It's so often the guys that are at the top who are the exception to the rules that are the problem.
I knew some folks who worked military communications and they broke rules regularly because senior officers just didn't want to walk across the street to do something secure...
Have worked in places where juniors had to lock devices when on prem; only authorized hardware in the rooms. Yet, the danger was from sloppy O6+ not the O1/GS6 who would (ready&abel) carry the water.
The is a serious problem with folk with power and authority and somehow no responsibility.
> The is a serious problem with folk with power and authority and somehow no responsibility.
Or perhaps the fundamental problem is with people in general - perhaps people without power and authority follow rules only because they don't have the power and authority to ignore them.
In the 00's, DIA had episodes of career researchers watching porn from secured and monitored systems and then losing their jobs and clearances. One can only conclude they wanted to be fired or were really, really stupid.
It’s absolutely necessary to have ChatGPT.com blocked from ITAR/EAR regulated organizations, such as aerospace, defense, etc. I’m really shocked this wasn’t already the case.
Unfortunately it’s not so shocking anymore. The Secretary of Defense texting imminent war plans to a journalist in a Signal group kinda jumped the shark.
There’s something in a dead reply that's a popular enough myth that its worth responding to:
> Something every single soldier and officer learns is that the entire department was previously called the Department of War. It was repackaged after WW2 as the Department of Defense when invading countries half-way around the world began being sold to the public as 'defense.'
This is a weirdly common belief, but it is not true. Up through WWII, the US had two cabinet level military departments, instead of the current one. Those two departments were the Department of War, under which was the Army, and fhe Department of the Navy, under which was the Navy and Marine Corps.
This was changed by two laws in the late 1940s. The first, the National Security Act of 1947, among other things:
* Split the Air Force and Army from each other, splitting the Department of War into two new cabinet-level Departments, the Department of the Army and the Department of the Air Force.
* Created an additional cabinet level Secretary of Defense to coordinate the combined military structure, which it called the National Military Establishment.
This was followed by the National Security Amendments Act of 1949, which:
* removed the Secretaries of the Army, Navy, and Air Force from the Cabinet and formally subordinated them to the Secretary of Defense
* renamed the National Military Establishment (which was frequently referred to by the inconveniently-pronounced, for its role, initialism NME) the Department of Defense (which conbined with the preceding point is the source of the unusual departments-within-a-department structure of the DoD.)
The Department of War did once exist, but it was never a name for the same thing as the Department of Defense. It was one of two coequal entities that were subsumed by the National Military Establishment, the only reason it still doesn't exist as a subordinate entity within the NME, now DoD, like the Department of the Navy does is that it was split in two.
It was always called the Department of War [1] from 1789 until 1947. At that point it was repackaged as the Department of Defense when we started framing invading countries half-way around the world as 'defense'. Prior to that rhetoric around war was far more honest. We tried to buy a sizable chunk of Texas from Mexico. They rejected our offer so we invaded and took it, because we wanted it.
It's only in 1947 and later that somehow invading countries half-way around the world and shipping weapons to anybody with a buck began being framed as 'defense' or somehow saving the world from whatever - tyrant, terror, communism, burdens of oil, and so on. So in many ways I think it would be far more apt to say that 'Department of Defense' is the cutesy name. They're not defending anything - nukes and geography take care of that, more or less, on their own.
> It was always called the Department of War [1] from 1789 until 1947.
No, what became the Department of Defense didn't exist from 1789 until 1947. The cabinet level Department of the Navy (current Department of the Navy) and the cabinet-level Department of War (later split into the current Department of the Army and Department of the Air Force) did, as separate, co-equal entities with no single civilian head over them beneath the President.
The National Military Establishment under the cabinet-level Secretary of Defense was created as a unified military structure in 1947 over both the Department of the Navy (which remained a cabinet-level department) and what had been the Department of War (which was split into the cabinet-level Departments of the Army and the Air Force). And in 1949 the three service departments were fully subordinated within the NME instead of being cabinet level, and the NME was renamed the Department of Defense (pribably not entirely because it was really awkward having the combined military organization use an initialism that sounded like “enemy”, but...)
All you are describing is a restructuring of which the Department of War had gone through repeatedly throughout its history. It's not like it had the same structure, or anything remotely like it, in 1942 as in 1789. The choice of the name was, as you observe, a choice. And it coincides exactly with the move away from public honesty in international relations and events.
You have things like WW1 being framed (at the time) as 'The War to End All Wars' but I think that was probably naivete whereas after we started calling war 'defense' we entered into the era of 'police actions' instead of wars, like the Korean War, and outright false flags such as the Gulf of Tonkin Incident for Vietnam. All the while the CIA was running around acting like a rabid chimp all across the world. It was entering into an era where deceiving the public became standard operating procedure, of which framing war as defense was but one typical aspect.
I believe we are now leaving that era, and I think that is a good thing for everybody.
> All you are describing is a restructuring of which the Department of War had gone through repeatedly throughout its history
No, from 1789 to 1947 there were two separate cabinet-level departments, War and Navy.
> It's not like it had the same structure, or anything remotely like it, in 1942 as in 1789
Internal to the two cabinet-level departments? Probably not.
At the cabinet level? There was exactly the same structure: the Department of War with the Army underneath it and the Department of the Navy with the Navy and Marine Corps.
The War Department did not become the Defense Department.
In 1947 War was split into Army and Air Force, and a fourth cabinet secretary, the Secretary of Defense was added, heading the combined National Military Establishment that was created over both what had been the War Department and what still was the Navy Department (all still cabinet level departments). In 1949, the three service secretaries (two of which headed parts of what had been the War Department) were formally subordinated to the Secretary of Defense and the NME was renamed the Department of Defense. The Department of War was direct predecessor to the Departments of the Army and Air Force, not the Department of Defense, which was a new level of coordination interposed between the President and the formerly organizationally-separated services.
This is inaccurate. The Department of War initially had oversight over the Navy as well. The separation of the Navy into a separate department (which did not even exist at the time when the War Department was created) was one of those many restructurings it went through, without ever having a name change until we entered the era of deception.
Sure. That doesn't mean denying access to ChatGPT though - the way I see it, the entire value proposition of Microsoft offering OpenAI models through Azure is to enable access to ChatGPT under contractual terms that make it appropriate for use in government and enterprise organizations, including those dealing with sensitive technology work.
I mean, they are all using O365 to run their day-to-day businesses anyway.
I used to work in a large technology multinational - not "tech industry", but proper industrial technology; the kind of corp that does everything, from dishwashers to oil rigs. It took nearly a year from OpenAI releasing GPT-4 to us having some form of access to this model for general work (coding and otherwise) internally, and from what I understand[0], it's just how long it took for the company to evaluate risks and iron out appropriate contractual agreements with Microsoft wrt. using generative models hosted on Azure. But they did it, which proves to me it's entirely possible, even in places where people are more worried about accidentally falling afoul of technology exports control than insider training.
--
[0] - Purely observational, I had no access to any insider/sensitive information regarding this process.
ITAR, yes, but there's no such thing as a person or organization that's not EAR-regulated. Everything exported from the US that's not covered by ITAR (State Department) is covered by EAR (Department of Commerce), even if only EAR99.
I really enjoyed unchecking all those cookie controls. Of the 1668 partner companies who are so interested in me, a good third have a "legitimate interest". With each wanting to drop several cookies, it seems odd that Privacy Badger only thinks there are 19 cookies to block. Could some of them be fakes - flooding the zone?
The same cookie can be shared with several partners or collected data can be passed to the partners.
It's not a cookie law — it's a privacy law about sharing personal data. When I know your SSN and email address, I might want to sell that pairing to 1668 companies and I have to get your "consent" for each.
I for one, after doing a bit of reserach, was shocked to find out the person in question is apparently completely unqualified for the job (if him pasting sensitive information into public ChatGPT didn't already make that abundantly clear). But the highlight from his Wikipedia page is this one:
>In December 2025, Politico reported that Gottumukkala had requested to see access to a controlled access program—an act that would require taking a polygraph—in June. Gottumukkala failed the polygraph in the final weeks of July. The Department of Homeland Security began investigating the circumstances surrounding the polygraph test the following month and suspended six career staffers, telling them that the polygraph did not need to be administered.[12]
So the guy failed a polygraph to access a highly controlled system full of confidential information, and the solution to that problem was to fire the people in charge of ensuring the system was secure.
We're speed running America into the ground and half the country is willfully ignorant to it happening.
> Do I have to go through the polygraph test to join CSIS?
> Yes. All CSIS employees must obtain a Top Secret security clearance and the polygraph is a mandatory part of the process.
Seems to be the same for CSE and to get "Enhanced Top Secret" clearance.
Back to the US, the Department of Labor says that private employers can't force people to undergo a polygraph test: https://www.dol.gov/agencies/whd/polygraph
But of course this does not apply to public sector jobs, where it's used more pervasively.
And an MBA. He seems like a lot of people I know who skim through their technical degrees just to get the credentials. And my experience is that Masters is often easier to get than a Bachelors.
Anyway what he did makes it abundantly clear that this person should not be head of security for anything.
It's bizarre that someone would choose to use the public, 4o bot over the ChatGPT Pro level bot available in the properly siloed and compliant Azure hosted ChatGPT already available to them at that time. The government can use segregated secure systems set up specifically for government use and sensitive documents.
It looks like he requested and got permission to work with "For Unofficial Use Only" documents on ChatGPT 4o - the bureaucracy allowed it - and nobody bothered to intervene. The incompetence and ignorance both are ridiculous.
Fortunately, nothing important was involved - it was "classified because everything gets classified" bureaucratic type classification, but if you're CISA leadership, you've gotta be on the ball, you can't do newbie bullshit like this.
today FOUO or CONFIDENTIAL, maybe tomorrow or next week SECRET and after that seemed fine maybe some TOP SECRET or throw in a SAP for fun! call it the maralago bathroom
the current united states government is staffed mostly with unserious people, or people who are serious about doing crimes against humanity. there's very little in between.
And who've been subjected to a firing spree I wouldn't wish on my worst enemy. It's the political appointees that are, frankly, there because of the connections and their willingness to, say, "work towards the ultimate leader".
This is a "Cybersecurity chief" causing an intern-level IT incident.
In many industries, this would be a rapid incident at the company-level and also an immediate fireable offense and in some governments this would be a complete massive scandal + press conference broadcasted across the country.
Then again the CTO of Crowdstrike that had their anti-malware code update cause huge problems, is the same guy that was CTO of McAfee when their AV code update, caused huge problems.
No but they could have easily created the culture that massively increased the probability of such mishaps... we have all seen how not OK work environment negatively affects deliveries right, or read about boeing fiasco(s).
Not an insider just to be clear here so maybe just really bad luck. But no benefit of doubt for the third strike.
Yay, on-premise llms are what is recomended for serious use, at least US gov thinks that :) But rest of us need to pay subscriptions for 3r party businesses passing back and forth our... everything ?
In old days ppl was saying: "I have no secrets" and now we evolved into "I know how to not upload important docs" ;)
There have to be GovCloud only LLMs just for this case.
I swear this government is headed by appointed nephews of appointed nephews.
I keep thinking back about that Chernobyl miniseries; head of the science department used to run a shoe factory. No one needs to be competent at their job anymore
> [ChatGPT] is blocked for other Department of Homeland Security staff. Gottumukkala “was granted permission to use ChatGPT with DHS controls in place,” adding that the use was “short-term and limited.”
He had a special exemption to use it as head of Cyber and still got flagged by cybersecurity checks. So obviously they don't think it's safe to use broadly.
> So obviously they don't think it's safe to use broadly.
More likely, everything gets added to the list because there shouldn't be false positives, it's worth investigating to make sure there isn't an adjacent gap in the security systems.
Somehow I think that the weak link in our government security is at the top - the President, his cabinet, and various heads of agencies. Because nobody questions what they're allowed to do, and so they're exempt from various common-sense security protocols. We already saw some pretty egregious security breaches from Pete Hegseth.
I have never worked in a company where an obviously incorrect CEO-demanded security exemption (like this one) would have been allowed to pass. Professionalism, boards (with a mandatory employee member/representative, after some size) and ethics exist.
30 years in about 8 software companies, Northern Europe. Often startups. Between 4 to 600 people. When they grow large the work often turns boring, so it's time to find something smaller again.
I’m in the US, SE since 1998, startups to multinationals. What the GP said holds true for me too. There are serious professionals in the world - I don’t know why some people want to drag every one else down to the level of the current US administration- they are exceptionally inept.
CTO at a successfull cybersecurity startup I worked at long ago was exempt from critical security updates. She refused to restart her computer out of fear for her Excel state.
I used to work devops for a startup. The _only_ person who was exempted from 2-factor auth was the CEO. It's the perfect storm: a tech illiterate person with access to everything and the authority to exclude himself from anything he finds inconvenient.
Why would you? He’s literally the only person ostensibly in charge of the direction of the company. Destroying the company through a security exemption or a bad business deal - both are the leader making a poor decision due directly to his seat of power.
Give sound advice of course, but ultimately it’s the exec’s decision make.
There are many reasons to deny a CEO ... in a good company structure such denials are circled back around to the board for review.
Case in point: Allowing a CEO with no flight training to "have the keys" to the company <rare, expensive, uniquely outfitted, airframe> because they want to take it for a spin.
Sheparding Royalty in Monarchies has been a neccessary, delicate, loaded, and life threatening role for centuries.
Being a C-suite Groom of the Stool isn't a happy job, but somebody has to do it.
No, it isn't - it's an asset owned by the company and shareholders - a CEO is an appointed or elected officer.
> To be clear, I’m referring much more to CEO/owners
Owners are what you are talking about. CEO / Owners are Owners and can act like owners.
That said, even owners need to be herded like cats when they are making bad decisions that impact tens of thousands of people on the basis of hubris and feels.
Somebody has to toss them shiny keys until the moment passes and they can make rational choices again.
Been there. The CEO of an internet security company was the one who clicked on the wrong email attachment and turned a virus loose.
I mean, I don't know if he had a security exemption, or if anyone who clicked on it would have infected us. But he was the weak link, at least in that instance.
whether he is personally and directly responsible for this specific incident, his leadership absolutely sets the tone for the rest of the federal government.
Humans generally find "food safety expert sickens guests with tuna salad he left out overnight on warm countertop" to be a far more damning charge than "fire safety expert sickens ... warm countertop".
Dig up a live mic catching Hillary calling the IOC a bunch of self-serving scum just as Obama was begging them to award the 2016 Olympics to Chicago, and we might call it comparable.
> No one needs to be competent at their job anymore
That's actually the whole point. Placing incompetents in positions of authority means they know absolutely to whom they owe their loyalty. Because they know they would never have that job on merit. And since they don't really know how to do the job, they have no moral qualms about doing a poor job, or strong opinions on what they should be doing -- other than whatever mission their patron has given them. It's a tool used by weak leaders and it's unfortunately very effective.
Make the government look so incompetent that it is a no brainer to let a private company (headed by your friends and family of course) to do the important jobs and siphon resources much more effectively.
> I swear this government is headed by appointed nephews of appointed nephews.
No joke, the previous head of the State Department task force tasked with fighting corruption and nepotism in international contracting was named Rich Nephew. (He's a very talented career civil servant and I mean no shade I just find that hilarious.)
It is perfectly plausible that someone from a shoe factory would end up in that guy’s position. He would just have been running the factory, not making shoes.
Guess what this administration would love to do with nuclear facilities...
Any time you have to include "competent" in a description of a job or related technology, that's a clue that it needs requisite oversight and (possibly exponetial) proportionate cost.
And when you get to the top, you actually experience how the shoe is on the other foot. One should get out early, not waiting for the other shoe to drop.
Of course this comment is mostly ironic, but noting for the whole class, when the MAGA talked about DEI they only ever meant ethnic and sexual minorities, competence be damned!
That is of course the thing about ideologies like it: loyalty before all else.
DEI at its worst is exactly what you say. (At its best, it's "we hire for abilities, but we also look for abilities in non-traditional people".
But, even though that's what DEI can be, not all "someone got a git not because of ability" is DEI. Cronyism, racism, and sexism all do that, too.
In the case of this administration, I think the traditional term is "yes men" - people who are hired not for ability, but because they will not say no to the boss.
They say that most fascist governments fall apart because they actively despise competence, which it turns out you need if you are trying to run a country.
I once read an interesting book on the economy of Nazi Germany. There were a lot of smart CEOs and high ranking civil servants who perfectly predicted US industrial might.
They say it, but they're wrong. Historically speaking there have been basically about 2 fascist governments, and they fell because they lost wars. And Germany, for one, did run them with high competence, to the extend that it took years for many countries to do anything about.
It we loosen "fascist" to just mean any authoritarian government, there are many that run of very long time.
WWII started in 1939 and was done in early 1945, so it didn't take that long.
More importantly, maybe the Nazi's were competent at first, but they absolutely fell apart internally due to mistrust, back stabbing, and demanding of loyalty above all else. Hitler famously made many poor military decisions.
Bob Lazar claims he was allocated in this project where not only they found working device capable of emiting gravitational waves out of phase with earth gravitational waves, but they achieved the same effect bombarding a mysterious unknown at the time element. He called the material element115 (the logical guess, element 114 properties was known/was synthesized), while emiting one proton and decaying back to element 115 the effect was achieved.
Apparently he was in fact allocated on a top secret project at los Alamos and his expertise was alternative propulsion back everything else is folklore, but it is deep folklore if you're interested in conspiracy theories
I wonder how far removed the interim director of the CISA is from any real world security. I bet they have not seen or solved any real security problems and merely are an executive looking over cybersec. This probably is another example of why you need rank and file security peeps into security leadership roles rather than some random exec.
I would like to be able to say that it is uncommon, but based on what I am seeing in my neck of the woods, all sorts of, one would think, private information is ingested by various online llms. I would have been less annoyed with it had those been local deployments, but, uhhh, to say it is not a first choice is being over the top charitable with current corporates. And it is not even question of money! Some of those corps throw crazy money at it.
edit: Just in case, in the company I currently work at, compliance apparently signed off on this with only a rather slim type of data verbotten from upload.
The Dept of Homeland Security has had its own internal gen-AI chat bot since before Trump took office [0]. That this guy couldn’t make do with that, and didn’t think through the repercussions of uploading non-public documents to a public chatbot doesn’t bode well for his ability to manage CISA
I adore that this guy had security clearance and I doubt I'd clear that bar. Last time I looked at the interview there was a question:
> have you ever misused drugs?
and I doubt I'd be able to resist the response:
> of course not, I only use drugs properly.
also I wouldn't lie, because that's would undermine the purpose. Still sad I can't apply for SC jobs because I'm extremely patriotic and improving my nation is something that appeals.
FWIW I have held a security clearance during my career, and telling them I smoked weed was not a dealbreaker. What they are ultimately looking for is reasons why you could be coerced into divulging classified information. If you owe money due to drugs/gambling, etc, that's where it becomes a dealbreaker.
The general rule is not to lie to them, because they will interview all your friends and someone somewhere will rat you out. It’s pointless to try to hide anything during these interviews, and, if you do it, then it’s a dealbreaker.
Yeah, this is true. They are looking for vulnerabilities that can be exploited by others - the fact you smoke a blunt once a week is not a problem in that regard.
You can see an archived list of industrial security clearance decisions here [0] which is interesting, and occasionally entertaining, reading. "Drug involvement security concerns" usually involve either actively using drugs or, worse, lying to cover up drug use, both of which are viewed as security concerns and grounds for rejection.
Because this is a thing I’ve heard. You can check and verify it yourself. I went to a CIA recruiting event when I was in university and this is what they told me, I assumed it was true but that’s why I caveated it. I shared it so the OP could do their own research since they seem to have even less information.
Can you clarify your own experience to help the OP?
Current use is still a problem AFAIK (not sure on weed).
That said I can confirm that a few years back a friend who had previously used/experimented with a wide variety of substances (EDM scene, psychs), had no trouble getting a clearance.
They disclosed all of it, said they weren't currently using it and wouldn't for as long as they were in the job role, passed the drug test, and that was fine.
That said, to add to the "lying is a bad idea" point: I believe some of their references were asked about if they'd ever known that friend to have a dependency + if they were aware of any current/very recent use.
OC had a point. If you take drugs in the way they are intended to be used, you can say no with a clear conscience. Whether the interviewer will accept that if they later find out you took drugs, I couldn't tell you.
how is it low IQ to be honest? People have to make decisions and if the decision is "no", I can handle that. Empowering the person making the decision to the fullest extent is something I'd still be interested in, even if it is to my detriment. Its like when middle-management ask me to lie or withold information from the COO or CEO, its just a no. If they're shit then its on the organisation to sort that out. Second guessing everything leads to even worse dysfunction.
We're not talking about sneaking into a concert or something low-stakes, the security of our nation is the foundation of our very civilization. I have dual citizenship of a nation that borders Russia and was once the USSR, so I appreciate the stakes of worst case scenarios because one of my nations was under that boot rather recently.
He graduated from Andhra University with a bachelor of engineering in electronics and communication engineering, the University of Texas at Arlington with a master's degree in computer science engineering, the University of Dallas with a Master of Business Administration in engineering and technology management, and Dakota State University with a doctorate in information systems.
And he still manages to make a rookie mistake. Time to investigate Mr. Gottumukkala's credentials. I wouldn't be surprised if he's a fraud.
And in all manner of regulated industries. People simply cannot resist throwing anything and everything at the magic text machine. A company can control its IT assets, but if the content is displayable on a screen, rest assured users will just take photos and upload to their personal LLM accounts to get the generative answers they endlessly desire.
I’m actually shocked that security teams aren’t up in arms over this exfiltration of company secrets. I know some companies that are running their own models and agents but the vast majority are copilot/claude/codex’ing away sending all that sweet sweet IP to 3rd parties
You can get agreements with all of the providers around data sharing etc and host the models themselves through AWS or another cloud provider. That's what clueful companies are doing, as expecting people not to use this stuff is doomed to fail.
Same, I want to believe that this is all a ruse and that the are smart and just really good at playing dumb, but there are just too MANY of them.
It's sycophancy plain and simple. Surround yourself with only yes-men, it ends up becoming less and less competent as the ones who stand up and say no are replaced.
Even if they know better, they can't do better because they know there is no loyalty to nay-sayers.
The main thing is that if you're a big enough entity, in favorable enough conditions, it's possible to make stupid decisions continuously and survive them for a very long time.
It's the "market can remain irrational..." problem.
And as a consequence, never recognize them as being stupid---in fact the reverse, because your bad ideas are met with macro success even while individually they may struggle.
The simpler explanation is that all the competent people saw what happened the first go around and want nothing to do with it. That leaves a detritus of sociopathic wannabes to select from for staff, all vying to mirror the behavioral profile of dear leader.
Not really. It is far easier to explain incompetence in powerful positions than to explain competence on purpose in powerful positions - the latter is definitely a conspiracy, the former is not.
It's not uncommon for incompetent people to be put in positions of power. Because they are incompetent, competent but malicious people take advantage of this and commit actual crimes.
This is where actual conspiracies show up. And that is the incompetent powerful people cover up said crime to avoid looking incompetent.
When Donald Trump saw the footage of the murder of Renee Good, he said "Oh". He didn't know what ICE were doing until then. He trusted his cabinet who were telling him they were getting illegal immigrants and left wing terrorists.
No, he did not trust his cabinet at all, which is why he put a bunch of yes men in place to ensure they fucked up and did the dumbest thing.
DT has had a long history of operating like a mafia boss where the design of the people he chooses around him is to put scapegoats on when the criminal activities he's involved in is caught.
He chose people who give him good emotions, because he has dementia. He didn't know that would mean they would screen the world from him, because he has dementia. If he did know that, he wouldn't understand it because he has dementia.
Unfortunately for Maduro, that operation was run by military professionals rather than directly by Trump's lackeys. But give Hegseth enough time and he'll bring them around to the new standard.
When I saw mention it was in context of a “contracting” type set of info / document I actually chuckled - I spent a decade in procurement and sales for high stakes contracts. Incompetent person has no idea how to manage a procurement and goes online. Basically this is a 2026 version of an inept executive bashing “what is an RFP” into a search engine from 2007.
And when the CCP compromised the law enforcement portal for every American ISP, stealing info on 80% of Americans, including both the Kamala and Trump campaigns, under the previous admin it was rock solid op-sec, presumably.
Or when the previous admin leaked classified Iran attack plans from the Pentagon, so bad that they didn't even know whether they were hacked or not.
You can at least pretend to make a technical argument over a political one.
Source? I cannot find anything suggesting that law enforcement agencies operate the portals. They are mandated by law and used by law enforcement, but operated by the telecom providers.
From [0]: “Last year almost a dozen major U.S. ISPs were the victim”, “the intruders spent much of the last year rooting around the ISP networks”, “telecom administrators failing to change default passwords”, “Biden FCC officials did try to implement some very basic cybersecurity safeguards, requiring that telecoms try to do a better job securing their networks”. Per the original topic, the article goes on to explain how the Trump admin destroyed those little security steps.
I’m okay with some both-sidesing of bad opsec, but I think you’re incorrect on the blame in this story, and to the extent it is the government’s responsibility, the Trump II response was worse than the Biden’s.
You're the one making a political argument by doing a whataboutism that attempts to negate the failings of this administration. Which you're not even doing correctly because by every measure the previous administration was drastically more competent by looking at the qualifications of the people who filled their posts.
Can you explain how leaking the phone metadata of 80% of Americans and compromising the integrity of the 2024 election campaign's private comms is better OpSec than a single leak?
It's the worst U.S. government leak of all time, by far.
What do you think of https://electiontruthalliance.org/ ? I haven’t deeply read their stuff, and I’m not really qualified to evaluate their statistics, but it seems like there are concerns worth following.
Is your position that the 2024 election, despite having a foreign power intercept the phone communications of both campaigns (confirmed and on record), had no integrity compromises?
What do you consider a compromise of integrity if not a hacking of political campaigns?
Also, please clarify whether the 2016 DNC hack is an exemption to your prior answer so I can weigh your bias.
Why don't you enlighten us since you seem to know so much about the topic?
I know that none of the people who are experts at detecting the statistical artifacts that appears during voting roll have questioned the integrity of the US election.
In fact the only people questioning it are conspirancy-minded people who don't know that there are robust methodologies to detect election fraud.
If they are so leaky then why were they able to capture Maduro without a single American casualty? On one hand you claim incompetence and yet no one was tipped off. So maybe the Signal group chat wasn't as important as it was made out to be?
Lol. The Maduro operation did leak, but the press held the story. Rubio said “Frankly, a number of media outlets had gotten leaks that this was coming and held it for that very reason, and we thank them for doing that, or lives could have been lost.” https://www.npr.org/2026/01/05/nx-s1-5667060/media-shows-res...
You have to actively maintain a state of ignorance to say this isn’t different. Go look at all of the public reporting starting in January about the way appointees in the Pentagon, DOGE, etc. blew through the normal policies and procedures controlling access, clearing people, or restricting sharing.
For example, this wasn’t just “oops, I used the wrong number” but Hegseth getting a custom line run into a secure facility so he could use a personal computer of unknown provenance and security:
That’s one of the reasons why one of the first moves they made was to fire CISOs and the inspectors general who would normally be investigating serious policy violations.
This isn’t “big government”, it’s the attitude that the law is a tool used to hurt their opponents and help themselves but never the reverse.
> Reviews of decades of scientific research suggest that polygraph tests are not reliable or accurate enough to be used in most forensic, legal or employment settings.
> Although lying can cause the physiological responses measured by polygraph machines—such as sweating and increased heart rate—those same changes can occur even when people are not lying, for example when they are nervous.
He was the 'CTO' of South Dakota and later the CIO/Commissioner of the South Dakota Bureau of Information and Telecommunications under governor Kristi Noem.
Edit: (From a European perspective) it seems like the southern states really took over the US establishment. I hadn't really grasped the level of it, before.
> Edit: (From a European perspective) it seems like the southern states really took over the US establishment. I hadn't really grasped the level of it, before.
It's good to know the Americans aren't the only ones who never look at maps outside their own country
South Dakota has a population of less than 1 million people and the complexity of a CTO job of a state like South Dakota would be quite low. It is < 0.3% of the US Population and likely has de minimis benefit programs.
South Dakota is in the northern portion. But to your statement, historically speaking the southern states after the civil war kept trucking along in terms of power and influence.
The Dakotas weren't really north/south in the Civil War context; only about 4k people lived there in 1860. It was largely empty land, and not a state until 1889.
I am so happy that my embarrassing lack of geographical knowledge of the US states' internal geographies amused you. A good laugh is great for your health, I've heard.
At least I know where your country is located.
Now, let me quiz you on the geographical locations of French regions? Or perhaps Finnish regions, if that's something you work closer with, day-to-day?
> In April 2025, secretary of homeland security Kristi Noem named Gottumukkala as the deputy director of the Cybersecurity and Infrastructure Security Agency; he began serving in the position on May 16. That month, Gottumukkala told personnel at the agency that much of its leadership was resigning and that he would serve as its acting director beginning on May 30.
The polygraph is still used for security vetting, today. No word on whether they still read a lamb's entrails for portents or consult the dead with a Ouija board.
These days I think that thing's main purpose is to bounce people who would otherwise request access that they don't really need. If it isn't worth sitting down for the machine you don't really need it.
> Gottumukkala failed the polygraph in the final weeks of July. The Department of Homeland Security began investigating the circumstances surrounding the polygraph test the following month and suspended six career staffers, telling them that the polygraph did not need to be administered.
More context is that he was promoted under Noem in her old job too, just before the Presidential election.
> On Tuesday, Gov. Kristi Noem announced Gottumukkala's appointment as CIO. In a statement, she said he will prioritize the state’s citizens, their data and government service delivery.
This is what you get when you prize personal loyalty over competence.
This issue is the one thing that gives me some hope that they can be ousted -- they are collectively too stupid and motivated only by their self interests to hold their power indefinitely.
> Cybersecurity monitoring systems then reportedly flagged the uploads in early August. That triggered a DHS-led damage assessment to determine whether the information had been exposed.
So it means, a DLP solution, browsers trusting its CA and it silently handling HTTP in clear-text right?
If I did this with a banal internal documentation at work I would be written up and maybe fired over breaking known policy. This administration is so ridiculously incompetent, and interim head of cyber security.. leaks. The onion wouldn't write this.
I’m a little surprised by the takes in the comments. Obviously, heads of departments or agencies, CEOs, or similar personnel are generally not in the same league as normal employees when it comes to compliance.
Productivity and efficiency are key for their work. I am sure there are lots of Sysadmins here, that had to disable security controls for a manager or had to configure something in a way to circumvent security controls from actually working. I have been in many situations where I have been asked by IT colleagues if doing something like that was fine, because an executive had to read a PowerPoint file NOW.
Sysadmins are afforded special leniency because of their demonstrated competence. Their leeway is earned. In this case, the "cyber security chief" has no proven skill other than absolute loyalty to his boss, which justified his skipping the usual vetting procedure.
Obviously those kinds of stories are common, but you can’t seriously be suggesting that it is a good or acceptable thing?
Execs are just as stupid as your average person and bypassing security controls for them puts an organization at an even greater risk due to the kinds of information they have access to. They just get away with it because they’re in charge.
It touched a nerve because no one in the trump admin is qualified to do their job. There's a lot of corruption and a lot of people getting access to things they shouldn't due to their relationship and loyalty, not merit. There's a big difference from a sys admin having super user access and some random politically connected hack abusing their privilege.
In any enterprise, normal would be to have monitoring on all ingress and egress points from the network and on devices themselves. You can't only have monitoring on managed devices because someone might BYOD and plug in an unmanaged device/connect it to internal wifi etc.
You bring in vendors and they need guest wifi to give you a demo, you need to be able to give them something to connect to but you don't want that pipe to be unmonitored.
What I'm really asking/wondering is how (and who or which party) figured out that this was leaked, and secondly how that propagated to the public. I don't really expect to find that answer. But if I had to guess OpenAI found out first, because employees there are more likely to leak the fact that the leak happened.
But also, how was it caught in the first place? Was it automatically flagged because content scanners automatically identified this as a concern, or was his account specially flagged for extra monitoring because of who he is?
it says "according to four Department of Homeland Security officials with knowledge of the incident." and "according to the four officials, each of whom was granted anonymity for fear of retribution." .. so It seems to be an internal lead.
as the post above says.. on managed devices, there can be an enforced vpn, that monitors all traffic coming and going, and while its at it, strip out the encryption and look inside the packets, and apply heuristics like .. what is the host domain, is it from a known LLM site.. and is its a POST message sending data, and then does the text of that data have a string matching "INTERNAL USE ONLY". I assume something like this.
> Once again, if you or I did this, it's federal crime and federal time.
For a single incident? I doubt it. And, you need to show (criminal) intent. We still have no idea if this was accidental. To be clear, before this incident, he looked like just another senior IT admin. I still see it that way.
I Googled for "cisa employment nationality requirements". I got a bunch of pages from CISA itself about how to apply for various jobs: recent grad, experienced specialist, and military vet. All have a bold statement under eligibility that says: "US Citizenship is required." It think it is safe to assume that Dr. Madhu Gottumukkala is a naturalised US citizen.
> None of the files Gottumukkala plugged into ChatGPT were classified, according to the four officials, each of whom was granted anonymity for fear of retribution. But the material included CISA contracting documents marked “for official use only,” a government designation for information that is considered sensitive and not for public release.
Guys... we're talking about FOUO. Not even low-level classified. This is a nothingburger. The toilet paper you wipe with is FOUO, there is essentially no document in the government that isn't at least FOUO.
Leaked is not the correct word here. Generally as it's used, it implies some intent to disclose, the information for it's own purposes. You would call a disclosure to the war thunder forums a leak, because the intent was to use that information to win an argument. You wouldn't call Leaving boxes of classified information in a wearhouse where you'd normally read them a leak. (At least not as a verb). Likewise you wouldn't call it a leak if you mistakenly abandoned them in a park.
That said, IIRC For Official Use Only is the lowest level of classification (note not classified) it's not even NOFORN. It's even multiple levels below Sensitive But Unclassified.
So, who cares?
Much more significant is he failed the SCI/full poly... that means you lied about something. Yes I know polys don't work, but the point of the poly is to try to ensure you've disclosed everything that could be used against you, which ideally means no one could flip you or manipulate you. The functional part is to determine if you have anxiety about things you might try to hide, because that fear can be used against you. No fear/anxiety, or nothing you're trying to hide means you're harder to manipulate.
That feels bad even ignoring the whole hostile spys kinda thing.
It's so often the guys that are at the top who are the exception to the rules that are the problem.
I knew some folks who worked military communications and they broke rules regularly because senior officers just didn't want to walk across the street to do something secure...
Have worked in places where juniors had to lock devices when on prem; only authorized hardware in the rooms. Yet, the danger was from sloppy O6+ not the O1/GS6 who would (ready&abel) carry the water.
The is a serious problem with folk with power and authority and somehow no responsibility.
That's across government, service and corporate.
> The is a serious problem with folk with power and authority and somehow no responsibility.
Or perhaps the fundamental problem is with people in general - perhaps people without power and authority follow rules only because they don't have the power and authority to ignore them.
I think this is the real winner here.
Power corrupts because power means you can be corrupt.
In the 00's, DIA had episodes of career researchers watching porn from secured and monitored systems and then losing their jobs and clearances. One can only conclude they wanted to be fired or were really, really stupid.
It’s absolutely necessary to have ChatGPT.com blocked from ITAR/EAR regulated organizations, such as aerospace, defense, etc. I’m really shocked this wasn’t already the case.
"The report says Gottumukkala requested a special exemption to access ChatGPT, which is blocked for other Department of Homeland Security staff."
That they got this is shocking in itself.
Surely that must have been approved by the Secretary of Homeland Security Kristi Noem, his former boss back in SD.
Every cause that led to this event is, in itself, quite shocking.
I feel for my American friends, and hope they never again optimise their government for comedy value.
Unfortunately it’s not so shocking anymore. The Secretary of Defense texting imminent war plans to a journalist in a Signal group kinda jumped the shark.
Secretary of War
In law, it is still the Department of Defense and Secretary of Defense, no matter what cutesy nicknames the executive branch invents.
There’s something in a dead reply that's a popular enough myth that its worth responding to:
> Something every single soldier and officer learns is that the entire department was previously called the Department of War. It was repackaged after WW2 as the Department of Defense when invading countries half-way around the world began being sold to the public as 'defense.'
This is a weirdly common belief, but it is not true. Up through WWII, the US had two cabinet level military departments, instead of the current one. Those two departments were the Department of War, under which was the Army, and fhe Department of the Navy, under which was the Navy and Marine Corps.
This was changed by two laws in the late 1940s. The first, the National Security Act of 1947, among other things:
* Split the Air Force and Army from each other, splitting the Department of War into two new cabinet-level Departments, the Department of the Army and the Department of the Air Force.
* Created an additional cabinet level Secretary of Defense to coordinate the combined military structure, which it called the National Military Establishment.
This was followed by the National Security Amendments Act of 1949, which:
* removed the Secretaries of the Army, Navy, and Air Force from the Cabinet and formally subordinated them to the Secretary of Defense
* renamed the National Military Establishment (which was frequently referred to by the inconveniently-pronounced, for its role, initialism NME) the Department of Defense (which conbined with the preceding point is the source of the unusual departments-within-a-department structure of the DoD.)
The Department of War did once exist, but it was never a name for the same thing as the Department of Defense. It was one of two coequal entities that were subsumed by the National Military Establishment, the only reason it still doesn't exist as a subordinate entity within the NME, now DoD, like the Department of the Navy does is that it was split in two.
It was always called the Department of War [1] from 1789 until 1947. At that point it was repackaged as the Department of Defense when we started framing invading countries half-way around the world as 'defense'. Prior to that rhetoric around war was far more honest. We tried to buy a sizable chunk of Texas from Mexico. They rejected our offer so we invaded and took it, because we wanted it.
It's only in 1947 and later that somehow invading countries half-way around the world and shipping weapons to anybody with a buck began being framed as 'defense' or somehow saving the world from whatever - tyrant, terror, communism, burdens of oil, and so on. So in many ways I think it would be far more apt to say that 'Department of Defense' is the cutesy name. They're not defending anything - nukes and geography take care of that, more or less, on their own.
[1] - https://en.wikipedia.org/wiki/United_States_Department_of_Wa...
> It was always called the Department of War [1] from 1789 until 1947.
No, what became the Department of Defense didn't exist from 1789 until 1947. The cabinet level Department of the Navy (current Department of the Navy) and the cabinet-level Department of War (later split into the current Department of the Army and Department of the Air Force) did, as separate, co-equal entities with no single civilian head over them beneath the President.
The National Military Establishment under the cabinet-level Secretary of Defense was created as a unified military structure in 1947 over both the Department of the Navy (which remained a cabinet-level department) and what had been the Department of War (which was split into the cabinet-level Departments of the Army and the Air Force). And in 1949 the three service departments were fully subordinated within the NME instead of being cabinet level, and the NME was renamed the Department of Defense (pribably not entirely because it was really awkward having the combined military organization use an initialism that sounded like “enemy”, but...)
More detailed version in https://news.ycombinator.com/item?id=46825849
All you are describing is a restructuring of which the Department of War had gone through repeatedly throughout its history. It's not like it had the same structure, or anything remotely like it, in 1942 as in 1789. The choice of the name was, as you observe, a choice. And it coincides exactly with the move away from public honesty in international relations and events.
You have things like WW1 being framed (at the time) as 'The War to End All Wars' but I think that was probably naivete whereas after we started calling war 'defense' we entered into the era of 'police actions' instead of wars, like the Korean War, and outright false flags such as the Gulf of Tonkin Incident for Vietnam. All the while the CIA was running around acting like a rabid chimp all across the world. It was entering into an era where deceiving the public became standard operating procedure, of which framing war as defense was but one typical aspect.
I believe we are now leaving that era, and I think that is a good thing for everybody.
> All you are describing is a restructuring of which the Department of War had gone through repeatedly throughout its history
No, from 1789 to 1947 there were two separate cabinet-level departments, War and Navy.
> It's not like it had the same structure, or anything remotely like it, in 1942 as in 1789
Internal to the two cabinet-level departments? Probably not.
At the cabinet level? There was exactly the same structure: the Department of War with the Army underneath it and the Department of the Navy with the Navy and Marine Corps.
The War Department did not become the Defense Department. In 1947 War was split into Army and Air Force, and a fourth cabinet secretary, the Secretary of Defense was added, heading the combined National Military Establishment that was created over both what had been the War Department and what still was the Navy Department (all still cabinet level departments). In 1949, the three service secretaries (two of which headed parts of what had been the War Department) were formally subordinated to the Secretary of Defense and the NME was renamed the Department of Defense. The Department of War was direct predecessor to the Departments of the Army and Air Force, not the Department of Defense, which was a new level of coordination interposed between the President and the formerly organizationally-separated services.
This is inaccurate. The Department of War initially had oversight over the Navy as well. The separation of the Navy into a separate department (which did not even exist at the time when the War Department was created) was one of those many restructurings it went through, without ever having a name change until we entered the era of deception.
[flagged]
> Every cause that led to this event is, in itself, quite shocking.
accidentally based
> Madhu Gottumukkala was born in Andhra Pradesh, India
meanwhile https://www.theguardian.com/technology/2026/jan/13/elon-musk...
Sure. That doesn't mean denying access to ChatGPT though - the way I see it, the entire value proposition of Microsoft offering OpenAI models through Azure is to enable access to ChatGPT under contractual terms that make it appropriate for use in government and enterprise organizations, including those dealing with sensitive technology work.
I mean, they are all using O365 to run their day-to-day businesses anyway.
I used to work in a large technology multinational - not "tech industry", but proper industrial technology; the kind of corp that does everything, from dishwashers to oil rigs. It took nearly a year from OpenAI releasing GPT-4 to us having some form of access to this model for general work (coding and otherwise) internally, and from what I understand[0], it's just how long it took for the company to evaluate risks and iron out appropriate contractual agreements with Microsoft wrt. using generative models hosted on Azure. But they did it, which proves to me it's entirely possible, even in places where people are more worried about accidentally falling afoul of technology exports control than insider training.
--
[0] - Purely observational, I had no access to any insider/sensitive information regarding this process.
I agree....but ITAR and EAR can be super vauge especially in higher education.
Its something I have been talking about. Going to be needed for everyone.
ITAR, yes, but there's no such thing as a person or organization that's not EAR-regulated. Everything exported from the US that's not covered by ITAR (State Department) is covered by EAR (Department of Commerce), even if only EAR99.
I really enjoyed unchecking all those cookie controls. Of the 1668 partner companies who are so interested in me, a good third have a "legitimate interest". With each wanting to drop several cookies, it seems odd that Privacy Badger only thinks there are 19 cookies to block. Could some of them be fakes - flooding the zone?
Damn. I forgot to read the article.
The same cookie can be shared with several partners or collected data can be passed to the partners.
It's not a cookie law — it's a privacy law about sharing personal data. When I know your SSN and email address, I might want to sell that pairing to 1668 companies and I have to get your "consent" for each.
I for one, after doing a bit of reserach, was shocked to find out the person in question is apparently completely unqualified for the job (if him pasting sensitive information into public ChatGPT didn't already make that abundantly clear). But the highlight from his Wikipedia page is this one:
>In December 2025, Politico reported that Gottumukkala had requested to see access to a controlled access program—an act that would require taking a polygraph—in June. Gottumukkala failed the polygraph in the final weeks of July. The Department of Homeland Security began investigating the circumstances surrounding the polygraph test the following month and suspended six career staffers, telling them that the polygraph did not need to be administered.[12]
So the guy failed a polygraph to access a highly controlled system full of confidential information, and the solution to that problem was to fire the people in charge of ensuring the system was secure.
We're speed running America into the ground and half the country is willfully ignorant to it happening.
Polygraphs have to be one of the most awkward / bizarre requirements for accessing a program. They are not scientifically reliable.
There is a reason why nobody uses them but the U.S.
The US uses them more pervasively it seems, but there's still remnants of it elsewhere.
The UK uses them for post-conviction monitoring in certain offenses: https://www.gov.uk/government/publications/police-crime-sent... ...and there's more than one British polygraph group: BPA and BPS (https://www.britishpolygraphassociation.org/, https://polygraph.org.uk/)
Australia did indeed reject the polygraph for security clearance: https://antipolygraph.org/blog/2006/10/19/australian-securit...
Canada however does seem to use it as part of their intelligence screening: https://www.canada.ca/en/security-intelligence-service/corpo...
> Do I have to go through the polygraph test to join CSIS?
> Yes. All CSIS employees must obtain a Top Secret security clearance and the polygraph is a mandatory part of the process.
Seems to be the same for CSE and to get "Enhanced Top Secret" clearance.
Back to the US, the Department of Labor says that private employers can't force people to undergo a polygraph test: https://www.dol.gov/agencies/whd/polygraph But of course this does not apply to public sector jobs, where it's used more pervasively.
They're somewhat effective at stopping people applying if those people know they will have to lie
Not defending the buy but completely might be inaccurate. He has a masters in comp sci eng. https://en.wikipedia.org/wiki/Madhu_Gottumukkala
I do realize this scholastic achievement is not indication he knows what he is doing.
And an MBA. He seems like a lot of people I know who skim through their technical degrees just to get the credentials. And my experience is that Masters is often easier to get than a Bachelors.
Anyway what he did makes it abundantly clear that this person should not be head of security for anything.
A polygraph isn't a competency test.
It's a person reliability test and he failed it.
> It's a person reliability test and he failed it.
It does not have the capability to say whether the person is reliable. It is a bunch of pseudoscience, basically.
meh diploma mill is a dime a dozen in University of India
It’s from UT Arlington - does that even count?
Yes
They aren't willfully ignorant, they're cheering it on.
People were already careless with social media which was openly public. I imagine it’ll be worse with these LLMs for the average person.
This is the real risk I think. Currently there are no means to even pretend to get anything deleted from LLMs either.
Yeah and ultimately those tools will be used as advertising machines. You'll get hyper specific targeted ads.
I'm pretty pessimistic about the future with LLMs, but I can't see it being a net positive for humanity in the long run.
"pessimistic... but can't see it being positive"
why "but"?
It's bizarre that someone would choose to use the public, 4o bot over the ChatGPT Pro level bot available in the properly siloed and compliant Azure hosted ChatGPT already available to them at that time. The government can use segregated secure systems set up specifically for government use and sensitive documents.
It looks like he requested and got permission to work with "For Unofficial Use Only" documents on ChatGPT 4o - the bureaucracy allowed it - and nobody bothered to intervene. The incompetence and ignorance both are ridiculous.
Fortunately, nothing important was involved - it was "classified because everything gets classified" bureaucratic type classification, but if you're CISA leadership, you've gotta be on the ball, you can't do newbie bullshit like this.
> It's bizarre that someone would choose to use the public, 4o bot over the ChatGPT Pro level bot available in the properly siloed
You're assuming the planted lackey has any knowledge of these tools.
Or any reason to give a shit and use the less convenient tool.
Another example why shitty software can easily become a compliance or security problem.
today FOUO or CONFIDENTIAL, maybe tomorrow or next week SECRET and after that seemed fine maybe some TOP SECRET or throw in a SAP for fun! call it the maralago bathroom
the current united states government is staffed mostly with unserious people, or people who are serious about doing crimes against humanity. there's very little in between.
The vast majority of government staff are career professionals who know what they are doing, not political appointees who showed up in the past year.
Right, if we change parent-poster's "staffed mostly with" to "controlled mostly by", I think that's an adequate fix.
And who've been subjected to a firing spree I wouldn't wish on my worst enemy. It's the political appointees that are, frankly, there because of the connections and their willingness to, say, "work towards the ultimate leader".
This is a "Cybersecurity chief" causing an intern-level IT incident.
In many industries, this would be a rapid incident at the company-level and also an immediate fireable offense and in some governments this would be a complete massive scandal + press conference broadcasted across the country.
Then again the CTO of Crowdstrike that had their anti-malware code update cause huge problems, is the same guy that was CTO of McAfee when their AV code update, caused huge problems.
The CTO created the update? Otherwise it's not the same situation
No but they could have easily created the culture that massively increased the probability of such mishaps... we have all seen how not OK work environment negatively affects deliveries right, or read about boeing fiasco(s).
Not an insider just to be clear here so maybe just really bad luck. But no benefit of doubt for the third strike.
I think he is real deal. I mean in reality he learned or knows very little about technical matters. No fraud needed.
Yay, on-premise llms are what is recomended for serious use, at least US gov thinks that :) But rest of us need to pay subscriptions for 3r party businesses passing back and forth our... everything ?
In old days ppl was saying: "I have no secrets" and now we evolved into "I know how to not upload important docs" ;)
There have to be GovCloud only LLMs just for this case.
I swear this government is headed by appointed nephews of appointed nephews.
I keep thinking back about that Chernobyl miniseries; head of the science department used to run a shoe factory. No one needs to be competent at their job anymore
The article says
> [ChatGPT] is blocked for other Department of Homeland Security staff. Gottumukkala “was granted permission to use ChatGPT with DHS controls in place,” adding that the use was “short-term and limited.”
He had a special exemption to use it as head of Cyber and still got flagged by cybersecurity checks. So obviously they don't think it's safe to use broadly.
They already have a deal with OpenAI to build a government focused one https://openai.com/global-affairs/introducing-chatgpt-gov/
> So obviously they don't think it's safe to use broadly.
More likely, everything gets added to the list because there shouldn't be false positives, it's worth investigating to make sure there isn't an adjacent gap in the security systems.
You are uploading information to the chat system every time you use it. Doubly true if you’re having it analyze or work with documents.
I presume pulling this data out is simple if you’re, say, China.
There really no security to investigate. Without a private instance, it’s an absolute non-starter for anything classified.
> presume pulling this data out is simple if you’re, say, China
Why would you presume that?
A nationstate has a lot of capacity to do things they shouldn't be doing
Because this is a discussion about national security.
Somehow I think that the weak link in our government security is at the top - the President, his cabinet, and various heads of agencies. Because nobody questions what they're allowed to do, and so they're exempt from various common-sense security protocols. We already saw some pretty egregious security breaches from Pete Hegseth.
That's also the case in businesses. No one denies the CEO a security exemption.
I have never worked in a company where an obviously incorrect CEO-demanded security exemption (like this one) would have been allowed to pass. Professionalism, boards (with a mandatory employee member/representative, after some size) and ethics exist.
30 years in about 8 software companies, Northern Europe. Often startups. Between 4 to 600 people. When they grow large the work often turns boring, so it's time to find something smaller again.
Ah, Northern Europe is probably the difference. This passes all the time in the US. It's probably more common in non-tech companies, as well.
I’m in the US, SE since 1998, startups to multinationals. What the GP said holds true for me too. There are serious professionals in the world - I don’t know why some people want to drag every one else down to the level of the current US administration- they are exceptionally inept.
CTO at a successfull cybersecurity startup I worked at long ago was exempt from critical security updates. She refused to restart her computer out of fear for her Excel state.
I used to work devops for a startup. The _only_ person who was exempted from 2-factor auth was the CEO. It's the perfect storm: a tech illiterate person with access to everything and the authority to exclude himself from anything he finds inconvenient.
>I have never worked in a company where an obviously incorrect CEO-demanded security exemption (like this one) would have been allowed to pass
You don't have worked in enough companies then.
Just for the sake of argument, you think anybody would have denied Jobs or Bezos or Musk one?
I saw what joining Apple did to a friend in the early 2000s.
(Extreme burnout, did not get rich from the pain. It was just pointless destruction.)
The phrase ‘Don’t you know who I am?’ Will be taken differently depending on corporate culture.
Why would you? He’s literally the only person ostensibly in charge of the direction of the company. Destroying the company through a security exemption or a bad business deal - both are the leader making a poor decision due directly to his seat of power.
Give sound advice of course, but ultimately it’s the exec’s decision make.
There are many reasons to deny a CEO ... in a good company structure such denials are circled back around to the board for review.
Case in point: Allowing a CEO with no flight training to "have the keys" to the company <rare, expensive, uniquely outfitted, airframe> because they want to take it for a spin.
Sheparding Royalty in Monarchies has been a neccessary, delicate, loaded, and life threatening role for centuries.
Being a C-suite Groom of the Stool isn't a happy job, but somebody has to do it.
I guess, but it’s his plane in a sense. If he wants to fly it and destroy the company, it’s his call. You just give the advice.
To be clear, I’m referring much more to CEO/owners - maybe more like Zuck than Bezos
No, it isn't - it's an asset owned by the company and shareholders - a CEO is an appointed or elected officer.
> To be clear, I’m referring much more to CEO/owners
Owners are what you are talking about. CEO / Owners are Owners and can act like owners.
That said, even owners need to be herded like cats when they are making bad decisions that impact tens of thousands of people on the basis of hubris and feels.
Somebody has to toss them shiny keys until the moment passes and they can make rational choices again.
The question isn’t whether they want it is whether they have a business need, as with any employee.
The CEO of vocal cola has no business need to know the secret formula. Giving it to him has no upside only downside, so you don’t.
So who gets the formula? A chemist with no vested interest? I have no clue why a CEO would be untrustworthy when any other employer wouldn’t be.
Been there. The CEO of an internet security company was the one who clicked on the wrong email attachment and turned a virus loose.
I mean, I don't know if he had a security exemption, or if anyone who clicked on it would have infected us. But he was the weak link, at least in that instance.
Hah no, weak links are everywhere at all levels. The stories just don't generate revenue for news companies.
A fish rots from the head back.
whether he is personally and directly responsible for this specific incident, his leadership absolutely sets the tone for the rest of the federal government.
[flagged]
It goes back long before the current regime. People may remember a certain cabinet secretary who ran her own exchange server in the basement.
It’s always fascinating how massive corruption is “whatabout”’d because someone years ago did something stupid.
Do you mean now, or then?
Bad is still bad, no matter what the party doing it.
[flagged]
Humans generally find "food safety expert sickens guests with tuna salad he left out overnight on warm countertop" to be a far more damning charge than "fire safety expert sickens ... warm countertop".
Dig up a live mic catching Hillary calling the IOC a bunch of self-serving scum just as Obama was begging them to award the 2016 Olympics to Chicago, and we might call it comparable.
> I swear this government is headed by appointed nephews of appointed nephews.
Don't forget the Large Adult Sons!
https://www.newyorker.com/culture/cultural-comment/the-land-...
https://knowyourmeme.com/memes/large-adult-sons
> No one needs to be competent at their job anymore
That's actually the whole point. Placing incompetents in positions of authority means they know absolutely to whom they owe their loyalty. Because they know they would never have that job on merit. And since they don't really know how to do the job, they have no moral qualms about doing a poor job, or strong opinions on what they should be doing -- other than whatever mission their patron has given them. It's a tool used by weak leaders and it's unfortunately very effective.
It's all part of the plan.
Make the government look so incompetent that it is a no brainer to let a private company (headed by your friends and family of course) to do the important jobs and siphon resources much more effectively.
> I swear this government is headed by appointed nephews of appointed nephews.
No joke, the previous head of the State Department task force tasked with fighting corruption and nepotism in international contracting was named Rich Nephew. (He's a very talented career civil servant and I mean no shade I just find that hilarious.)
Do remember that HBO Chernobyl is fiction, there was no shoe guy publicly drinking vodka irl
It is perfectly plausible that someone from a shoe factory would end up in that guy’s position. He would just have been running the factory, not making shoes.
not in the USSR at the time of the events.
Yes in reality that guy was a machinist.
The failsons of the king of the failsons
Guess what this administration would love to do with nuclear facilities...
Any time you have to include "competent" in a description of a job or related technology, that's a clue that it needs requisite oversight and (possibly exponetial) proportionate cost.
Isn't using azure openai enough? I read their docs and they have self hosted instances for corporate data compliance.
Hey, working at a shoe factory is serious business. You have to be a real bootlicker to get ahead in a place like that.
And when you get to the top, you actually experience how the shoe is on the other foot. One should get out early, not waiting for the other shoe to drop.
just until you get to upper management
there are, he was just too lazy to use them
DEI in action (funny people thst voted for this were apparently anti-DEI and now they get 100% DEI)
Of course this comment is mostly ironic, but noting for the whole class, when the MAGA talked about DEI they only ever meant ethnic and sexual minorities, competence be damned!
That is of course the thing about ideologies like it: loyalty before all else.
DEI is basically “someone else got a gig not because of their abilities but because _____”
The entire Trump administration, every single person, is a DEI hire.
DEI at its worst is exactly what you say. (At its best, it's "we hire for abilities, but we also look for abilities in non-traditional people".
But, even though that's what DEI can be, not all "someone got a git not because of ability" is DEI. Cronyism, racism, and sexism all do that, too.
In the case of this administration, I think the traditional term is "yes men" - people who are hired not for ability, but because they will not say no to the boss.
They say that most fascist governments fall apart because they actively despise competence, which it turns out you need if you are trying to run a country.
That’s because eventually reality catches up to you.
If the reality of a thing is in opposition to the regime’s wishes, you can’t just wish that away.
However, the regime will favor those who say “yes” over those who accept reality.
Competence gives way to ideology.
I once read an interesting book on the economy of Nazi Germany. There were a lot of smart CEOs and high ranking civil servants who perfectly predicted US industrial might.
They say it, but they're wrong. Historically speaking there have been basically about 2 fascist governments, and they fell because they lost wars. And Germany, for one, did run them with high competence, to the extend that it took years for many countries to do anything about.
It we loosen "fascist" to just mean any authoritarian government, there are many that run of very long time.
WWII started in 1939 and was done in early 1945, so it didn't take that long.
More importantly, maybe the Nazi's were competent at first, but they absolutely fell apart internally due to mistrust, back stabbing, and demanding of loyalty above all else. Hitler famously made many poor military decisions.
Six years for a country holding back the allies is not "that long" - and 6 years more since they came into power?
And as a government they'd still be in power 20 and 30 years later if they didn't start the war (judging from Franco's spain).
The Nazis were in power for years before they started WWII.
[dead]
> There have to be GovCloud only LLMs just for this case.
I hear Los Alamos labs has an LLM that makes ChatGPT look like a toy. And then there's Sentinel, which may be the same thing I'm not sure.
Check the engineering salaries between each organization and reconsider your claim.
And we all heard they reverse engineered alien anti gravity technology in the 80s.
All I've heard was that they were aware it's anti gravity. Nothing about reverse engineering.
Care to say more about that?
Bob Lazar claims he was allocated in this project where not only they found working device capable of emiting gravitational waves out of phase with earth gravitational waves, but they achieved the same effect bombarding a mysterious unknown at the time element. He called the material element115 (the logical guess, element 114 properties was known/was synthesized), while emiting one proton and decaying back to element 115 the effect was achieved.
Apparently he was in fact allocated on a top secret project at los Alamos and his expertise was alternative propulsion back everything else is folklore, but it is deep folklore if you're interested in conspiracy theories
Is it called "Skynet?"
I wonder how far removed the interim director of the CISA is from any real world security. I bet they have not seen or solved any real security problems and merely are an executive looking over cybersec. This probably is another example of why you need rank and file security peeps into security leadership roles rather than some random exec.
I would like to be able to say that it is uncommon, but based on what I am seeing in my neck of the woods, all sorts of, one would think, private information is ingested by various online llms. I would have been less annoyed with it had those been local deployments, but, uhhh, to say it is not a first choice is being over the top charitable with current corporates. And it is not even question of money! Some of those corps throw crazy money at it.
edit: Just in case, in the company I currently work at, compliance apparently signed off on this with only a rather slim type of data verbotten from upload.
The Dept of Homeland Security has had its own internal gen-AI chat bot since before Trump took office [0]. That this guy couldn’t make do with that, and didn’t think through the repercussions of uploading non-public documents to a public chatbot doesn’t bode well for his ability to manage CISA
[0] https://www.dhs.gov/archive/news/2024/12/17/dhss-responsible...
Isn't their internal chat bots provided by grok or Oracle AI?
dot is self hosting several openai and Claude models on chat.dot.gov it's awesome
I adore that this guy had security clearance and I doubt I'd clear that bar. Last time I looked at the interview there was a question:
> have you ever misused drugs?
and I doubt I'd be able to resist the response:
> of course not, I only use drugs properly.
also I wouldn't lie, because that's would undermine the purpose. Still sad I can't apply for SC jobs because I'm extremely patriotic and improving my nation is something that appeals.
FWIW I have held a security clearance during my career, and telling them I smoked weed was not a dealbreaker. What they are ultimately looking for is reasons why you could be coerced into divulging classified information. If you owe money due to drugs/gambling, etc, that's where it becomes a dealbreaker.
The general rule is not to lie to them, because they will interview all your friends and someone somewhere will rat you out. It’s pointless to try to hide anything during these interviews, and, if you do it, then it’s a dealbreaker.
Yeah, this is true. They are looking for vulnerabilities that can be exploited by others - the fact you smoke a blunt once a week is not a problem in that regard.
You can see an archived list of industrial security clearance decisions here [0] which is interesting, and occasionally entertaining, reading. "Drug involvement security concerns" usually involve either actively using drugs or, worse, lying to cover up drug use, both of which are viewed as security concerns and grounds for rejection.
[0] https://web.archive.org/web/20170218040331/http://www.dod.mi...
wait, so I can apply and be honest? Sick! I just poorly misassumed they had classicly archaic interpretations of drugs.
I don’t have a clearance so someone can correct me, I believe you still have to have not used drugs in the prior year.
Maybe you can get a security clearance, but don’t cross the border: https://www.wired.com/2007/04/canadian-psycho/
>I don’t have a clearance so someone can correct me
Why would you give an answer when by your own statement, you're not knowledgeable? What a strange mindset.
>I believe you still have to have not used drugs in the prior year.
My own experience does not agree with this speculation.
Because this is a thing I’ve heard. You can check and verify it yourself. I went to a CIA recruiting event when I was in university and this is what they told me, I assumed it was true but that’s why I caveated it. I shared it so the OP could do their own research since they seem to have even less information.
Can you clarify your own experience to help the OP?
Current use is still a problem AFAIK (not sure on weed).
That said I can confirm that a few years back a friend who had previously used/experimented with a wide variety of substances (EDM scene, psychs), had no trouble getting a clearance.
They disclosed all of it, said they weren't currently using it and wouldn't for as long as they were in the job role, passed the drug test, and that was fine.
That said, to add to the "lying is a bad idea" point: I believe some of their references were asked about if they'd ever known that friend to have a dependency + if they were aware of any current/very recent use.
OC had a point. If you take drugs in the way they are intended to be used, you can say no with a clear conscience. Whether the interviewer will accept that if they later find out you took drugs, I couldn't tell you.
You would not get a security clearance, and the admin would make a note on your IQ. The correct answer is simply
> no
and keep the rest of it in your head.
how is it low IQ to be honest? People have to make decisions and if the decision is "no", I can handle that. Empowering the person making the decision to the fullest extent is something I'd still be interested in, even if it is to my detriment. Its like when middle-management ask me to lie or withold information from the COO or CEO, its just a no. If they're shit then its on the organisation to sort that out. Second guessing everything leads to even worse dysfunction.
We're not talking about sneaking into a concert or something low-stakes, the security of our nation is the foundation of our very civilization. I have dual citizenship of a nation that borders Russia and was once the USSR, so I appreciate the stakes of worst case scenarios because one of my nations was under that boot rather recently.
A smart person seeking a security clearance would not volunteer information that wasn't asked for, that causes him to be denied the clearance.
smart is not necessarily the same as deceitful. Also the question:
> do you misuse drugs
is very much asking for the information about my drug use. So it was asked for.
From wikipedia:
He graduated from Andhra University with a bachelor of engineering in electronics and communication engineering, the University of Texas at Arlington with a master's degree in computer science engineering, the University of Dallas with a Master of Business Administration in engineering and technology management, and Dakota State University with a doctorate in information systems.
And he still manages to make a rookie mistake. Time to investigate Mr. Gottumukkala's credentials. I wouldn't be surprised if he's a fraud.
It’s happening all across corporate too
And in all manner of regulated industries. People simply cannot resist throwing anything and everything at the magic text machine. A company can control its IT assets, but if the content is displayable on a screen, rest assured users will just take photos and upload to their personal LLM accounts to get the generative answers they endlessly desire.
I’m actually shocked that security teams aren’t up in arms over this exfiltration of company secrets. I know some companies that are running their own models and agents but the vast majority are copilot/claude/codex’ing away sending all that sweet sweet IP to 3rd parties
You can get agreements with all of the providers around data sharing etc and host the models themselves through AWS or another cloud provider. That's what clueful companies are doing, as expecting people not to use this stuff is doomed to fail.
This administration's op-sec has been consistently "barney fife" levels of incompetence.
Leave Fife out of it. His heart was in the right place, at least. Also, his boss made sure he was unarmed.
Or at least not readily armed, bullet in the shirt pocket and all.
In at least one episode he gets it taken away from him, which is my favorite bit. “Give me my bullet!”
this administrations competence on anything and everything has been a kid eating glue
One of them has bragged about how difficult it is to identify a giraffe, but that he's done it three times
And probably also been asked to draw a clock at a certain time, too.
If it wasn't meant to be eaten, it shouldn't have tasted so good!
We should get their heads checked for crayons.
[dead]
Pretty sure that's a feature, not a bug
Personally I believe this but it gets into conspiracy theory real quick. There are far simpler explanations.
Same, I want to believe that this is all a ruse and that the are smart and just really good at playing dumb, but there are just too MANY of them.
It's sycophancy plain and simple. Surround yourself with only yes-men, it ends up becoming less and less competent as the ones who stand up and say no are replaced.
Even if they know better, they can't do better because they know there is no loyalty to nay-sayers.
The main thing is that if you're a big enough entity, in favorable enough conditions, it's possible to make stupid decisions continuously and survive them for a very long time.
It's the "market can remain irrational..." problem.
And as a consequence, never recognize them as being stupid---in fact the reverse, because your bad ideas are met with macro success even while individually they may struggle.
It's yet another broken feedback loop.
[dead]
The simpler explanation is that all the competent people saw what happened the first go around and want nothing to do with it. That leaves a detritus of sociopathic wannabes to select from for staff, all vying to mirror the behavioral profile of dear leader.
Incompetence and conspiracies go hand-in-hand.
Not really. It is far easier to explain incompetence in powerful positions than to explain competence on purpose in powerful positions - the latter is definitely a conspiracy, the former is not.
This administration’s incompetence allows their opponents to conspire much more effectively.
Quite often it is both.
It's not uncommon for incompetent people to be put in positions of power. Because they are incompetent, competent but malicious people take advantage of this and commit actual crimes.
This is where actual conspiracies show up. And that is the incompetent powerful people cover up said crime to avoid looking incompetent.
It is an extremely common pattern.
When Donald Trump saw the footage of the murder of Renee Good, he said "Oh". He didn't know what ICE were doing until then. He trusted his cabinet who were telling him they were getting illegal immigrants and left wing terrorists.
He also repeated the lies that she was a domestic terrorist etc. I don’t think we need credit trump with any moral fibre over this just yet…
No, he did not trust his cabinet at all, which is why he put a bunch of yes men in place to ensure they fucked up and did the dumbest thing.
DT has had a long history of operating like a mafia boss where the design of the people he chooses around him is to put scapegoats on when the criminal activities he's involved in is caught.
He chose people who give him good emotions, because he has dementia. He didn't know that would mean they would screen the world from him, because he has dementia. If he did know that, he wouldn't understand it because he has dementia.
Maduro and his bodyguards would slightly disagree.
Unfortunately for Maduro, that operation was run by military professionals rather than directly by Trump's lackeys. But give Hegseth enough time and he'll bring them around to the new standard.
The trick is how to weaponize the incompetence against them.
There at least one country that weaponised it against the US.
Russia
When I saw mention it was in context of a “contracting” type set of info / document I actually chuckled - I spent a decade in procurement and sales for high stakes contracts. Incompetent person has no idea how to manage a procurement and goes online. Basically this is a 2026 version of an inept executive bashing “what is an RFP” into a search engine from 2007.
And when the CCP compromised the law enforcement portal for every American ISP, stealing info on 80% of Americans, including both the Kamala and Trump campaigns, under the previous admin it was rock solid op-sec, presumably.
Or when the previous admin leaked classified Iran attack plans from the Pentagon, so bad that they didn't even know whether they were hacked or not.
You can at least pretend to make a technical argument over a political one.
> CCP compromised the law enforcement portal for every American ISP
Isn’t that the fault of the ISPs, not the admin?
It was a previous admin who mandated a backdoor. Predictably, enemies of the state got access to the backdoor.
Nope. The breach was in law enforcement operated portals.
Source? I cannot find anything suggesting that law enforcement agencies operate the portals. They are mandated by law and used by law enforcement, but operated by the telecom providers.
From [0]: “Last year almost a dozen major U.S. ISPs were the victim”, “the intruders spent much of the last year rooting around the ISP networks”, “telecom administrators failing to change default passwords”, “Biden FCC officials did try to implement some very basic cybersecurity safeguards, requiring that telecoms try to do a better job securing their networks”. Per the original topic, the article goes on to explain how the Trump admin destroyed those little security steps.
I’m okay with some both-sidesing of bad opsec, but I think you’re incorrect on the blame in this story, and to the extent it is the government’s responsibility, the Trump II response was worse than the Biden’s.
[0] https://www.techdirt.com/2025/11/07/trump-cybersecurity-poli...
You're the one making a political argument by doing a whataboutism that attempts to negate the failings of this administration. Which you're not even doing correctly because by every measure the previous administration was drastically more competent by looking at the qualifications of the people who filled their posts.
Can you explain how leaking the phone metadata of 80% of Americans and compromising the integrity of the 2024 election campaign's private comms is better OpSec than a single leak?
It's the worst U.S. government leak of all time, by far.
The 2024 election had no substantial integrity compromises. Nobody with credibility has critiqued its results.
What do you think of https://electiontruthalliance.org/ ? I haven’t deeply read their stuff, and I’m not really qualified to evaluate their statistics, but it seems like there are concerns worth following.
Is your position that the 2024 election, despite having a foreign power intercept the phone communications of both campaigns (confirmed and on record), had no integrity compromises?
What do you consider a compromise of integrity if not a hacking of political campaigns?
Also, please clarify whether the 2016 DNC hack is an exemption to your prior answer so I can weigh your bias.
Why don't you enlighten us since you seem to know so much about the topic? I know that none of the people who are experts at detecting the statistical artifacts that appears during voting roll have questioned the integrity of the US election.
In fact the only people questioning it are conspirancy-minded people who don't know that there are robust methodologies to detect election fraud.
It's been the same with every administration, unfortunately. It's just a side effect of such an unnecessarily big goverment.
Inviting a reporter from the Atlantic to your signal chat where you coordinate military plans has nothing to do with government being too big
If they are so leaky then why were they able to capture Maduro without a single American casualty? On one hand you claim incompetence and yet no one was tipped off. So maybe the Signal group chat wasn't as important as it was made out to be?
... because they didn't leak the Maduro operation? Also because Venezuela cooperated.
Lol. The Maduro operation did leak, but the press held the story. Rubio said “Frankly, a number of media outlets had gotten leaks that this was coming and held it for that very reason, and we thank them for doing that, or lives could have been lost.” https://www.npr.org/2026/01/05/nx-s1-5667060/media-shows-res...
You have to actively maintain a state of ignorance to say this isn’t different. Go look at all of the public reporting starting in January about the way appointees in the Pentagon, DOGE, etc. blew through the normal policies and procedures controlling access, clearing people, or restricting sharing.
For example, this wasn’t just “oops, I used the wrong number” but Hegseth getting a custom line run into a secure facility so he could use a personal computer of unknown provenance and security:
https://www.nytimes.com/2025/04/24/us/politics/hegseth-signa...
That’s one of the reasons why one of the first moves they made was to fire CISOs and the inspectors general who would normally be investigating serious policy violations.
This isn’t “big government”, it’s the attitude that the law is a tool used to hurt their opponents and help themselves but never the reverse.
Are you sure? This guy didn't pass a counterintelligence polygraph. Like, the one that asks "are you sure you're not a spy?"
Which polygraph, "lie detector" polygraph?
https://www.apa.org/topics/cognitive-neuroscience/polygraph
> Reviews of decades of scientific research suggest that polygraph tests are not reliable or accurate enough to be used in most forensic, legal or employment settings.
> Although lying can cause the physiological responses measured by polygraph machines—such as sweating and increased heart rate—those same changes can occur even when people are not lying, for example when they are nervous.
You really think that every other administration has had this level of incompetence? The current bumbling and corruption is absolutely unparalleled.
https://en.wikipedia.org/wiki/Madhu_Gottumukkala
He was the 'CTO' of South Dakota and later the CIO/Commissioner of the South Dakota Bureau of Information and Telecommunications under governor Kristi Noem.
Edit: (From a European perspective) it seems like the southern states really took over the US establishment. I hadn't really grasped the level of it, before.
> Edit: (From a European perspective) it seems like the southern states really took over the US establishment. I hadn't really grasped the level of it, before.
It's good to know the Americans aren't the only ones who never look at maps outside their own country
South Dakota has a population of less than 1 million people and the complexity of a CTO job of a state like South Dakota would be quite low. It is < 0.3% of the US Population and likely has de minimis benefit programs.
South Dakota is in the northern portion. But to your statement, historically speaking the southern states after the civil war kept trucking along in terms of power and influence.
The Dakotas weren't really north/south in the Civil War context; only about 4k people lived there in 1860. It was largely empty land, and not a state until 1889.
4k white settlers
That is one of the best comments I've seen on HN to date!
It seriously got me laughing. Thanks.
I am so happy that my embarrassing lack of geographical knowledge of the US states' internal geographies amused you. A good laugh is great for your health, I've heard.
At least I know where your country is located.
Now, let me quiz you on the geographical locations of French regions? Or perhaps Finnish regions, if that's something you work closer with, day-to-day?
;)
You can do that to someone who's confidently making incorrect assumptions about French or Finnish regions, sure.
Sounds about on par with what I would expect competence wise.
Hand-picked by Noem, so yeah.
https://en.wikipedia.org/wiki/Madhu_Gottumukkala
> In April 2025, secretary of homeland security Kristi Noem named Gottumukkala as the deputy director of the Cybersecurity and Infrastructure Security Agency; he began serving in the position on May 16. That month, Gottumukkala told personnel at the agency that much of its leadership was resigning and that he would serve as its acting director beginning on May 30.
> Gottumukkala had requested to see access to a controlled access program—an act that would require taking a polygraph
Are the US ok? It's 2026 not 1926
The polygraph is still used for security vetting, today. No word on whether they still read a lamb's entrails for portents or consult the dead with a Ouija board.
> No word on whether they still read a lamb's entrails for portents or consult the dead with a Ouija board.
Don’t give RFK Jr ideas.
These days I think that thing's main purpose is to bounce people who would otherwise request access that they don't really need. If it isn't worth sitting down for the machine you don't really need it.
> Gottumukkala failed the polygraph in the final weeks of July. The Department of Homeland Security began investigating the circumstances surrounding the polygraph test the following month and suspended six career staffers, telling them that the polygraph did not need to be administered.
This is pretty insane though.
The Feds love polygraphs. Still very much in active use.
It's actually a few minutes to 1929, so that checks out.
Feels like 1935
More context is that he was promoted under Noem in her old job too, just before the Presidential election.
> On Tuesday, Gov. Kristi Noem announced Gottumukkala's appointment as CIO. In a statement, she said he will prioritize the state’s citizens, their data and government service delivery.
https://www.govtech.com/workforce/south-dakota-governor-appo...
This is what you get when you prize personal loyalty over competence.
This issue is the one thing that gives me some hope that they can be ousted -- they are collectively too stupid and motivated only by their self interests to hold their power indefinitely.
Does anyone in this administration actually trusts each other’s personal loyalties? I wouldn’t.
> Cybersecurity monitoring systems then reportedly flagged the uploads in early August. That triggered a DHS-led damage assessment to determine whether the information had been exposed.
So it means, a DLP solution, browsers trusting its CA and it silently handling HTTP in clear-text right?
If I did this with a banal internal documentation at work I would be written up and maybe fired over breaking known policy. This administration is so ridiculously incompetent, and interim head of cyber security.. leaks. The onion wouldn't write this.
I’m a little surprised by the takes in the comments. Obviously, heads of departments or agencies, CEOs, or similar personnel are generally not in the same league as normal employees when it comes to compliance.
Productivity and efficiency are key for their work. I am sure there are lots of Sysadmins here, that had to disable security controls for a manager or had to configure something in a way to circumvent security controls from actually working. I have been in many situations where I have been asked by IT colleagues if doing something like that was fine, because an executive had to read a PowerPoint file NOW.
Sysadmins are afforded special leniency because of their demonstrated competence. Their leeway is earned. In this case, the "cyber security chief" has no proven skill other than absolute loyalty to his boss, which justified his skipping the usual vetting procedure.
Obviously those kinds of stories are common, but you can’t seriously be suggesting that it is a good or acceptable thing?
Execs are just as stupid as your average person and bypassing security controls for them puts an organization at an even greater risk due to the kinds of information they have access to. They just get away with it because they’re in charge.
Yes.
It touched a nerve because no one in the trump admin is qualified to do their job. There's a lot of corruption and a lot of people getting access to things they shouldn't due to their relationship and loyalty, not merit. There's a big difference from a sys admin having super user access and some random politically connected hack abusing their privilege.
DOGE/Musk, noem, Kash, hegseth, etc.
BTW, what's the current status on LLMs and confidential documents ? Which license from which suppliers are fine and which aren't ?
Where does this "cybersecurity monitoring" take place? On OpenAIs side? Or some kind of monitoring tools on the devices themself?
In any enterprise, normal would be to have monitoring on all ingress and egress points from the network and on devices themselves. You can't only have monitoring on managed devices because someone might BYOD and plug in an unmanaged device/connect it to internal wifi etc.
You bring in vendors and they need guest wifi to give you a demo, you need to be able to give them something to connect to but you don't want that pipe to be unmonitored.
What I'm really asking/wondering is how (and who or which party) figured out that this was leaked, and secondly how that propagated to the public. I don't really expect to find that answer. But if I had to guess OpenAI found out first, because employees there are more likely to leak the fact that the leak happened.
But also, how was it caught in the first place? Was it automatically flagged because content scanners automatically identified this as a concern, or was his account specially flagged for extra monitoring because of who he is?
it says "according to four Department of Homeland Security officials with knowledge of the incident." and "according to the four officials, each of whom was granted anonymity for fear of retribution." .. so It seems to be an internal lead.
as the post above says.. on managed devices, there can be an enforced vpn, that monitors all traffic coming and going, and while its at it, strip out the encryption and look inside the packets, and apply heuristics like .. what is the host domain, is it from a known LLM site.. and is its a POST message sending data, and then does the text of that data have a string matching "INTERNAL USE ONLY". I assume something like this.
Once again, if you or I did this, it's federal crime and federal time.
But when the chief does it, it's an oopsie poopsie "special exemption".
I wonder how they could discern the upload of sensitive documents from non-sensitive ones
Well, at least there's gonna be a swift and appropriate punishment. LOL
My assumption is that it goes the other direction on a permanent basis.
How is such a critical position filled with a foreign national?
I Googled for "cisa employment nationality requirements". I got a bunch of pages from CISA itself about how to apply for various jobs: recent grad, experienced specialist, and military vet. All have a bold statement under eligibility that says: "US Citizenship is required." It think it is safe to assume that Dr. Madhu Gottumukkala is a naturalised US citizen.
This is a very good question. Seems like it would negatively affect our security posture.
He's a naturalized US citizen
I can't say I'm shocked.
Better go have him sit in front of a powerpoint for a few hours. That'll help him.
Chalaki
> None of the files Gottumukkala plugged into ChatGPT were classified, according to the four officials, each of whom was granted anonymity for fear of retribution. But the material included CISA contracting documents marked “for official use only,” a government designation for information that is considered sensitive and not for public release.
Guys... we're talking about FOUO. Not even low-level classified. This is a nothingburger. The toilet paper you wipe with is FOUO, there is essentially no document in the government that isn't at least FOUO.
Leaked is not the correct word here. Generally as it's used, it implies some intent to disclose, the information for it's own purposes. You would call a disclosure to the war thunder forums a leak, because the intent was to use that information to win an argument. You wouldn't call Leaving boxes of classified information in a wearhouse where you'd normally read them a leak. (At least not as a verb). Likewise you wouldn't call it a leak if you mistakenly abandoned them in a park.
That said, IIRC For Official Use Only is the lowest level of classification (note not classified) it's not even NOFORN. It's even multiple levels below Sensitive But Unclassified.
So, who cares?
Much more significant is he failed the SCI/full poly... that means you lied about something. Yes I know polys don't work, but the point of the poly is to try to ensure you've disclosed everything that could be used against you, which ideally means no one could flip you or manipulate you. The functional part is to determine if you have anxiety about things you might try to hide, because that fear can be used against you. No fear/anxiety, or nothing you're trying to hide means you're harder to manipulate.
That feels bad even ignoring the whole hostile spys kinda thing.