Social Security Confronts IT ObsolescenceSocial Security Confronts IT Obsolescence

The Social Security Administration's primary data center is nearing the end of its usefulness--its electrical system is an accident waiting to happen, and decades-old software hampers the agency's ability to extend its services to the Web. Social Security has a plan to replace the overburdened facility with a modern data center, but that will be a five-year process with challenges of its own.

The Government Accountability Office and Social Security's inspector general have looked into the issues and published reports calling for remediation. Social Security's data center--located at agency headquarters in Woodlawn, Md.--is home to 4 petabytes of demographic, wage, and benefits data, and the agency last year distributed $703 billion in retirement, disability, and survivor benefits to 53 million Americans. Uncle Sam can ill afford for the agency's services to be disrupted by an outage to the systems that manage it all.

"Service interruption would severely affect the American public, delaying the delivery of benefits to citizens who depend on these funds in their day-to-day lives, and likely hindering people's ability to obtain employment, driver's licenses, and even loans and mortgages," inspector general Patrick O'Reilly told a House of Representatives committee in February.

Social Security has been planning construction of a new data center for the past few years. That project has already fallen a year behind schedule, though agency officials recently assured Congress it wouldn't slip further. However, even if the project remains on track, the new data center won't be operational until 2016.

Floor space isn't the problem in the Woodlawn data center; it's the building's infrastructure--electrical, cooling, and heating systems--that can no longer keep up with requirements. According to a project plan released in August, the facility will reach its maximum electrical distribution capacity within four years.

Data Center Faces Retirement

Social Security Administration's primary data center in Woodlawn, Md., is expected to max out its electrical distribution capacity within four years The facility's HVAC system is outdated, and replacement parts are no longer available for its UPS system Mainframes run Cobol applications and a file system written in assembler language A replacement 400,000-square-foot data center to be built in Urbana, Md., is scheduled to open in 2016

The building, designed for 1970s-era mainframes, lacks redundant electrical, heating, and cooling systems, and its fire suppression system doesn't even cover the entire data center floor. Its HVAC system is "well beyond its expected life cycle," says Kelly Croft, the agency's deputy commissioner for systems.

Likewise, the data center's uninterruptible power supply system can't be trusted. The vendor for the custom-designed UPS has informed Social Security that replacement parts are no longer available. And the facility's electrical system serves other areas of the building, raising the risk that a power surge elsewhere could cause a partial outage among the computer systems.

What about backup and recovery? Social Security operates a secondary data center in North Carolina, but it's a poor safety net. It would take five days to get the secondary data center to run critical applications if needed.

Efficient And Secure

The new facility will be built on a 63-acre property at the Urbana Research Center in Urbana, Md., that will also be the site of new office space for the agency. The data center, to be called the National Support Center, will be about 400,000 square feet. It will be an energy-efficient Tier 3 data center, with a minimum of 99.982% uptime, a LEED "silver" design certification, and state-of-the-art physical security.

Bids on the construction phase of the project were due March 2. Once the contract is awarded, the schedule calls for construction to be completed by September 2014 and for IT systems to begin moving into the facility in January 2015. The agency estimates that migration could take 18 months to complete.

Most of the funding for the new data center will come from $500 million made available through the American Recovery and Reinvestment Act of 2009. However, the Republican-controlled House of Representatives' revised budget for the rest of fiscal 2011 would cut $120 million of that stimulus funding. If that happens, one of the first things to go could be $100 million in software and system upgrades planned for the new data center.

Social Security continues to run its core applications--including the Retirement, Survivors and Disability Insurance Accounting System and the Supplemental Security Income Record Maintenance System--on four powerful IBM mainframes. Those systems are only a year or two old, but many of the apps that run on them were written decades ago in the Cobol programming language.

That old software constrains how data gets accessed and shared internally, and how services and data are made available on the Web. "We do a lot of batch processing, so there are hours when our systems aren't even available to the public," CIO Frank Baitman says.

"We have very limited dollars to invest, so you've got to invest where you're going to get the biggest bang." -- Social Security CIO Frank Baitman

Social Security is five years into a project to convert its aging Master Data Access Method (Madam) file management system to IBM's DB2 database management system. Various government reports going back as far as 1997 have characterized Madam, which was written in the 1980s in IBM assembler language, as primitive, obsolete, and outdated.

The transition from Madam to DB2 will happen in three stages, and the agency is only midway through the first of those, the file conversion phase. Completion of the entire project is expected by September 2013.

Social Security's inspector general reviewed the project in May and concluded that the agency lacked "critical decision-making information" around the DB2 project, including a baseline for measuring performance. No analysis had been done on what it would cost to rewrite applications for the DB2 environment, even though the agency contended that such a rewrite would be "too resource intensive."

In addition, Social Security had warned that, as a result of anticipated employee retirements, it faced a potential shortage of technical staff with Madam skills, potentially leaving the agency short-handed during the Madam-to-DB2 transition. However, Social Security didn't specify when that would become a critical issue, according to O'Reilly.

There are no plans to rewrite the agency's core apps as part of the DB2 conversion. Instead, Social Security will take the lesser step of modifying the applications to enable DB2 access. The National Research Council determined in 2007 that moving away from Madam without rewriting the Social Security's applications "would limit the functionality of existing applications and compromise the design of the new database." At the time, Social Security defended its approach as "more cautious and less risky."

But the question of software obsolescence won't go away. A Social Security advisory board told President Obama's transition team in 2008 that the agency needed to convert its Cobol-based IT infrastructure to newer technologies. The agency has yet to articulate a plan for doing so.

Cobol Devotees

CIO Baitman concedes that Cobol code will continue to be used by the agency "for the foreseeable future," pointing to a lack of funding for long-term software development to replace that code. "We have very limited dollars to invest, so you've got to invest where you're going to get the biggest bang," he says. "In some cases, that may mean replacing something, and in other cases, it may be running something new that's an add-on to an existing legacy system."

The 50-year-old Cobol language has a devoted following among experienced IT pros. "It's remarkably efficient for certain things," Baitman says. "We have business processes that are designed around it, and Cobol lends itself to that."

At the same time, Baitman is acknowledging the reality of tight funding in his embrace of Cobol. The House of Representatives' resolution would take $1.7 billion away from Social Security's 2011 budget, and that could be just the beginning of a drawn-out period of spending austerity aimed at reducing the federal deficit.

Social Security's strategy of extending the life of its legacy software is further complicated by the fact that some of the IT staffers required to manage and maintain its code are reaching retirement age, even if the software isn't. About 42% of the agency's IT specialists are expected to retire between 2010 and 2016.

Given the scarcity of recent college graduates who are proficient at Cobol, replacing those skills won't be easy. Baitman wants young computer scientists to come to Social Security to pick up those skills, but that, too, is proving difficult--the agency is in the middle of a hiring freeze.

The experts aren't warning yet that Social Security's data center and applications are at risk of imminent failure, but there's no ignoring that the data center and apps are inefficient and inherently risky, and offer limited support of new Web services. Like millions of Americans, Social Security must focus on retirement planning--of its data center and legacy software--to avoid painful problems down the road.

information: Mar. 14, 2011 Issue

Download a free PDF of information magazine
(registration required)