Flash Audit Alert - Archuleta actually gonna kick Big Blue out of .GOV?

The era of Big Government is... our era. By some estimates 40 million people work for it either directly or, more commonly, indirectly. It's just about 20% of the US national workforce. Not that you'd ever be able to calculate the leviathan by looking at Federal OPM numbers because they only count the direct employees - one's that have a paycheck cut from the treasury that says Federal Employee on it. But of course there are tens of millions more who work for the Federal Government - how many millions? About 21.5 Million. That's what Wired says anyway and it's so cute the way they phrase it:

"That breach affected some 21.5 million people—not only federal workers but friends, family members and others who were interviewed over the last twenty years for security clearance applications."

Umm, no, not "friends, family members and others" but contractors, off the books, Federal employees. One of the good things to come out of the recent OPM Cybersecurity Incidents is that it gives the American voter an accurate idea of how many people the Federal Government actually employs. WaPo is a little more honest than Wired:

"Sensitive information from at least 15 years of background investigations of 21.5 million employees, contractors and job applicants seeking security clearances, and their families, had been snatched. That was in addition to another theft, which seemed huge when it was first revealed on June 4 — personal data on 4.2 million employees,  including Social Security numbers. There was some overlap in the information compromised in each of the breaches."

I sincerely doubt they kept the "job applicant" info in the same database as the actual employees and contractors. And the term "some overlap" is ambiguous at best - outright deceptive in it's phrasing and implications.

The fall gal for this cybersecurity breach is political hack Katherine Archuleta who had no business running a mammoth Federal agency but was good at following orders and giving the current administration Hispanic props (old world, colonial Hispanic that is). There's been a lot of focus on what Archuleta didn't do to secure personnel files of Federal employees but according to her there's really no one to blame except the thieves themselves. She explained it all to Congressional oversight in June after theft #1 (the 4.2 Million):

“This is decades of lack of investments in systems that I inherited,” Archuleta responded.
She noted that even total FISMA compliance – an area with which OPM struggled – might not have guaranteed safety from a breach.
OPM’s vulnerability could not be attributed to any one person, Archuleta claimed, though she did assign guilt for the breaches.
“If there’s anyone to blame, it is the perpetrators,” she said.
But at OPM, “I don’t believe anyone is personally responsible,” Archuleta stated.

Translation: My department want's to spend more money. We are not compliant with the Federal Information Security Management Act of 2002 and you can't you blame us, just look at all the crap you've got to implement (And that 2002 is not a typo - the law has been on the books for 13 years - THIRTEEN YEARS PEOPLE!). There is no personal responsibility which is, of course, absolutely true of OPM as it is with every Federal Agency in the Administrative State. Kate Archuleta doesn't know how to secure employee data - hell, she probably doesn't understand a thing about IT infrastructure and security and she wasn't appointed to implement any of that FISMA gobbledygook. She was appointed to award contracts baby, and those contracts are to go to "friends" of the administration. So let's look at what Archuleta DID do.

"Our primary concern is that the OCIO has not followed U.S. Office of Management and Budget (OMB) requirements and project management best practices. The OCIO has initiated this project without a complete understanding of the scope of OPM's existing technical infrastructure or the scale and costs of the effort required to migrate it to the new environment.
In addition, we have concerns with the nontraditional Government procurement vehicle that was used to secure a sole-source contract with a vendor to manage the infrastructure overhaul. While we agree that the sole-source contract may have been appropriate for the initial phases of securing the existing technical environment, we do not agree that it is appropriate to use this vehicle for the long-term system migration efforts."

So Archuleta awarded a sole-sorce contract to some company ("which one?" you might ask and good luck finding the answer) and that contract "involves hosting OPM systems in two commercial data centers" ("what data centers?") and will have "no mainframe or legacy applications". Which means kicking out established vendors with Big Government contracts - Green Field my friends, no legacy infrastructure at all and THAT is what SHE did. Putting aside the fact that her department could not implement security measures that have been implemented by other agencies over the past decade and that mainframe computers are the most secure IT environments available there is the fundamental question of why OPM keeps all this info in one place so that if some Chinese hacker were to get access they would be able to get ALL the sensitive info on ALL government employees.  Oops! Sorry you pasty faced saps, but you probably voted for this hope and change in '08 and '12 so blame the perpetrators - I know you won't blame yourselves.