Using the same password for stuff that doesn't really matter, like your spam collecting email and tracking your exercise, is kind of normal. I wouldn't care if my Gmail or FitnessPal passwords got compromised.
One should never do that for important accounts.
Anyway, that's why password security policies must be enforced, changing passwords regularly must also be enforced, and 2-factor authentication should be enforced as well. Important data should never be stored in non-encrypted form etc.
Government officials are normal people, like everybody else. Most of them simply don't realize how vulnerable they are, and can't be expected to act as if they do.
So ... enforce policies.
The problem is when you have TOP directors that refuse to listen to their security department.
Obama appointed Katherine Archuleta to head OPM in 2013. She had no experience whatsoever in security and refused to follow security guidance. Eventually OPM was hacked. Ms Arculeta later admitted that "more than 21 million complete biographies of applicants for security clearance — including financial and health histories, family trees and other deeply personal data — had been stolen." Another hack at the same time compromised more than 4 million Social Security numbers."
This was not normal information. Anybody who has gone through a classified clearance check knows just how much personal information is included. Your entire life gets documented. And the deeply incompetent DEI hire Ms. Archuleta basically handed over the personal information of 22 million people to some unspecified crooks.
https://www.washingtontimes.com/news/2015/jul/10/katherine-archuleta-quits-opm-director-after-massi/
Last edited: