Hacker News Reader

Comment by roenxi | Hacker News Reader

So from your comment it seems you see a body that is basically advisory. Would I be correct in assuming you see no issue with getting rid of the parts of the EPA that deal in water? They don't sound like they do anything particularly important. They were probably overstepping their mandate with the cybersecurity stuff if your view is accurate; nobody needs to sue them if they don't exercise any control.

Those functions could be wholly coordinated by the states or direct communication between relevant bodies by the way.

View on HN

The EPA is specifically mandated to do this in the clean water act. They're not overstepping at all, and neither is CISA.

I dunno, there seems to be a logical issue here. You've told me that water systems aren't managed at the federal level, and I take you at face value.

So if, as toomuchtodo points out, Republicans are having to sue the EPA to stop them from managing water systems it is clear that the EPA is overstepping their mandate.

If they do in fact have a mandate to manage water systems and the Republicans aren't simply and obviously in the correct moral and legal position here, then this idea that they don't have a mandate must be discarded and they are in fact managing water systems at the federal level.

As can be seen from my earlier posts, I agree with the Republican lawyers & what appears to be your position - the EPA shouldn't be managing water systems. Leave it to the state & local authorities, the results will be better overall. If they are alarmed over something they can report it all they like, but they shouldn't be the ones to try and fix it.

They have a mandate to monitor and set standards for water systems. That's what they're doing here. Implementing those standards is left up to the municipal water supplies that actually manage the water systems. Similarly, CISA has a mandate to monitor and strengthen infrastructure cybersecurity. There's no contradictions here.

If you have questions on the extent of the EPA's mandate and why, you'll probably find the Wikipedia page a better resource than me.

I'm not actually asking questions about the EPA here, this is more an exploration of what you think.

> They have a mandate to monitor and set standards for water systems.

So we've found a point of disagreement, because that is pretty much my definition of management. IMO, to a reasonable approximation, management is the process of monitoring a situation and setting standards that people must meet.

What do you think management involves, and what would separate the work of, say, senior management from what the EPA is doing? If the power to monitor and set standards isn't the heart of management, what is?

It's still local governments designing the water treatment systems, working with suppliers and local polluters, designating water source uses, setting the local quality standards (which may be different than the federal standards), collecting monitoring data, granting discharge permits, getting funding, handling lawsuits, filing state level reports, and so on. I'm barely even scratching the surface of how much is involved with modern infrastructure either.

I don't understand why you think an agency nationally coordinating all the local governments' efforts and making reports to Congress should exist at any level below the federal.

Well yeah, execution has to happen locally. But you did open this with a "Do you think water systems are managed at the federal level? They're not.". And I'm not sure why you think that because you seem to be describing a situation where the EPA, at the federal level, is in fact managing water systems. Obviously we have a terminology disagreement here somewhere.

I mean, if there was a software engineer designing systems, working with vendors, setting his own standards that were higher than company standards, collecting monitoring data, managing permissions, yada yada, we would still have to acknowledge that he was not the manager in the region, he is an employee and the manager is someone else. He is managing some aspects of the situation, no doubt, but if we ask "who is managing all this" the conventional answer isn't the developer, but the developer's manager. "Management" is typically reserved for the senior managers in the area monitoring the outcomes and setting high-level standards. By analogy, the EPA is attempting to manage water systems at the Federal level.

Do parts of that chain of logic seem questionable to you? Is it possible that when you say "managed" you mean what I would call "executed"?

> I don't understand why you think an agency nationally coordinating all the local governments' efforts and making reports to Congress should exist at any level below the federal.

I recommend asking questions if you don't understand something. It works well for me. This (drinking water) is a critical system. Centralised management is too risky, if something goes off the rails then it'd affect drinking water across an entire country. It is better to have disparate systems where failure is more localised.

Right now, the headline suggests <10% of the US is at risk. Trading that for a situation where there is a <10% chance that all of the US is at risk is actually making the risk profile worse. The chance of a problem is the same because nothing has been done to lower the triggers, but the consequences are substantially worse because the system is trying to centralise under the EPA. The EPA shouldn't be in a position where local authorities feel they have to sue them to keep the system decentralised, they shouldn't be trying to manage local operations.

When presented with an issue that poses a real and present danger to the drinking water supply of citizens of this country your contribution is pearl clutching over notional mandates? To be clear, in your opinion "overstepping their mandate" is the bigger threat here? Here's a wild idea, how about we return to the concept of actual governance for the first time in a few decades and actually empower the EPA with both budget and enforcement rights to ensure that local and state run systems that our fellow citizens rely on aren't falling through the cracks?

> ...your contribution is pearl clutching over notional mandates...

> Here's a wild idea, how about we return to the concept of actual governance for the first time in a few decades...

These two ideas are actually somewhat contradictory, I recommend picking one. You can't return to good governance by ignoring governance every time you think something needs to be done.

And you don't need the EPA to be involved to defend against these sort of risks. In fact, standardising the IT approach through the EPA will might increase the risk since any vulnerabilities will be more likely to be standardised. Highly heterogeneous systems are expensive and difficult to cripple. If an adversary wants to attack there is a single point of failure they can target - the EPA process.

> In fact, standardising the IT approach through the EPA will might increase the risk since any vulnerabilities will be more likely to be standardised. Highly heterogeneous systems are expensive and difficult to cripple.

This is not a safe assumption to make. As an example: Standardized patching programs are very basic and reduce a lot of this risk. Without them (or incentive/budget for them), it’s typical for most private and public orgs to end up with pretty bad security posture.

This is a known failure state that results in many known vulnerabilities that can be trivially exploited, regardless of how heterogeneous these various networks are.

Sadly, from what I’ve seen in the news and in various reports, I don’t think many regional organizations have the funding, expertise, or incentive to run effective security programs.

Clearly you need someone involved to defend against these sort of risks as they are demonstrably not being addressed currently. May as well involve the EPA, they already exist and water is already a thing they do. Given we're already discussing a diverse mix of insecure systems "heterogeneity" isn't much of a talking point. You're proposing local and state governments spend orders of magnitude more taxpayer money on duplication of effort. In a forum that generally favors efficiency this seems out of place.

They are being addressed. By the headline something like >90% of the US isn't affected.

If it was a more centralised system, there'd be a 90% chance it was all working and a 10% chance that the incompetent local officials were incompetent EPA officials instead, standardising everyone on insecure systems with nobody able to overrule them. It'd make a bad situation into an all-or-nothing gamble with substantially worse worst-case performance.

> You're proposing local and state governments spend orders of magnitude more taxpayer money on duplication of effort.

Doubt it. The expenses are going to be mostly capital and operating ones that can't be avoided.

10% of the us is like 30 million people.

Is 30 million people’s water being at risk in one of the richest countries on the planet a success? Is it even good enough?

Percentages like that aren’t as meaningful for government as they are for SaaS products.

> Doubt it. The expenses are going to be mostly capital and operating ones that can't be avoided.

This suggests to suspicion you've never worked in or with local or state government agencies and have spent zero time in a water treatment facility. I've done both so here's a couple of things that might help form a more robust picture of the situation:

1. These organizations are typically operating with budgets below the minimum requirements necessary to maintain the systems they're responsible for. This is why municipal bond initiatives are so common for water system maintenance and expansion projects.

2. Private contractors created this situation. Local and State government agencies contract out all of their IT projects and do not have personnel on staff capable of performing the work under discussion.

Point 1 isn't anything to do with economies of scale though - the municipal authorities could operate with an appropriate budget.

Point 2 is underdone, the question is basically should knowledge be in the private or public sector. Given that the private sector is generally more efficient than the public it seems a bit of an assertion to say that contracting out projects will decrease efficiencies. It could easily make the situation better. The US Federal government is absolutely known for being captured by contractors and consulting firms because it is a big, obvious & lucrative target and its bandwidth is completely overwhelmed to the point where very few people vote based on EPA policy. Odds are it'd be much more efficient to handle that at a lower level of government.

> This suggests to suspicion you've never worked in or with local or state government agencies and have spent zero time in a water treatment facility.

This is a silly point. I might as well ask "Are you one of the people who are managing water operators in the US incompetently?". If the debate is that the managers are clearly not up to the challenge, a lack of expertise is not a downside because the process the managers are using is being challenged.

I have had a lot of experience on the subject of organisational design. If you want better results, centralising into a single unaccountable bureaucracy isn't usually the way to get there. It is a bad strategy.

Private industry is even less accountable to the public than government agencies so that dog doesn't hunt.

How so? What accountability measures exist for the EPA that don't exist for the private sector?

I anticipate you saying voting, so I'll preemptively observe that voters can vote for the government to switch to a different private provider too. Voting doesn't lose any of its potency if the government uses contractors, although it runs into the same problem as always that the EPA is realistically never going to be high enough on the priority list to change an election's outcome.

There's many people who would reasonably disagree with a course like this, because there are no elected positions in the EPA.

The whole "overstepping their mandate" thing is perceived as a very real and present threat among MAGA people, for this reason specifically. This is the whole notion of "The Swamp" Trump was going to drain; unelected career bureaucrats.

That they would disagree isn't in question. That their position is reasonable is, however, very much up for debate. Career bureaucrats are literally the pool of experience and expertise that make government agencies function, to the extent that's possible given legislative hobbles. The only thing that gets drained when these people are replaced by elected officials or private industry is expertise and theoretically sane incentives.

It’s funny how it seems we care more about years of expertise for the engineers on our software teams than the people running government.

There’s a balance that needs to be struck between new blood with fresh perspectives and old guard with decades of experience navigating Washington politics.

Reply on news.ycombinator.com