A Federal Adaptive, On-Demand Pharmaceutical Manufacturing Initiative

Summary

The COVID-19 pandemic has highlighted the urgent need to address lags in American pharmaceutical manufacturing. An investment of $5 billion over five years will improve U.S. pharmaceutical manufacturing infrastructure, including the development of new technologies that will enable the responsive, end-to-end, on-demand production of up to half of the Food and Drug Administration (FDA) list of 223 essential medicines by year two, and the entire portfolio by year five. Spearheading improvements in domestic manufacturing capacity, coupled with driving the advancement of new adaptive, on-demand, and other advanced medicine production technologies will ensure a safe, responsive, reliable, and affordable supply of quality medicines, improving access for all citizens, including vulnerable populations living in underserved urban communities, rural areas, and tribal territories.

A Carbon Tax to Combat Climate Change and Support Low-Income Households

Summary

Putting a price on carbon is fundamental to achieving U.S. climate goals for 2050. Many options for carbon price-setting exist, and in this policy brief we propose a tax-and-dividend approach that mitigates the challenging impacts that carbon policies have on poor and suburban/rural communities, particularly those in Middle America. Such a plan will be a net gain for low-income households, in contrast to other proposed climate change policies which will adversely affect the poor. Furthermore, it has been shown that even a modest carbon tax can have large benefits in terms of cost-effectiveness.

For that reason, we propose the following:

Creating a National DeepTech Capital Fund

Summary

The Biden-Harris Administration should establish a National DeepTech Capital Fund (NDTC Fund) to bridge capital gaps and enable more DeepTech entrepreneurs to bring promising and beneficial technologies to market. 

Greater investment in DeepTech is critical in order to return the United States to the forefront of advanced science and technology research and development (R&D). “DeepTech” refers to companies and innovators building science-based, or R&D-based, products and services including hardware and advanced materials, robotics, manufacturing, and biotech. U.S. government investment in technology has declined by two-thirds in the past decades. Private capital typically eschews investment in advanced technologies, due to a combination of the additional expertise needed for and risks inherent to advanced-technology investment. Silicon Valley’s early days were cushioned by government risk capital at a time when the private sector could not see the value of investing in R&D. But relying entirely on Silicon Valley to drive investment in innovation has led the U.S. to a point where it risks being replaced by other innovation centers such as China. A National DeepTech Capital Fund would encourage and enable investment in companies building solutions to society’s greatest challenges, while ensuring that the United States remains at the center of global innovation.

Banning Noncompete Agreements to Create Competitive Job Markets

(To see full list of citations, download the PDF version)

Competitive job markets are critical to the success of the national economy, spurring innovation while boosting wages and labor equality. The moment is ripe for the new administration to foster competitive job markets by banning noncompete agreements (noncompetes). New empirical evidence shows that noncompetes have harmful effects on job mobility, wages, competition, entrepreneurship, and equality. Yet noncompetes are widely included in employment contracts. And inconsistent state rules on noncompetes (and their enforcement) have led to employee confusion and disputes among state courts.

A tough, consistent federal strategy to eliminate noncompetes is needed. Several recent federal and state initiatives addressing noncompetes have created momentum that the new administration can build on to rapidly address this issue. The Biden-Harris administration should (1) adopt a federal ban on noncompetes, (2) actively educate the public about their labor-mobility rights (and actively support those rights), and (3) take proactive steps to ensure compliance with labor-mobility policy. Specific steps the new administration could consider include:

Challenge and Opportunity

Noncompetes Hurt Workers and the Economy

Noncompete agreements are contracts that prohibit employees from working for or becoming a competitor for a certain period of time. By restricting employees from switching employers or starting their own competing businesses, noncompetes have harmful economic effects. They depress wages, reduce entrepreneurship, and impede efforts to correct inequities in labor markets. In the past decade, a wealth of research—including diverse empirical, experimental, and theoretical studies—have revealed the adverse effects of noncompete contracts and similar restrictions on the free movement of human capital. As a 2018 article states, “policymakers, economists, and legal scholars…overwhelmingly conclude that the harms of noncompetes far outweigh their potential benefits.” The research shows that lifting noncompete restrictions—thereby increasing job mobility—is good for entrepreneurship, wages, industry and regional economic growth, and equality.

Entrepreneurship

Increased enforcement of noncompetes favors large, incumbent firms. Studies find that markets become more concentrated when noncompetes are adopted and enforced. When employees sign noncompetes with established firms, start-up companies have difficulty recruiting talent. Indeed, a ban on noncompetes in California generated greater and faster innovation because employees with good ideas that their employer did not want to use were able to take those ideas elsewhere.

Wages

Noncompetes decrease wages. Employers calibrate compensation largely based on competing external offers. When external offers are reduced, employers face less pressure to increase wages. In 2015, Hawaii passed a law banning noncompete and non-solicitation clauses from employment contracts in the high-tech industry. A recent study found that Hawaii ban increased employee mobility in the high-tech sector by 11% and increased new-hire salaries by 4%. Noncompetes even decrease wages for employees who have not signed them. In a market that enforces noncompetes, wages and mobility are lower for everyone, including those not directly bound by noncompetes. These impacts can last a long time. A 2017 study found that post-employment restrictions have persistent wage-suppressing effects that last throughout a worker’s job and employment history. 

Equality

Restrictions on job mobility have a disproportionate negative effect on certain demographics. In job markets, discovering one is competitive depends on the frequency with which one is exposed to information about one’s comparative options in the market. In job markets where workers don’t often move from job to job, the “price” of labor (i.e., the terms and conditions of an employee’s contract) will lag behind an employee’s true market value. If an employee discovers their undervalued labor compensation by receiving an external (better) offer from a competitor employer, the employee can use that information to negotiate a higher salary with their current employer. If the current employer offers to match the higher salary, the competitor employer can come back with an even higher offer. This process continues until one employer backs down, leaving the employee better and more fairly compensated as a result.

The existence of noncompetes cause this process to break down by taking away employee bargaining power. Noncompetes harm equality in several ways as a result. First, noncompetes exacerbate the gender pay gap. Women are more likely to have geographic constraints based on family and spousal obligations. Noncompetes that restricts employee capacity to compete within a region therefore disproportionately hurt woman. Second, taking away employee capacity to entertain outside offers can cause historical pay gaps to persist or widen. Employees cannot discover their true value without external offers. The more external offers are available, the more equity norms and competitive pressures from mobility drive employers to raise wages as retention efforts. Third, white women and people of color are more likely to have non-monetary preferences for a workplace that is free of discrimination and hostility and that values diversity. For example, if a woman discovers that her employer systematically allows harassment of its female employees, she will have a strong interest in examining other opportunities in the market. A noncompete restricting her mobility will prevent her from escaping the discriminatory workplace.

Noncompetes are on the Rise

The use of noncompetes is on the rise in the United States. Employment agreements routinely prohibit workers from accepting a competitor’s job offer, and/or from working in a competing business for a specified period in a certain geographic area. The Treasury Department recently estimated that nearly 30 million workers are bound by noncompete provisions. A study of executive employment contracts found that 70% of the firms investigated imposed noncompetes on their top employees. A forthcoming 2021 study found that noncompetes are also common for non-executive employees with base salaries below $100,000 per year. A 2019 report noted that “the use of noncompetes is so pervasive that even volunteers in non-profit organizations, in states that do not even enforce them, are asked to sign away their post-employment freedom.”

Workers currently have limited recourse when it comes to contesting noncompetes. Court decisions in cases involving noncompetes are highly unpredictable, and litigation can be prohibitively expensive and burdensome for individual employees. Some states—recently including Massachusetts, Washington, Maryland, and New Hampshire—have passed laws voiding most noncompetes, but this state-specific legislative patchwork can be difficult for workers to understand. Many employees, especially those outside the professional class, end up complying with noncompetes even if they aren’t enforceable in the state in which they work (or are planning to move for a new job). Moreover, more and more people are employed at companies with a national presence. Such companies often demand adherence to a noncompete nationwide, even for employees in a state that won’t enforce noncompetes. Inconsistent state rules have also led to conflicts across state lines when an employee bound by a noncompete moves to a state that doesn’t enforce them. This has resulted in a “race to the courthouse” when employees change jobs, as each side tries to get its own state law to apply. It has even led to the unseemly spectacle of courts in different states attempting to prohibit each other from enforcing their respective state policies. Finally, the complex legal landscape surrounding noncompetes further entrenches established companies. Companies with substantial legal and financial resources can be more aggressive in using noncompetes to drive out competition even when their legal claims are on weak grounds. Incumbents may even use a reputation for suing employees who leave as a strategy to deter other employees from leaving.

National Leadership is Needed

Noncompetes aren’t just bad for workers, but for our economy and society as a whole. We do better when workers can easily move between jobs. Increased mobility makes it easier for employees to find employers that most value their skills, and for employers to find employees who are good fits. But without guaranteed labor mobility, the anti-competitive impulses of individual firms create a collective-action problem. Smart policy is needed to ensure everyone benefits from a continuous, high-quality, and flexible labor pool over time. The problem of noncompetes is not a problem that can be solved by states on their own. National leadership is needed. Several federal bills limiting the use of noncompetes (either entirely or just for low-wage workers) have already been drafted. The White House issued a Call for Action in 2016 urging states to limit the use of post-employment restrictions. Also in 2016, the U.S. Treasury Department issued a report on noncompetes warning that when noncompetes are enforced, “innovations spread more slowly, possibly inhibiting the development of industrial clusters like Silicon Valley.” In 2020, the Federal Trade Commission convened a meeting to consider a rule prohibiting noncompete clauses. But so far the FTC has taken no action.

The Biden-Harris Administration can build on this momentum to eliminate noncompetes in the United States once and for all.

Plan of Action

To support talent mobility and enhance human capital, the Biden-Harris Administration should (1) adopt a federal ban on noncompetes, (2) actively educate the public about their labormobility rights (and actively support those rights), and (3) take proactive steps to ensure compliance with labor-mobility policy. Below, we recommend specific steps that the new administration could take towards these goals.

Adopt a Federal Ban on Noncompetes

A federal ban on noncompetes could potentially be achieved by a Federal Trade Commission (FTC) rule barring noncompetes, action through the Department of Justice (DOJ), an executive order, and/or legislation. If barring all noncompetes is not yet politically feasible, targeting noncompetes imposed on low-wage and unskilled workers would be a good first step. 

FTC rule/DOJ action

The FTC and the DOJ’s Antitrust Division have only recently started to consider anti-competitive practices in the labor market to be within their scope of regulating competition and unfair trade practices. The FTC could use its regulatory power under Section 5 of the FTC Act’s prohibition on “unfair methods of competition” to issue a federal rule to ban noncompetes nationwide in appropriate circumstances, such as concentrated markets. The FTC could enforce this rule by bringing action against employers who use, or seek to use, noncompetes to restrict employee mobility in ways that interferes with competition. 

Moreover, California’s Section 16600 and Section 1 of the federal Sherman Act share the language of prohibiting contracts “in restraint of trade.” The California law has been consistently interpreted to ban employment noncompetes. Using this interpretation as precedent, the DOJ could leverage the language in Section 1 of the Sherman Act to ban employment noncompetes nationwide in appropriate circumstances, such as in concentrated markets.

Executive Order

The Biden-Harris administration can also issue executive orders that (1) restrict or eliminate government contracting with companies that employ noncompetes; (2) require employers in states that restrict noncompetes not to sign them with employees in those states, and/or to give prominent notice of the unenforceability of noncompetes in those states.

Legislation

Two recently proposed federal bills propose legislative solutions to the problem of noncompetes. The Workforce Mobility Act proposed in 2018 would prohibit and prevent enforcement of noncompetes for employees who “engage in commerce or in the production of goods for commerce.” Under the proposed bill, employers would be fined for each employee subject to a violation of this law, or for each week the employer was in violation. The House version of the bill goes further, specifically stating that noncompetes may violate antitrust laws.

The Mobility and Opportunity for Vulnerable Employees (MOVE) Act of 2015—proposes a full or partial ban on noncompetes, in addition to barring noncompete agreements entirely for low-wage workers. The bill would also require companies to notify job applicants ahead of time if they would be asked to sign a noncompete if hired.

The new administration could work with Congress to revive and pass one or both of these bills. Any federal bill governing noncompetes should also grant employees a private right of action for damages if they are asked to sign an overly broad noncompete agreement.

Actively Support and Publicize Labor-Mobility Rights

Even in states that ban noncompetes, a significant number of employers still require employees to sign them. For example, employers in California—a state that bans noncompetes—insert noncompetes into their employment contracts at rates similar to non-California employers. Because employees in these states may not be aware that noncompetes are illegal, unlawful noncompetes can have a significant deterrent effect on employee mobility. The administration should act to educate the public about their labor-mobility rights, and to crack down on employers unlawfully promulgating noncompetes. The Biden-Harris administration should issue an executive order directing the Department of Labor, FTC, and the DOJ Antitrust Division to collaborate to actively enforce existing labor-mobility laws, and to pursue some or all of the actions below.

Require “right-to-leave” notice in employment contracts

The Biden-Harris Administration should require employment contracts to include a notice about employees’ right to leave their employer. The Defend Trade Secrets Act (DTSA), enacted by Congress in 2016, provides a model for this type of mandatory notice. The DTSA gives employees immunity from criminal or civil liability for reporting illegalities at a company even if reporting reveals trade secrets. The DTSA requires employers to include notice of this immunity in “in any contract or agreement with an employee that governs the use of a trade secret or other confidential information.” Similarly, the Federal Government should require employment contracts to include a clause about the rights of an employee to compete with their previous employer after leaving a job. This clause should be required for all contracts in states that ban noncompetes post-employment. If a federal noncompete ban is enacted, it should apply nationwide. The Federal Government could further promote market competition by amending the DTSA to include a notice on the limits of trade secrets explaining that general know-how and information that is readily ascertainable from public searches cannot be deemed secret and proprietary.

Enforce mobility rights beyond formal noncompetes

In employment contracts, restrictive covenants do not simply appear as a formally labeled “noncompete clause”. Employment contracts regularly include other restrictive provisions such as requirements for non-solicitation of customers and coworkers, pre-innovation assignment agreements, nondisclosure agreements, and non-disparagement clauses. Restrictions like these impose harms similar to noncompete clauses: preventing employee mobility, slowing innovation, stifling start-ups, and concentrating industries. Customer non-solicitation requirements in particular effectively function as noncompetes “because a business without clients is like a pool without water.” Coworker non-solicitation clauses essentially reduce the job opportunities of every former co-worker that the employee in question knows, regardless of whether those coworkers agreed to be part of a restrictive regime. Nondisclosure agreements, theoretically designed to protect trade secrets, are often structured to include not just proprietary knowledge, but also readily ascertainable knowledge about customers and coworkers. The knowledge that a departed employee would use to solicit a former coworker—knowledge pertaining to a person’s skills, talent, personality, experience, and salary—is not an employer’s trade secret and should not be restricted by contract. California courts have recently recognized that employee non-solicitation clauses comprise unlawful restraints on trade under Section 16600. The new administration can build on precedent set in California to control proliferation of overly restrictive provisions in employment contracts nationwide.

Ban salary secrecy

The ability to reveal one’s salary to co-workers and others in the industry is protected by both federal and state law. The National Labor Relations Board (NLRB) holds that prohibiting any employee—unionized or not—from discussing salaries violates their rights under the National Labor Relations Act to engage in concerted activity for mutual aid. The NLRB has specifically ruled that confidentiality agreements are invalid when they contain provisions that “prohibit employees from disclosing certain personnel information unless authorized by the Company.” Many state laws also make it illegal for any employer to prohibit pay discussions among employees. Digital platforms such as LinkedIn, Glassdoor, Salary.com, and SalaryExpert make compensation information easily searchable. Yet employers have attempted to claim that use of salary knowledge in recruitment efforts by a former employee of a co-worker can amount to a breach of a nondisclosure agreement. The administration should extend the NLRB rule beyond the context of labor unions, banning salary secrecy.

Ensure Compliance with Labor-Mobility Policy

As discussed above, litigation alone cannot address the widespread use of noncompete clauses. Employees often lack the money, time, expertise, or will needed to challenge a noncompete in court. The Federal Government must instead be proactive in understanding the effects that common employer practices and provisions have on labor mobility. Several state attorneys general have taken such a proactive stance. Illinois and New York in particular have recently investigated employers who required their employees to sign unenforceable contracts. These states used consumer laws worded similarly to the federal FTC Act as bases for prosecution. For example, Illinois’s Consumer Fraud and Deceptive Business Practices Act prohibits “unfair methods of competition and unfair or deceptive acts or practices.” The state attorney general’s office explains that: “An ‘unfair practice’ is one that (1) offends public policy as established by statute, common law or otherwise, (2) is immoral, unethical, oppressive, or unscrupulous, or (3) causes substantial injury to consumers. A non-compete that violates existing common law or statutory restrictions could satisfy each prong of this test, creating a cause of action in states with similar consumer protection statutes or strong unfair competition laws.”80 The Department of Labor and the FTC should collaborate on investigating employers who require their employees to sign unjustifiable noncompetes, using the FTC Act as grounds for investigation.

Conclusion 

The modern economy depends on employee mobility. Our workforce needs to be able to respond to sudden disruptions like COVID-19, which radically shifted demand for workers, and to longer-term geographic and economic trends. Employees should have the freedom to take the jobs that are best for them, or to start new companies if they have innovative ideas that otherwise will never see the light of day. 

Unfortunately, companies are too often able to prevent employees from leaving, either because the law permits it in many states or because employees don’t know their rights. This control depresses wages and employee initiative. It reduces innovation and the adoption of new technologies. And it keeps people stuck in dead-end jobs when they have better alternatives available to them. The current hodgepodge of state laws and the threat of enforcement of a noncompete means that even states that ban noncompetes can’t get the full benefit of the protections they provide to their workers and innovators. It is time for the Federal Government to step in.

Frequently Asked Questions
What agencies would be involved in a federal crackdown on noncompetes?
The approach described herein would be a White House-led, multi-agency effort. Supporting a competitive job market is a goal shared by several government agencies. The Department of Labor oversees employee rights and the Equal Employment Opportunity Commission (EEOC) collects data and enforces federal anti-discrimination laws. The Federal Trade Commission and the Department of Justice Antitrust Division regulate competition policy. The General Services Administration and individual departments have their own contracts with private suppliers. Because no one agency has clear authority over all the effects of non-competes, the White House should take the lead in developing and implementing a multi-agency approach to eliminating or minimizing noncompetes nationwide. Harnessing the regulatory and enforcement powers of multiple agencies under White House leadership will have significant national impact on wages, innovation, and economic growth.
Didn’t President Obama already take action on noncompetes in 2016?
In 2016, President Obama convened a White House working group that resulted in a Presidential Call for Action to curtail the expansion of noncompetes. The Call for Action asked states that do enforce noncompetes to reject reformation and blue penciling and to take strong action against misleading contracts. That Call for Action was an important step. But it has not resulted in uniform state action to restrict noncompetes. Noncompetes remain pervasive, even in states that do not enforce them. Additional federal leadership is needed.
Is legislation required to curb noncompetes?
Legislation is not required to implement most of the proposals described herein. Executive orders can accomplish things like making notice of labor-mobility rights a mandatory component of employment contracts and giving preference for government contracts to companies that do not use noncompetes. Even a federal ban on noncompetes may not require legislation. Such a ban could be achieved by an FTC rule barring noncompetes under Section 5 of the FTC Act’s prohibition on “unfair methods of competition”. The FTC could enforce this rule by bringing action against employers who use, or seek to use, noncompetes with their employees. Section 1 of the federal Sherman Act prohibiting contracts “in restraint of trade” could similarly be used to prohibit noncompetes that restrain competition in the talent market, particularly in concentrated industries.
Won’t eliminating noncompetes interfere with trade secrets?
In 2016, the Defend Trade Secrets Act (DTSA) created a federal civil cause of action for tradesecret misappropriation. The DTSA complements state trade-secrecy laws, which follow the Uniform Trade Secrecy Act. In states like California that ban noncompetes, trade-secrecy laws continue to project employers against the misappropriation of proprietary information. Trade secrecy laws give employers potent protections. Even without noncompetes, employers can continue to protect their confidential information through trade-secrecy law and (reasonable) non-disclosure agreements. Indeed, the effectiveness of trade-secrecy laws highlights the problematic nature of noncompetes. Companies already have strong tools to prevent departing employees from taking their trade secrets. If there’s little risk of a departing employee taking their former employer’s trade secrets with them, the employer’s justification for banning them from taking a new job is much weaker.
Isn’t banning noncompetes at odds with antitrust law’s distinction between horizontal and vertical agreements?
Horizontal collusions among companies agreeing not to hire each other’s employees have only recently drawn the attention of the Department of Justice, which now concludes that these practices are violations of American antitrust law. Similar vertical agreements—i.e., between an employer and their employees—are not normally treated as illegal. But they are still subject to antitrust scrutiny under the rule of reason, and certain categories of vertical restriction are illegal per se. Noncompetes seek to accomplish the same goal that no-poach agreements do: preventing an employee from moving from one competitor to another. In fact, noncompetes are often broader than do-not-hire agreements as they seek to prevent competition within an entire industry, not merely among several firms. Noncompete clauses can hence be interpreted under the Sherman Act as unreasonable non-price vertical restraints.
Wouldn’t federal action on noncompetes interfere with states’ rights?
Competitive labor markets, like competitive consumer markets, are a national issue. Federal law regulates numerous aspects of the labor market, including wage and hour laws, health and safety, discrimination, and family and medical leave. Federal law supplements state law in protecting trade secrets in a global market as well. It makes sense for the Federal Government to also support workers’ ability to leave their employers and to remain active in the national talent pool. Noncompetes contribute to national wage stagnation, continuous racial and gender pay gaps, and market concentration. When they are enforced, employees are either forced to stay with the same company or take an unpaid leave from their industry, risking unemployment and overall reduction in innovation and economic growth. These are issues of key national importance. Moreover, misinformation about noncompete laws is rampant in part because of the great uncertainty created by interstate differences in these laws. Federal leadership will help replace this patchwork with consistency. Finally, employers regularly attempt to include a “choice of law” clause in employment contracts. These contracts allow the employers to adopt the law of the jurisdiction most likely to enforce noncompete clauses. As a result, employees regularly sign noncompetes even in states where they are unenforceable. A national policy is needed to address these linked issues of widespread misinformation and “forum shopping”.

Disrupting Vulnerability Traps and Catalyzing Community Resilience

Summary

The United States needs to radically enhance its efforts to build community disaster resilience. The frequency and cost of billion-dollar weather and climate disasters have increased significantly over the past decade. According to the National Oceanic and Atmospheric Agency’s estimates, the direct costs of disasters between 2018 and 2019 amounted to over $136 billion. And 2017 Hurricanes Harvey, Irma, and Maria resulted in over $265 billion in damage and displaced many communities. Moreover, accelerated urbanization and climate change continue to exacerbate communities’ vulnerability to climate disasters, rendering the current disaster mitigation, recovery, and emergency response policies untenable in the near future.

Resilience has served as an organizing principle for policymakers, first responders, and businesses in marshalling resources to reduce community vulnerability, stimulate recovery, and ensure reliable access to critical services (e.g., energy, water, shelter, food, health, ecosystems services and mobility) in the aftermath of climate disasters. However, the current set of reactive disaster recovery efforts and resilience policies have proven to be inefficient and costly, contributing to the widening of the `climate gap’ and entrenching vulnerability traps, particularly among marginalized and disadvantaged communities.

The Biden-Harris Administration should invest in information technology, data transparency and convergence research to build data-enabled predictive capabilities that anticipate shifts in communities’ demand for critical services under compound climate disasters, and inform effective resource allocation to equitably mitigate the impacts of climate change. These investments will not only enhance stewardship of taxpayer dollars, create jobs and bolster the economy, but will also shrink the rapidly widening climate gap and save lives.

Recruiting and Retaining Highly Effective Teachers of Color

Summary

The Biden-Harris Administration is committed to providing the best possible education to all students. Research has established that students of color experience benefits to social and emotional development and learning outcomes when taught by educators of color. Diverse educators and administrators are particularly important for schools with many students of color. Accordingly, schools across the country should prioritize hiring highly-effective teachers of color. This policy proposal identifies opportunities to recruit—and retain—highly effective K-12 educators of color.

As a first step, the Biden-Harris Administration should create an Under Secretary of Diversity at the Department of Education (ED), charged with organizing a White House Summit to establish the value of a diverse teacher workforce and convene leaders to identify best practices and a strategy for Federal Government support of state, local, and private programs. Following the summit, ED, led by the Under Secretary of Diversity, should revisit current programs that identify high need areas, such as math, science and special education to include the pressing need for diverse educators. Simultaneously, the administration must work with Congress to reauthorize the Higher Education Act, incorporating the previously introduced College Transparency Act to ensure robust data reporting and evaluate the effectiveness of financial incentives.

Elevating Science and Technology Policy at the State Department

Summary

Science and technology (S&T) must play a prominent and strategic role at all levels of United States foreign policy. On Day One, the Biden-Harris Administration should reinvigorate and reassert U.S. strength in science, technology, and data-driven decision making. S&T issues at the Department of State (Department) have historically been concentrated into specific offices and personnel, which has constrained the use of S&T as a tool to advance U.S. foreign policy goals. On Day One, the Administration can better identify, allocate, and elevate S&T issues and personnel throughout the Department. Building and rewarding diverse teams with the right mix of skills is good management for any organization, and could create significant progress toward breaking down the silos that prevent the realization of the full benefits of the S&T expertise that already exists among U.S diplomatic personnel.

Compliance as Code and Improving the ATO Process

A wide-scale cyber-attack in 2020 impacted a staggering number of federal agencies, including the agency that oversees the United States nuclear weapons arsenal. Government officials are still determining what information the hackers may have accessed, and what they might do with it.

The fundamental failure of federal technology security is the costly expenditure of time and resources on processes that do not make our systems more secure. Our muddled compliance activities allow insecure legacy systems to operate longer, increasing the risk of cyber intrusions and other system meltdowns. The vulnerabilities introduced by these lengthy processes have grave consequences for the nation at large.

In federal technology, the approval to launch a new Information Technology (IT) system is known as an Authority to Operate (ATO). In its current state, the process of obtaining an ATO is resource-intensive, time-consuming, and highly cumbersome. The Administration should kick-start a series of immediate, action-oriented initiatives to incentivize and operationalize the automation of ATO processes (also known as “compliance as code”) and position agencies to modernize technology risk management as a whole.

Challenge and Opportunity

While the compliance methodologies that currently comprise the ATO process contribute to managing security and risk, the process itself causes delays to the release of new systems. This perpetuates risk by extending the use of legacy—but often less secure—systems and mires agencies with outdated, inefficient workflows. 

To receive an ATO, government product owners across different agencies are required to demonstrate compliance with similar standards and controls, but the process of providing statements of compliance or “System Security Plans” (SSPs) is redundant and siloed. In addition, SSPs are often hundreds of pages long and oriented toward one-time generation of compliance paperwork over an outdated, three-year life cycle. There are few examples of IT system reciprocity or authorization partnerships between federal agencies, and many are reluctant to share their SSPs with sister organizations that are pushing similar or even identical IT systems through their respective ATO processes. This siloed approach results in duplicative assessments and redundancies that further delay progress. 

The next administration should shift from static compliance to agile security risk management that meets the challenges of the ever-changing threat landscape. The following Plan of Action advances that goal through specific directives for the Office of Management and Budget (OMB) Office of the Federal CIO (OFCIO), General Services Administration (GSA), Technology Transformation Service (TTS), and other agencies.

Plan of Action

The Office of Federal Chief Information Officer (OFCIO) should serve as the catalyst of several of activities aimed at addressing inefficiencies in the ATO attainment process. 

OFCIO should draft an OMB Compliance as Code Memorandum that initiates two major activities. 

First, the Memorandum will direct GSA to create a Center of Excellence within the Technology Transformation Service (TTS). The goals and actions of the Center of Excellence are detailed under “Action Two” below. Second, the Memorandum should require Cabinet-level agencies to draft brief “exploration and implementation plans” that describe how the agency or agencies might explore and adopt compliance as code to create efficiencies and reduce burden.1

OFCIO should offer guidance for the types of explorations that agencies might consider. These might include:

During the plan review process, the OFCIO should collaborate with the Resource Management Offices (RMOs) at OMB to identify agencies that offer the most effective plans and innovations.3 Finally, OFCIO should consider releasing a portion of the agency plans publicly with the goal of spurring research and collaboration with industry.

The General Services Administration should create a Cybersecurity Compliance Center of Excellence. 

OMB should commission the creation of a Cybersecurity Compliance Center of Excellence at the General Services Administration (GSA). Joining the six other Centers of Excellence, the Cybersecurity Compliance Center of Excellence (CCCE) would serve to accelerate the adoption of compliance as code solutions, analyze current compliance processes and artifacts, and facilitate cross-agency knowledge-sharing of cybersecurity compliance best practices. In addition, OMB should direct GSA to establish a Steering Committee representative of the Federal Government that leverages the expertise of agency Chief Information Security Officers (CISOs), Deputy CISOs, and Chief Data Officers (CDOs) as well as representatives from the National Institute of Standards and Technology (NIST) and the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). 

The CCCE Steering Committee will research potential paths to propagate compliance as code that are not overly burdensome to agencies, deliberate on these initiatives, and guide and oversee agency innovations. The ultimate goal for the Steering Committee will be to devise a strategy and series of practices to increase compliance as code adoption via the Cybersecurity Compliance Center of Excellence and OMB oversight. 

The following sections detail potential opportunities for CCCE Steering Committee investigation and evaluation:

Study IT System Acquisition Rules for Vendor Compliance Information. The Steering Committee should review existing acquisition guidance and consider drafting a new acquisition rule that would require software vendors to provide ATO-relevant, machine-readable compliance information to customer agencies. The data package could include control implementation statements, attestation data and evidence guidance for the relevant NIST controls.4 In addition, the new system and process improvements should be agile enough to allow the incorporation of controls unique to a particular application or service.

Shifting the responsibility of managing compliance information from agencies to vendors
saves time and taxpayer dollars spent in the duplicative discovery, creation, and maintenance
of control implementation guidance for common software. The rule would be doubly
effective in time saved if the vendor’s compliance data package has common reciprocity
between agencies, allowing for faster adoption of software government wide.5 Finally, the
format of the data package should be open sourced, fungible and accessible.

Examine and Improve the Utility of System Security Plans (SSPs). System Security Plans are the baseline validator of a system’s security compliance and a comprehensive summary of an IT system’s security details.6 OMB and the CCCE Steering Committee should direct agencies to investigate the reusability and transmutability of System Security Plans (SSPs) across the Federal Government. A research-focused task force, composed of federal data scientists, compliance subject matter experts, auditors, and CISOs, should research how SSPs are utilized and draft recommendations on how best to improve their utility. The research task force would collect a percentage of agency SSPs, compare time-to-ATOs for various government organizations, and develop a common taxonomy that will allow for reciprocity between government agencies.

Create a Federal Compliance Library. The Steering Committee should investigate the creation of an inter-agency Federal Compliance Library. The library, most likely hosted by NIST, would support cross-agency compliance efforts by offering vetted pre-sets, templates, and baselines for various IT systems. A Federal Compliance Library accelerates the creation and sharing of compliance documentation and allows for historical knowledge and best practices to have impact beyond one agency. These common resources would free up agency compliance resources to focus on authorization materials that require novel documentation.

Explore Open Security Controls Assessment Language (OSCAL). The Steering Committee should explore the value added by mandating the conversion of agency SSP components to machine readable code such as Open Security Controls Assessment Language (OSCAL).7 OSCAL allows for the automated monitoring of control implementation effectiveness while making documentation updates easier and more efficient.

Conclusion

Federal compliance processes are ripe for innovation. The current system is costly and perpetuates risk while trying to control for it. The Plan of Action detailed above creates a crossagency collaborative environment that will spur localized innovations which can be tested and perfected before scaling government wide.

Frequently Asked Questions
Why is this recommendation important?
Current compliance processes are slow, costly and ineffective. They result in bureaucratic inertia that stalls the adoption of new technologies and exacerbates risk. The compliance-as-code recommendations outlined in this text dovetail with conclusions drawn from the Federal Cybersecurity Risk Determination Report and Action Plan to the President of the United States (2018). Compliance-as-code solutions match core actions that are necessary to address cybersecurity risks across the federal enterprise.
Why are OFCIO and TTS best positioned to lead these efforts?
OFCIO and TTS have been successful in guiding and monitoring agencies through a number of technology transformation initiatives including Data Center Consolidation Initiative, the HTTPSOnly Standard, and the FITARA Scorecard among many others. OMB OFCIO has the ability to direct agencies to develop exploration plans, as described above, and GSA TTS is well situated to stand up a new Center of Excellence to facilitate pilot initiatives and cross-agency collaboration. In addition, a Steering Committee for the Cybersecurity Compliance Center of Excellence (CCCE) that leverages the expertise of CISOs, Deputy CISOs, and CDOs as well as representatives from NIST and DHS CISA can ensure that GSA and OMB are developing guidance based on the actual situations within agencies. Greater participation and representation from agencies will ensure greater transparency, collaboration and adoption of new innovations.
How will these proposals make the ATO compliance process more efficient?
ATO processes have been a known encumbrance for some time. A handful of agencies have begun to explore automation and compliance as code, including, but not limited to, the Defense Digital Service Rapid ATO12 and the Centers for Medicare and Medicaid “Simplified and Guided Authorization for Rapid ATO” pilot. While many agencies recognize the need, most lack the resources to explore innovations and automate processes. These proposals aim to elevate the issue and proposed solutions to the White House level and align the most promising innovations with support and funding. Once solutions are identified and tested, they can be scaled for government-wide adoption.
Are there risks to centralizing all IT compliance in one library? Are there security concerns?
Published data formats provide greater security than proprietary counterparts. While the reference implementations and data formats must be open, the data collection and analysis of an operational system is fully protected by encryption. If required, certain SSPs can be delivered to new agencies on a by-request basis instead of being made publicly available.
Is it overly burdensome to ask agencies to convert their SSPs to OSCAL?
OSCAL integration across the Federal Government should be evaluated for burden and agencies’ current technical capacity to support OSCAL integration must be considered. Agencies should consider smaller-scale integrations of OSCAL as a starting point. Research should also be focused on potential time saved from automating compliance checks, streamlining the review process, and increasing the speed of adopting new technologies.
Are there any legal requirements or obstacles for agencies that may prevent them from participating in these reforms?
The request that software vendors provide machine-readable security documentation is to their own benefit. It is currently cumbersome and repetitive for a software vendor to provide information to support the ATO process on an individual basis every time their software is evaluated or implemented. Vendors already decide what information to share and are likely careful about what they choose to provide. A shared SSP library or reciprocity of SSP statements across agencies should not introduce any new legal obstacles or concerns into the process. Vendors should be made aware that any information they share is eligible for a cross-agency shared repository.
What exactly is the scope of the term “compliance as code”? in technical terms?
‘Compliance as Code’ is the automated implementation, verification, remediation, monitoring and reporting of compliance information and status. In technical terms, compliance as code can be facilitated by migrating the static SSP from Microsoft Word to OSCAL, including front matter, control implementation statements, and appendices. Additional examples of compliance as code include: evidence gathering and verification code, commit and pull-request automated testing, and DevOps context aware notifications and documentation. Developer tools such as an RMF and OSCAL-Aware GRC plugin for VS Code and continuous monitoring plugins can also be included.

Enabling Federal Agencies to Tackle Complex Problems with the Help of Makers-In-Residence

Summary

Across the U.S., there are approximately 2,000 makerspaces and Fab Labs where makers with a broad and diverse set of skills have developed innovative approaches to solving pressing problems in their communities. The next administration should implement a Maker-In-Residence (MIR) fellowship program that allows federal agencies to leverage the incredible skills and knowledge of the American maker community to address complex problems specific to their missions.

Implementation of the MIR fellowship program would enable American makers and innovators to:

  1. Contribute their knowledge and unique and diverse skill sets to fulfilling the missions of federal agencies while learning first-hand about federal policy and the policymaking process
  2. Utilize their learnings to solve complex societal problems and affect policy change in their local communities.

Building Thriving Local Economies by Leveraging the Maker Movement to Close the Skills Gap

Summary

The Federal Government should further invest in, support and scale four existing approaches to building local skills and vibrant, self-sufficient local economies by coupling localities’ needs with workforce development and small-scale manufacturing. This is achieved by scaling local programs and initiatives which harness the Maker Movement, a community-driven, grassroots effort to enable people to design, prototype and manufacture projects, solutions and products.

Specifically, the Federal Government should:

By harnessing early successes from across the country, these policy solutions can rapidly stand up localized programs to immediately support more American communities grappling with skills shortages. This need is exponentially more critical in the face of COVID-19, as 80% of U.S. manufacturers have articulated that their business will be financially affected by the pandemic and 53% require a change of operations, including the increased use of automation technologies.

Advancing Astrobiology: The Search for Signs of Life Elsewhere in the Universe

Summary

NASA should invest in a comprehensive program to answer one of humanity’s biggest questions: “Are we alone?”

The United States has the scientific and technological prowess to find possible evidence of past or present life in our solar system. Over the last decade, the space science community has discovered Earth-like planets around other stars. The United States has launched Mars 2020—its first astrobiology mission to Mars. The Perseverance Rover will seek signs of ancient life and is part of the initial Mars Sample Return campaign. And, in the coming decade, we are poised for exponential growth in the technology, planetary science, and astrophysics components of the search for life.

Establishing a formal Astrobiology Program Office at NASA would better elevate, coordinate, and guide what could be the agency’s most important mission. Notably, there are currently no NASA programs on astrobiology that integrate across the Astrophysics and Planetary Science divisions in NASA’s Science Mission Directorate along with the technology investments of NASA’s Space Technology Mission Directorate. NASA has no astrobiology czar.

Astrobiology is a relatively modern scientific field of study that has been enabled by a suite of robotic space missions and next-generation telescopes. We now have the potential to reveal new insights into the fundamental nature of life across the universe and our own planet.

Transition Document for the United States Patent and Trademark Office

Summary

This transition document provides over 25 actionable recommendations on the future of the United States Patent and Trademark Office (USPTO), in order to support future federal leadership and enable their success. The document is the result of collaboration between the Day One Project and a group of veteran policymakers who convened virtually to produce recommendations related to the following three categories:

  1. Identifying specific policy and governance ideas that can be pursued in the first days and months of the next administration.
  2. Gathering “lessons learned” from those who have previously served in government to learn from past challenges and better inform future initiatives.
  3. Understanding key science and technology staffing and “talent” needs, and related challenges for the USPTO that can be addressed in the next administration.

The document also includes a cover memo which highlights some of the overarching key considerations for the future of the USPTO.

Contributors