As someone who works in a MUCH smaller organization that deals with 'sensitive' data, it is extremely difficult to maintain the policy of least privilege. The

As someone who works in a MUCH smaller organization that deals with 'sensitive' data, it is extremely difficult to maintain the policy of least privilege. The system almost can not be maintained from the outside, because administrators don't see every individual document, and not all sensitive forms of data can be targeted by automation/scanners. This means the actual people doing the business processes with the data must take personal responsibly for keeping it properly maintained. And aside from that nebulous property of 'personal responsibility' they must also have an accurate ability to classify it. Aside from that, workers who deal with the data have a bunch of conflicting incentives, like working with people in other teams, working efficiently, and maintaining the policy of least privilege. The problems I've seen dealing with keeping information secure in a small environment make me feel like it'd actually be impossible to do at the scale of The US Government. So yeah, my money is on 'organizational failure' but also 'inherent complexity'