IBM's protest also claimed that the CIA modified the terms of the cloud contract after it had picked AWS.
The CIA contract called for the winner to ensure that all software in its cloud be free from viruses. AWS argued that it should only be responsible for vetting the software it provided, and not third-party software, and the CIA agreed.
After the CIA picked AWS, IBM said removing the third-party software security requirement amounted to an unfair alteration of the contract. The GAO agreed as part of its June recommendation to re-open bidding.
Wheeler noted that before the CIA awarded the deal to AWS, IBM itself tried to have the third-party software security requirement removed. "IBM's objection was not raised in a timely fashion and therefore should have been barred," Wheeler said in the document, calling the GAO decision to uphold IBM's protest "irrational."