Hairpin traffic, distant data centers and the road to federal zero trust
When OMB told agencies to maximize telework, the binding constraint was a network design that sent remote traffic back through agency data centers and Trusted Internet Connections. Fixing it pushed federal security from location toward identity and device.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On March 17, 2020, the Office of Management and Budget issued memorandum M-20-16, telling federal agencies to maximize telework across the country, including mandatory telework if necessary, while maintaining mission-critical work. Earlier guidance had focused on the national capital region. The memo also asked agencies to extend telework to contractor staff wherever feasible. Many federal employees who had rarely worked remotely were sent home within days. Agencies moved quickly to expand VPN capacity, buy laptops and add licenses for collaboration tools. State and local governments made similar moves as states declared emergencies. The Cybersecurity and Infrastructure Security Agency followed in April with interim guidance on applying the Trusted Internet Connections 3.0 model to telework.
Federal agencies had telework policies long before 2020, and many employees already had government laptops. The difficulty lay in the network. It assumed that users sat inside an agency perimeter and that internet traffic passed through a few Trusted Internet Connections where it could be inspected. When most staff went home at once, three parts of that design came under strain: the path traffic took, the devices it came from, and the way users proved who they were. Each strain had a short-term fix, and each fix raised a question that only a different architecture could answer. The closing paragraphs set out what that architecture implied for the order of investment.
The path: everything back through the center
Under the TIC model as most agencies built it, a teleworker’s traffic travelled over a VPN into the agency network. It then went out through a TIC access point to reach the internet, including cloud services the agency itself used. That hairpin made sense when remote users were few. With most of the workforce remote, VPN concentrators and TIC links carried far more traffic than they were sized for. Much of it was video and collaboration traffic headed for cloud services anyway.
Agencies responded in three ways. They enabled split tunneling for trusted cloud services, so that traffic to approved platforms went direct. They bought emergency capacity for concentrators and circuits. Some scheduled when groups of staff could connect. Each was a reasonable measure. Split tunneling, though, removed the agency’s view of that traffic. Security teams now had to answer a new question: how to apply inspection, logging and data loss controls to traffic that never touched the agency network.
The hairpin also hurt users. Video routed through a distant data center and back suffered latency and dropped calls. Staff reasonably looked for workarounds, such as personal accounts for meetings. Poor performance turns into a security problem when it pushes people off sanctioned tools, and help desk ticket volumes were an early warning that it was happening.
The device: who owns the endpoint
Not every employee had a government-furnished laptop. Some agencies let personal devices reach virtual desktops or web-based email. Others could not, and staff waited weeks for equipment while suppliers were stretched. Where personal devices were used, the agency had little visibility of their patch level, malware protection or who else used them.
Sensitive data made this harder. Rules for federal tax information, health records and criminal justice information did not anticipate unmanaged endpoints. Program offices had to decide quickly what was acceptable, often without a clear owner for the decision. Virtual desktops that kept data off the device were the safest option, but they added load to the same central infrastructure that was already congested.
Contractors added another layer. M-20-16 asked agencies to extend telework to contract staff where feasible. Those staff often used employer-issued laptops, governed partly by their employers’ policies. Few agencies could say with confidence which contractor devices were connecting, or how they were configured. Contract clauses on device security, where they existed, had been written for on-site work.
The identity: a card and a reader
Federal employees authenticate with Personal Identity Verification cards. At home, that requires a card reader, a device configured to use it, and a working process for expired or lost cards. Issuance normally requires an in-person visit to a credentialing office, many of which were closed or limited. Agencies that relied on PIV as the only strong authenticator found that the credential itself was now a logistics problem.
Several agencies issued temporary alternative credentials and extended card validity where policy allowed. Those were sensible stopgaps, but they created a population of accounts with weaker or non-standard authentication. Tracking those exceptions, and retiring them later, required a register that many agencies did not keep. Cloud services added a further gap: some accepted PIV through federation, while others still relied on passwords.
Taken together, the strains pointed in one direction. Security that depends on where the user sits and how traffic flows does not scale to a distributed workforce using cloud services. Security that depends on the identity of the user, the state of the device and the sensitivity of the resource does. CISA’s interim TIC 3.0 telework guidance began to formalize that shift. It allowed security capabilities to be applied closer to the user and the cloud service, rather than only at the agency edge.
For a federal CIO, that meant reordering investment. Identity providers that could enforce strong authentication for every application came first. Device management that could report a laptop’s health before granting access came second. Network capacity, the most visible bottleneck in March, mattered least over time because it could be bought quickly. State and local agencies, facing the same strains with smaller budgets, had even more reason to follow that order. Capacity can be bought in a crisis; identity and device maturity cannot.
With hindsight
The shift that began as an emergency was soon formal policy. After the SolarWinds compromise came to light in December 2020, Executive Order 14028 in May 2021 directed agencies toward zero trust architecture. OMB memorandum M-22-09 in January 2022 then set out a federal zero trust strategy, with goals for identity, devices, networks, applications and data. Phishing-resistant multi-factor authentication, including PIV and FIDO-based options, is now a central requirement.
Telework itself turned into a political question, and a January 2025 presidential memorandum directed federal employees back to in-person work. The architecture did not reverse with it. The case for identity-based access never depended on where people worked. It depended on where applications and data lived, and much of that had already moved to the cloud.