3 ms·
It’s 2025, not 1995, and it’s not like the people in charge of classified information handling at the national level haven’t heard of SPF or the concept of chec
by acdha 2y ago
It’s 2025, not 1995, and it’s not like the people in charge of classified information handling at the national level haven’t heard of SPF or the concept of checking email headers – or simply picking up the phone and asking for confirmation for a huge amount of work which they’re personally liable for confirming is approved. There’s no way they haven’t had training on federal records laws which included the consequences of not following those rules.
If this was not an official instruction, the response to the press would be a simple “no, I did not authorize that”. That message isn’t ambiguous and it’s not the kind of thing you’d forget sending.
- snvzz 2y ago>it’s not like the people in charge of classified information handling at the national level haven’t heard of SPF or the concept of checking email headers I'd hope. But I wouldn't count on it.
- acdha 2y agoI would. That kind of thing is a federal requirement for many years (https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security https://www.cisa.gov/news-events/directives/bod-18-01-enhanc... was codifying existing practice) and everyone gets training on phishing which includes things like getting confirmation if you’re unsure. This is a highly sensitive request, almost certainly in violation of their records policies, so asking for confirmation is about as controversial as a bank teller calling the bank’s president to confirm that it’s really him asking to empty out the vault.