Over half a century ago mainframe COBOL helped send men to the moon. Since then it has been used to develop and operate a myriad of government systems.  It is so prevalent that currently, 75% of the world’s financial transactions are processed though COBOL systems, according to Chris Ostrander, principal at Deloitte Consulting LLP. Many organizations in the public and private sector have tried to modernize their COBOL systems and failed, while others have hesitated to even attempt it, as it runs the heart of their business. The current global pandemic has caused COBOL to again dominate headlines given the sudden surge of demand for access to the services it enables. How can federal government agencies, still working with the once-state-of-the-art language of COBOL, use inspiration from Neil Armstrong, to take one small step towards modernization, one giant leap toward next generation systems?

Thinking Differently About Modernization

“The technologies and approaches people think they know have evolved,” said Scott Buchholz, managing director and chief technology officer for Government and Public Services at Deloitte Consulting LLP. “People who have been down the journey once might want to take another look.”

In decades past, systems modernization projects often started by gathering user requirements based on their understanding of current processes and operations. Technology modernization specialists, like Scott, would create bespoke upgrades based solely on the requirements provided, and, once modernized, hand the new system back to users for testing. But users kept finding problems. It inevitably turned out that the users who had been providing the requirements did not have a full view of how the system worked, and successfully redeveloping the system actually required an understanding of all individual parts, along with a larger holistic view of how the parts worked together.

Similar to NASA realizing that COBOL, originally a necessity for launch, needed to progress into the future, CIOs also began realizing their IT systems strategies needed to make significant technological leaps, possibly leaving COBOL behind. In the last decade alone, IT Modernization trends have included:

1. Understanding legacy system functionality using automated tools
2. Speeding up development and system integration with Low Code Platforms
3. Using Cloud to standardize platforms and reduce time to market

Helping understand legacy system functionality with automated tools

The risk of legacy modernization project failure often increases if there is not a complete understanding of scope, scale, and details of the legacy functionality they are attempting to replace.

“You can think about most legacy systems like the attic in my grandmother’s old barn – a dangerous treasure trove with sharp, rusty objects everywhere,” Buchholz said. “Picking anything up meant picking up a pile of stuff, and nobody really knew what was underneath.”

What do leaders know already or want to know when going into a modernization project today? Deloitte Consulting works with government agencies to help understand the valuable information embedded in their legacy systems, provide clear steps to migrate them to more current technology and establish a digital foundation allowing the organization to adapt more quickly to changes into the future.

Increasingly powerful code and data analysis tools automate a large portion of a formerly manual process to understand a system’s business logic and the data it uses, providing valuable information into a strategic approach for the organization to modernize while still functioning with business-as-usual.

Speeding up development and system integration with Low Code Platforms

For years, government agencies like NASA had a saying, “slow COBOL is still better than no COBOL.” Recently though, NASA and other organizations began to look at how legacy mainframes that once got them to the moon could now be transformed through automated tools. Tools such as low code platforms could accelerate processes, while at the same time reducing costs to get the new functionality up and running. Updating a myriad of interfaces to a legacy system happens to be something low-code systems excel at, as they can quickly build APIs and replace piles of file-based legacy interfaces.

“These platforms already contain a lot of the underlying processes, workflow and data collection that make building things like case management systems much quicker and easier,” Ostrander said. “And so in some cases, when people know what the system’s doing, or if they can just reinvent the way they’re working, it’s easier to start with some of these more modern platforms that accelerate the process, because they already have a lot of the functionality built in.”

Landing in the Cloud

Finally, while many public sector agencies have IT infrastructure facing unprecedented surges, through deep insights we know moving core applications to the cloud can improve operations through availability, reliability, and resiliency. A new Gartner survey predicts that worldwide spending on IT services will decrease 7% this year, even as businesses rely more heavily on technologies and people to support operations. As budget pressures increase—and many analysts believe they will— adoption of cloud computing is likely to accelerate.

Moreover, moving systems to the cloud can enable government organizations to take advantage of ongoing advances and investments being made by the major cloud providers in areas ranging from machine learning and emerging technologies to areas like security, stability, and scalability.

Taking another look at modernization

Application modernization and migration is more important than ever for government systems. Modernizing can create efficiencies that help to lower costs and build flexible, agile IT environments.  Then modernized applications can be migrated to the cloud for additional efficiencies and reliability, potentially reducing costs, enhancing scalability, and lowering operational spending—and that alone can help agencies adapt in the near term and thrive in the long term. So, as Armstrong might say, when it comes to modernization today, the eagle has landed.

As used here, “Deloitte” means Deloitte Consulting LLP, a subsidiary of Deloitte LLP. Please see www.deloitte.com/us/about for a detailed description of Deloitte’s legal structure. Certain services may not be available to attest clients under the rules and regulations of public accounting.

Copyright © 2020 Deloitte Development LLC. All rights reserved.

For the last decade, governments at the federal, state, and local levels have been advancing digital transformation programs that support broader online access to benefits, services, and information. The COVID-19 crisis has highlighted that progress has been made to date but that there is still much to be done, particularly for citizens needing access to services from multiple government agencies.

More often than not, citizens are required to laboriously register new credentials for each service, inputting the same personal information for each site and service. When peeling back the layers of how digital identity can enable broader, stronger, and more convenient online transactions, four specific principles can be distilled:

Digital identity solutions should be user controlled and portable so that citizens can easily access many online services with the same secure digital identity, and not have to create multiple different identities for each service.

Digital identity services should be flexible and adaptive to support the rapid integration of different end-user devices and authentication mechanisms—such as biometric technologies and low-friction solutions such as behavioral analytics—based on evolving technologies and the shifting threat environment.

A broader digital identity ecosystem will likely emerge where verified information will be consumed—for example, a citizen may establish reputational trust around their digital identity that is used to post online information; or threat alerts, such as compromised email addresses or other information that may be shared among organizations in the ecosystem.

Strong digital identity systems should enable bi-directional trust – that is, governments need to know that the authorized citizens are accessing services and information, but citizens also need to trust that they are interacting with a legitimate service, that their personal information will be protected, and that they can efficiently access services.

Bi-directional trust puts the individual in control of their identity

Deloitte’s perspective on this critical topic of digital identity—based on supporting programs across federal and state governments for over a decade—is that the specific aspect of bi-directional trust has historically been the sticking point. “In the past, there has understandably been more of a focus on the government identifying individuals correctly to make sure benefits and services are going to the right people,” said Colin Soutar, managing director in the Cyber and Strategic Risk practice at Deloitte & Touche LLP. “But as online services evolve, there also needs to be reciprocal trust by citizens that their interactions with service providers are securely protected and that their privacy is preserved.” Deloitte believes that achieving this bi-directional trust is incumbent upon embracing and implementing the principles of digital identity stated above.

As this bi-directional trust is established, the user experience should also be simplified and streamlined. Currently, citizens accessing different government services online typically have different logins, different passwords, and need to supply the same set of personal information each time to verify their identity. That’s because government currently operates on the basis of re-identifying digital users each time they access a new service.

Instead of this re-identification cycle, bi-directional trust embraces the principle of putting the citizen in control of their digital identity. The federal or state governments, or the commercial sector, can issue citizens verified attributes that they can then use to access government services. Depending on the risk of the transaction—filing taxes would likely be high risk, booking a tennis court would likely be low risk—the required attributes for that transaction would change. But regardless of the transaction and whether it was with local, state, or the federal government, the digital identity would be the same.

Bi-directional trust is convenient for all parties

With this bi-directional trust and user convenience, governments can achieve digital transformation milestones, leading to greater efficiencies and cost savings. “When citizens don’t trust the government service that they are interacting with, they might walk away,” Soutar says. “We often see loss of patience or trust as a predictor of online attrition rates.” That attrition costs government money, because those people who could have interacted with services online now have to be supported in person or telephonically, which is more expensive and resource intensive.

“Even if they request different services, it is ultimately the same individual who is a constituent,” said Ryan Galluzzo, manager in the Cyber and Strategic Risk practice at Deloitte & Touche LLP. “Enabling that individual to bring their own identity to different online interactions promotes a simpler user experience and gives the individual greater ability to control their own identity data. It also means that the government doesn’t have to force identity proofing each time an individual accesses a different service or government agency.”

Important to this portability is that a user can carry their trusted digital identity across disparate platforms and agencies, to access a multitude of government services and interactions. There are many different concepts to enable this portability and most are based on the idea that individuals would be able to receive verified attributes—date of birth, address, driver license number, Social Security number—from attribute providers. The attributes could be stored in a mobile driver license or a digital wallet and then used by the individual as needed. This model would enable the individual would be able to choose which attributes to reveal based on the transaction and there would be privacy-enhancing features. The digital wallet or mobile driver license would show that they are over a certain age for age verification rather than revealing full date of birth, and instead of giving out the entire address it would confirm that they live in a specific town.

Layered bi-directional trust enables more agile systems

Overall, portability can be accomplished via common standards and the digital identity can be protected through authentication methods like biometrics, device fingerprinting, or more traditional techniques like multi-factor authentication. This use of diverse authentication technologies also enables governments to adapt to changes in security posture; user preferences; or modernization needs. It also allows citizens to choose their preferred channel—mobile, laptop, desktop, etc.—for interaction with the government while feeling safe in the knowledge that their digital identity is enabling secure communication.

As digital identity systems continue to evolve, governments may benefit from deploying a layered approach that dynamically adjusts controls based on the current situational and transactional risk. This would be supported by broader ecosystem capabilities, such as shared threat signals, crowdsourced vulnerability hunting, and broad information sharing that unlocks identity ecosystem-wide security capabilities that can support trusted transactions. This broader digital identity ecosystem will, of course, also require that bi-directional trusts exists between all ecosystem participants such as governments, businesses, and individuals. This would be based on common adoption of operating principles such as those stated here.

A broader digital identity ecosystem benefits all

“For years, the security industry has been calling for two-factor authentication—which remains a valid and powerful tool—but we are already seeing some traditional two-factor authentication methods being subverted,” Galluzzo remarks. “A way for governments to stay ahead of attackers is to manage risk through the layering of new and innovative solutions that can be rapidly deployed through modular, service-based architectures.”

Techniques such as behavioral biometrics, device attributes, user history, and dynamic access controls can create moving targets for attackers and support a stronger security posture. “With many of these solutions the need for transparency becomes paramount,” Galluzzo says. “Users need to know what data governments are collecting, how it’s being used, and how they can opt-out. Without this, bi-directional trust is not possible.”

A more dynamic and cohesive digital identity ecosystem can enable citizens to more efficiently and conveniently move around online while governments gain the assurance that they need to determine that benefits are going to the correct individuals. The world has been disrupted by the COVID-19 pandemic, and it is inevitable that a more virtual society will persist beyond the crisis. This virtual society will have many diverse circumstances – with use cases that span a wide range of requirements for verification of digital identities. One approach to satisfy those needs is to embrace a broader digital identity ecosystem that embraces bi-directional trust between citizens and government, portability across government, and the ability to be flexible and adapt to the needs of the individual.

In March 2020, something many experts have spent their careers claiming is impossible actually came to pass: the majority of the federal government transitioned to telework and working in remote, virtual teams, nearly overnight. This monumental shift happened in response to the coronavirus pandemic, but its repercussions are expected to ripple far into the future as the federal government and its workforce adapt to the changing nature of work.

Jacqui Winters, Principal at Deloitte Consulting LLP, said that while a crisis may have prompted this shift, it’s the recovery period immediately after that presents an opportunity for federal agencies to look at the business of government differently.

“This trend of the future of work, how jobs are changing, how a professional’s experiences and expectations are changing, how government customer needs are changing, and the criticality of being ever more agile in the future are all really significant. Those agencies that are prepared to do that are taking the right steps now to serve their mission and meet citizens’ needs – whether that is in person or through technology – and they will be more resilient after the pandemic.”, Winters said. “Many of these things that are being applied now will be optimized and employed as critical components of the way government operates in the future. And with that, we hope that we can make the best of the situation to begin to learn from this situation and build toward the new era that’s ahead of us around digital disruption and workforce disruption.”

Not every job is appropriate for telework. But many federal agencies are finding out that it can be done on a far greater scale than had been anticipated. And this is an opportunity for those agencies to take a look at what works, what doesn’t, and where greater mobility and flexibility can be applied to develop an engagement model for the future of the federal workforce. To be sure, some tasks are getting done differently than before, and some aren’t getting done at all. This may help agencies reconsider what activities can be automated and where workers can focus their time differently on the mission work that matters most.

Some agencies and teams were already ahead of the curve. Those that leaned into telework early and put significant thought into what their employees would need to effectively work remotely were better positioned when this crisis began, and may be able to move to long-term transformation faster.  Employees and agencies alike are discovering new challenges, tools and resources to fit this new paradigm.

“Those agencies that respond to that will have a competitive edge when it comes to attracting talent. We have seen consistently that there is a growing interest in and demand for more flexibility and more options for a number of reasons,” said Lucy Melvin, Human Capital Senior Manager at Deloitte Consulting LLP. “People are looking for more flexibility and how they balance their work with their other obligations in life.”

This can apply to everything from employees who want to pursue further education to agencies looking to leverage a more geographically diverse workforce. Flexibility is a key as agencies seek to expand their talent pool and attract employees.

“Successful remote work and virtual teams depend on effective communication, clear alignment around goals and outcomes, and equipping staff with the tools and resources they need to be successful in a virtual environment. That muscle is there in everyone,” said Jacqui Winters. “It’s just getting that opportunity to flex that muscle and feeling comfortable doing it. When we explain that to our federal clients, they see telework does not need to be a barrier. Everyone can telework and can do it well.”

As with so many other things in the federal space, and especially revolving around technology, what is most important are the people and the processes, not the technology itself. The tools and capacity to make this possible exist, or can be built. But the culture has to embrace them, from Directors and Senior Executives to managers and supervisors to the frontline workers. And this is an opportunity for that to happen.

“One thing that’s really comes to light is how important it is to recognize a telework policy doesn’t exist in a vacuum,” said Melvin. “It intersects with cybersecurity policy, it intersects with the culture and HR policy of an organization, as well as all of those things around recruitment, and what types of work are being prioritized, and how the organization is monitoring performance to hold staff accountable for outcomes and detect performance challenges. And so it’s really worth seeing telework as a big — but certainly not the only — lever for agencies to have this discussion around what things they need to change and what things might continue on after all this is done.”

As used in this document, “Deloitte” means Deloitte Consulting LLP, a subsidiary of Deloitte LLP. Please see www.deloitte.com/us/about for a detailed description of our legal structure. Certain services may not be available to attest clients under the rules and regulations of public accounting.

This publication contains general information only and Deloitte is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This publication is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this publication.

Ask any IT manager across government what challenges they face, and somewhere in the top three they’ll tell you how hard it is to find and hire talent. The private sector pays better and has better talent pipelines. So while government is busy trying to find new ways to attract talent besides the mission, it also needs to be looking for new ways for the people it does have to do more. Analytics, automation and artificial intelligence are helping in that regard, but agencies need to be more proactive in laying the foundation for these technologies in order to reap the cybersecurity benefits they offer to the organization and its workforce.

Deloitte Insights’ article “AI-augmented cybersecurity” addresses cognitive technologies that can help address the cyber workforce shortage.

Cloud migration may have started out as a cheaper, more effective way for federal agencies to store and manage data, but it’s evolved into much more in the past decade. The efficiencies inherent in cloud platforms have allowed agencies to put their data to use in new ways that are changing the nature of work. Cloud is the foundation of technologies like robotic process automation, artificial intelligence, data analytics, and the Internet of Things. It’s also facilitating the fundamental changes in the way federal employees work, making the recent massive shifts to telework possible and enhancing collaboration throughout organizations. Across government, agencies come to cloud for the savings, and stay for the possibilities.

Learn more in Deloitte’s Government Trends 2020 report.

Agencies making the move to the cloud have found that one cloud provider simply can’t provide all the services they need to accomplish their goals. But it’s possible to go too far in the other direction as well. Cloud sprawl can make it difficult for agencies to manage their various cloud applications and precludes visibility across the enterprise. Agencies need a holistic approach that allows them to standardize policies, procedures, governance and workflows across their cloud environments.

Read the full Wall Street Journal article, “Rx for Cloud Sprawl: Multicloud Management”.

One of the most common refrains you hear from people concerned about automation and artificial intelligence is that robots will take their jobs. But the future of work isn’t about using machines to replace people – it’s about using technology tools to augment what people can do. Robotic process automation and other tools will help employees shift from mundane jobs like data entry to higher-value, more satisfying work that serves the mission. For example, algorithms and data analytics can help employees find trends and anomalies in huge data sets, with applications from fraud mitigation to cybersecurity. What agencies need right now is to start planning to make the interface between humans and technology as seamless as possible to harness this power.

Deloitte’s interactive webpage on the future of government jobs explores this and more.

Technology seems to progresses faster than the people using it, and the public sector can be particularly slow to catch up. New technologies like automation and the cloud are changing the way work is getting done, and federal workforce policies need to change to accommodate them. The government will need a more diverse talent pool, and will need to offer more training to current employees. Agencies will need more robust programs for employees working away from their typical office space. These and other adaptations will help government attract and retain the workforce it will need to move into the future of work.

The Deloitte Center for Government Insights report “The future of work in government” explores the shifting talent landscape.

Federal agencies have been working toward IT modernization for so long, it’s beginning to seem like a Sisyphean task. But the coronavirus pandemic has given it a serious kick in the pants. Shifting the majority of the federal workforce to telework overnight forced agencies to improve capacity, and shift workloads, applications and data to the cloud on a massive scale in the name of continuity of operations. And as many agencies come around to the idea that this is not only the new normal, but the future of work, efforts will only continue. That means the need to migrate mission-critical functionality embedded in legacy applications is only going to increase, even after the pandemic ends, and they’re going to need partners to do it.

Deloitte was named a strong performer in Application Modernization and Migration Services in a recent report by Forrester. Read Deloitte’s case studies in modernization here.

The oft-promised federal “retirement tsunami” has yet to materialize, but about 14% of the current federal workforce is eligible to retire this year. In 2017, the Government Accountability Office estimated almost 32% of the federal workforce will be eligible to retire by 2022. As these employees retire, federal agencies potentially face a significant loss of institutional knowledge that will affect every aspect of government. This loss will likely most keenly be felt, however, around legacy systems and applications. Although modernization has been a priority in IT shops across government for years, most agencies still have a significant amount of legacy technology performing vital functions. They’re going to need a strategy to ensure continuity in their systems as the only employees who fully understand them rapidly approach retirement.

Read the full Wall Street Journal article, “As coders retire, who will run your legacy apps?” here.

If data is the new oil, the federal government is sitting on huge reserves, but is only just now figuring out how to refine it. Federal agencies collect personal data on citizens, GPS data, health care data, meteorological data, and a multitude of other kinds. That data is central to a number of ongoing initiatives in government: cybersecurity, automation, fraud and abuse mitigation, efficiency and transparency. But to use this data effectively, experts increasingly call for agencies to have a comprehensive data strategy, and a chief data officer to oversee it. Some agencies are farther along than others in this area, but new technologies and ways of doing business demand that each of them begin to address this now, if they haven’t already.

Deloitte’s Center for Government Insights put together a playbook for CDOs in government. Read it here.

One of the ripest opportunities for predictive analytics in the federal government is fraud and abuse. The Government Accountability Office estimated that in 2019 alone, the federal government paid out $175 billion in improper payments. Of that, $75 billion was deemed to be recoverable. That’s money on the table for agencies willing to put in the work to pursue it, and some agencies have already started using predictive analytics to do so. In 2018, the most recent year for which data has been reported, the Department of Health and Human Services’ Office of Inspector General recovered $2.3 billion in healthcare fraud judgements and settlements. Predictive analytics have played a significant part in that, sniffing out likely cases of fraud for investigators to pursue. Coronavirus stimulus spending is only going to create more potential opportunities for fraud in government Tim Persons, the Government Accountability Office’s chief scientist, said these data analytics tools, powered by artificial intelligence algorithms, have helped agencies “deal with messier, larger data sets,” and serve as force multipliers for auditors and investigators to recover money from these improper payments.

Read more about how governments are using predictive analytics to help spot fraud in this Deloitte article.

The President’s Budget Request for 2021 anticipates doubling spending on federal research and development for artificial intelligence. But increased spending without a clear plan for implementation might be a recipe for disaster. Some agencies have already started down the path to developing an AI strategy, like the Department of Defense, which stood up its Joint Artificial Intelligence Center in 2018. Other agencies have only just begun to consider how AI can enhance their operations. These agencies will have to plan carefully to avoid missteps and maximize the benefits they glean from this technology.

“AI is a powerful emerging and enabling technology that is rapidly transforming culture, society and, eventually, even warfighting. Whether it does so in a positive or negative way depends on our approach to adoption and use,” Air Force Lt. Gen. Jack Shanahan, director of the Joint Artificial Intelligence Center, said earlier this year. “We owe it to the American people … to adopt AI principles that reflect our nation’s values.”

What constitutes an effective AI strategy for a government agency? This article discusses: Crafting an AI strategy for government leaders