While AWS/Azure do make the initial configs rather fool proof, that falls apart the moment you start configuring them for actual use. It’s also especially easy to mess things up when handling PII, at the SSA level it’s probably something that DOGE staff don’t have experience with.
As for vaccines. Largely through that out there cause it seemed like obvious bait for you, but I don’t think a single slogan “my choice my body” really encapsulates the arguments around abortion
Sorta, typically we think of raising/lowering interest rates to combat macroeconomic issues. Raising rates cools an overzealous economy, lowering rates fires up a slow economy.
However, we have a slowing economy with hot/rising prices. Either way you move rates you’ll likely end up exacerbating one of those issues. So the knee jerk reaction to lower rates could backfire.
In cyber security you may never know if a bad actor got access to your systems/data. The issue with not following good security practices is that you increase the risk of this happening.
Its like saying we should stop mandating vaccines cause the diseases aren’t around anymore. When you let down your defenses you end up with outbreaks that shouldn’t have happened and are harder to control.
There is a third option!
Economy isn’t doing great and facing inflationary pressure due to tariffs and trade wars, force rates to lower for a short boost only to cause more inflation and weakening dollar!
The SSA stores a lot of sensitive data. Normally with sensitive data you want to be very careful with who can access it and how.
What is potentially worrisome in this situation is it seems like the SSA is taking on the “move fast and break things” attitude of Silicon Valley.
More technically, most government agencies use AWS and Azure (cloud providers) to host data. So spinning up a new server isn’t inherently bad. However, creating a new server that is secure and has the correct access controls (user permissions regarding who can see/change content) can be challenging. The whistle blower believes they are not doing this right, and it sounds like the head of the SSA isn’t disagreeing, just saying he thinks the risk is worth it.
Given it’s the government it’s most likely AWS or Azure. That really isn’t inherently bad, it’s more the attitude of “move fast and break things” doesn’t necessarily work for secure systems with sensitive data.
If you read the article, the current head of the SSA acknowledges they did set up the system being discussed and that he’s accepted the increased risk of the implementation as there is a “business need”.
I agree that “random server” is a bad choice of words, but do want to add additional information context as the concern isn’t necessarily unwarranted. Another qoute from the article:
“I have determined the business need is higher than the security risk associated with this implementation and I accept all risks,” wrote Aram Moghaddassi, who worked at two of Mr. Musk’s companies, X and Neuralink, before becoming Social Security’s chief information officer, in a July 15 memo.
Its also sounds like they did spin up a new database with limited security/oversight to “move” faster. Why that’s worrisome is they aren’t denying there is a risk or lack of security, they are just saying it’s justified.
I always appreciate the actual quotes and excerpts because it helps you really understand that even the people venerated by the south were cruel and didn’t even follow the rule of law.
I think the line “how does handling PII make it easier to mess things up” just about sums things up for me.