Or maybe that'd have been the sort of project and standard CISA would have formerly done before the Republicans gutted it last year I guess, and this is just another symptom of rot? But yeah to your point technology certainly can absolutely help with this sort of thing. It's not some inevitable act of nature.
They do use it for a lot, but there are a lot of things that need to authenticate to each other in a modern ecosystem, especially if you're trying to replace security based on network boundaries as trust boundaries with zero trust (as the government is).
I worked with more than a few IL4 systems where the PKI/smartcard stuff was simply shoved into an F5 that did TLS termination and then everything on the internal VPC just used HTTP headers without even a crypto signature to convey which user had actually logged in.
As with anything else, the more you make it easy to the do the right thing, the more often you tend to see the right thing being done. So agencies that make it easy to request server PKI certs see increased uptake, other agencies just have server-to-server auth done by PSKs / API keys instead.
So the concern isn't usually cost but compliance, if it's nearly impossible to get those little developer experience affordances ATO'd themselves, agencies will instead just focus on getting the mission system itself ATO'd come hell or high water and the devs just get told to piece it together however...
The usage of "exhibit a pattern consistent with..." is just describing what it looks like the repository was used for. i.e. it's not a set of government sourcecode for an internal project, it's not something indicative of intentionally leaking large amounts of data, etc.
They clearly stated what pattern this usage is consistent with: using it as a sort of personal scratch pad.
You’re assigning more meaning to the statement than there is. They are simply stating an observation.
You'd be rich if you got a dollar for every worldwide murder too, but that doesn't make murder a common workplace occurrence.
In public data (source code on GitHub, etc.) you can expect a prevalence somewhere in the range of 0.5-2.5 live secrets per gigabyte of content. Now yes, there are more than 8 billion people on earth now and the murder prevalence is a lot higher than 0.5-2.5 per billion. But there are _far_ more bytes of public content than there are people on earth, so in absolute terms, there are far more leaked secrets than murders.
If you look at other types of data (like internal Git forges), the prevalence is much higher.
I think you could indeed retire with $1 per leaked secret!
This makes it seem more intentional to me. Regardless of what the ultimate purpose were use of the repository was it says to me, the person knew what they were doing and it wasn’t just an innocent oversight like anybody could’ve made.
The nuance here: when I’ve slipped and committed secrets, it’s typically a relative nothing burger: most common case is API keys to some third-party service. I’ve worked across a bunch of regulated industries and, within those, not caused a breach—because being in that space you know to be more careful, and because the companies in those spaces (wisely!) tend to support good security practices, more so than the industry average.
In 2020 Chris Krebs contradicted stolen election claims. In 2025, Trump sacked Krebs and revoked his clearance, leaving CISA without a director. https://en.wikipedia.org/wiki/Chris_Krebs
In March 2025, the cuts began. https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st...
In 2026, it was still without a director and running on fumes. https://techcrunch.com/2026/02/25/us-cybersecurity-agency-ci...
This activity is consistent with intentionally weakening a country's defenses from within and sowing chaos.
It's staggering the country is just looking at him.
[1]https://www.padilla.senate.gov/newsroom/press-releases/padil...
This is the "who killed Hannibal" meme. If Padilla and Warner didn't know about this, then they're incompetent themselves. Especially because they reported on it last year:
https://www.padilla.senate.gov/newsroom/news-coverage/cnn-tr...
Why did you forget this happened, Padilla?
because behind any senator there is a propaganda team, not a brain
Propaganda that just confirms preexisting mass delusions is actually pretty easy to run if you have a lot of support from similar actors running adjacent campaigns.
Eventually, paths like that may lead to increased privatization through security contractors.
Any system grows to fill its known universe and as it grows it operates in unpredictable ways. And the unseen changes dictate what the system really does (not it's job title). MTA is not here to be your public transportation. It's job is to generate massive debt for investment bankers on wall street who get paid through nefarious interest swap agreements. And how many other city metro's are operating under the same investment banking schemes? From what I could tell LA, Denver, Phili, Detroit and (up until recently) Chicago.
CISA, however, was the administration whose head was caught using an unauthorized commercially-hosted LLM for government data a few months ago:
Oh wow. Except for those secrets.
So "no indication" is completely correct.
More competent technical control means a random contractor doesn't have passwords from mid-2025 to copy to their home machine that even still work after 30 days, if not 5.