Notices by Dan Hon (danhon@dan.mastohon.com), page 2

26/ I *cannot imagine* what it is like for the people in 18F and the US Digital Service right now and I don't hold them in judgment at all.

Like, I'm sure I know the person who was instructed to and made the commits on websites to scrub anything to do with DEI, likely under threat.

14/ But the only effective, practical thing stopping changes is because there is a rule and you would get in trouble for breaking the rule.

The person running DOGE and this administration don't care about getting in trouble for breaking those rules.

*There is nothing to stop them*

15/ There is a thing in federal government called an ATO, an Authority to Operate: digital.gov/resources/an...

You are not supposed to, uh, operate a software system without obtaining an ATO. Normally this is really hard! (In many cases it shouldn't be)

16/ The DOGE team are absolutely behaving in a way that suggests they don't give a shit about ATOs.

What's terrifying is that there is nobody stopping them.

Which is why I said this comes down to *people making decisions* and *whether those people care about consequences*.

17/ What's happening *is just like* a corny Bond supervillain plot. Get control of the computer and information systems and you can do *a lot*.

You *can* stop payments. You *can* just turn things off. You *can* just break them, which practically can be the same as turning things off.

18/ "But Dan, what about security measures like, I don't know, some sort of 2FA or a PIV card, or multiple signoffs before deploying?"

1) "You're fired unless you give me that 2FA code"
2) "You're fired unless you give me your PIV"
3) "You're fired unless you approve this deployment"

19/ In computer security, there's a class of problem called The Evil Housekeeper Problem*. Basically: once someone has physical access to a system, you are effectively screwed.

* Used to be The Evil Maid Problem, but we're making DEI progress

12/ One reason why rules make it so difficult to change government technology is because it's brittle.

It *is* reliable, but until the technology is capable of rolling back a change, making changes absolutely comes with risk.

13/ Here's a reason why there are rules that make it hard to make changes to government technology:

A system in California deals with submitting federal Medicaid reimbursement. When I worked with that system, it dealt with so much that if it broke for one day, *California would be insolvent*

1/ Here's my take on what's happening with DOGE.

I've got fed experience through contracting with Health & Human Safety, Head Start, The Centers for Medicare and Medicaid Services, and DOD. I get brought in when people need to get shit done. Other people here have way more experience than me.
https://dan.mastohon.com/@danhon/113953007466779969

2/ (Meanwhile, check out the reporting at https://wired.com and https://404media.co, it's good and you can tell they've got good sources.)

It's really bad!

Here's the thing about tech in general, and tech in gov specifically. It's always about people, not the technology.

3/ *The most important thing* to realize here is that technology is just a tool and it's used at the direction of people to accomplish their goals.

The second most important thing is that *things change when they are deemed important enough*.

COVID and unemployment insurance is a good example.

5/ Unemployment Insurance (UI) systems needed to be modernized for lots of reasons before COVID hit.

But the lesson of COVID-19 is that modernizing, upgrading, and making government services simpler, clearer, faster *could have happened at any time* if it was deemed important enough.

4/ When COVID hit, a whole bunch of government technology became critical and politically sensitive. Just the same way the launch of the Affordable Care Act website was botched.

In both cases, "we" *knew* what to do, how to figure it out, and and how to do it.

7/ What's happening is the combination of:

i) People at the highest level of leadership with clear priorities
ii) People who _don't care about the consequences_
iii) A bureaucratic model of deference

And I think at the lowest level, some of the actual tech.

6/ I give you all this setup because like I said, the most important thing to realize is that the combination of Musk and the President and the administration's core have made what they want to achieve *very, very, very important*.

9/ Some of the rules stopping you from changing government technology (from the copy on a webpage to changing how rebates are calculated) are reasonable and make sense.

8/ In normal times, it is very very very hard to make a change to government technology. This is mainly because there are rules to stop you and people who will enforce those rules. It is much less so because of the underlying technology.

10/ But many of the rules are unreasonable. They are absolutely too conservative in favor of reducing risk. Sometimes this is described as "doing nothing is the least riskiest option"*

* It's wrong, because the current position is frequently risky itself.

11/ Across government, most of the people who enforce & make these rules are unqualified and inexperienced.

In a safe environment, they will admit that. Most of our knowledge has been hollowed out to the private sector. On purpose.