5 ms·

> It is embarrasing for the company but really this move won't change anything financially for either party. I beg to differ. National news about a security f

by GBond 16y ago

> It is embarrasing for the company but really this move won't change anything financially for either party. I beg to differ. National news about a security firm being hacked for its confidential IP can't be good for future business.

krschultz 16y ago
That's very true. But the conjecture that the FBI "won't pay [the firm]" becuase "[anonymous] will give it to them for free" is pure bullshit. Trust me, the company will still get paid. If necessary, they will change their name.
- tomrod 16y ago
  I call BS on your BS call. Releasing something like this puts it into the public domain. Unless the FBI has a contract already in place, payment is not ensured.
  - bmelton 16y ago
    Given the nature of how the government provisions work to contractors, they almost certainly do. Not being privvy to the task at hand, they likely had one of the following scenarios at play: 1) The Federal Government (hereby, "Fed") wanted the data. Fed puts out a request for proposal to qualified federal contractors to solicit work bids. Qualified federal contractors respond with work proposals, detailing the level of effort, the likely strategy to obtain the information, and establishing a cost and payment terms. Cost structure is either Time & Materials (T&M) or firm fixed. If it's T&M, they'll be paid for the time, effort and overhead required to have performed the task. If it's firm fixed, they'll be paid a set cost as established in the proposal. 2) HBGary had an existing contract for work with Fed. This contract may cover intelligence gathering, cyber intel, whatever. Fed creates a new task order for HBGary on the existing contract. Contract is either amended (if firm fixed, after the effort is quoted) or falls under existing task orders. HBGary is paid according to the terms of the existing contract. To cut to the chase, there are other likely scenarios, but they all look similar to the above, and all involve HBGary being paid under the terms of the contract. Whether they're paid a flat fee or based on the effort involved depends on the terms of the contract. When they get paid depends on the terms of the contract. How much they get paid depends on the terms of the contract. It sometimes happens that the government opts out of paying for things like this, and someone decides to buck the red-tape-brigade, but those matters usually end up in court as a contract dispute. Generally speaking, I think it's fairly safe to assume that HBGary is getting paid. What I suspect a lot of people are overlooking here is that generally, if the government has contracted to buy something, EVEN IF somebody completely different comes up with the same good (tangible or intangible) for zero or significantly reduced cost, the government is not allowed to purchase unless there are provisions in their existing contract that allow for this. The rules governing this process are the "Federal Acquisition Regulations", are set in stone, and are established so that both sides 'play fair'. The terms of the contract are always upheld unless there are exceedingly dramatic reasons not to, or failures of performance. If I contract to buy 10 servers for the government for $1,000 each, and somebody else then offers 10 identical servers to the government for $0 each, I will still be paid. Since the cost of technology generally goes down over time, this prevents Fed from buying cheaper after the original contract was penned, and is allotted to protect contractors from the Fed, as well as the other way 'round. It's complicated as sin, and yeah, there are loopholes out the wazoo (most of which relate to winning work,) but it's also defined, repeatable and ends up in HBGary getting paid.
    - tomrod 16y ago
      Getting government rents must be very nice.
      - bmelton 16y ago
        It's actually quite a hard way to earn a living. GETTING the contracts is next to impossible, as despite having the FAR in place, they generally are wired for a particular company. Most government work is, of course, only eligible to companies who have 'past qualifications' of doing similar work for government agencies, meaning that new companies have an even harder time breaking into the network of opportunities and that even if you've built a 100 'websites & cms systems' for government agencies, you're not qualified to build a system categorized as 'web portal' unless some of the work you've previously done was labelled as such in the contracts. After you've gotten the contract, it's difficult to work with the government's red tape and still live up to the terms of the contract. If you've ever worked on a project with a prolonged or contracted management life-cycle, you have _some_ idea of what it's like, in a very small sense. Changes requested are shot down by government lifers on little basis. "I vote no, until we've thoroughly thought about the security implications," was a valid rejection on a project I was running that involved, at least partly, replacing plain-text passwords stored in configuration files with Kerberos Keytab certificates. Infuriating, at best. Meanwhile, slips to the project schedule don't affect your project's contractually obligated deadline. The government is generally happy to trod along at a tortoise pace while contractors run sprints in spurts -- weeks waiting on an approval for a change, then sprinting until it's done. Add to that the required overhead of having somebody able to meet incessantly about every single line item in every single invoice. Add to that the fact that in most government agencies, their IT staff is comprised by a heterogenous mix of slow government employees and other contractors that would love to see you fail (as they likely also bid on the work you won, and would love the opportunity to see it rebid in the event that you fail). Add to that having to get approval on every single change in any product, no matter how trivial, by a committee of stakeholders -- the size of which shrinks and grows as the project moves on, and knowing that no change, however firmly approved, is ever REALLY approved until ship date (aside, months after development on a renovation had begun on a portal's backend infrastructure, senior government personnel were still arguing over the look and feel of a mockup that had been approved and finalized prior to the beginning of development.) Again, red tape, red tape, red tape.
- wisty 16y ago
  They will also probably do some security audit. Believe me, there will be a lot of boxes that will need ticking, meetings, powerpoint shows, and sentences written in the passive voice.

by GBond 16y ago

krschultz 16y ago

That's very true. But the conjecture that the FBI "won't pay [the firm]" becuase "[anonymous] will give it to them for free" is pure bullshit. Trust me, the company will still get paid. If necessary, they will change their name.

tomrod 16y ago
I call BS on your BS call. Releasing something like this puts it into the public domain. Unless the FBI has a contract already in place, payment is not ensured.
- bmelton 16y ago
  Given the nature of how the government provisions work to contractors, they almost certainly do. Not being privvy to the task at hand, they likely had one of the following scenarios at play: 1) The Federal Government (hereby, "Fed") wanted the data. Fed puts out a request for proposal to qualified federal contractors to solicit work bids. Qualified federal contractors respond with work proposals, detailing the level of effort, the likely strategy to obtain the information, and establishing a cost and payment terms. Cost structure is either Time & Materials (T&M) or firm fixed. If it's T&M, they'll be paid for the time, effort and overhead required to have performed the task. If it's firm fixed, they'll be paid a set cost as established in the proposal. 2) HBGary had an existing contract for work with Fed. This contract may cover intelligence gathering, cyber intel, whatever. Fed creates a new task order for HBGary on the existing contract. Contract is either amended (if firm fixed, after the effort is quoted) or falls under existing task orders. HBGary is paid according to the terms of the existing contract. To cut to the chase, there are other likely scenarios, but they all look similar to the above, and all involve HBGary being paid under the terms of the contract. Whether they're paid a flat fee or based on the effort involved depends on the terms of the contract. When they get paid depends on the terms of the contract. How much they get paid depends on the terms of the contract. It sometimes happens that the government opts out of paying for things like this, and someone decides to buck the red-tape-brigade, but those matters usually end up in court as a contract dispute. Generally speaking, I think it's fairly safe to assume that HBGary is getting paid. What I suspect a lot of people are overlooking here is that generally, if the government has contracted to buy something, EVEN IF somebody completely different comes up with the same good (tangible or intangible) for zero or significantly reduced cost, the government is not allowed to purchase unless there are provisions in their existing contract that allow for this. The rules governing this process are the "Federal Acquisition Regulations", are set in stone, and are established so that both sides 'play fair'. The terms of the contract are always upheld unless there are exceedingly dramatic reasons not to, or failures of performance. If I contract to buy 10 servers for the government for $1,000 each, and somebody else then offers 10 identical servers to the government for $0 each, I will still be paid. Since the cost of technology generally goes down over time, this prevents Fed from buying cheaper after the original contract was penned, and is allotted to protect contractors from the Fed, as well as the other way 'round. It's complicated as sin, and yeah, there are loopholes out the wazoo (most of which relate to winning work,) but it's also defined, repeatable and ends up in HBGary getting paid.
  - tomrod 16y ago
    Getting government rents must be very nice.
    - bmelton 16y ago
      It's actually quite a hard way to earn a living. GETTING the contracts is next to impossible, as despite having the FAR in place, they generally are wired for a particular company. Most government work is, of course, only eligible to companies who have 'past qualifications' of doing similar work for government agencies, meaning that new companies have an even harder time breaking into the network of opportunities and that even if you've built a 100 'websites & cms systems' for government agencies, you're not qualified to build a system categorized as 'web portal' unless some of the work you've previously done was labelled as such in the contracts. After you've gotten the contract, it's difficult to work with the government's red tape and still live up to the terms of the contract. If you've ever worked on a project with a prolonged or contracted management life-cycle, you have _some_ idea of what it's like, in a very small sense. Changes requested are shot down by government lifers on little basis. "I vote no, until we've thoroughly thought about the security implications," was a valid rejection on a project I was running that involved, at least partly, replacing plain-text passwords stored in configuration files with Kerberos Keytab certificates. Infuriating, at best. Meanwhile, slips to the project schedule don't affect your project's contractually obligated deadline. The government is generally happy to trod along at a tortoise pace while contractors run sprints in spurts -- weeks waiting on an approval for a change, then sprinting until it's done. Add to that the required overhead of having somebody able to meet incessantly about every single line item in every single invoice. Add to that the fact that in most government agencies, their IT staff is comprised by a heterogenous mix of slow government employees and other contractors that would love to see you fail (as they likely also bid on the work you won, and would love the opportunity to see it rebid in the event that you fail). Add to that having to get approval on every single change in any product, no matter how trivial, by a committee of stakeholders -- the size of which shrinks and grows as the project moves on, and knowing that no change, however firmly approved, is ever REALLY approved until ship date (aside, months after development on a renovation had begun on a portal's backend infrastructure, senior government personnel were still arguing over the look and feel of a mockup that had been approved and finalized prior to the beginning of development.) Again, red tape, red tape, red tape.
wisty 16y ago
They will also probably do some security audit. Believe me, there will be a lot of boxes that will need ticking, meetings, powerpoint shows, and sentences written in the passive voice.