100 articles · Government · page 3 of 5
Articles
Week of 29 January 2024
Why CISA’s Ivanti disconnect order was decided by people, before it was issued
CISA gave federal agencies about two days to unplug and rebuild their Ivanti gateways. The steps were written down; people decided who made it: who could approve cutting staff off, who could rebuild the devices, and each agency’s place in a contractor’s queue.
Week of 8 January 2024
Why the SEC’s hijacked account was most valuable the day before a decision
The fake bitcoin ETF post from the SEC’s X account landed one day before the real approval, when markets would believe it. Agencies whose words move markets or behavior should guard official accounts as privileged credentials, by the calendar and for the audience.
Week of 1 January 2024
For FinCEN’s beneficial ownership launch, the hardest design problem was shrinking
On January 1, 2024, FinCEN opened beneficial ownership filing to tens of millions of small companies while the law faced a constitutional challenge. A public obligation at that scale has four design problems, and the last one, how it shrinks, is rarely planned.
Week of 18 December 2023
When the FBI offers a decryptor: what ALPHV’s takedown asked of public agencies
In December 2023 the FBI disrupted the ALPHV ransomware gang and handed hundreds of victims a free decryption tool. Taking that help well meant three things few agencies plan for: checking the offer is real, using the tool safely and keeping legal deadlines.
Week of 30 October 2023
How OMB’s first AI memo reached AI systems agencies already ran
Days after the October 2023 AI executive order, OMB’s draft guidance told agencies that AI affecting people’s rights or safety must meet minimum practices by a deadline or be switched off. The hardest cases were systems already running, many hidden inside vendor products.
Week of 9 October 2023
Rapid Reset sorted agency websites into three groups, and one of them had no owner
A flaw in the web’s plumbing, disclosed in October 2023, produced record-breaking floods of traffic that the biggest providers absorbed unseen. Whether an agency’s public services were safe depended on which of three groups each fell into: rented protection, self-hosted, or unknown.
Week of 25 September 2023
Shutdown plans counted people; agency systems depended on contracts and expiry dates
The shutdown averted on September 30, 2023 still made agencies write plans for a funding lapse. Those plans counted people. But agency technology also depended on how each contract was paid for, what would expire mid-lapse, and how systems would restart afterward.
Week of 4 September 2023
Storm-0558’s post-mortem described three key failures every agency development team can repeat
Microsoft’s September 2023 post-mortem told a story of a signing key it believed slipped out in diagnostic data, tokens trusted far beyond their purpose, and a key that lived for years. Agencies that build their own software carry all three risks themselves.
Week of 14 August 2023
A weekend of public red-teaming showed agencies that AI testing never finishes
In August 2023, members of the public spent a weekend at DEF CON trying to make leading chatbots misbehave. It was a demonstration, not a certification. For agencies buying AI, testing is ongoing work before award, before deployment and in operation, limited by staff.
Week of 19 June 2023
Why a stolen DMV file weakened identity checks at agencies that were never breached
The MOVEit hack exposed the license records of most drivers in two states, and license numbers and issue dates stopped being secrets. Every agency that used them to check who residents were online inherited the breach, whether or not it ran MOVEit.
Week of 29 May 2023
Flat caps, rising subscriptions: how the debt deal squeezed federal IT from the inside
The 2023 debt deal held nondefense spending roughly flat for two years. Federal IT budgets did not shrink evenly: subscriptions and cloud bills grew on their own, modernization slipped by default, and technical staff thinned through attrition. Each needed its own control.
Week of 22 May 2023
Volt Typhoon left little to scan for, so agencies had to know their own normal
In May 2023 officials described a state-backed intruder inside US infrastructure that used everyday admin tools and hijacked home routers instead of malware. Catching it meant knowing what normal looks like, owning the network edge, and planning to run without a trustworthy network.
Week of 10 April 2023
Clearance, access and need-to-know: three controls the Discord leak pulled apart
A junior IT specialist with a valid top secret clearance shared secrets on Discord. He had the access but no need for the material. Why any organization holding sensitive data should treat access, monitoring and supervision as three separate jobs.
Week of 3 April 2023
Eligible but unreachable: Medicaid unwinding ran on contact data
With pandemic-era continuous coverage over, states had about a year to recheck Medicaid eligibility for tens of millions of people. Who kept coverage depended less on the rules than on data: renewing people automatically, reaching the rest and processing their replies.
Week of 27 March 2023
Why the spyware order put the burden on acquisition staff
Executive Order 14093 did not ban commercial spyware. It barred agencies from using tools that threatened US security or had been misused abroad, which meant the policy would stand or fall on the unglamorous work of agency lawyers, security staff and contracting officers.
Week of 9 January 2023
A deleted file, a national ground stop, and the runbook nobody rehearsed
The FAA’s pilot-notice system failed in January 2023, and the easy story was an aging system. The trigger was routine database maintenance that damaged both the main copy and the backup. For agencies running old mission systems, procedure, people and recovery design come first.
Week of 19 December 2022
The quantum law asked for a price tag agencies could only get from their vendors
A December 2022 law asked OMB to tell Congress what protecting federal systems from future quantum computers would cost. Most of that cost sat in products agencies did not build, so an honest answer depended on vendor roadmaps, contracts and replacement cycles.
Week of 21 November 2022
Banned from the market, still on the wall: the FCC’s equipment order and the installed base
In November 2022 the FCC stopped approving new equipment from Huawei and ZTE, and security gear from Hikvision, Dahua and Hytera. It left installed devices alone, so the real work moved to each agency’s own inventory.
Week of 12 September 2022
M-22-18 asked producers to sign; agencies first had to know who they were
In 2022 the White House told software makers selling to federal agencies to sign their names to how they build it. The form got the headlines. The lasting work was knowing who made your software, and deciding what their promises were worth.
Week of 5 September 2022
When a service portal is the target, the outage is the message
Iran’s attack on Albania’s online government services was after public embarrassment, not ransom. When disruption itself is the goal, agencies must keep a basic service visible, push back on the attacker’s version of events, and know who decides whether to name the culprit.