Hacker News Reader

Comment by sleeping_pills | Hacker News Reader

I don't think most of them would be that stupid. Just lazy. In a government official's mind, if the 50 page IT security document was filled out then he can't be held responsible when the shit hits the fan.

View on HN

It's both...it's a problem of incentives. The government guy aint getting stock options or a real bonus or whatever for a job well done. And he's probably close to impossible to fire if he does poorly. So what does he care? And while this is a problem in itself, it also creates a self-selection problem where good candidates don't want to work there in the first place.

My first job out of school was with the US government. I'm speaking from experience. It is worse than you could possibly imagine. Onion levels of absurdity, snake oil levels of effectiveness.

Being young and naive I, at first, thought it was just an isolated case of astonishing incompetence but I came to realize it was actually accepted as normal and good practice across many parts of government.

Once my idealism about civil service wore off I got out of there as fast as possible.

To be honest, I don't think laziness is a problem, either (or at least, THE problem). The problem is the utterly impossible goal of 100% security from all possible threats with a nearly unlimited mandate to do so. The goal is improbable, the consequences dire, so the result is the mad scramble to do visible things. And so we get security theater instead of reasonable precautions and courage in the face of a statistically insignificant threat.

Fifty pages filled out means it is now someone else's job to read those pages and implement. His hands are clean.

Reply on news.ycombinator.com