAP IAW DoDI 8510.01, DoD Information Assurance Certification and Accreditation Process (DIACAP), and AFI 33-210, Air Force Certification and Accreditation (C&A) Program (AFCAP) to complete Information Technology Lean and Security, Interoperability, Supportability, Sustainability, and Usability (SISSU) checklist in the Enterprise Information Technology Data Repository (EITDR).

This seemingly daunting array of acronyms and document references is actually comprehensible to those in the IT security business - but the actual solicitation is barely so. It reads more like a grammar schools student's attempt to write a paper on the theory of relativity by stringing together related chunks from the encyclopedia. A knowledgeable reader quickly apprehends that the creators of this solicitation have little understanding of the subject about which they are writing. How they intend to judge the merits of the responses is a mystery.

But the real thigh slapper is found in the final pages of the work statement – truly revealing the thrown-together nature of the enterprise. Bidders are admonished that in the course of their work reviewing the security posture of IT systems they must be prepared to deal with toxic stuff:

If the contractor spills or releases any substance contained in 40 CFR 302 into the environment, the contractor or its agent shall immediately report the incident to the Hill AFB Command Post at 801-777-3007. The liability for the spill or release of such substances rests solely with the contractor and its agent.

The "40 CFR 302" (available to masochists and insomniacs here) is a 74 page document that includes lengthy definitions of words like "facility" , "person" and "release". ("Release means any spilling, leaking, pumping, pouring, emitting, emptying, discharging, injecting, escaping, leaching, dumping, or disposing into the environment..."). Some 50 pages are taken up with a list of substances with names like Diethyl-p-nitrophenyl phosphate.

So in the unlikely event the intrepid security contractor releases more than 23 kilograms of Ethanimidothioic acid, he is enjoined to notify the command post. Great. Glad we have that covered.

What is not so amusing, and which speaks volumes about the mistrust with which many people regard the government is seen in the final addendum to the procurement request:

This is to notify all interested parties that the Government is hereby cancelling this solicitation. There has been a tremendous amount of interest and numerous questions on this requirement. These questions pointed out areas that we need to address and clearly define before we can re-solicit this requirement. We felt this action was necessary in order to provide you a better understanding of our requirements, proposal expectations and evaluation procedures. We apologize for any inconvenience.

Translated in plain English, this says

Having hastily and carelessly thrown together this ill-defined request for bids, full of inconsistencies and security boiler-plate pasted from well known documents that say nothing about our actual requirements, we have received an avalanche of pointed questions from knowledgeable security professionals who have made us aware just how meaningless our document is. No doubt dozens of contractors have wasted hundreds of man-hours trying to create a comprehensible response to this mess, which will only serve to drive up the cost of the services that we will eventually procure when we fix this piece of junk and reissue it. Sorry about that.

Or consider this nine (yes, nine) page document drafted to secure dustpans for the General Services Administration (https://www.fbo.gov/index?tab=documents&tabmode=form&subtab=core&tabid=aaec633ba60681fba7e3155a6292cc6c) Dustpans are carefully defined thusly:

The dustpan shall consist of a pan attached to a handle, and shall be in accordance with the following characteristics...The front edge of the pan shall be in continuous contact with the floor when in use or when pressed to the floor with slight downward pressure applied to the handle. When the dustpan is lifted from the floor by the handle, the pan shall swing downward by gravity into a vertical position so that debris will move into the hooded area. The handle shall balance in the upright position when the pan is flat on the floor. The handle shall not interfere with the entrance of debris into the pan.

In contrast to the previous procurement, it can be said that the writer of these words knows a little something about his subject. Now if only we could get that knowledge and precision applied to a slightly more complex topic like computer security.

Single payer health care, anyone?