December 2011 the Economic Development Administration was notified by the Department of Homeland Security that there was a malware infection spreading around it’s network, referred to in the report as a “cyber-incident”.

Malware infections happen, it’s why you keep a trusted computer company with IT professionals around to fix these problems.  The Federal Gov’t, on the other hand, apparently doesn’t have any of those…

In the report put out June 26, 2013 by the Department of Commerce, who oversees the EDA, they “found neither evidence of a widespread malware infection nor support for EDA’s decision to isolate its IT systems from the HCHB network…Our review of EDA’s recovery activities found that (a) EDA decided to replace it’s entire IT infrastructure based on its incorrect interpretation of recovery recommendations and (b) EDA’s recovery efforts were unnecessary.”

If that sounds like mistakes were made and those who don’t know enough about technology are in charge of our government’s technology, it only get’s worse from there.  That paragraph includes the replacement of their entire IT infrastructure, but that doesn’t really make clear the extent of waste involved.

“EDA’s CIO concluded that the risk, or potential risk, of extremely persistent malware and nation-state activity (which did not exist) was great enough to necessitate the physical destruction of all EDA’s IT components. EDA’s management agreed with the risk assessment and EDA initially destroyed more than $170,000 worth of it’s IT components, including desktops, printers, TVs, cameras, computer mice and keyboards. By August 1, 2012, EDA had exhausted funds for this effort and therefore halted the destruction of it’s remaining IT components, valued at over $3 million. EDA intended to resume this activity once funds were available . However, the destruction of IT components was clearly unnecessary because only common malware was present on EDA’s IT systems.”

So many innocent mice lost their lives!  And worse is the amount of taxpayer money wasted in this purge.

 

Is this a case of merely not having the right personnel in key IT positions in the government?  A pervasive feeling in our government that money can just be spent with no worry about accountability?  Or is this an example of a bureaucratic calamity, where not having highly skilled technology professionals or an appropriate concern for taxpayer money came together in a tsunami of government incompetence?

I’ve never met an IT professional who would ever tell you that destroying your mouse is going to put an end to that malware, spyware, ransomware infection.  Of course all these infections are something to be taken very seriously, but with the appropriate amount of knowledge guiding both your decisions after an infection is detected and on the front end managing network vulnerabilities a report like this should never have to be written.