Lessons from the Cloud(s)

Cloud Procurement and the Department of War

While the Department of War’s (DoW) fallout with Anthropic dominates headlines, in the annals of the Pentagon, a far less sexy and far more symbiotic relationship with tech companies hums along. IT modernization may not sound consequential or impressive, but migrating to and managing systems in the cloud is no small feat. Enter the Joint Warfighting Cloud Capability (JWCC) program, a part-voluntary, part-mandated cloud acquisition facilitator for the armed services, combatant commands, and sundry DoW agencies.

In 2022, JWCC improved upon its politicized, years-behind-expectation predecessor by opening up its $9 billion in contracts to four vendors instead of just one. Drawing inspiration from a similar platform that the CIA stood up in 2020 for the intelligence community, JWCC allows each cloud service provider (CSP) to bid on each contract, rather than a single winner-take-all mega-contract. JWCC doesn’t just centralize cloud contracts, though, it also offers a more centralized strategy for managing, moving, and using data.

A key component of that strategy involves cloud interoperability and portability. That is, JWCC’s overseeing office aims to have data flow across providers without unreasonable latency (i.e. lag), to have applications translate well across cloud environments, and to structure data and applications so they can permanently migrate off their current cloud. Cloud interoperability and portability have proven to be a bit of a white whale: for the last few years, regulators and industry watchers have routinely pushed CSPs to seamlessly harmonize their cloud architectures. While some progress has been made, complete interoperability is next to impossible. Given that, JWCC stands out. And it’s not just its approach to interoperability that’s notable. If the saga with Anthropic is a masterclass in what not to do as an agency, then JWCC offers lessons in multi-cloud provision, in government procurement, and in government efficiency.

Lesson #1: Multi-Cloud Interoperability Demands Personal Responsibility

American bureaucracy is not where one expects to learn a lesson in personal responsibility. But this is exactly what distinguishes JWCC’s approach to multi-cloud provision. The architects of JWCC understood that interoperability is the customer’s responsibility as much as it is the cloud providers’ and that no amount of regulation or standardization can save a cloud customer from poorly navigating a path-dependent market.

JWCC has been tasked with some tall orders. To start, it must coordinate a tangled morass of multi-cloud platforms among the armed services. While an increasing number of those contracts are funneled through JWCC and branches signal interest in collaborating, combating territorialism among military branches is always an uphill battle. JWCC also has the seemingly impossible task of establishing edge computing in austere environments, managing what may well be the most global IT system in the world, and establishing all-domain warfare capabilities that demand data-sharing across branches, allies, and clouds.

Previously, thousands of contracts scattered across the vast sprawl of the military debilitated purchasing power and thoughtful cloud management. That’s why JWCC’s governing body, known as the Defense Information Systems Agency (DISA), doesn’t just help secure the best contract for offices and services within DoW. DISA also serves as a sherpa for agencies in their cloud journey, advising customers on which products have best served others with similar needs in the past and developing custom IT tools that enable efficient cloud adoption.

Likewise, the DoW’s continuous Authorization to Operate, which began around the same time as JWCC and relies on its centralization, speeds software deployment by shifting from one-time approvals to continuous risk monitoring. This streamlines clearing the necessary extra hurdles for handling sensitive data—a win for efficiency and security.

Little of that success translates to private sector cloud operations. Even so, industry, and indeed regulators, have something to learn from JWCC’s clear-eyed approach to massive, indefinite multi-cloud provision.

First, the cloud is a living being, not an invisible building. Too often, enterprises treat the cloud as a static data container. DISA understands that each cloud provider, and public cloud itself, has a time and a place. For example, public cloud is not very valuable when you have a great deal of highly consistent traffic that needs to travel thousands of miles with low latency (think livestreams of military installations or continuous streams of classified reports). In such instances, it may be wise to switch to private cloud or to move data away from cloud’s compute-and-storage-rental model back to in-house hardware, a model known as on-premises. This is why, in addition to creating a private cloud, DISA has modernized on-premises outfits, has accelerated development and simplified cloud management regardless of CSP, and is building a cloud mesh to bypass idiosyncrasies and improve cross-system data sharing.

Accommodating DoW’s wide variety of agencies and services forces DISA to build more agilely, lending flexibility when a customer’s cloud needs change. Especially for large enterprises that, like the DoW, have varied and indefinite cloud needs, this strategy makes awarding cloud contracts more like renewing a lease and less like restructuring your mortgage.

Second, contracting out essential IT services is always a calculated risk. Vendor lock-in is the downside of best-in-class tools, some of which are proprietary to a single CSP. If interoperability is to be a worthy goal, it cannot mean relying only on uncustomized, open-source tools. The least common denominator is the least cutting-edge offering. If we think of interoperability and portability as essentially supply chain optionality—how many vendors can provision a tool and how well it will work with tools elsewhere in the stack—it becomes clear how idolizing these concepts stifles innovation. Just think of where critical infrastructure would be if we demanded every component have a dozen potential suppliers.

So then, desirable interoperability must mean weighing the benefit of a proprietary tool with the reality of being locked in to a vendor. As the deputy CTO in charge of JWCC put it, the expectation that you can pick “this piece of a cloud and this piece of another and then jam them together is…a fallacy.” The ability to be cloud agnostic, to be in one cloud on Monday, another on Tuesday, or simultaneously in both by Wednesday, relies on DoW’s ability to modernize apps such that they are as portable as possible.

Perfect cloud agnosticism just doesn’t exist. If complete off-the-shelf interoperability is possible (which it likely isn’t), we are years away from it, regardless of the regulatory state or industry standards. Relying on an outside contractor to provide a critical service requires doing the heavy lifting beforehand to ensure apps and data can migrate elsewhere should the time come. It also requires recognizing that life in the cloud isn’t frictionless, a lesson that rings all the truer in classified environments where some of the greatest obstacles to interoperability—identity and access management and security—are all the harder.

Many seem to presume the burden of interoperability falls solely on cloud providers, who avoid it in an anti-competitive attempt to entrench themselves in the IT infrastructure of their customers. While standards may facilitate interoperability, we cannot forget the role that personal responsibility plays in setting yourself up for success.

Lesson #2: In Government Procurement, Purchasing Power and Continuous Contracts Encourage Competitive Cooperation

A thoughtful approach to multi-cloud procurement isn’t the only thing working in JWCC’s favor. Its massive purchasing power also contributes to its relative agility. In the first 18 months of contract awarding, JWCC inked $1 billion in contracts, instantly ranking it on par with cloud vendors’ biggest customers. In the 12 months that followed, it awarded $2 billion more. Egress fees are a good example of this purchasing power leverage at work. JWCC negotiated baseline discounts ranging from 35 to 100 percent for data egress, upon which further discounts can be offered for particular task orders.

JWCC’s steady stream of lucrative contracts encourages CSPs to create interoperable solutions. This may seem counterintuitive, as CSPs participate in a prisoner’s dilemma-type game where interoperability makes winning future contracts easier regardless of existing infrastructure, but each CSP benefits from locking in customers to their cloud by using proprietary tech and mutually unintelligible semantics. However, this is an infinitely repetitive prisoner’s dilemma, in which there are near infinite rounds of contracts. In this scenario, game theory suggests that CSPs will cooperate with each other, making their systems as interoperable with one another as possible so that everyone plays nice in the sandbox. (Cue John Nash telling his buddies not to all go after the blonde in A Beautiful Mind). All the while, third-party providers, which JWCC looks to increase in its next version of the program, are incentivized to create seamless migration across CSPs for a particular app or program.

This cooperative strategy assumes some things about the way the repeated contract bid game is set up. First, it assumes that for any given contract, CSPs can either cooperate by making their service as interoperable as technically feasible, or they can defect by purposefully making the service less than optimally interoperable. For instance, if a customer seeks a contract for a customized tool that would function best using proprietary technology, the winning CSP is not “defecting” if technical hurdles prevent seamless interoperability with other CSPs. Rather, the provider only defects if it purposefully obstructs interoperability.

This leads to the second assumption: all losing providers must be able to detect whether the winning CSP has cooperated or defected, and all losers will calibrate their strategy the next round based on the winner’s strategy this round. Lastly, it assumes the payoff for the current contract round is not so astronomically high compared to the payoff of future task orders that it nullifies the incentive to continue cooperating. If CSPs expect this round’s contract to be worth more than the present value of all future contracts, the cooperative strategy no longer makes sense.

In truth, these assumptions don’t perfectly reflect hyperscalers’ cloud provision for JWCC customers, but they hold sufficiently to encourage greater cooperation. The first assumption obviously holds. In fact, the defect strategy of making services purposefully less interoperable is the strategy regulators presume hyperscalers adopt in the broader market. The second assumption is trickier. JWCC contracts are negotiated, not open. At most, the government only has to reveal how much the total award amount is and explain why the losers lost. Even if later interactions with the winner’s systems make obvious a previous defection, the time lag doesn’t allow for direct retaliation against the defecting winner; it only harbors regret that you yourself are not defecting more often.

Unlike in traditional prisoner’s dilemma games, however, this one has a game master. If a CSP defects, the probability of winning future contracts diminishes. Its unnecessarily poor interoperability may “lock in” future contracts that touch specific systems, but it has tarnished its broader reputation. JWCC negotiators act as third- party arbitrators or mediators, both of which lead to greater cooperation. As for the last assumption, a rational actor has no reason to believe that future contracts won’t be just as lucrative as the present one. Winning big now in a way that locks in large future contracts is still shortsighted in light of the potentially bigger contracts from which you’ve now practically disqualified yourself.

Realistically, JWCC is not a perfect game master. As its financial operations metrics improve, it will be better positioned to sniff out the runaway costs that vendor lock-in can cause, but for now its ability to detect defection probably leaves something to be desired. What’s more, JWCC contract officers may have short memories or turn a blind eye to defection if the service quality is otherwise exceptional. On the whole, however, JWCC’s pooled purchasing power and iterative multi-vendor contract awarding encourage hyperscalers to cooperate so that they can maintain a good reputation for future contracts and benefit from the cooperation of others. Government agencies have something to learn here—in procurement, sometimes, it pays to keep paying.

Lesson #3: There’s a Right Way to Think about Efficiency

To say JWCC is successful is to imply it is more “efficient” than the system it replaced. That word has gotten a lot of attention from policy wonks lately. Between DOGE’s bureaucratic warpath and the breakout success of the Abundance movement, 2025 was the year when both the right and the left began reimagining what our government could do, if only it were more efficient. At the crux of this imaginative project is how exactly to define efficiency. JWCC is a good example of what American bureaucratic efficiency should look like precisely because it doesn’t aim to be as efficient as possible.

First, in the pursuit of resilience, JWCC accepts redundancy. One could argue that the entire military operating off a single cloud provider would be the most efficient in that it is the only way to ensure complete interoperability, but this is one of many reasons its predecessor program failed. Procuring from a single vendor may streamline things, but it also fosters mediocrity and vulnerability, whereas real efficiency is durable and versatile.

Imagine a race car capable of hitting 275 mph, significantly faster than the top speed on most NASCAR tracks. If hitting 275 causes it to overheat or break down, it would come in dead last every time. Similarly, if you build such a vehicle as cheaply as possible, its versatility is limited. There’s a reason an F1 car is wildly more expensive than a NASCAR stock model—the latter can only handle oval tracks with banked turns, the former can turn on a dime. The car best suited to its aim is the most efficient, even if it takes longer to build or costs more.

Second, JWCC entices, rather than manipulates, private companies’ participation. JWCC invites companies to compete in a way that serves the public interest without attaching political prerequisites or changing the conditions to participate partway through the process. When unelected officials’ administrative capacity is so great that it can pursue its own political ends, we’re in trouble. Perhaps this is what prominent mid-20th century liberal Senator Eugene McCarthy meant when he said, “An efficient bureaucracy is the greatest threat to liberty.”

Not only is this type of efficiency anathema to our democratic republic, it also isn’t efficient in the long run. If bureaucratic directives at the behest of the sitting executive are a hyper-efficient way to enact a political agenda, they are also imminently reversible.

In the modern whirlwind of extra-congressional action, bureaucrats marshaled by the last three presidents have changed everything from environmental goals to immigration policy to student loan forgiveness programs, only to have them changed back again roughly four years later. Those of us who have closely watched the disbursement of money (or lack thereof) under the BEAD Act are intimately familiar with the inefficiency of executive tampering. In 2024, a landmark Supreme Court decision overturned a longstanding precedent known as Chevron deference. In effect, this deference encouraged agencies to interpret their mandate according to their own political preferences and the sitting executive’s agenda. Its overturning all but guarantees bureaucratic delays as Congress further clarifies and updates statutes. Yet the Court’s decision also exhorts Congress, rather than unelected federal agencies, to steward the programs it has enacted and the taxpayer money with which it has been entrusted. This improves long-term efficiency: careening the ship side to side prevents it from moving forward. Efficiency demands having a clear mandate and sticking to it.

JWCC, then, is a successful government program not because it worships efficiency at the expense of innovation or resilience, nor because it uses its lucrative contracts to entangle companies in ongoing political fights. It is successful because it is clear eyed enough to know it can’t outsource project stewardship to contractors, it’s big enough not to get bullied by major corporations, and it is insulated enough from political meddling both within the Pentagon and at the White House.

Waging war in Iran and at domestic tech companies leaves little time for introspection, but the DoW would be well served by reflecting on its own success as it prepares to announce a JWCC Next, JWCC’s successor. It would seem many of the lessons JWCC offers have yet to fully sink in, even within the Pentagon.