The public is finally starting to learn what security experts have been warning for years: the US government has no idea what it’s doing when it comes to cybersecurity. Worse, the government’s main “solutions” may leave all our data even more vulnerable to privacy violations and security catastrophes.

The effects of the massive hack of the Office of Personnel Management (OPM) continue to ripple through Washington DC, as it seems every day we get more information about how the theft of millions of government workers’ most private information is somehow worse than it seemed the day before. (New rule: if you read about a hack of a government or corporate database that sounds pretty bad, you can guarantee it be followed shortly thereafter by another story detailing how the same hack was actually much, much “worse than previously admitted.”)

How many millions of people were affected by the OPM hack exactly? Well, no one has any idea. And we’re not just talking about credit card numbers that can be reset. The siphoned files include what are known as SF-86 forms, which contain the detailed financial, medical, and personal histories of anyone who applied for a federal clearance. It’s a goldmine for potential blackmailers. The government’s penance to those affected is to offer everyone 18 months of free credit report monitoring. How generous.

It gets more embarrassing. The alleged Chinese hackers were inside the government’s systems for a year before they were found. There was a second major breach that wasn’t previously disclosed. The OPM ignored repeated warnings by its inspector general that its security practices were dangerously negligent. Ars Technica even reported that contractors had direct access to the servers that stored the data inside foreign countries, including China.

As security expert Jonathan Zdziarski tweeted, if you have two-step authentication enabled on Twitter – a basic security feature that almost all social media platforms offer – “then your tweets are safer than the government’s data on 4 million federal employees and contractors.” Why the White House is only now urging agencies to implement this kind of security measure is a mystery.

It’d be one thing if this incompetence was exclusively an OPM problem, but despite the government trying to scare private citizens with warnings of a “cyber-Armageddon” or “cyber-Pearl Harbor” for years, they failed to take even the most basic steps to prevent massive data loss on their own systems. As OTI’s Robyn Greene writes, 80-90% of cyber-attacks could be prevented or mitigated with basic steps like “encrypting data, updating software and setting strong passwords.”

The agency that has been singled out for some of the worst criticism in recent years is the Department of Homeland Security, the agency that is supposedly in charge of securing all other government systems. The New York Times reported this weekend that the IRS’s systems still allow users to set their passwords to “password,” along with other hilariously terrible mistakes.

On Tuesday it was reported that the Navy is spending $30m to stay on Windows XP. Windows XP! The same operating system that is so old, Microsoft stopped providing public support for it a year ago. It was released in 2001! Do you remember what your computer was like back then? And if that doesn’t scare you enough, this will:

At the Nuclear Regulatory Commission, which regulates nuclear facilities, information about crucial components was left on unsecured network drives, and the agency lost track of laptops with critical data.

Instead of addressing their own problems and writing a bill that would force the government to upgrade all its legacy systems, implement stronger encryption across federal agencies and implement basic cybersecurity best practices immediately, members of both parties have been pushing dangerous “info-sharing” legislation that will end with much more of citizens’ private data in the hands of the government. And the FBI wants tech companies to install “backdoors” that would give the government access to all encrypted communications – thereby leaving everyone more vulnerable to hackers, not less. Two “solutions” that won’t fix any of the glaring problems staring them in the face, and which may make things a lot worse for ordinary people.



Why should anyone trust what the government says on cybersecurity when they can’t secure the systems they have full control over? If Congress were to write a bill that would bring protections of government systems into the 21st century it would have the instant support of civil liberties organizations, security professionals and just about anyone. So why don’t they do that, instead of wasting time on controversial bills that make us less safe?