Event Information

Cloud computing services over the Internet have the potential to spur a significant increase in government efficiency and decrease technology costs, as well as to create incentives and online platforms for innovation. Adoption of cloud computing technologies could lead to new, efficient ways of governing.

On April 7, the Brookings Institution hosted a policy forum that examines the economic benefits of cloud computing for local, state, and federal government. Federal Chief Information Officer Vivek Kundra delivered a keynote address on the role of the government in developing and promoting cloud computing. Brookings Vice President Darrell West moderated a panel of experts and detailed the findings in his paper, "Saving Money through Cloud Computing," which analyzes its governmental cost-savings potential.

After the program, panelists took audience questions.

Video

• Cloud Computing a Fiscally Smart Move
• Cloud Computing Saves Money, Makes Government More Open
• Cloud Computing Will Fundamentally Change Government Operations
• Government on Cloud Will Yield Cost-Effective System

Audio

• The Economic Gains of Cloud Computing

Transcript

• Uncorrected Transcript (.pdf)

Event Materials

• 20100407_cloud_computing
• 0407_cloud_computing_kundra_remarks
• 0407_cloud_computing_kundra_presentation

Technology offers the greatest source for innovation in the public sector and one of the best examples falls within the area of cloud computing. As I noted in a recent paper, the U.S. federal government spends nearly $76 billion each year on information technology, and $20 billion of that is devoted to hardware, software, and file servers. Traditionally, computing services have been delivered through desktops or laptops operated by proprietary software. But new advances in cloud computing have made it possible for public sector agencies alike to access software, services, and data storage through remote file servers.

I looked at possible cost savings a federal agency might expect from migrating to the cloud. After undertaking case studies of government agencies that made the move, I found that the agencies generally saw between 25 and 50 percent savings in moving to the cloud. Public officials can save money by reducing the number of file servers they need to purchase, cutting software costs, relying on fewer information technology specialists, and improving the efficiency of their data storage utilization.

In 2008, Washington, D.C. city government shifted many of its 38,000 employee email services across 86 agencies to the cloud, and the migration saved 48 percent on email expenditures. In 2009, the city of Los Angeles moved email service for its 30,000 employees to the cloud. An analysis undertaken by City Administrative Officer Miguel Santana for the City Council found that the five-year costs of running the new Google system would be $17,556,484, which was 23.6 percent less than the $22,996,242 for operating GroupWise during that same period. And in terms of personnel savings, the city needed nine fewer people in its information technology department.

The U.S. Air Force 45th Space Wing is responsible for launching and tracking unmanned space vehicles from Cape Canaveral Air Force Station and employs more than 10,000 workers. The Wing had 60 distinct file servers, but found that it utilized only 10 percent of central processing unit capacity. Commanders modernized their system and saved $180,000 per year in annual computing costs. In addition, the unit saved money by not buying new hardware or deploying new software. These are just some of the ways the government is using technology to save money and increase efficiency of its operations.

Executive Summary

Government information technology is subject to a variety of rules, regulations, and procurement policies.  Computing is treated differently depending on whether the platform is based on desktops, laptops, mobile devices, or remote file servers known as cloud computing.  There are differences between the executive, legislative, and judicial branches of government, as well as in the level of privacy and security expected for various applications.  

Some people perceive higher security on desktop or laptop computers and lower security with the cloud because the latter’s information is stored remotely through third-party commercial providers.  In reality, though, there are serious security threats to all electronic information regardless of platform, and cloud server providers often take security more seriously than mass consumers or government officials employing weak passwords on their local computers. 

In this paper, I review current federal IT policy and discuss rules, practices, and procedures that limit innovation.  There are a variety of obstacles that make it difficult for policymakers to take full advantage of the technological revolution that has unfolded in recent years.  After outlining these issues, I make recommendations on policy changes required to improve the efficiency and effectiveness of federal computing. 

My specific recommendations include:

1. Public officials should develop more consistent rules on computing across desktop, laptop, mobile, and cloud platforms.  
2. The use of video, collaboration, and social networking should be authorized for congressional offices.  This would make legislative branch policy consistent with that of the executive branch.
3. Judicial branch computing should be modernized, with greater emphasis on cloud computing. 
4. There should be a more uniform certification process for federal agencies.  Right now, each agency is responsible for certifying its own applications.  It makes sense to have a “joint authorization board” with the power to review management services and certify particular products for use across the government. 
5. Congress should update the Electronic Communications Privacy Act to change the process by which law enforcement agents obtain electronic information.  Instead of using a prosecutor’s subpoena, legislation should require a “probable cause” search warrant that is approved by a judge.  This would provide greater safeguards in terms of online content, pictures, geolocation data, and e-mails.
6. Privacy rights should be placed on the same footing regardless of whether a person is using desktop or cloud computing.  It makes little sense to have weaker standards on one platform than another.  Consumers and government decision-makers expect the same level of protection whether they are accessing information on a desktop, laptop, mobile, or cloud storage system. 
7. Congress should amend the Computer Fraud and Abuse Act to strengthen penalties for unwanted intrusion into computing systems.  The law has inconsistent penalties and prosecutors have found that it is hard to prosecute cyber-crimes. 
8. Apps.gov represents a big step forward and government use should be expanded because it makes procurement easier and speeds public sector innovation.  It is a model of how the government can reinvent itself through digital technology in ways that improve efficiency and effectiveness.
9. Countries need to harmonize their laws on cloud computing so as to reduce current inconsistencies in regard to privacy, data storage, security processes, and personnel training,  
10. There should be mechanisms for data exchange that encourage portability across platforms.  We should avoid vendor lock-in that precludes data exchange.
11. Data on uptime, downtime, recover time, archiving, and maintenance schedules would help build public trust by providing information on computing performance.

Downloads

• Download the Full Paper

Event Information

The U.S. government spends billions of dollars each year on computer hardware, software and file servers that may no longer be necessary. Currently, the public sector makes relatively little use of cloud computing, even though studies suggest substantial government savings from a migration to more Internet-based computing with shared resources.

On July 21, the Center for Technology Innovation at Brookings hosted a policy forum on steps to enhance public sector adoption of cloud computing innovations. Brookings Vice President Darrell West moderated a panel of experts, including David McClure of the General Services Administration, Dawn Leaf of the National Institute for Standards and Technology, and Katie Ratte of the Federal Trade Commission. West released a paper detailing the policy changes required to improve the efficiency and effectiveness of federal computing.

Audio

• Moving to the Cloud: How the Public Sector Can Leverage the Power of Cloud Computing

Transcript

• Uncorrected Transcript (.pdf)
• Download Dawn Leaf's PowerPoint Presentation (.pdf)
• Download David McClure's PowerPoint Presentation (.pdf)

Event Materials

• 20100721_cloud_computing
• 0721_cloud_computing_leaf
• 0721_cloud_computing_mcclure

Event Information

Although research suggests that considerable efficiencies can be gained from cloud computing technology, concerns over privacy and security continue to deter government and private-sector firms from migrating to the cloud. By its very nature, storing information or accessing services through remote providers would seem to raise the level of privacy and security risks. But is such apprehension warranted? What are the real security threats posed to individuals, business and government by cloud computing technologies? Do the cost-saving benefits outweigh the dangers?

On October 26, the Brookings Institution hosted a policy forum on the privacy and security challenges raised by cloud computing. Governance Studies Director Darrell West moderated a panel of technology industry experts examining how cloud computing systems can generate innovation and cost savings without sacrificing privacy and security. West will also present findings from his forthcoming paper “Privacy, Security, and Innovation in Cloud Computing.”

After the program, panelists took audience questions.

Transcript

• Uncorrected Transcript (.pdf)

Event Materials

• 20101026_cloud_computing

Executive Summary

Cloud computing can mean different things to different people, and obviously the privacy and security concerns will differ between a consumer using a public cloud application, a medium-sized enterprise using a customized suite of business applications on a cloud platform, and a government agency with a private cloud for internal database sharing (Whitten, 2010). The shift of each category of user to cloud systems brings a different package of benefits and risks.

What remains constant, though, is the tangible and intangible value that the user seeks to protect. For an individual, the value at risk can range from loss of civil liberties to the contents of bank accounts. For a business, the value runs from core trade secrets to continuity of business operations and public reputation. Much of this is hard to estimate and translate into standard metrics of value (Lev, 2003) The task in this transition is to compare the opportunities of cloud adoption with the risks. The benefits of cloud have been discussed elsewhere, to the individual to the enterprise, and to the government (West, 2010a, 2010b).

This document explores how to think about privacy and security on the cloud. It is not intended to be a catalog of cloud threats (see ENISA (2009) for an example of rigorous exploration of the risks of cloud adoption to specific groups). We frame the set of concerns for the cloud and highlight what is new and what is not. We analyze a set of policy issues that represent systematic concerns deserving the attention of policy-makers. We argue that the weak link in security generally is the human factor and surrounding institutions and incentives matter more than the platform itself. As long as we learn the lessons of past breakdowns, cloud computing has the potential to generate innovation without sacrificing privacy and security (Amoroso, 2006; Benioff, 2009).

Downloads

• Download the Full Paper

EXECUTIVE SUMMARY

Many web services are examples of cloud computing, from storage and backup sites such as Flickr and Dropbox to online business productivity services such as Google Docs and Salesforce.com. Cloud computing offers a potentially attractive solution to customers keen to acquire computing infrastructure without large up-front investment, particularly in cases where their demand may be variable and unpredictable, as a means of achieving financial savings, productivity improvements and the wider flexibility that accompanies Internet-hosting of data and applications.

The greater flexibility of a cloud computing service as compared with a traditional outsourcing contract may be offset by reduced certainty for the customer in terms of the location of data placed into the cloud and the legal foundations of any contract with the provider. There may be unforeseen costs and risks hidden in the terms and conditions of such services.

This document reports on a detailed survey and analysis of the terms and conditions offered by cloud computing providers.

The survey formed part of the Cloud Legal Project at the Centre for Commercial Law Studies (CCLS), within the School of Law at Queen Mary, University of London, UK. Funded by a donation from Microsoft, but academically independent, the project is examining a wide range of legal and regulatory issues arising from cloud computing. The project's survey of 31 cloud computing contracts from 27 different providers, based on their standard terms of service as offered to customers in the E.U. and U.K., found that many include clauses that could have a significant impact, often negative, on the rights and interests of customers. The ease and convenience with which cloud computing arrangements can be set up may lull customers into overlooking the significant issues that can arise when key data and processes are entrusted to cloud service providers. The main lesson to be drawn from the Cloud Legal Project’s survey is that customers should review the terms and conditions of a cloud service carefully before signing up to it.

The survey found that some contracts, for instance, have clauses disclaiming responsibility for keeping the user’s data secure or intact. Others reserve the right to terminate accounts for apparent lack of use (potentially important if they are used for occasional backup or disaster recovery purposes), for violation of the provider’s Acceptable Use Policy, or indeed for any or no reason at all. Furthermore, whilst some providers promise only to hand over customer data if served with a court order, others state that they will do so on much wider grounds, including it simply being in their own business interests to disclose the data. Cloud providers also often exclude liability for loss of data, or strictly limit the damages that can be claimed against them – damages that might otherwise be substantial if a failure brought down an e-commerce web site.

Although in some U.S. states, in E.U. countries and in various other jurisdictions the validity of such terms may be challenged under consumer protection laws, users of cloud services may face practical obstacles to bringing a claim for data loss or privacy breach against a provider that seems local online but is, in fact, based in another continent. Indeed, service providers usually claim that their contracts are subject to the laws of the place where they have their main place of business. In many cases this is a US state, with a stipulation that any dispute must be heard in the provider’s local courts, regardless of the customer’s location.

Perhaps the most disconcerting discovery of the Cloud Legal Project’s survey was that many providers claimed to be able to amend their contracts unilaterally, simply by posting an updated version on the web. In effect, customers are put on notice to download lengthy and complex contracts, on a regular basis, and to compare them against their own copies of earlier versions to look for changes.

The cloud computing market is still developing rapidly, and potential cloud customers should be aware that there may be a mismatch between their expectations and the reality of cloud providers' service terms, and be alive to the possibility of unexpected changes to the terms.

Downloads

• Download the Full Paper

Event Information

While research suggests that considerable efficiencies can be gained from cloud computing technology, concerns over privacy and security continue to deter governments and private-sector firms from migrating to the cloud. Senator Amy Klobuchar (D-Minn.) has advanced discussion of the “Cloud Computing Act of 2011,” draft legislation that would address these challenges by encouraging the U.S. government to negotiate with other countries to establish consistent laws related to online security and cloud computing. The bill also creates new enforcement tools for investigating and prosecuting those who violate online privacy and security laws.

On June 16, the Brookings Institution hosted a forum on the policy proposals in the Cloud Computing Act of 2011. Discussion included an overview of the international policy implications as governments and firms adjust to a coherent legal framework, changes and innovations in public procurement, and challenges for private industry as it balances consumer needs and compliance with these proposed cloud computing safeguards.

After the program, panelists took audience questions.

Transcript

• Uncorrected Transcript (.pdf)

Event Materials

• 20110616_cloud_computing

Executive Summary

The move to the cloud is one of the defining information technology trends of the early 21st century. By providing businesses, universities, government agencies, and other entities with access to shared and often physically dispersed computing resources, cloud computing can simultaneously offer increased flexibility, reduced cost, and access to a wider array of services.

Cloud computing has also created a set of new challenges. For example, the issues of privacy and security in the cloud are well recognized and have been extensively discussed in the business and popular press. However, one critical issue that has received very little attention with respect to cloud computing is export control.

In the broadest sense, export control relates to regulations that the United States and many other countries have put in place to restrict the export of various sensitive items, information, and software.

There is an inherent tension between cloud computing and export control. While the concept of the cloud is centered on the premise of removing the need to track the details of data movement among various destinations, export control regulations are built largely around restrictions tied to those very movements.

If cloud computing is to reach its full potential, it is critical for providers and users of cloud services to address its implications with respect to export control. It is equally important to adapt the export control regulations to reflect the increasing prevalence of cloud computing in a manner that preserves the ability of American companies to benefit from the efficiencies of the cloud while also ensuring that American national security and foreign policy interests are adequately protected.

Downloads

• Download the Paper

As of today, the federal government will require that all cloud service providers have Federal Risk and Authorization Program (FedRAMP) approval. FedRAMP is a program meant to standardize the security of cloud services, thus reducing the time and effort that independent cloud providers would need to spend ensuring cloud security. According to a 2013 annual report by the General Services Administration, agencies that use FedRAMP could save 50 percent on staffing and $200,000 in costs overall. FedRAMP will operate under similar rules as the Federal Information Security Management Act (FISMA), which helps maintain security of federal IT systems, applications and databases. Both FISMA and FedRAMP will provide enhanced protection and scrutiny for federal and independent agencies.

To learn more about cloud computing, read Darrell West’s papers Saving Money Through Cloud Computing and Steps to Improve Cloud Computing in the Public Sector. Visit the FedRAMP website here.

MaryCate Most contributed to this post.

The first instance of “cloud” computing came in 2006, when Amazon released its Elastic Compute Cloud, a service for consumers to lease space on virtual machines to run software. Now, the cloud enables the transfer and storage of data around the world, in an almost seamless fashion. Using cloud services are a seamless experience from the consumer perspective. This ease of use obscures significant regulation from governments on both sides of the Atlantic. The Safe Harbor Principles is a framework that ensures that personal consumer data being transferred from the EU to the US is still subject to a level of security in compliance with the EU’s stricter regulation on data protection. US companies must be certified within this framework, in order to transfer consumer data outside the EU.

A comprehensive data privacy arrangement that satisfies both sides of the Atlantic is necessary to preserve the free flow of data, and the resulting commerce, between the two regions. Speaking at the 2014 Cloud Computing Policy Conference, Cameron F. Kerry suggested that neither side of the Atlantic can afford to partition the Internet. Currently trade negotiators are assessing the viability including an update to Safe Harbor Principles as a part of the Transatlantic Trade and Investment Partnership (TTIP).

TTIP and the Future of Trade

The NSA revelations last year have only increased support for further regulation over the transfer of personal data in the cloud, especially in the European Union (EU). The revelations have also brought to light significant differences in the European and US conceptions of privacy. The ruling by the European Court of Justice on the “right to be forgotten” is a recent example of this transatlantic divide. In EU countries, citizens can now request Google to take down links from search results that lead users to potentially damaging information.

There are several disputes that negotiators must first resolve. Europeans would prefer that American regulators take a more active role in cases where US firms are violating the Safe Harbor principles. EU officials have also indicated they would like to include a mechanism to send an alert if data were improperly shared with US law enforcement officials. The expansion of the codes of conduct within the cloud would serve as a major step towards finalizing TTIP. A European Commission Analysis finds that TTIP would inject about $130 billion into the US economy. Ultimately both the EU and the US have so much to gain that both nations must find a way to resolve these thorny issues.

Kevin Risser contributed to this post.

Cloud computing is becoming omnipresent in the private sector as companies latch on to this innovation as a way to manage scalability, improve flexibility, and reduce cost. Analysts at IDC predict that, over the next six years, nearly 90 percent of new spending on Internet and communications technology will be on cloud-based platforms. Apple, Google, Amazon, Microsoft, and hundreds of smaller companies are positioning themselves to dominate the estimated $5 trillion worldwide market. While few companies will provide numbers, it is estimated that Amazon and Google may run as many as 10 million servers while Microsoft runs close to one million. In short, it is an innovation that makes a mockery out of Moore’s law.

But, like all innovations, cloud computing has potential pitfalls. Public sector organizations in particular have had difficulty taking advantage of new technologies. The Heritage Foundation keeps a list over 50 examples of government ineptitude including $34 billion in fraudulent Homeland Security contracts, National Institutes of Health renting a lab that it neither needs nor can use for $1.3 million per month, and the Department of Agriculture wasting $2.5 billion in stimulus money on broadband internet. Technological ineptitude received special attention with the failed launch of the Healthcare.gov, the release of classified data from Edward Snowden, and the costly FBI virtual case file debacle.

Cloud computing is far more than just a simple technology change and requires a close examination of governance, sourcing, and security. We sought to understand how well state government is prepared to address the challenges of cloud computing.

The Approach

We have gathered and started to do a content analysis of the IT strategic plans for each state. For each plan, we performed a content analysis, which is looking for certain phrases or text within the IT strategic plan in order to have a structured way to understand the data. Details for our approach can be seen in our previous blog post.

How States Are Implementing the Cloud

We were not surprised to see a number of states preparing to study or embark on cloud computing.

While some states don’t mention it (e.g. Alabama), most states are eagerly exploring it. For example, North Dakota’s plan talks about cloud computing as an integral part of the future and seven of its thirteen major IT initiatives are centered on preparation for transitioning to the cloud “where and when it makes sense”.

Vermont puts itself squarely in the studying period. The plan describes that, “While the risks of enterprise-wide and cloud-based IT must be carefully managed, trends continue to just larger-scale operations.” Wisconsin also clearly lays out its view on cloud computing, writing that, “Flexibility and responsiveness (also) guide Wisconsin’s approach toward adoption of cloud services” and suggests that its version of a private cloud “…offers advanced security and service availability tailored for business needs.” West Virginia provides an equally balanced approach by requiring that only services with an acceptably low risk and cost-effective footprint will be moved to the cloud.

In short, all of the states that are considering cloud computing are taking a thoughtful and balanced approach.

The Good

One of the most critical aspects of cloud computing is security and, without question, states understand the importance of good security. A good example of this is Colorado who designates security as one of its four “wildly important goals” and sets the target of “10 percent reduction in information security risk for Colorado agencies by close of FY15”.

South Carolina echoed the same theme by asserting that security and confidentiality are “overriding priorities at every stage of development and deployment.” Connecticut’s plans explain the need to “continuously improve the security and safeguards over agency data and information technology assets”.

The Bad

Despite the interest in cloud computing, we were only able to find a single state (Georgia) that explicitly links governance to security and, to us, by extension to cloud computing. In Georgia’s plan, they start with the idea that “strong security programs start with strong governance” and then explicitly describe necessary changes in governance to improve security.

We were, however, impressed with the seriousness that New York, North Carolina and Massachusetts took governance but it was difficult to find many other states that did.

The Ugly

Unfortunately the results on sourcing were dismal. While a few states (e.g. Kansas, Ohio, and Massachusetts) specifically discuss partnerships, most states seemed to ignore the sourcing aspect of cloud computing. The most ominous note comes from Alabama where they make a statement that innovation in the state is being stifled by a lack of strong personnel.

While we have great enthusiasm for government to address cloud computing, some of the non-technical issues are lagging in the discussion. Good government requires that these items be addressed in order to realize the promise of cloud computing.

Since 2009 the federal government started the process of replacing local computers with cloud platforms. A recent report from the Congressional Research Service (CRS) provides an interesting view into the progress of these investments. It reveals the benefits that public agencies gain when using cloud services and the barriers they face when making the transition.

Advantages of Cloud Computing

Cloud computers are superior to locally-run data centers for a variety of reasons. The CRS report identifies six specific cloud benefits:

• Cost- Cloud computer platforms use resources more efficiently than local servers. An organization that uses local Information Technology (IT) must invest in the infrastructure to support computer systems at times of peak demand. However, most times companies or government agencies require only a fraction of that computing power. Cloud computing allows organizations to pay for all of the resources they need and avoid costly investments in rarely used local IT systems.
• Energy Efficiency- Cloud computing data centers benefit from economies of scale to run more efficiently than local servers. In some cases this can result in huge energy savings. For a large cloud computing center it also makes economic sense to invest in green energy sources like wind or solar for power.
• Availability- Cloud computing systems make it easy for any device with an Internet connection to access files or software. However, if a facility temporarily loses Internet access the files on cloud system are inaccessible. Alternatively, a locally administered IT system could function without Internet connectivity.
• Agility- Cloud systems can make it easier to upgrade operating systems and applications. The available computing power also means that memory intensive software packages are cost effective.
• Security- Cloud providing companies also have the financial resources to purchase the tools necessary to ensure that networks remain safe.
• Reliability- Cloud systems can save data onto multiple servers. If a single server goes down due to a cyberattack or another issue, the data is available on another server.

Government Investments in the Cloud

Determining the exact size of government cloud computing expenditures is difficult. Government spending on IT has increased every year from 2001 to 2013 when it reached a peak of $81 billion. In the three subsequent years it has decreased. Cloud computing expenditures likely represent a tiny fraction of that total. Market research firms have estimated that the federal government spends between $1.4 billion and $7 billion on cloud computers annually.

Trends in Total Federal Investment in Information Technology

Source: Congressional Research Service

Challenges for Migrating to the Cloud

The federal government has encountered several barriers in its plan to shift more functions to cloud platforms:

• High Federal Security Requirements- The government faces new advanced persistent threats routinely. System-wide security updates are necessary more often than for private sector organizations. The short update cycle provides a unique challenge to cloud providers.
• Adopting New Technologies- Government agencies have ingrained cultures that are slow to change. This shift from locally-based servers to the cloud can be slow and tedious for this reason.
• Ancillary Technologies- Cloud technologies are known for their flexibility. However, government agencies may lack the necessary IT infrastructure or speedy Internet connections that leverage the maximum potential of the cloud.
• Technical Know How- Cloud platforms require specialized knowledge to administer. Many government agencies lack the necessary experts to oversee a migration to the cloud.
• IT Expenditure- Migration to the cloud can involve expensive initial costs. Additional funding is necessary to facilitate the shift to the cloud.

The Future of the Government Cloud

An analysis of the costs and benefits of cloud migration uncover a few specific barriers that the federal government must overcome to earn the full value from new technologies. First, lawmakers must be willing to spend more now to save money later. Cloud systems are cheaper to run than local administered servers but the initial transition costs are high. Current funding levels, which are trending down, are too low to finance such a change. Privacy and security are also major challenges. Government servers host troves of data that Americans expect to remain private. Converting these systems to the cloud will require the government’s full confidence that cloud systems are at least as secure. New legislation is likely necessary to achieve the complimentary goals of privacy and security.

More TechTank posts available here

In December 2009, the Saban Center for Middle East Policy conducted a day-long simulation of the diplomatic and military fallout that could result from an Israeli military strike against the Iranian nuclear program. In this Middle East Memo, Kenneth M. Pollack analyzes the critical decisions each side made during the wargame.

The simulation was conducted as a three-move game with three separate country teams. One team represented a hypothetical American National Security Council, a second team represented a hypothetical Israeli cabinet, and a third team represented a hypothetical Iranian Supreme National Security Council. The U.S. team consisted of approximately ten members, all of whom had served in senior positions in the U.S. government and U.S. military. The Israel team consisted of a half-dozen American experts on Israel with close ties to Israeli decision-makers, and who, in some cases, had spent considerable time in Israel. Some members of the Israel team had also served in the U.S. government. The Iran team consisted of a half-dozen American experts on Iran, some of whom had lived and/or traveled extensively in Iran, are of Iranian extraction, and/or had served in the U.S. government with responsibility for Iran.

Read more »

Downloads

• Download

Introduction:

In the ebb and flow of Middle East diplomacy, the two interrelated issues of an Israeli-Syrian peace settlement and Washington’s bilateral relationship with Damascus have gone up and down on Washington’s scale of importance. The election of Barack Obama raised expectations that the United States would give the two issues the priority they had not received during the eight years of the George W. Bush administration. Candidate Obama promised to assign a high priority to the resuscitation of the Arab-Israeli peace process, and separately to “engage” with Iran and Syria (as recommended by the Iraq Study Group in 2006).

In May 2009, shortly after assuming office, President Obama sent the assistant secretary of state for Near Eastern affairs, Jeffrey Feltman, and the senior director for the Middle East in the National Security Council, Daniel Shapiro, to Damascus to open a dialogue with Bashar al-Asad’s regime. Several members of Congress also travelled to Syria early in Obama’s first year, including the chairman of the Senate Committee on Foreign Relations, John Kerry, and the chairman of the House Committee on Foreign Affairs, Howard Berman. In addition, when the president appointed George Mitchell as special envoy to the Middle East, Mitchell named as his deputy Fred Hof, a respected expert on Syria and the Israeli-Syrian dispute. Last summer, both Mitchell and Hof visited Damascus and began their give and take with Syria.

And yet, after this apparent auspicious beginning, neither the bilateral relationship between the United States and Syria, nor the effort to revive the Israeli-Syrian negotiation has gained much traction. Damascus must be chagrined by the fact that when the Arab-Israeli peace process is discussed now, it is practically equated with the Israeli-Palestinian track. This paper analyzes the difficulties confronting Washington’s and Jerusalem’s respective Syria policies and offers an approach for dealing with Syria. Many of the recommendations stem from lessons resulting from the past rounds of negotiations, so it is important to understand what occurred.

Downloads

• Download Full Report - English

Introduction

The issue of Iran has become a central preoccupation for the international community in recent months, thanks to the intersection of the historic changes in the region, an American presidential election, sharpening rhetoric from Israel, and Tehran’s relentless determination to advance its nuclear capabilities. The focus of policymakers in Washington and around the world remains fixed on the options for forestalling Iran’s determined march toward a nuclear weapons capability. This is the appropriate objective; the best possible outcome for maintaining peace and security in the Gulf and avoiding a deeply destabilizing nuclear arms race remains a credible, durable solution that curtails Iran’s nuclear ambitions. And while achieving such an outcome remains profoundly problematic, largely as a result of Tehran’s intransigence, preventing Iran from crossing the nuclear weapons threshold—either through persuasion, coercion, or some combination of the two—remains fully and unambiguously within the capabilities of the international community.

The shadow cast by Tehran has created a particularly intense sense of existential anxiety for the smaller Gulf states, including Kuwait, Bahrain, the United Arab Emirates, Qatar, and Oman. After all, these are the same states whose civil orders were repeatedly disrupted by Iranian subversion and sponsorship of terrorism during the first decade after Iran’s Islamic revolution, and whose thriving economies rely on unimpeded access to the global commons. The events of the past decade have only exacerbated the smaller Gulf states’ endemic sense of insecurity. Iran has achieved a synergistic, sometimes even parasitic, relationship with the leadership of post-Saddam Iraq that, together with Tehran’s longstanding relationships with Syria and Lebanese Hizballah, greatly enables its bid for predominance in the heart of the Middle East. Today, the uncertainties surrounding the implications of regional flux have left Tehran simultaneously weakened and emboldened—a particularly dangerous combination for this particular array of Iranian leaders.

With Iran’s nuclear program advancing by the month and its efforts to tilt the regional balance in its favor growing more forceful, the small states of the Persian Gulf must face the distinct dilemma of preparing for the possible worst-case scenario of the nuclearization of their neighborhood, while participating ever more robustly in the international efforts to preclude that very possibility. In some respects, the Gulf states’ situation is unique. Unlike Israel, another small state that perceives an existential threat from Iran, the Gulf states cannot fall back upon either a presumptive nuclear deterrent or a primordial bond to the body politic of the world’s only remaining superpower. And in contrast to Iran’s other neighbors, the vast resources and history of ideological and territorial disputes between the Gulf states and Tehran significantly intensify the stakes. Even before the Gulf became the vital transportation corridor for global energy, the fault line in the regional balance of power had always run between the northern states and their southern rivals. The mere possibility that the north may gain a nuclear advantage is reshaping the security environment for Iran’s neighbors in the Gulf.

Because the threat of Iran looms large, the exigency of considering the widest possible array of alternative prospects for the evolution of this protracted crisis is important. This paper tackles the scenarios that successive American presidents have deemed unacceptable—an Iranian development or acquisition of a nuclear weapons capability or of nuclear weapons themselves—and the implications that such scenarios would have for the global nonproliferation regime and regional security, with a particular focus on the special challenges faced by Iran’s southern neighbors. To protect against threats along their borders, the Gulf states have traditionally hedged their bets by seeking balanced relations with their more powerful neighbors while cultivating extra-regional allies. That formula is already changing, as evidenced by a new assertiveness in Gulf states’ postures toward Tehran and a new creativity in deploying strategies for deterring and mitigating Iran’s efforts to extend its influence and/or destabilize its neighbors. The Gulf states must transform this tactical innovation into a full-fledged new hedging policy: one that deploys every possible tool to prevent a nuclear Iran while taking every possible step to prepare for such an eventuality.

Download » (PDF)

Downloads

• Thinking the Unthinkable: The Gulf States and a Nuclear Iran

The American people deserve to have a federal government that is both responsive and effective. That simply isn’t the case for more than 1 million people who are awaiting the adjudication of their applications for disability benefits from the Social Security Administration.

Washington can and must do better. This gridlock harms applicants either by depriving them of much-needed support or effectively barring them from work while their cases are resolved because having any significant earnings would immediately render them ineligible. This is unacceptable.

Within the next month, the Government Accountability Office, the nonpartisan congressional watchdog, will launch a study on the issue. More policymakers should follow GAO’s lead. A solution to this problem is long overdue. Here’s how the government can do it.

Congress does not need to look far for an example of how to reduce the SSA backlog. In 2013, the Veterans Administration cut its 600,000-case backlog by 84 percent and reduced waiting times by nearly two-thirds, all within two years. It’s an impressive result.

Why have federal officials dealt aggressively and effectively with that backlog, but not the one at SSA? One obvious answer is that the American people and their representatives recognize a debt to those who served in the armed forces. Allowing veterans to languish while a sluggish bureaucracy dithers is unconscionable. Public and congressional outrage helped light a fire under the bureaucracy. Administrators improved services the old-fashioned way — more staff time. VA employees had to work at least 20 hours overtime per month.

Things are a bit more complicated at SSA, unfortunately. Roughly three quarters of applicants for disability benefits have their cases decided within about nine months and, if denied, decide not to appeal. But those whose applications are denied are legally entitled to ask for a hearing before an administrative law judge — and that is where the real bottleneck begins.

There are too few ALJs to hear the cases. Even in the best of times, maintaining an adequate cadre of ALJs is difficult because normal attrition means that SSA has to hire at least 100 ALJs a year to stay even. When unemployment increases, however, so does the number of applications for disability benefits. After exhausting unemployment benefits, people who believe they are impaired often turn to the disability programs. So, when the Great Recession hit, SSA knew it had to hire many more ALJs. It tried to do so, but SSA cannot act without the help of the Office of Personnel Management, which must provide lists of qualified candidates before agencies can hire them. SSA employs 85 percent of all ALJs and for several years has paid OPM approximately $2 million annually to administer the requisite tests and interviews to establish a register of qualified candidates. Nonetheless, OPM has persistently refused to employ legally trained people to vet ALJ candidates or to update registers. And when SSA sought to ramp up ALJ hiring to cope with the recession challenge, OPM was slow to respond.

In 2009, for example, OPM promised to supply a new register containing names of ALJ candidates. Five years passed before it actually delivered the new list of names. For a time, the number of ALJs deciding cases actually fell. The situation got so bad that the president’s January 2015 budget created a work group headed by the Office of Management and Budget and the Administrative Conference of the United States to try to break the logjam. OPM promised a list for 2015, but insisted it could not change procedures. Not trusting OPM to mend its ways, Congress in October 2015 enacted legislation that explicitly required OPM to administer a new round of tests within the succeeding six months.

These stopgap measures are inadequate to the challenge. Both applicants and taxpayers deserve prompt adjudication of the merits of claims. The million-person backlog and the two-year average waits are bad enough. Many applicants wait far longer. Meanwhile, they are strongly discouraged from working, as anything more than minimal earnings will cause their applications automatically to be denied. Throughout this waiting period, applicants have no means of self-support. Any skills applicants retain atrophy.

The shortage of ALJs is not the only problem. The quality and consistency of adjudication by some ALJs has been called into question. For example, differences in approval rates are so large that differences among applicants cannot plausibly explain them. Some ALJs have processed so many cases that they could not possibly have applied proper standards. In recognition of both problems, SSA has increased oversight and beefed up training. The numbers have improved. But large and troubling variations in workloads and approval rates persist.

For now, political polarization blocks agreement on whether and how to modify eligibility rules and improve incentives to encourage work by those able to work. But there is bipartisan agreement that dragging out the application process benefits no one. While completely eliminating hearing delays is impossible, adequate administrative funding and more, better trained hearing officers would help reduce them. Even if OPM’s past record were better than it is, OPM is now a beleaguered agency, struggling to cope with the fallout from a security breach that jeopardizes the security of the nation and the privacy of millions of current and past federal employees and federal contractors. Mending this breach and establishing new procedures will — and should — be OPM’s top priority.

That’s why, for the sake of everyone concerned, responsibility for screening candidates for administrative law judge positions should be moved, at least temporarily, to another agency, such as the Administrative Conference of the United States. Shortening the period that applicants for disability benefits now spend waiting for a final answer is an achievable goal that can and should be addressed. Our nation’s disabled and its taxpayers deserve better.

Editor's note: This piece originally appeared in Politico.

Event Information

An American Enterprise Institute-Brookings/USC Schaeffer Initiative Event
 

For most of the last five decades, the most-discussed finding by the Medicare trustees has been the insolvency date, when Medicare’s trust fund would no longer be able to pay all of the program’s costs. Last year’s report projected that the hospital insurance trust fund would be depleted by 2030 – just 14 years from now. The report also predicted a more immediate and controversial event: the Independent Payment Advisory Board (IPAB), famously nicknamed “death panels,” would be required to submit proposals to reduce Medicare spending in 2018, with the reductions taking place in 2019. Do we remain on this path to automatic Medicare cuts next year?

The American Enterprise Institute and the Schaeffer Initiative for Innovation in Health Policy, a collaboration between the USC Leonard D. Schaeffer Center for Health Policy & Economics and the Brookings Institution, hosted a discussion of the new 2016 trustees report on June 23. Medicare’s Chief Actuary Paul Spitalnic summarized the key findings followed by a panel of experts who discussed the potential consequences of the report for policy actions that might be taken to improve the program’s fiscal condition. You can join the conversation at #MedicareReport.

Video

• Introduction and keynote address
• Panel discussion

Audio

• The 2016 Medicare Trustees Report: One year closer to IPAB cuts?

Event Materials

• AEI TR16 final
• 20160623_medicaretrusteesreport_transcript

It seems the Senate could have a really hot summer. Majority leader Harry Reid (D-NV) has reportedly threatened to “go nuclear” this July—meaning that Senate Democrats would move by majority vote to ban filibusters of executive and judicial branch nominees. According to these reports, if Senate Republicans block three key nominations (Richard Cordray to head the Consumer Financial Protection Bureau, Thomas Perez at Labor, and Gina McCarthy at EPA), Reid will call on the Democrats to invoke the nuclear option as a means of eliminating filibusters over nominees.

Jon Bernstein offered a thoughtful reaction to Reid’s gambit, noting that Reid’s challenge is to “find a way to ratchet up the threat of reform in order to push Republicans as far away from that line as possible.” Jon’s emphasis on Reid’s threat is important (and is worth reading in full).  Still, I think it’s helpful to dig a little deeper on the role of both majority and minority party threats that arise over the nuclear option.

Before getting to Reid’s threat, two brief detours. First, a parliamentary detour to make plain two reasons why Reid’s procedural gambit is deemed “nuclear.” First, Democrats envision using a set of parliamentary moves that would allow the Senate to cut off debate on nominations by majority vote (rather than by sixty votes). Republicans (at least when they are in the minority) call this “changing the rules by breaking the rules,” because Senate rules formally require a 2/3rds vote to break a filibuster of a measure to change Senate rules. The nuclear option would avoid the formal process of securing a 2/3rds vote to cut off debate; instead, the Senate would set a new precedent by simple majority vote to exempt nominations from the reach of Rule 22. If Democrats circumvent formal rules, Republicans would deem the move nuclear. Second, Reid’s potential gambit would be considered nuclear because of the anticipated GOP reaction: As Sen. Schumer argued in 2005 when the GOP tried to go nuclear over judges, minority party senators would “blow up every bridge in sight.” The nuclear option is so-called on account of the minority’s anticipated parliamentary reaction (which would ramp up obstruction on everything else).

A second detour notes simply that the exact procedural steps that would have to be taken to set a new precedent to exempt nominations from Rule 22 have not yet been precisely spelled out.  Over the years, several scenarios have been floated that give us a general outline of how the Senate could reform its cloture rule by majority vote. But a CRS report written in the heat of the failed GOP effort to go nuclear in 2005 points to the complications and uncertainties entailed in using a reform-by-ruling strategy to empower simple majorities to cut off debate on nominations. My sense is that using a nuclear option to restrict the reach of Rule 22 might not be as straight forward as many assume.

That gets us to the place of threats in reform-by-ruling strategies. The coverage of Reid’s intentions last week emphasized the importance of Reid’s threat to Republicans: Dare to cross the line by filibustering three particular executive branch nominees, and Democrats will go nuclear. But for Reid’s threat to be effective in convincing GOP senators to back down on these nominees, Republicans have to deem Reid’s threat credible. Republicans know that Reid refused by go nuclear last winter (and previously in January 2009), not least because a set of longer-serving Democrats opposed the strategy earlier this year. It would be reasonable for the GOP today to question whether Reid has 51 Democrats willing to ban judicial and executive branch nomination filibusters. If Republicans doubt Reid’s ability to detonate a nuclear device, then the threat won’t be much help in getting the GOP to back down. Of course, if Republicans don’t block all three nominees, observers will likely interpret the GOP’s behavior as a rational response to Reid’s threat. Eric Schickler and Greg Wawro in Filibuster suggest that the absence of reform on such occasions demonstrates that the nuclear option can “tame the minority.”  Reid’s threat would have done the trick.

As a potentially nuclear Senate summer approaches, I would keep handy an alternative interpretation.  Reid isn’t the only actor with a threat: given Republicans’ aggressive use of Rule 22, Republicans can credibly threaten to retaliate procedurally if the Democrats go nuclear.  And that might be a far more credible threat than Reid’s. We know from the report on Reid’s nuclear thinking that “senior Democratic Senators have privately expressed worry to the Majority Leader that revisiting the rules could imperil the immigration push, and have asked him to delay it until after immigration reform is done (or is killed).” That tidbit suggests that Democrats consider the GOP threat to retaliate as a near certainty. In other words, if Republicans decide not to block all three nominees and Democrats don’t go nuclear, we might reasonably conclude that the minority’s threat to retaliate was pivotal to the outcome. As Steve Smith, Tony Madonna and I argued some time ago, the nuclear option might be technically feasible but not necessarily politically feasible.

To be sure, it’s hard to arbitrate between these two competing mechanisms that might underlie Senate politics this summer.  In either scenario—the majority tames the minority or the minority scares the bejeezus out of the majority—the same outcome ensues: Nothing. Still, I think it’s important to keep these alternative interpretations at hand as Democrats call up these and other nominations this spring. The Senate is a tough nut to crack, not least when challenges to supermajority rule are in play.