Hacker News new | ask | show | jobs
by freejazz 96 days ago
How would you get it in the first place?
1 comments

I mean, insider risk is insider risk.

In the DOGE case, they specifically broke all the controls that existed to manage insider risk and keep people from making copies like this, but (especially 20-30 years ago) I've been on plenty of networks that just had no concept of insider risk and everything was just open for anyone to access (or protected by shared passwords everyone knew).

So you're saying that if you worked there you would also steal the social security data? What am I supposed to be taking away from this besides the fact that you would make poor choices and lack ethics? Didn't seem like it was a problem for people who worked in gov't prior to DOGE existing, so I'm not really getting any other takeaway here.
Steal?

Oh no no no no no, not once, not ever.

But look around the network, see what file shares are world readable, maybe see if there's any FTPs or Telnet servers with no username/password (or at least, no password stronger than "guest")? That's just being curious. And if I see any interesting files, and I make a copy to look at later, that's not a crime, is it?

I'd like to think my younger self, if he'd been hired at the SSA or somewhere similar, would see the difference between "the personal data of hundreds of millions of people" and the networks I actually had access to at the time. I know I wouldn't be trying to sell the data or trying to otherwise leverage it for financial gain, but I don't really have such a high opinion of my younger self's judgement that I would completely rule out making a copy for objectively dumb reasons.

Why are you telling on yourself so hard?
> they specifically broke all the controls

Is there a reference or citation for this? I didn't see in the article.

I don't know about this person specifically, but the news from when DOGE was active was full of "employee of department fired for trying to prevent DOGE employees from directly accessing system no one is allowed to directly access".