5 ms·

It's not really a breach if it is from the same organization (i.e. the executive branch). It may lead to one.

by mattmaroon 2y ago

Frankion 2y ago
[dead]
johnnyanmac 2y ago
Technically yes. I'd still be just as worried as a breach given the context though.
atkailash 2y ago
[dead]
lozenge 2y ago
Although authorised by some members of the executive branch, it is missing some of the oversight the executive branch is supposed to have.
- rayiner 2y ago
  Such as what oversight exactly?
  - afavour 2y ago
    Security clearances are surely one? Government employees with access to that data are heavily vetted. DOGE, not so much.
    - rayiner 2y ago
      Security clearances for classified information and most IRS employees don’t have security clearances.
      - philistine 2y ago
        Yeah, let's just assume there are no safeguards in place at the IRS to protect personal data.
        xyzzyz 2y ago
        These IRS safeguards will not be of the “security clearance required” form. IRS data, while private, is not classified.
        master_crab 2y ago
        This. IRS data isn’t protected because it’s classified. It’s protected because of confidentiality enforced by laws passed by Congress (the Tax reform act I believe) (and the fact that the executive branch can be sued out of their pants for civil damages).
        jrs235 2y ago
        *(and the fact that the executive branch can be sued out of their pants for civil damages) if the government agrees to allowing itself to be sued...
        genewitch 2y ago
        They have 500MB email boxes! Actually I wonder, now, because they wanted to hire 84k people last year...
        rayiner 2y ago
        You’re the one assuming DOGE is ignoring “safeguards” you don’t even know exist.
        afavour 2y ago
        We know they are? > The USAID systems the DOGE team tried to access included personnel files and security systems, including classified systems beyond the security level of at least some of the DOGE employees, according to three of the sources. The systems also included security clearance information for agency employees, two of the sources said. https://www.nbcnews.com/politics/national-security/usaid-security-leaders-removed-refusing-elon-musks-doge-employees-acce-rcna190357 https://www.nbcnews.com/politics/national-security/usaid-sec...
    - evanjrowley 2y ago
      I'm familiar with IRS contracts and while security clearances are not involved, they do have a unique background investigation process that involves a tax audits.
    - figassis 2y ago
      It would not be security clearances, but some form of assurances for protecting PII. Think of it this way. If this system contained people’s credit cards numbers, the entire system would be required to be PCI certified, and that requires that processes and procedures be in place so that even employee access is extremely limited. Data shouldn’t even be plaintext at rest. No one really needs to see anyone’s credit card number. Anonymized data is just fine. So some agency, authorized by the president or not, barging in asking for read/write access to card numbers should not be allowed, because the data aren’t the president’s to give. Same should be valid for social security numbers. You can’t guarantee that 100% of DOGE’s employees are benign, or that they are have the best opsec, or that their devices are not exploitable (or exploited already). So you minimize this attack surface by minimizing access. Because if anything happens, then you can be 100% certain that Musk/Trump will not voluntarily answer for it/make people whole. They will at best be taken to court where they will fight for years while the victims suffer the consequences in the present. So you do everything you can to prevent this nebulous, blameless “we meant well, we couldn’t know this would happen, we’re sorry for all the pain, let’s move forward together” outcome.
  - snowwrestler 2y ago
    Congress is in charge of the IRS, and the president is charged with operating it. Since the president and members of Congress are not posted up in there 24/7, the IRS has created internal controls and procedures so that when the president or Congress asks for a report, the IRS can give them an accurate one. It’s these controls that people are thinking of. The article has an example: > Political officials do not have access to the Integrated Data Retrieval System, or IDRS. The IRS’s commissioner, national taxpayer advocate and even senior officials in the office of the chief information officer, do not have IDRS access either. “Do not have access” in this case means they have made internal rules, essentially denying themselves access, in order to better document that they are doing what Congress wants them to do. This is true in many agencies, and one of the concerns with DOGE is that they seem to be trying to circumvent these controls. That may impair the ability of an agency to meet their legislative mandate (e.g. protecting taxpayer privacy), and also impair the agency’s ability to even document what they are doing. So the answer to “what oversight” is that Congress ultimately has the power of oversight, and the executive branch has the responsibility to operate in such a way that they can accurately satisfy requests from Congress.
  - freejazz 2y ago
    The legislation and the judiciary, this is Civics 101.
Applejinx 2y ago
It is if it's actually to a foreign adversary.
- fjjjrjj 2y ago
  https://www.businessinsider.com/musk-spotted-pro-putin-russian-tv-presenter-world-cup-2022-12 https://www.businessinsider.com/musk-spotted-pro-putin-russi...
- scarab92 2y ago
  [flagged]
  - krapp 2y ago
    [flagged]
  - dang 2y ago
    Could you please stop posting flamebait comments and please stop duplicating comments? You've been doing way too much of this and are over the line at which we'd ban an account. I don't want to ban you because everyone goes on tilt sometimes, but please stop now. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
deleted 2y ago
[deleted]
dboreham 2y ago
It's like if your CEO sent you an email saying you should give the production DB credentials, and any encrypted at rest keys to their cousin. Probably you wouldn't do that.
- Spivak 2y ago
  Like technically he does have the authority to compel you to do that but at the same time it's a massive red flag if he asks you in the first place. I do understand why this administration is trying very hard to centralize authority because it's faster than vetting a bunch of people they can trust to act on their behalf. But on the other hand federal employees making it as hard as possible to do what they perceive as bad/immoral is a soft-check on the executive.
  - aforwardslash 2y ago
    He may not actually have the authority for it; Imagine you're a cto receiving this request - you don'respond to the ceo, but to the administration board instead, just like the ceo. In fact, if you were a cto and you carried out this request without any kind of due diligence or vetting, you'd probably be legally and criminally liable for it. The same applies to anyone under the cto management (so basically all IT); they don't respond to the ceo, their top boss is the cto. I know, in smaller companies, where the ceo is also the owner, there is a tendency to confuse the boundaries of the roles - in my experience, it is up to the cto to politely deny these requests and educate the ceo on the "why"; if he still wants to move forward, he can hire another cto
- mattmaroon 2y ago
  You might resist, but if you didn’t it would hardly be a data breach.
kevin_thibedeau 2y ago
We can be all but certain that the CCP has its tendrils into Big Balls' phone and computers. A bunch of idiots with no opsec skills makes for easy pickings.
- cced 2y ago
  Why does the ccp always come up in these discussions? You have Rogue billionaire taking an axe at the pillars of government and there’s still someone bringing up the ccp. Why
  - Kelvin506 2y ago
    A lot of people are so brainwashed by U.S. propaganda they cannot comprehend that American billionaires are independently evil. Add to that the fanboyism where his sycophants can't see how utterly rotten Musk is and always has been. Their sense of world order requires there be a shadowy threat actor such as Russia or China, instead of the obvious truth that this is American capitalism operating as designed.
    - andriesm 2y ago
      What makes Musk so utterly rotten? Otherwise "it's just like your opinion, man..." "Requires a shadowy threat actor such ad Russia and..."? Trump is trying to normalize US-Russian relations. "This is American capitalism operating as designed" - Honestly what do you mean? Trump and Musk's reforms looks different enough from anything else tried in the last 25 years that I am super curious to see where it goes. I'm not into fear porn that this is the end of the world, H*tler, or whatever. I'm also curious about Billionaires being independently evil - what do you mean, are virtually all billionaires evil? Are they really morally worse people than the average or do they just have access to more resources and influence?
      - fjjjrjj 2y ago
        > I'm not into fear porn that this is the end of the world, H*tler, or whatever. Are you are okay with Trump splitting Ukraine with Russia and blessing Russia's war on Ukraine? There are historical parallels with Hitler annexing other countries. You not being into that reality is a choice.
wodenokoto 2y ago
You can have data breaches within an organization.
- mattmaroon 2y ago
  Ok, you’re right, but this is not that. This is the leader of the organization specifically wanting them to have the data.

It's not really a breach if it is from the same organization (i.e. the executive branch). It may lead to one.

Frankion 2y ago

[dead]

johnnyanmac 2y ago

Technically yes. I'd still be just as worried as a breach given the context though.

atkailash 2y ago

[dead]

lozenge 2y ago

Although authorised by some members of the executive branch, it is missing some of the oversight the executive branch is supposed to have.

rayiner 2y ago
Such as what oversight exactly?
- afavour 2y ago
  Security clearances are surely one? Government employees with access to that data are heavily vetted. DOGE, not so much.
  - rayiner 2y ago
    Security clearances for classified information and most IRS employees don’t have security clearances.
    - philistine 2y ago
      Yeah, let's just assume there are no safeguards in place at the IRS to protect personal data.
      - xyzzyz 2y ago
        These IRS safeguards will not be of the “security clearance required” form. IRS data, while private, is not classified.
        master_crab 2y ago
        This. IRS data isn’t protected because it’s classified. It’s protected because of confidentiality enforced by laws passed by Congress (the Tax reform act I believe) (and the fact that the executive branch can be sued out of their pants for civil damages).
        jrs235 2y ago
        *(and the fact that the executive branch can be sued out of their pants for civil damages) if the government agrees to allowing itself to be sued...
      - genewitch 2y ago
        They have 500MB email boxes! Actually I wonder, now, because they wanted to hire 84k people last year...
      - rayiner 2y ago
        You’re the one assuming DOGE is ignoring “safeguards” you don’t even know exist.
        afavour 2y ago
        We know they are? > The USAID systems the DOGE team tried to access included personnel files and security systems, including classified systems beyond the security level of at least some of the DOGE employees, according to three of the sources. The systems also included security clearance information for agency employees, two of the sources said. https://www.nbcnews.com/politics/national-security/usaid-security-leaders-removed-refusing-elon-musks-doge-employees-acce-rcna190357 https://www.nbcnews.com/politics/national-security/usaid-sec...
  - evanjrowley 2y ago
    I'm familiar with IRS contracts and while security clearances are not involved, they do have a unique background investigation process that involves a tax audits.
  - figassis 2y ago
    It would not be security clearances, but some form of assurances for protecting PII. Think of it this way. If this system contained people’s credit cards numbers, the entire system would be required to be PCI certified, and that requires that processes and procedures be in place so that even employee access is extremely limited. Data shouldn’t even be plaintext at rest. No one really needs to see anyone’s credit card number. Anonymized data is just fine. So some agency, authorized by the president or not, barging in asking for read/write access to card numbers should not be allowed, because the data aren’t the president’s to give. Same should be valid for social security numbers. You can’t guarantee that 100% of DOGE’s employees are benign, or that they are have the best opsec, or that their devices are not exploitable (or exploited already). So you minimize this attack surface by minimizing access. Because if anything happens, then you can be 100% certain that Musk/Trump will not voluntarily answer for it/make people whole. They will at best be taken to court where they will fight for years while the victims suffer the consequences in the present. So you do everything you can to prevent this nebulous, blameless “we meant well, we couldn’t know this would happen, we’re sorry for all the pain, let’s move forward together” outcome.
- snowwrestler 2y ago
  Congress is in charge of the IRS, and the president is charged with operating it. Since the president and members of Congress are not posted up in there 24/7, the IRS has created internal controls and procedures so that when the president or Congress asks for a report, the IRS can give them an accurate one. It’s these controls that people are thinking of. The article has an example: > Political officials do not have access to the Integrated Data Retrieval System, or IDRS. The IRS’s commissioner, national taxpayer advocate and even senior officials in the office of the chief information officer, do not have IDRS access either. “Do not have access” in this case means they have made internal rules, essentially denying themselves access, in order to better document that they are doing what Congress wants them to do. This is true in many agencies, and one of the concerns with DOGE is that they seem to be trying to circumvent these controls. That may impair the ability of an agency to meet their legislative mandate (e.g. protecting taxpayer privacy), and also impair the agency’s ability to even document what they are doing. So the answer to “what oversight” is that Congress ultimately has the power of oversight, and the executive branch has the responsibility to operate in such a way that they can accurately satisfy requests from Congress.
- freejazz 2y ago
  The legislation and the judiciary, this is Civics 101.

Applejinx 2y ago

It is if it's actually to a foreign adversary.

fjjjrjj 2y ago
https://www.businessinsider.com/musk-spotted-pro-putin-russian-tv-presenter-world-cup-2022-12 https://www.businessinsider.com/musk-spotted-pro-putin-russi...
scarab92 2y ago
[flagged]
- krapp 2y ago
  [flagged]
- dang 2y ago
  Could you please stop posting flamebait comments and please stop duplicating comments? You've been doing way too much of this and are over the line at which we'd ban an account. I don't want to ban you because everyone goes on tilt sometimes, but please stop now. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

deleted 2y ago

[deleted]

dboreham 2y ago

It's like if your CEO sent you an email saying you should give the production DB credentials, and any encrypted at rest keys to their cousin. Probably you wouldn't do that.

Spivak 2y ago
Like technically he does have the authority to compel you to do that but at the same time it's a massive red flag if he asks you in the first place. I do understand why this administration is trying very hard to centralize authority because it's faster than vetting a bunch of people they can trust to act on their behalf. But on the other hand federal employees making it as hard as possible to do what they perceive as bad/immoral is a soft-check on the executive.
- aforwardslash 2y ago
  He may not actually have the authority for it; Imagine you're a cto receiving this request - you don'respond to the ceo, but to the administration board instead, just like the ceo. In fact, if you were a cto and you carried out this request without any kind of due diligence or vetting, you'd probably be legally and criminally liable for it. The same applies to anyone under the cto management (so basically all IT); they don't respond to the ceo, their top boss is the cto. I know, in smaller companies, where the ceo is also the owner, there is a tendency to confuse the boundaries of the roles - in my experience, it is up to the cto to politely deny these requests and educate the ceo on the "why"; if he still wants to move forward, he can hire another cto
mattmaroon 2y ago
You might resist, but if you didn’t it would hardly be a data breach.

kevin_thibedeau 2y ago

We can be all but certain that the CCP has its tendrils into Big Balls' phone and computers. A bunch of idiots with no opsec skills makes for easy pickings.

cced 2y ago
Why does the ccp always come up in these discussions? You have Rogue billionaire taking an axe at the pillars of government and there’s still someone bringing up the ccp. Why
- Kelvin506 2y ago
  A lot of people are so brainwashed by U.S. propaganda they cannot comprehend that American billionaires are independently evil. Add to that the fanboyism where his sycophants can't see how utterly rotten Musk is and always has been. Their sense of world order requires there be a shadowy threat actor such as Russia or China, instead of the obvious truth that this is American capitalism operating as designed.
  - andriesm 2y ago
    What makes Musk so utterly rotten? Otherwise "it's just like your opinion, man..." "Requires a shadowy threat actor such ad Russia and..."? Trump is trying to normalize US-Russian relations. "This is American capitalism operating as designed" - Honestly what do you mean? Trump and Musk's reforms looks different enough from anything else tried in the last 25 years that I am super curious to see where it goes. I'm not into fear porn that this is the end of the world, H*tler, or whatever. I'm also curious about Billionaires being independently evil - what do you mean, are virtually all billionaires evil? Are they really morally worse people than the average or do they just have access to more resources and influence?
    - fjjjrjj 2y ago
      > I'm not into fear porn that this is the end of the world, H*tler, or whatever. Are you are okay with Trump splitting Ukraine with Russia and blessing Russia's war on Ukraine? There are historical parallels with Hitler annexing other countries. You not being into that reality is a choice.

wodenokoto 2y ago

You can have data breaches within an organization.

mattmaroon 2y ago
Ok, you’re right, but this is not that. This is the leader of the organization specifically wanting them to have the data.