Obfuscation Is Not Security
There’s been much ado about sensitive information being shared inappropriately with the public. Reality is more nuanced and troubling. Most federal agencies possess deeply ingrained political instincts that overemphasize secrecy in public statements, rely heavily on “obfuscation” as a low-cost security strategy, and suffer from consistently poor operational security (OpSec). A prime example is the Social Security Administration. On February 26, 2014, then Acting Commissioner Carolyn Colvin testified before Congress, stating: “Although there is a low level of fraud in our disability programs, no amount of fraud is tolerable.” While well-intentioned, this kind of messaging sets unrealistic expectations for the public. Fraud is a risk in any large-scale system, and every major bank accepts certain loss levels as the cost of doing business. Striving for zero fraud is noble. Pretending it’s achievable without tradeoffs is misleading. As one former CIA Director put it: “If an organizat...