CIO Coleman Extols Benefits of Telework
As prepared for delivery
Chief Information Officer
U.S General Services Administration
Industry Advisory Council Executive luncheon
December 5, 2007
Thank you and good afternoon. It’s a pleasure to be here. I’d like to thank IAC on behalf of myself and our Administrator, Lurita Doan, for this opportunity to address the luncheon.
I think many of you are familiar with our Administrator. Lurita is a woman of limitless energy and many creative ideas. I was named CIO on August 29th. On September 12th, inspiration struck and Administrator Doan announced her latest idea and challenge for GSA leadership:
Get 50 percent of our eligible workforce teleworking by 2010.
Suffice it to say that was the easy part. At GSA Headquarters, word began to spread and people began talking. There was broad and enthusiastic support. Some started picking their telework days.
There was also this question for the new CIO:
Just how are we going to do this?
That’s much of what I’m going to talk about today. First, though, a little background.
It shouldn’t come as any surprise that GSA leads the development of alternative workplace arrangements for the federal community. As a long-time innovator and leader in this arena, GSA has been at the forefront of government-wide regulations on telework. We’re now in the process of looking at each position in the agency to determine if it’s telework eligible, and our latest job postings include a notice to the same effect.
There’s also been a slight philosophical shift. That is, we now tell our managers and supervisors that every GSA job is telework eligible unless they document why it is not. That’s not to say every job will be eligible. There are very good reasons why some positions are not suited to telework – I’ll talk about those in a minute – but we are taking the opt-out approach in an effort to meet the challenge. Once we determine which positions are eligible, we will still need to look at the people. Not everyone is suited to be or chooses to be a teleworker. Our goal is broad participation and improved employee performance.
We live, as has been said, in interesting times. Advances in technology have made it possible for public and private sector workers to do their jobs away from the traditional worksite. It’s a good deal if you think about it. They can work anytime or anywhere, conserve energy and lessen our dependence on foreign oil, all at the same time. They need a computer, a high speed data line, and a phone. In the very near future, I expect that all three will be rolled into one device. Voice over internet, high speed WI-FI, and data encryption all exist; it’s just a question of the best and most cost-effective way of ensuring that each teleworker has the right equipment, training, and data security to do his or her job.
And by the way, the dividends go beyond environment and work-life balance. How many remember the SARS scare from a few years back? At the end of 2002 through the summer of 2003 we had an international pandemic with about 8,000 known infected cases and about 775 deaths. After China, Canada was one of the hot zones for SARS.
Unlike the 1918 Spanish Flu Pandemic, we were a lot smarter about how to control the spread of the disease. In Toronto, if you visited a place where there was a known infection – like a hospital, doctor’s office, or even a work place – you were sent home and quarantined for two weeks -- even if you never exhibited any symptoms. The good news is that the disease didn’t spread much in Canada. The bad news is that, because many organizations lacked systems to work from home, a lot of people sat at home watching tv for two weeks. So, in addition to the other benefits I’ve mentioned, telework also plays a key role in continuity planning.
Of course getting everything in proper order requires support from the top. At GSA, we have a far-sighted Administrator who has become an advocate, and the effort to meet her ambitious target is already underway.
In truth, we need to do more in this area. In 2005, there were a little over 140,000 teleworkers in the federal government -- 19 percent of the telework-eligible workforce and 7.7 percent of the total workforce.
In D.C., federal employees now have the option of working from home or from one of GSA’s 14 Regional Telework Centers. The centers, in Maryland, Virginia and West Virginia, were established to provide a full range of workplace services so employees can work away from the conventional office. The centers are equipped with computers and telephone services, fax and copier machines, meeting rooms, and onsite technical assistance staff.
A 2005 analysis shows that GSA’s 14 telework centers saved commuters from traveling nearly 2.8 million miles, which, in turn, saved almost 115 thousand gallons of fuel. In addition, 2.3 million pounds of emissions were kept from being released into our atmosphere.
Home telework is even more important as GSA and other agencies include it in their routine planning and consultation with our client agencies to conserve energy by occupying less space and using less electricity and lighting in their buildings.
I confess our lack of progress is a little frustrating because the benefits of telework are so obvious: it saves taxpayer dollars; reduces energy use; cuts down on greenhouse gases; eases traffic; reduces our dependence on foreign oil and even increases worker productivity. And as we discussed, telework also prepares us to operate remotely and continue business operations in the event of a national disaster, pandemic event, or terrorist attack.
That’s why Administrator Doan is so intent to have GSA lead by example. Let me tell you a little bit about how we’re trying to meet the challenge.
While there are many personnel, policy and culture issues to tackle, a key concern involves information technology. Today’s federal workforce is primarily made up of information workers -- employees who make their living using I-T tools and data to make critical agency decisions. To be productive, these new virtual employees need the same access to their data, agency I-T systems and agency intranet web sites from their homes, telework sites or other virtual locations as they now have in their offices.
GSA’s CIO Management team has started performing cost/benefit analysis and vendor comparisons of products, and in the near future will be making some hard decisions about how to meet the Administrator’s challenge.
Making telework a reality raises new I-T challenges – namely, how to provide the new breed of workers unencumbered access to the information resources they need while still providing adequate safeguards for agency data and networks. The issues around telework I-T security can be placed into three categories: endpoint security, network security, and data security.
Endpoint addresses what endpoint devices are allowed to connect to the GSA network over the internet and how or whether we allow them to connect. The idea is to provide a ‘smart,’ controlled, enterprise-managed entry point into the network for any legitimate computer requesting access to I-T resources on the GSA network. Endpoint security solutions can determine the difference between an agency-managed laptop plugged into a home broadband connection, an employee’s home computer with out-of-date virus scan and another employee working at an airport internet kiosk, and perform specific “deny” or “allow” actions for each. These systems also allow for inclusion of 2 factor authentication as required by OMB. They provide an important first step in allowing safe, secure remote data access for remote workers.
Network security addresses many of the same issues as the endpoint solutions. These include protection of the agency network and data from malicious code, malware and viruses, while allowing secure access to agency data from outside of the safety of the network. Products in this space also help address the two factor authentication and session timeout requirements of OMB Memo 06-16.
The third issue is data security. I don’t need to tell you that data security breaches make headline news. And trust me, the last thing an agency wants is to be on the front page of the Post explaining how personally identifiable or other sensitive data was compromised by a teleworker, a network vulnerability or other security breach.
So how do we protect this data while making it accessible to those who have a bona fide need for it? GSA is looking at a multi-pronged approach. First, there’s the issue of data leaving the network. Employing systems that can ‘sandbox’ agency data into virtual sessions, such as Citrix or other server-based computing technologies, a user gets access to a virtual session with a fully functioning application and data, appearing to run on his or her remote, untrusted computer, but without the ability to save any data to that untrusted computer’s hard drive, USB drive or if desired, to even print it to a remote printer. This provides the employee with a rich user experience while ensuring that the data never leaves. Another technology under review is data at rest, laptop data encryption, again to comply with OMB. GSA will be rolling this out over the course of fiscal 2008 on all portable computer systems.
While security is a paramount concern, it is by no means the only concern. Other issues being reviewed:
• Issuance of a single, laptop computer as the default computer for all eligible teleworkers. While requiring an additional upfront cost, this will significantly reduce overall hardware and support costs, and provide the agency with mobile I-T assets to be used for our coop response.
• Agency funding of home broadband service for teleworkers. While Public Law (104-52) allows agencies to fund “phone lines, necessary equipment and pay for monthly charges, in any private residence of an employee authorized to work at home,” this is obviously a significant financial issue that must be decided individually by each agency.
• Next is the issue of asset management of remote devices. we’re about to begin a project in which many or potentially most of GSA’s laptop computers will be out of the office for extended periods of time. This presents another issue:
• How to keep track of them and ensure recovery when or if they get lost. To address this issue, GSA has recently added Absolute Software’s ‘Computrace’ product to every new laptop purchased on our BPA with Intelligent Decisions, Incorporated. This product monitors a laptop’s location, provides an asset management portal to track remote computers, and if a device becomes lost or stolen, can remotely wipe the laptop hard drive as well as assist law enforcement with locating the device.
A final decision and probably the most contentious is whether to allow personally owned computers to be used for telework. There are many valid reasons both for and against. One could easily make an argument that they are too insecure, could be used too easily by viruses to attack the agency network and if we are issuing laptops to every employee, why would we need to allow this? On the other hand, if the security measures I mentioned are employed, (especially requiring any user on an untrusted home computer to only access agency data via a virtual, server-based application session), this would provide a secure method to use personally owned equipment and yet prevent a network breach or data loss.
This method completely isolates the user’s home computer from the agency network. Another argument for allowing this access is to provide for additional I-T assets to be used by employees in case of a COOP or pandemic situation, when anxieties will run high and the trusted, agency laptop may have been left back in the office or otherwise unavailable. We will undoubtedly have significant debate over this issue before a final decision is made.
To sum up, the benefits of telework are obvious to the agency as well as to the taxpayer and ultimately for the environment. However, before an agency gives the ‘green light’ for a majority of its employees to telework, it will require a significant number of issues for the I-T community to address first. The I-T vendor community has seen this trend to mobile workforce coming for awhile and has provided us with plenty of product choices to resolve the security, access, and management issues.
What needs to be done now is clear: each agency needs to identify its unique issues, do the analysis and put in place solutions to address them.
GSA plans to lead the way. In the process, we hopefully will demonstrate to our agency clients how to balance these tricky issues of cost, security and employee productivity.
Thank you very much.