St. John is the chief technology officer of Fannie Mae--formerly called the Federal National Mortgage Association--the nation's largest source of financing for home mortgages and the largest non-bank financial services company in the world. She oversees 1,800 information technology employees, more than a third of the company's work force.

Fannie Mae was founded as a government agency in 1938 and became a shareholder-owned company 30 years later, with the mission of raising home-ownership rates. It makes buying homes possible for many low-, moderate- and middle-income families. The company helps lenders raise money by buying mortgage-backed securities.

Although it is often associated with historic periods such as the post-Depression recovery and the suburban boom after World War II, the Fannie Mae of 2002 is a decidedly modern enterprise. St. John is as comfortable talking about open-source technology and the future of Web services as she is about real estate.

To maintain its leadership status in the intensely competitive mortgage market, Fannie Mae has jumped headfirst into e-commerce, conducting $1.6 trillion in online business-to-business transactions and booking earnings of $5.37 billion in 2001.

Fannie Mae makes its money through interest income and fees associated with mortgage lending and trading, but that fact means revenue figures are hard to pin down. Analysts tend to play down revenue figures of financial services companies like Fannie Mae because such organizations do not make products. But some estimate that its 2001 revenue was around $50.8 billion, excluding various expenses.

Those numbers may sound impressive, but St. John isn't satisfied. In a recent interview with CNET News.com, she offered her views on new technologies, IT staffing plans, and how to pick the best hardware and software suppliers.

Q: Fannie Mae moves around a lot of mortgages and has a lot of assets ($808 billion and another $896 billion in mortgage-backed securities held by outside investors). What kind of tech infrastructure do you need to pull all of that off seamlessly?
A: It's a good question and a fairly complex one to answer, but let me take a shot at it. We are a very large-scale environment if you think about the scale in terms of what Fannie Mae does in revenue or transactions and the number of employees we have. We are a Fortune 20 company with only 4,500 employees, so we're obviously highly leveraged with technology. We have a fairly significant e-business architecture that we run ourselves, and we have a very large server farm. We're largely a Sun/Oracle environment.

When it comes to evaluating suppliers, what does Fannie Mae require, and what type of technology are you looking for?
Technology is extremely critical to what Fannie Mae does, so we evaluate vendors very carefully. Obviously I use all of the large technical research organizations like Forrester, Giga and Gartner. I also have a fairly sizable technical architecture and standards team that reviews any sort of technology decisions that we make. And then when we actually bet on vendors, we usually start with the best-of-breed and narrow it down.

We actually do some deep technical due diligence on products and run stuff through our test labs. We also look hard at market positioning because we are making a bet on the future, so we want to be careful that we're picking market leaders.

Flash back to a few years ago. Were you considering some of the high-flying, so-called best-of-breed software suppliers, or were you always looking at larger, established companies?
Unless it was for niche competitive advantage, no. Because the role we play is so unique, we have to be running a large-scale environment that has to be secure and highly reliable. We did $1.6 trillion over the Internet last year. We are going with mainstream vendors with proven technologies that we have experience in so we can deliver the reliability and service that our lending partners require.

In terms of platforms, are you all Unix?
We are a big Unix shop. Microsoft is on the desktop and maybe on the front end for some Web stuff, but we're primarily a big Sun/Unix environment. That is not dissimilar to other financial services companies.

Has Microsoft approached Fannie Mae to try to make inroads?
We do have a relationship with Microsoft, and we do use some of their products. All vendors approach us. My voice mailbox is full every day.

Are they approaching you a lot more these days than they did 24 months ago?

Do you see your IT spending going up over the next 12 to 24 months?
Yes. We are a very large-scale company that plays a critical role in housing finance so we can provide liquidity and housing access. Because we are issuing trillions in debt every year and doing trillions over the Internet, we have to be leveraged with technology. We (the IT department) are a big part of Fannie Mae. We have a third of the company, and my budget tends to increase in line with revenue growth. Last year, revenue growth was 25 percent. That's not precisely how much my budget grew, but it has definitely increased.

We invest in technology because we are a large e-business. We know how important running a large-scale, secure, reliable financial e-business is. We have a strong understanding of what it takes to manage that complexity and to make it reliable and secure. I have a chairman who is incredibly aware and visionary about technology, so it's a stated area of investment for the company.

If your IT budget is growing at a nice clip, what are your hiring plans?
I am always looking for good people because technology is so strategic to what Fannie Mae does. I've been hiring at a fairly steady rate and will continue to do that. I have aggressive training programs in place and very low attrition. People who come here tend to stay because we are doing bleeding-edge technology, and it's strategic to the business. It's a great place to work and a fun technologist environment.

Last year my attrition was only at 3 percent. I think that's unusual when a lot of your people have been there for five years or more. I also have a strong senior team, so I haven't done a lot of hiring on that level. Software engineers, systems integrators and e-business infrastructure skills I've been hiring for.

Looking into the crystal ball, what three technologies do you think will matter the most over the next year or two?
Let's assume first of all that the Internet and all it offers in terms of extending your enterprise and reach is a given. I think Web services will be increasingly important because it will provide a better integration environment that enables us to work more closely with our business partners, and we're building to a service-based architecture. We believe that's where the future is.

Another area that I think will be important to Fannie Mae is SANs (storage area networks) because we are unabashed data hogs. We manage interest and credit risk for a living and use lots of data analyzing lots of trends to do that in a world-class way. Both transactional and analytical data continues to grow at a clip of 50 percent. All of that storage area network technology we have invested in, and I think it'll be important.

Another area that's on my mind as a CTO is security. Post-Sept. 11--and also with the volume of e-business transactions that we do--it's extremely critical to me to run a secure environment. It's an area we invest heavily in. I'm never done there. It's constant vigilance.

Finally, voice over IP will be very important. We have done some work with voice over IP and have managed to really reduce local Bell operating costs, moves and changes costs, and long-distance charges. We believe there is some potential there.

Going back to those areas, what companies do you say are the leaders right now?
Web services is kind of a toss-up between the J2EE (Java 2 Enterprise Edition) camp and (Microsoft's) .Net. We are a J2EE shop and a big Sun shop. I think that the industry is still sorting that through. I'm a big proponent of an open standard, so that's where I stand. For voice over IP, Cisco has very good products and is heavily investing there. On storage area networks, I am trying to not have one vendor dominate, and we would like to see the promise of an open standard there and interoperability. Right now, I don't have a pick of a vendor.

In terms of architecture, do you consider yourself to be open source? What's your view of open source and the different platforms?
If you look at Fannie Mae's perspective, we obviously subscribe to open standards. But the standards organizations in the industry haven't settled on what things are going to be. We are a J2EE shop and use open source for certain things. We do have an open-source policy, and if we think it's appropriate, we use it. We have a very strict policy on it, and there are only some uses it's appropriate for.

Who do you use for storage now? EMC?
Yes, and we also use Brocade and Hitachi. Everyone is trying to get into storage, and I'm not sure who the leader is going to be right now. All the big ones are pitching to us on SANs and also promise there will be interoperability, although they'd all prefer we buy a suite installation.

We have not made our pick about who we're going to bet on. We're a best-of-breed right now trying to evaluate who we're going to partner with.

What about security? Who's the leader?
I do not want to talk about any of the security vendors for security reasons. I never disclose any of that stuff.

Do you use any of the outside providers?

When looking at the technologies, what are your return-on-investment benchmarks? Is there a base ROI you need to go with a technology?
ROI isn't exactly how I look at it. I look at the total cost of ownership over the life of the technology...Some things are just the price of being in this game. You have to have a secure business infrastructure to have a business the size of Fannie Mae, so that is not an ROI discussion. It's a core competency we have to have. That said, we are a third of the company, so I have to be focused on cost of ownership. It's something I manage very carefully.

Are there productivity benchmarks? What's your take on technology leading to productivity gains?
We're a great example of technology leading to productivity, if you go back to the fact we're a Fortune 20 company with 4,500 people. I think that we're always trying to streamline our processes to promote higher-value-added jobs. If we are automating some business processes, we always try to streamline them to get productivity savings there. There is no one benchmark. It depends on the function; there are different business problems. We evaluate them differently.

If you were to draw up your ideal e-business blueprint, what would the components be?
I wouldn't want to share that with you, but it's a good question. That said, I am very "pro the Internet," but I do think part of what you see with Web services is that it takes a lot of thought and engineering design care to effectively architect the environment so you can run it well. That may be because of the scale I'm working in; I'm doing large financial transactions over the Internet. Where you used to have the big box and the client and the server, now you have the Web server, the app server, the load balancer and the firewall--it's just more complex. So we spend a lot of time architecting and engineering.

Speaking of Web services, do you think it has been properly defined by the Microsoft and J2EE camps? Are you implementing Web services now? It just seems like there's a big gap between the reality and the hype.
You do have the concept versus the reality. We are doing work in J2EE, and I don't think all components are ready for prime time, but I think for J2EE there's a lot of good work you can do--and we are. We just benchmark carefully. We have seen in the J2EE environment significant productivity gains--not out of the gate, but as our software engineers get into it, they can build applications more quickly. They can also modify applications to deliver business functions more quickly. That's really important to us because as the market changes you need to be able to respond.

How important is a company like BEA Systems to you when working in J2EE?
We use BEA, so they are important to us.

What about IBM? They seem to be neck and neck in market share.
There are camps. There is the BEA/Sun/Oracle camp and the IBM camp. I think IBM has some good products, but given where Fannie Mae is right now I think the strategy we're pursuing is the right one for us.

Is there anything about Web-based technologies you are disappointed about? It sounds like you are sold on the Internet.

Would you say the Web-based technology isn't up to snuff for large deployments?
I wouldn't say that, but I think you really have to invest in the infrastructure. All of the foundation really matters. The firewalls matter, the load balancers matter, the security matters. It requires a heavy investment and a good understanding of how important the underlying foundation is.

What keeps you up at night? What's your tech nightmare?
I'm actually a pretty good sleeper, but I think a lot about the technology challenges we have because it's so important to the company. I take a very risk-management approach. I have extremely good flight dials on managing that risk. I wouldn't say that there's anything that keeps me up at night, because I plan so far ahead on the infrastructure and the things that can bite us. I have good indicators, so I know where Fannie Mae is at all times.

How do you measure success and failure as a CTO?
Partially, I measure my success by my alignment with the business. If you think about what financial services do, you are moving money and data around with computers. It can either be a very paper-intensive environment or a highly automated environment. I spend a lot of time with my partners, understanding their businesses so I can think ahead and be a technology enabler. It's really alignment with the business and helping Fannie Mae achieve its mission. Then there are all the regular things: containing costs, reliability and scale. I think it all comes from enabling the business.

Back to intro