CISA tries to contain data leak (opens in new tab)

Worse—it may even be compromised by domestic interests

Hold up, I think we have some sort of math denominator problem here.

You'd be rich if you got a dollar for every worldwide murder too, but that doesn't make murder a common workplace occurrence.

“Experts who reviewed the exposed secrets said the commit logs for the code repository showed the CISA contractor disabled GitHub’s built-in protection against publishing sensitive credentials in public repos.”

This makes it seem more intentional to me. Regardless of what the ultimate purpose were use of the repository was it says to me, the person knew what they were doing and it wasn’t just an innocent oversight like anybody could’ve made.

If I had a dollar for each secret I’ve committed to a public repo, I could probably buy a couple of sandwiches. I’m not smarter and my opsec probably isn’t any better than most old devs, but I also don’t have a treasure trove of government secrets on disk and—crucially!—_I would make different decisions if did_.

The nuance here: when I’ve slipped and committed secrets, it’s typically a relative nothing burger: most common case is API keys to some third-party service. I’ve worked across a bunch of regulated industries and, within those, not caused a breach—because being in that space you know to be more careful, and because the companies in those spaces (wisely!) tend to support good security practices, more so than the industry average.

I think you have to look at it against the backdrop of so many people being fired and new employees being tasked with “urgent” projects across the government. It’s very plausible that the people who used to enforce all of the policies which would’ve preceded or contained this were either fired for political reasons or didn’t think they could tell someone to follow policy if it slowed them down.

> In fact I thought the government had long since gotten pretty serious about using smartcards and HSMs for everything?

They do use it for a lot, but there are a lot of things that need to authenticate to each other in a modern ecosystem, especially if you're trying to replace security based on network boundaries as trust boundaries with zero trust (as the government is).

I worked with more than a few IL4 systems where the PKI/smartcard stuff was simply shoved into an F5 that did TLS termination and then everything on the internal VPC just used HTTP headers without even a crypto signature to convey which user had actually logged in.

As with anything else, the more you make it easy to the do the right thing, the more often you tend to see the right thing being done. So agencies that make it easy to request server PKI certs see increased uptake, other agencies just have server-to-server auth done by PSKs / API keys instead.

So the concern isn't usually cost but compliance, if it's nearly impossible to get those little developer experience affordances ATO'd themselves, agencies will instead just focus on getting the mission system itself ATO'd come hell or high water and the devs just get told to piece it together however...

I worked for a bit in an org that was agglomerated into CISA. Let's just say PKI integration continues to be infeasibly difficult for most projects, especially small ones. (And cost is very, very much a concern. Be honest, do you want your taxes going into a project where it isn't?)

Not all "government" systems are the same. They're rated in terms of impact level and data classification. Classified systems can't be logged into outside of SCIFs anyway and have no outgoing connection to the Internet. Unclassified systems at IL5 require certificate auth with a government-issued smart card. IL4 requires endpoint attestation but can otherwise use normal username/password auth. Lower impact levels are not as heavily secured. I would have expected they at least require MFA to access the AWS API, but even that depends. A lot of times accounts will be split between production and non-production with MFA required on the production accounts, but work done purely for experimentation, platform development, or other non-user facing things that don't touch real data might not even be in GovCloud since the commercial accounts are cheaper.

Exactly. He's a Putin asset. Everything he does is either enriching himself and his ilk, or helping Putin.

It's staggering the country is just looking at him.

Correct, thank you, I can't edit now though. Fired in 2020, clearance revoked in 2025.

> Why did you forget this happened, Padilla?

because behind any senator there is a propaganda team, not a brain

with a breach, the data ends up in one group's hand but a leak means everyone gets access. Which would you rather have?

Yes, multiple times IIRC (my "they" was more general than a specific agency)

CISA, however, was the administration whose head was caught using an unauthorized commercially-hosted LLM for government data a few months ago:

https://cyberpress.org/cisa-public-chatgpt/

Yeah, that was OPM...twice.

They probably don't have systems in place to even detect that data was snorkeled off.

So "no indication" is completely correct.

See the trick is to not consider your data sensitive, no SENSITIVE data was leaked.