C01 Oracle Java 2021 - Justification and Approval_Redacted.pdf

Control Number VA-21-00034419

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA) Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way

Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed price delivery order issued under the National Aeronautics and Space Administration (NASA) Solutions for

Enterprise-Wide Procurement (SEWP) V Governmentwide Acquisition Contract (GWAC) for the procurement of brand name Oracle Java Standard Edition Subscriptions for desktop and server software maintenance.

3. Description of the Supplies or Services: VA, Office of Information and Technology (OI&T) has a requirement for brand name Oracle Java Standard Edition Subscriptions for desktop and server software maintenance, which is inclusive of access to software updates, fixes, security alerts and patches and 24 x 7 customer support/assistance.

Java is a computing platform and software commonly known as middleware that enables software applications and websites to work independent of each other. Java enables the software application to be written once but be accessible from any type of device (PC, MAC, Smartphone, etc.) and on different operating systems (Windows, MAC OS, Linux, etc.). Java was originally produced by Sun Microsystems and is now owned by the Oracle Corporation. Sun MicroSystems developed and made Java available to the public as free and open source software under a General Public License (GPL). In January 2010, Oracle purchased Sun Microsystems and continued providing support for all supported versions of Java as free and open source software under a GPL. As a result, VA added Oracle Java to its Windows Gold Image resulting in Oracle Java being installed on all VA desktops and laptops. This ensured that if Oracle Java was required it was already installed and available.

In February 2019, Oracle increased the cadence of its Java releases from one major release every three years to one feature/minor release every six months. For example, Oracle Java 11, released in September 2018, is a major release, and Oracle provides long term support for major releases. Oracle Java 8 is also a major release, and Oracle will provide long term support for Oracle Java 8 until 2025. Additionally, in February 2019, Oracle changed its pricing model, requiring customers to purchase a software maintenance subscription for long term support versions of Oracle Java. Long term support versions of Oracle Java are supported for approximately 10 years. VA and its applications are too large to support complex Oracle Java upgrades every six months; therefore, VA requires a procurement to continue the existing software maintenance subscription support on the currently installed long term support versions of Oracle Java (versions 8 and 11).

VA became aware of this pricing model change in April 2019. At that point, VA began working with the Oracle group/division who oversees VA’s Oracle Enterprise License

Oracle Java 2021 Control Number VA-21-00034419

Agreement to determine a path forward to ensure VA has access to Java support. In May 2020, a one-year Oracle Java contract was awarded to afford VA time to reduce its Oracle Java footprint and/or migrate to alternative Java technologies.

Currently, there are ~150 VA applications which utilize long term support versions of Oracle Java, versions 8 and 11, that encompass ~24,000 server subscriptions as well as ~34,000 desktop subscriptions. VA requires software maintenance to support the current desktops and servers that these applications run on. This software maintenance is required to ensure the Oracle Java 8 and 11 software remains operational. This proposed action is for software maintenance only, no new software will be procured or renewed. The period of performance will be May 15, 2021 through

May 14, 2022. The total estimated value of this proposed action is

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C. 4106(c)(2) as implemented by FAR 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: The required brand name Oracle Java software subscription for maintenance support utilized by VA is proprietary to Oracle. Currently, VA has Oracle Java installed on approximately 24,000 servers supporting approximately 150 VA applications performing critical functions such as claims processing, clinician collaboration, provision of patient care, Veteran medical records data entry, secure transmission of patient data, and real-time access to patient data by clinicians and patients. From May 2020 to February 2021, VA reduced its

Oracle Java footprint on endpoint devices from 38,000 to 34,000 and servers from 25,000 to 24,000, supporting approximately 150 applications, all of which have been unable to migrate to alternative Java technologies. Although easily identified instances of unused Oracle Java have been removed, there remain mission critical applications which still use and may only be certified to work, with Oracle Java. If another brand of software were to be implemented, such as Amazon Corretto or Azul Zulu OpenJDK, VA would have to re-write existing mission critical Veteran facing medical and benefits applications to ensure interoperability with the variety of platforms listed in Section 3.

This would significantly impact services to Veterans, incur significant cyber security risks, increase manual system integration, and increase the ongoing Oracle Java maintenance costs.

VA subject matter experts considered utilizing Open Java Development Kit (OpenJDK), which is a free and open source implementation of the Java Platform, Standard Edition.

The OpenJDK source code is the basis for alternate commercial Java products such as Amazon Corretto or Azul OpenJDK. VA evaluated OpenJDK and it was determined that the patching support was not adequate for VA’s needs. Specifically, there is no emergency patching supported and there are no “Long Term Support” versions offered.

VA does not have the resources required to maintain OpenJDK in order to meet the

Oracle Java 2021 Control Number VA-21-00034419 security requirements for protecting any data containing Protected Health Information, Personal Identifiable Information, or sensitive information as mandated by VA. As a result, VA requires commercially supported versions of OpenJDK. An alternate commercially supported version of OpenJDK is Amazon Corretto, which is available for VA’s use through Amazon’s enterprise cloud contract at no additional cost to the Government. Both Oracle Java and Amazon Corretto are certified to support the OpenJDK as long as the additional proprietary extensions are not utilized. However, VA has not been able to determine which VA applications use the proprietary Oracle Java extensions. VA continues to work to gather this information, however it is not yet available. Once this information has been provided, VA will be able to assess which applications could move to an alternate Java solution that adheres to the OpenJDK.

Transitioning involves risk, and each of the hundreds of applications would need to be tested individually to ensure proper functionality. VA has tested moving applications, such as the IntelliSpace - CPRS interface, to an alternate commercially supported version of OpenJDK with unsuccessful results. Instead, this application has begun developing a non-Java solution which will not be ready prior to the end of the Oracle Java 2020 contract. Other VA applications, including Benefits and Memorials (BAM) have evaluated alternative Java solutions and are planning a migration but it will be a multi-year development effort to re-write their applications to remove the Oracle Java dependency.

VA has removed or transitioned all easily identified instances of Oracle Java and we continue working to transition everything that we can. Although easily identified instances of unused Oracle Java have been removed, there remain mission critical applications which still use and may only be certified to work with Oracle Java. If another brand of software were to be implemented, such as Amazon Corretto or Azul

Zulu OpenJDK, VA would have to re-write and perform extensive regression testing of existing mission critical Veteran facing medical and benefits applications to ensure interoperability with the variety of platforms within VA. This would significantly impact services to Veterans, incur significant cyber security risks, increase manual system integration, and increase costs associated with regression testing and any potential re-writes

VA undertook numerous steps attempting to identify and remove unnecessary Oracle

Java. The steps included issuing seven Bulletins and five Action Items. The Bulletins informed stakeholders across VA about Oracle’s change in pricing strategy for Oracle Java as well as communicated VA’s plan for reducing its Oracle Java footprint. The Action Items provided instructions for removing unnecessary installations of Oracle Java and provided a communication portal for VA stakeholders to report progress.

To maintain these mission critical systems, VA must ensure a software maintenance subscription agreement is in place to provide access to Oracle Java updates, fixes, security alerts and patches for all the Oracle Java installations mentioned above. No source other than Oracle, through its resellers, has access to the proprietary data and source code necessary to provide the required access to software updates, fixes, Oracle Java 2021 Control Number VA-21-00034419 security alerts and patches and access to 24 x 7 customer support/assistance for Oracle Java currently deployed throughout VA. This continued software maintenance subscription is required to maintain the integrity and security of VA applications and its

IT environment.

Based on market research, as described in Section 8 of this justification, it was determined that limited competition is viable amongst multiple resellers for the brand name Oracle Java subscriptions for desktops and servers software maintenance.

6. Efforts to Obtain Competition: Market research was conducted, details of which are in Section 8 of this document. This effort did not yield any additional sources that can provide support for the required Oracle Java technology. However, the undersigned VA technical representative determined that limited competition is available among resellers for brand name Oracle software maintenance. Although the Government is limiting competition as a result of specifying brand name software, limited competition is viable amongst multiple resellers of the required brand name Oracle Java subscription for desktop and server software maintenance. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR

5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Contract Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: The Government will continue to conduct market research to ascertain if there are changes in the marketplace that would enable future actions to be competed. The Government continues its undertaking of two projects.

The first removes unused instances of Oracle Java within VA and second to encourage product teams to migrate to alternative Java technologies where Oracle Java proprietary extensions are not required.

8. Market Research: The Governments technical experts conducted market research by reviewing other similar software subscriptions. This market research started in February 2019 and is continuously being done in order to determine a future path to reduce VA’s dependency on Oracle Java. The other similar software products reviewed to date include Amazon Corretto, IBM Software Developers Kit and Red Hat Open Java Development Kit. However, none of these products can provide the software updates, fixes, security alerts and patches for the currently deployed Oracle Java products (Oracle Java 8 and Oracle Java 11) already in place within VA without access to the proprietary source code for the Oracle subscription licenses. Unauthorized software providers do not have access to use the proprietary source code of the Oracle subscription licenses and are not able to provide troubleshooting, updates, fixes, patches, and upgrades. Additionally, some VA products are only certified by the product vendor to work with Oracle Java.

In February 2021, VA conducted further market research by issuing a Request for Information (RFI) on the NASA SEWP V GWAC for the brand name Oracle Java

Oracle Java 2021 Control Number VA-21-00034419 product. In response to the RFI for brand name Oracle Java, VA received two responses from resellers for Oracle Java and three responses for non-Oracle Java alternatives from two different Original Equipment Manufacturers (Azul Zulu OpenJDK and Red Hat OpenJDK). Specifically, ImmixGroup and ThunderCat Technology identified Azul Zulu OpenJDK as an alternate product, and Three Wire Systems identified Red Hat OpenJDK as an alternate product. As discussed in section 5 above, these alternate OEM products will not meet VA’s immediate need without re-writing existing mission critical Veteran facing medical and benefits applications to ensure interoperability. Further, neither of these two products can provide the software updates, fixes, security alerts and patches for the currently deployed Oracle Java products (Oracle Java 8 and Oracle Java 11) already in place within VA without access to the Oracle’s proprietary source code and extensions. On April 12, 2021, VA OI&T issued responses to the three aforementioned RFI respondents, and informed them of the Governments assessment. Subsequently, ThunderCat and ThreeWire replied to VA with no further comments or questions. On April 14, 2021, VA received questions/comments back from ImmixGroup. After reviewing the questions and comments received, VA responded to those inquiries on April 21, 2021, and still maintains that the effort to implement a non-Oracle Java technology would require significant time and investment, and does not agree that it is a simple / easy replacement of Oracle JDK with the alternate Java. VA has tested moving applications, such as the IntelliSpace - CPRS interface, to an alternate commercially supported version of OpenJDK with unsuccessful results. Nevertheless, VA will continue to look at ways to improve VA’s implementation of Java in the future.

Lastly, several VA applications rely on the functionality embedded in the proprietary extensions offered by Oracle. Migrating these VA applications to another brand of Java would create a stop-work situation forcing applications to fund and implement application code changes to account for the gap created by the lack of Oracle proprietary extensions. VA subject matter experts evaluated the following two alternatives to Oracle Java: Amazon Corretto and Azul Zulu OpenJDK. These products do not provide the proprietary extensions embedded in Oracle Java. VA is and will continue to assess opportunities to improve VA’s Java installation.

In addition, Oracle does not sell software maintenance directly to the Federal Government but rather uses channel partners or resellers. In March 2021, VA contacted Oracle requestion a list of resellers that are authorized to provide Oracle Java to VA. In response, Oracle identified four “Platinum Partners” that are authorized to resell Oracle Java maintenance to VA, and all four Platinum Partners are listed as Prime contract holders on NASA SEWP V GWAC, indicating competition at the reseller level.

9. Other Facts: Based on the results of numerous data calls, network scans, and the internal effort to reduce VA’s footprint of Oracle Java, VA’s requirement for Java is 34,000 desktops/laptops and 24,000 servers.

Oracle Java 2021 Control Number VA-21-00034419

10. Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipated competition and discounts among multiple value-added resellers of the required brand name Oracle Java subscriptions for desktop and server software maintenance support described herein. Additionally, further price analysis of quotes received will be conducted to determine fair and reasonable price. Finally, pricing of products awarded under NASA SEWP V GWAC have already been determined to be fair and reasonable.

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief.

Oracle Java 2021 Control Number VA-21-00034419

Approval

In my role as procuring activity Advocate for Competition, based on the foregoing justification, I hereby approve the acquisition of brand name Oracle Java Standard Edition Subscriptions for desktop and server software maintenance on an other than fair opportunity basis pursuant to the authority cited in Section 4 above, subject to availability of funds, and provided that the services herein described have otherwise been authorized for acquisition.