John H. Pendleton serves as a nonresident scholar in the Technology and International Affairs Program. Prior to joining Carnegie, he served almost thirty-five years at the U.S. Government Accountability Office (GAO). He has testified before Congress a dozen times and signed more than 130 reports on a wide range of prominent issues. John’s work has been cited in the Wall Street Journal, New York Times, Washington Post, and Time, and he has been interviewed on NPR’s “All Things Considered” and appeared in several other media outlets.
After the COVID-19 pandemic struck, John pivoted to lead reviews of the Paycheck Protection Program and Emergency Rental Assistance program, including how well they reached underserved populations. He also directed work on the use of virtual currencies for illicit activities such as drug and human trafficking as well as the appropriate government role in providing backstops for cyber insurance, which in turn piqued his interest in cyber security and resilience.
Up until 2020, John directed the military readiness portfolio at GAO, where his influential work and testimonies prompted the Senate Armed Services Committee to require development of a DOD-wide readiness-rebuilding plan to guide investment decisions. His reports covered a range of high-profile topics such as training, maintenance, and other issues that contributed to deadly 2017 Navy crashes in the Pacific; plans for key Air Force programs like the A-10 and F-22; Army force structure plans including the creation of new cyber-focused units and the use of its Patriot Air Defense system; expansion of the U.S. Special Operations Command; reviews of nuclear and missile defense planning and operations; and the military’s response to Hurricane Katrina, among many others.
In the early 1990s, John was posted overseas (Germany) where he led a body of work on the military drawdown in the post-Cold War period and focused his research on the nexus of national security and international affairs throughout his career. For example, he developed a series of reports on interagency planning and coordination among U.S. government agencies, including the issues around the creation of U.S. Africa Command; the military’s equipment pre-positioning programs in Europe, Asia, and the Middle East; as well as the theater campaign planning of the geographic combatant commands.
John graduated from the University of Kentucky (B.B.A.-Finance) in 1987 and has completed professional courses at MIT (Seminar XXI), Harvard (Negotiations), Syracuse (National Security Leadership); Aspen Institute (Executive Seminar); and Center for Creative Leadership (Leadership Program); among others. As a member of GAO’s adjunct faculty, he taught courses on report writing and how to prepare congressional testimony.
He lives in Berkeley Lake, Georgia, just outside Atlanta, where he serves as the city treasurer and director of the finance committee. He also serves on the executive board of his local YMCA.
The world recently woke to a massive global cyber outage paralyzing major enterprises and critical services. The culprit turned out not to be traceable to a sophisticated hacker, instead to a routine but insufficiently tested software update intended to protect Microsoft Windows users that had been pushed out by the cybersecurity firm CrowdStrike.
As increasing amounts of information and services are moved to the cloud, a few providers have come to manage the bulk of cloud services. This level of dependence and concentration offers some benefits and risks, but policy action is needed to minimize and manage the risks.
The universal adoption of cloud-centric operating models is bringing enormous benefits to every sector of the global economy, yet the ubiquity of dependence on common technologies and service providers also creates a new potential for systemic risk.
