[asinclair]

This absolutely blows my mind. It's clear that the GAO has no competent experienced network people advising them in these matters...or the GAO decided to ignore them.

Hosting CONUS data, intended for consumption in CONUS workstations, outside of the CONUS is irresponsible for the following reasons:

• Reliability of off-CONUS routing: I deal all the time with problems with performance of out-of-CONUS connections every day. I get complaints "I can cannot connect to you" but when I analyze the link from them to us I find the problem is almost always closer to them, if not directly in their uplink. Routers so overloaded they can't pass data without losing a bunch of packets. Links oversubscribed to the point that packets "fall off" the queue.
• Speed of off-CONUS routing: 186,000 miles per second is not only a good idea, it's the law. Unfortunately, signals don't pass through wire or fiber at exactly the speed of light, but at some large fraction of the speed. That's why connections from the US to India can experience round-trip delays exceeding 700 milliseconds, or more if any of the 25 routers have unusually large amounts of traffic. These delays mean the cloud-based applications will crawl, making it unlikely that agencies who have a lot of work to do will stick with the cloud. (Think of DMV slow, and you get the idea.)
• Security of off-CONUS storage: This was mentioned in the original article. Consider this, though. I run my own mail server because I don't want any LEO to be able to subpoena anyone for my mail, except me. The decisions coming from US courts erodes privacy in significant ways. (I was a third party to such a subpoena, and under a gag order about it to boot.) Consider what happens when YOUR data is stored overseas -- are you that confident that non-US governments are so stable that your personal data is safe?
• Effect on intercontential transmission links: Can you imagine the effect on traffic volume on an overseas link if you have EVERY SINGLE FEDERAL EMPLOYEE generating traffic on that link? Even if the cloud computing awards are spread widely geographically, you will still put a huge load on the few links we have. And satellite links just make it worse, as bits have to go to geosynchronous orbit and back. That speed limit again.
• The cost of private dedicated links that cross oceans are not insignificant. Such costs would need to be included in any bid from an off-shore applicant. I don't see any mention of such a requirement.

So, in my mind, these are excellent technical reasons to require cloud data centers be restricted to the continental United States (CONUS).

[In Maryland]

Thanks for the post. I'm not at all conversant with all the details of transmission, but enforcing security IN CONUS is a nightmare as it is - outside CONUS - forget it.

And, of course, I'm sure they have never thought about the fact that the systems that access the cloud are, no doubt, connected to other systems - might as well put a sign out: "Please Hack us Here!".