To play devils advocate: federal authorization workflows for such things can be notoriously slow and counter intuitive. I'd argue that 18F's completed projects

To play devils advocate: federal authorization workflows for such things can be notoriously slow and counter intuitive. I'd argue that 18F's completed projects, and any other contract company's similar attempts, would either be impossible or greatly underperformed if done "the proper way." Of course, security is not something that can be played off as technical debt and 18F is definitely in the wrong here. However, the security apparatus of the federal government must evolve if projects like 18F's improvements to healthcare.gov are desired in the federal space. You cant have monolithic waterfall processes and agile project performance anymore than you can eat your cake and have it too.