Willful ignorance. "No indication" meaning they haven't seen any evidence anything was compromised. Could be because they've been working very hard not to look at any evidence or analysis of what happened. "I'm not aware of X" is very different from "X is not true".
> “Ultimately, this is a thing you can’t solve with a technical control,” Boileau said on this week’s podcast. “This is a human problem where you’ve hired a contractor to do this work and they have decided of their own volition to use GitHub to synchronize content from a work machine to a home machine. I don’t know what technical controls you could put in place given that this is being done presumably outside of anything CISA managed or even had visibility on.”
More competent technical control means a random contractor doesn't have passwords from mid-2025 to copy to their home machine that even still work after 30 days, if not 5.
What an egregious mistake. "exhibits a pattern consistent with an individual operator using the repository as a working scratchpad or synchronization mechanism rather than a curated project repository" - isn't is git 101 to not put creds in git? What pattern do they think this is consistent with?
It's almost like gutting the agency of experts diminishes their opsec capacity among many others.
In 2020 Chris Krebs contradicted stolen election claims. In 2025, Trump sacked Krebs and revoked his clearance, leaving CISA without a director. https://en.wikipedia.org/wiki/Chris_Krebs
Reduced funding has nothing to do with degraded service. MTA is one of the worlds most expensive public transit systems and 15-20% of it's 21 billion dollar budget is being consumed by debt. The term enshittification, in my view, is just a progressive catch phrase for systemantics.
Any system grows to fill its known universe and as it grows it operates in unpredictable ways. And the unseen changes dictate what the system really does (not it's job title). MTA is not here to be your public transportation. It's job is to generate massive debt for investment bankers on wall street who get paid through nefarious interest swap agreements. And how many other city metro's are operating under the same investment banking schemes? From what I could tell LA, Denver, Phili, Detroit and (up until recently) Chicago.
> CISA, which lost more than a third of it workforce and almost all of its senior leaders after the Trump administration forced a series of early retirements, buyouts, and resignations across the agency’s various divisions
Lawmakers want answers but they never provide answers themselves. Who watches the so-called watchers? Corruption on a massive scale on by lawmakers but when a key gets published, heads will roll? Keys are mistakenly published all the time by very smart people. Ever ran rm -rf *? Every destroy a production db? Ever power off the wrong server? Yes.
Seems senators had questions about why CISA was scaling back efforts related to election security[1]. Tulsi's resignation today seems interestingly timed to when this became public.
I remember when they leaked a million SF-86s. You know, the form we fill out with a ton of highly personal information so they can decide if we can be trusted with sensitive data.
If these guys who are supposed to be the experts cannot really be secure on the internet, I'm not sure how anyone else is supposed to be secure on the internet.
19 comments
[ 14.4 ms ] story [ 49.4 ms ] threadOh wow. Except for those secrets.
More competent technical control means a random contractor doesn't have passwords from mid-2025 to copy to their home machine that even still work after 30 days, if not 5.
In 2020 Chris Krebs contradicted stolen election claims. In 2025, Trump sacked Krebs and revoked his clearance, leaving CISA without a director. https://en.wikipedia.org/wiki/Chris_Krebs
In March 2025, the cuts began. https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st...
In 2026, it was still without a director and running on fumes. https://techcrunch.com/2026/02/25/us-cybersecurity-agency-ci...
This activity is consistent with intentionally weakening a country's defenses from within and sowing chaos.
Eventually, paths like that may lead to increased privatization through security contractors.
Any system grows to fill its known universe and as it grows it operates in unpredictable ways. And the unseen changes dictate what the system really does (not it's job title). MTA is not here to be your public transportation. It's job is to generate massive debt for investment bankers on wall street who get paid through nefarious interest swap agreements. And how many other city metro's are operating under the same investment banking schemes? From what I could tell LA, Denver, Phili, Detroit and (up until recently) Chicago.
[1]https://www.padilla.senate.gov/newsroom/press-releases/padil...