100 articles · Government · page 5 of 5
Articles
Week of 26 April 2021
Backups could not answer the D.C. police data leak
The Babuk group’s theft of Washington, D.C. police files in April 2021 showed agencies that extortion now ran on the threat of publication. Good planning starts by asking which data would hurt whom if released: the workforce, the mission or the public.
Week of 8 March 2021
One-time money, recurring bills: the Rescue Plan’s technology hangover
The American Rescue Plan handed state and local governments $350 billion of flexible, temporary money. Where it paid for technology subscriptions, the risk hid in three places: the shape of the funds, the shape of the costs, and contracts signed in a hurry.
Week of 1 March 2021
ProxyLogon: the patch was the easy part
Hidden flaws in Microsoft’s email server software set off a race to patch in March 2021. For public agencies, the damage was decided by three gaps no patch could close: seeing what faced the internet, hunting intruders, and owning the retirement decision.
Week of 8 February 2021
Oldsmar’s disputed hack, undisputed weaknesses
Nobody could later prove whether an outsider or an employee changed Oldsmar’s chemical setting. That uncertainty was itself the finding: small utilities need evidence that tells the two apart, safeguards that work whoever is at the controls, and public statements that survive revision.
Week of 1 February 2021
Accellion and the file transfer server nobody owned
The Accellion breaches reached government agencies through an aging file transfer appliance few senior officials could have named. File transfer sits between owners, budgets and inventories, which is why the same pattern kept returning through other products for years.
Week of 18 January 2021
Vaccine access hinged on open appointments nobody could see
Vaccine eligibility widened in January 2021 faster than states could show where doses were. Booking failed less because of web traffic than because of three ownership gaps: eligibility rules, appointments held in partners’ systems, and phone and community help treated as overflow.
Week of 14 December 2020
SolarWinds and the three assumptions behind every update policy
The SolarWinds Orion compromise broke three things agencies took for granted: that a signed update is a safe update, that monitoring tools are harmless plumbing, and that federal sensors would spot a national-scale intrusion. Only the second was quick to fix.
Week of 30 November 2020
Congress regulated connected devices by deciding what agencies may buy
The IoT Cybersecurity Improvement Act set no rules for device makers. Instead it set rules for one very large customer, the federal government, pushed security duties onto its contractors, and exposed an old problem: you cannot secure devices you do not know you own.
Week of 23 November 2020
Three things a delayed federal transition moved at once
The late start to the 2020 presidential transition squeezed a huge handover of people and their system access, records and accounts, and programs already running. Each needs its own playbook, written by career staff long before any election.
Week of 9 November 2020
Who may see the vaccination record: the negotiation behind the rollout
The first strong COVID-19 vaccine result turned a scientific question into a logistics one. For public agencies the hardest constraint was data: matching people without a national ID, agreeing who could see records, and connecting hundreds of new sources in weeks.
Week of 17 August 2020
Why the Postal Service slowdown belonged on agency risk registers
The August 2020 mail slowdown was covered as an election story. For agencies that mail notices, payments and medicines, it revealed something less visible: a critical dependency with legal deadlines attached and nobody inside the agency watching it.
Week of 10 August 2020
What NIST’s zero trust definition quietly required agencies to know
NIST’s zero trust guide is remembered for its diagrams. Its real legacy was a less visible list of things an agency has to know about itself first: its devices, its people, its data and its signals. No vendor could sell those.
Week of 22 June 2020
BlueLeaks: one small web host, hundreds of agencies’ files
BlueLeaks exposed years of law enforcement and fusion center files through the breach of one small web firm. Each agency had weighed its own modest contract; nobody had weighed the shared platform, the archive piling up on it or everyone who could log in.
Week of 8 June 2020
When vendors set facial recognition policy before agencies did
Within days in June 2020, IBM, Amazon and Microsoft stepped back from selling facial recognition to police. Agencies discovered their suppliers were setting AI policy for them, because few had their own inventory, use rules or contract terms.
Week of 11 May 2020
Every unemployment fraud control had a cost to real claimants
In May 2020, federal warnings about organized fraud against state unemployment systems pushed agencies to add identity checks to services already buckling under demand. Wherever they placed those checks, at application, before payment or after, someone legitimate paid part of the price.
Week of 13 April 2020
Why exposure notification apps rose or fell on the back office
Apple and Google settled the privacy design of exposure notification for health agencies. Whether an app helped came down to what agencies controlled: how fast positive tests produced codes, what alerts told people to do, and getting residents to switch it on.
Week of 16 March 2020
Hairpin traffic, distant data centers and the road to federal zero trust
As Washington sent its workforce home in March 2020, the bottleneck was not laptops but a network built to haul every connection back through the office. Fixing it moved federal security away from location and toward who you are and what device you use.
Week of 3 February 2020
Iowa’s caucus app failed at rollout before it failed in code
The Iowa caucus app had a coding error, but the public failure came from a hard installation, untrained users and a backup phone line nobody had sized. Every agency launch carries the same three operational risks.
Week of 27 January 2020
A 90-day declaration that ran for three years
The federal public health emergency declared on January 31, 2020, looked like a precaution. Then other powers, new laws and agency systems came to rest on it. Agencies needed to track what depended on it from day one, not when it ended.
Week of 13 January 2020
Why a Windows crypto patch was an asset inventory test
CISA gave agencies ten business days to fix a flaw in how Windows checks digital identities, on the very day Windows 7 support ended. Installing the fix was easy. Knowing which systems needed it, who owned them and how to prove it was hard.