GAO smacks down GSA requirement for data center location


A federal cloud computing solicitation can't restrict the global location of data centers absent a legitimate government need--which the General Services Administration failed to do when it issued a May request for quotation for cloud-based email, office suite applications and records management services, says the Government Accountability Office.

In a protest decision dated Oct. 17, the GAO says the solicitation stipulated that data centers, if located outside the United States, had to be in a country covered by the Trade Agreements Act, a list that happens to include Afghanistan and Yemen, but excludes South Africa. Also on the excluded list is the People's Republic of China, the Philippines, India, Thailand and Malaysia.

GSA requires all vendors holding a schedules contract with it to abide by the TAA, which excludes from the government market goods or services from non TAA-countries. However, the criteria by which the TAA establishes the country of origin of a service depends on where the service company itself is "established." (The origin of a product depends on where it has been "substantially transformed," a whole different can of worms.)

In other words, services are said to originate from the country of establishment of the company providing them, not the actual country in which they are performed. When services require on-site work in the United States, this is a non-issue, but in seeking to purchase computing capacity as a service, GSA lost the ability to specify the location of data centers without a compelling reason to do so, the GAO says.

GSA didn't even want to permit data centers at all to be located outside the United States, the protest decision says, but the Office of Management and Budget and the U.S. Trade Representative said that such a limitation would impermissibly restrict free trade.

GSA was not even able tell GAO lawyers the differences among TAA countries in data rights regulations, the decision notes.

GSA spokeswoman Cara Battaglini said GSA is in talks with OMB on next steps. GSA's decision to restrict the data center location to TAA countries, she added, was not taken by itself, but in consultation with agency chief information officers.

Technosource Information Systems of Annapolis, Md., and TrueTandem of Reston, filed the protest.

For more:
- download the GAO decision, B-405296

Related Articles:
Vietmeyer: Cloud computing will make agile development cost effective 
NIST identifies cloud computing standards gaps 
VA to allow access to commercial cloud collaboration sites