Hacker News Reader

Comment by pcaharrier | Hacker News Reader

Notice that the email from the deputy CIO mentions SCuBA.This is the "Secure Cloud Business Application Project" from CISA.If you look at two of the required policies you will find this:

"A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role."[1]

and

"Privileged users SHALL be provisioned with finer grained roles instead of Global Administrator."[2]

So at least for the agency-wide removal of security administrator roles, that would seem to be unrelated to anything DOGE was doing. The NLRB was supposed to be doing that anyway.

[1] https://www.cisa.gov/resources-tools/services/m365-entra-id#... [2] https://www.cisa.gov/resources-tools/services/m365-entra-id#...

View on HN

Is this a new policy? Otherwise, why this sudden and broad implementation so that "suddenly none of the IT employees at the agency could do their jobs properly anymore" (according to the source).

It's pretty new, yes. The binding operational directive from CISA only came down in December. Agencies are in the midst of running the assessment tools and implementing the changes right now. See here: https://www.cisa.gov/news-events/directives/bod-25-01-implem....

The policy you linked doesn't say "agency-wide removal of security administrator roles". It discusses a limit. That says nothing about how many there were here, how it suddenly changed, how elmu's DOGE was able to gain administrator access despite these restrictions, how elmu's DOGE administrators were chosen, etc.

Yes, a limit of eight. Meaning that if there were more than eight across the agency, the rest were supposed to be removed by order of CISA. So the binding operational directive is a plausible, alternate explanation of the facts reported in the article. Again, I didn't just do a google search and come up with this; the Deputy CIO specifically mentioned SCuBA in the email that's put in the article. It's not my fault that neither Krebs (nor anyone else, apparently) decided to look into what the email meant by "SCUBA."

> Meaning that if there were more than eight...

That seems like a big "if". What I'm asking is, how many were there before elmu's DOGE started compromising systems? Was it more than 8? If not, that would not be a valid justification for the DCIO to cite.

Did elmu's DOGE make sure not to grant themselves administrative access (because that would make it more than 8)?

How many remain? Is it 8? Do the current administrators match the ones which existed before elmu's DOGE started compromising systems?

This is about the Global Administrator role. I don't believe that the employee had this role to begin with.

Otherwise this quote wouldn't make sense:

> [...] top-tier user privileges that neither Berulis nor his boss possessed

However, my guess would be that this is the role that DOGE employees requested to be assigned as it is the role with the highest level of privileges.

Reply on news.ycombinator.com