Army’s Project Gatekeeper Platform to Launch This Month

Companies looking for a faster way to secure Army accreditation for their software and code won’t have to wait long for the service’s new Project Gatekeeper platform.

Speaking at the Association of the U.S. Army conference Tuesday, Army Acting CIO Gabe Chiulli said the new DevSecOps platform would debut on Oct. 23 to common access card (CAC) users, with broader access expected in mid-November as the General Services Administration works to integrate Login.gov authentication into Project Gatekeeper.

Chiulli said during a media roundtable at the conference that the AI-backed platform’s main goal is to provide industry with a clear, but secure, path to assess their software or code against the Army’s accreditation process and broaden communication on how to do business with government.

“Success to me looks like a company — within minutes — is able to log in, commit their code, get the green check mark from our pipeline that says you are good to go, and they are very able to provide that code up the network to wherever they need to be able to deliver,” he said. “To remove the barrier of what time it takes to bring in updates, if you will, but also make it so, very quickly, a company gets to commit their code to this pipeline and actually get an answer whether or not it’s been cleaned.”

Project Gatekeeper will operate on the Department of Defense Information Network (DODIN), but in isolation with Information Impact Level 5 (IL5) security controls to ensure the software and code introduced by industry remains contained from rest of the network while it’s being assessed.

Software and code submitted to Project Gatekeeper will run through the Army’s accreditation process, with the final step being an AI-enable assessment to catch any compliance issues that may not have been previously identified in the process.

How long will that process take? It depends on the company and the level of development of its software for Army use, but Chiulli said that thanks to the Army’s community DevSecOps tools (cDSO) already integrated into Project Gatekeeper, an authority-to-operate could be issued in minutes for secure software.

For software that isn’t yet secure, Army CDO David Markowitz said another value of Project Gatekeeper is offering industry a platform from which they can receive clear assessments to iterate from, even within the platform.

“It depends upon our industry partner to actually meet the higher security standards. Some folks may find it a challenge to meet those higher security standards, and they rightfully may take a long time to get an ATO because they’re not secure. But now, they get the feedback instantly, so if you’re ready and you’re secure, it can be minutes.”

When asked about the risks and possibilities of malicious AI attacks on the Project Gatekeeper platform in the wake of ongoing unintended impacts from frontier AI models, David Wright, chief engineer at the Army Software & Innovation Center, said while the Army is working with frontier AI companies on new harnesses to detect new vulnerabilities, much of what malicious AI is finding are not unknown weaknesses, but traditional ones located faster.

“We rely very heavily on like cryptographic attestations to [assess] the software for code signings. When we evaluate a piece of software and we run our dual scan and we get those results back, we know that the software that we’re then moving up into the DODIN network is one-for-one the software that we have evaluated,” he said. “As far as vulnerabilities inside of the code space, AI is providing a lot of different things, and AI scanners are great. But the fact is that traditional tools, from the security perspective, are still incredibly effective at finding malicious activity inside the codebase.”

Chiulli said Project Gatekeeper will open up the aperture for companies wanting to work with the Army, but were unable to due to lack of access.

“We spent a lot of time and energy just trying to get people CAC cards simply to help work with us, and this is to get rid of all that,” he said. “Sometimes companies have 100 developers in the backend that … don’t have CAC cards, and sometimes we have to give all those people CAC cards simply so that they can do a commit to us. And so getting rid of a lot of that is actually a very useful activity as well.”