'Will They Be Fired?': Nancy Mace Asks Official If Employee At Fault For Data Breach Will Be Fired

At Wednesday's House Administration Committee hearing, Rep. Nancy Mace (R-SC) grilled officials about the data breach of the D.C. Health Exchange.
Fuel your success with Forbes. Gain unlimited access to premium journalism, including breaking news, groundbreaking in-depth reported stories, daily digests and more. Plus, members get a front-row seat at members-only events with leading thinkers and doers, access to premium video that can help you get ahead, an ad-light experience, early access to select products including NFT drops and more:
account.forbes.com/membership...
Stay Connected
Forbes on Facebook: forbes
Forbes Video on Twitter: / forbes
Forbes Video on Instagram: / forbes
More From Forbes: forbes.com

[@steveladner4346]

Will they be fired?? 😂 Fast food workers are held to much higher standards.

[@DD-bn2mx]

Just like the ":fast food workers", dumb and cheap standards.

[@pay-tray-it4897]

He'll no! There still trying to figure out who leaked the information from the scouts nearly a year ago!

[@steveladner4346]

@@pay-tray-it4897 Its all a dog and pony show. Pure entertainment.

[@lightpropulsionguy]

​@@steveladner4346no, I really believe they're that inept!

[@samuelpancake4084]

Lol fast food still can't get a order right and they don't get fired . I've litteraly had to return food 4 times on one order for wrong items and all sorts of problems

[@rebahughes3696]

And you can't figure this out in 5 freaking years!!!!

[@russelfernandes8483]

Its an IP address silly, these things take time.

[@ginaguarino3163]

These people can’t close an investigation within 5 years? What’s your first clue to get rid of them??? There’s no oversight on these people that do nothing!!!!

[@Shines2God]

And it takes 4+ years and you are STILL investigating!! WTF??

[@michealspry2561]

Yep they still investigating trump chasing their tales. Boy we got him this time😂😂😂

[@trevorhart545]

They haven't received a report from the Committee set up to decide HOW they should investigate to then pass onto the Committee that will then decide WHO will do the investigation. You cannot rush a committee who have not yet appointed a Chair or Terms of Reference!

[@PDDunn]

Just like Hunter's laptop; AND the years trying to figure his tax problem. Stupid people really believe it takes that long. Geeze!

[@leona369]

Kind of like the Hunter biting laptop right but when it comes to President Donald Trump they dont miss a sec, corruption everywhere, i'm surprised they didn't blame it on Russia !!!!!

[@DesignRhythm]

Only in the Government does IT move at the speed of mud.

[@carlamarie8680]

In other words it was "UNSECURED" 🥴😡🤬

[@pascalouellette8516]

as a former IT consultant this leader is clueless about data security for server implementations

[@shakostarsun]

It's a health agency director so I don't think they would be a computer expert but her investigation is not done so she doesn't know a lot of the answers.

[@stevenorosz1518]

Getting physical access to data closet or tapping cat 5 in the ceilings would be pretty easy. Hospital security wouldn't have a clue. Was probably a disgruntled contractor or worker of a contractor.

[@mikesmith6838]

Could not agree more! Having over 25 years in I.T., I can tell you with utmost confidence that most management has ZERO clue on what we do. This lady is more clueless than most.

[@frankdillard2522]

@@mikesmith6838 But she knows all the cool words to make other people who don't know anything swoon in amazement.

[@letabranch7459]

I’m not an expert but shouldn’t security be an automatic when configuring a server?

[@ramonasp4989]

I am so Thankful to God and my training as a deputy, that I CAN PROTECT MY FAMILY-- cause these idiots are SELLING US OUT !!

[@Custardpie174]

💯

[@antonioprovenzano5130]

You ONLY grasping the surface

[@randallharman5424]

So we will definitely know something sometimes somewhere, somehow .

[@kathymott1187]

We have external investigators, but we are paying them.....hmmmm!

[@kateturner1849]

@kathy mott - my sentiments EXACTLY! Clearly someone dodgy enough to shift in their favour!

[@garethbarnes3680]

The same answer was given to every question. They cannot give a straight yes or no

[@davidhfranz]

"The initial configuration was mid-2018" - That's an admission that either the default login credentials were never changed, the firewall rules weren't updated, the access control lists weren't verified, 802.11x (port security) rules weren't followed, MAC filtering wasn't done or that a whole host of remediations weren't considered in response to IAVAs or the CVD. This woman is the last person you want briefing this topic. The correct person to send to these hearings is a retired Warrant Officer. He or she would make a Congressional Representative's head explode from data overload.

[@trevorhart545]

HR, they are NOT responsible and have NO Knowledge except HOW to Sack, Make Redundant and How to APPOINT BLAME to someone else.

[@joeoeoeoeaaaa]

Switch port security (802.11x) is a security control for layer 2 networking (switches) on a LAN and is the same thing as MAC filtering. The breach relates to a layer 3 IP service exposed to the internet listening on the WAN, which would require a layer 3 or 7 security control to protect it instead of 802.11x. MAC addresses aren't in scope here but otherwise agreed

[@davidhfranz]

@@joeoeoeoeaaaa port security would prevent an unauthorized endpoint from accessing the network onsite. it would also mitigate a rogue access point. Don't underestimate the insider threat generated from stupid insiders.

[@suzannehartmann946]

@@davidhfranz Or lazy ones

[@suzannehartmann946]

@@lamont814 I do not have that much technical info and I know better than how they handled this

[@PioneerRifleCompany]

Misconfigured...right. Most of the healthcare system has given the keys to every employee involved in software and server support. It isn't a breach, it is plain laziness and folks that wish to NOT do their job.

[@davidhfranz]

So, in other words, a complete disregard for Separation of Duties and the principle of Least Privilege?

[@Skank_and_Gutterboy]

Yep, it's the same problem that Snowden, Bradley Manning, and Texiera keep bringing to light and DoD keeps not doing a damn thing about it. They keep saying in training and statements to the public that a security clearance isn't enough, a person also has to have need-to-know to see classified documents. Nope, when a person gets access, they get access to everything. Snowden, Bradley Manning, and Texiera had ZERO need-to-know but got to snoop through documents at their leisure. This will keep happening until DoD starts obeying its own rules. The security guys and commanders should be getting prosecuted, too.

[@advancedimpressions7014]

What do you expect from the monkeypox stooges holding federal jobs?

[@Sheahova]

no it’s called where there is a will there is a way. If your server is connected to an internet connection it is vulnerable no matter if you are a heavily encrypted server or a personal computer. People act like nerds aren’t smart enough to breach data.

[@Sheahova]

you know who else steals data? every tech company in the history of tech companies…

[@rebahughes3696]

So I think what she's saying is that they're paying loads of money to external investigators to do their job. And that's why they can't answer any of these basic questions that they should know this is been going on for five years come on

[@quitefranklysamanthatheres1018]

This is just so bad

[@tedwoods8117]

Why aren’t witnesses being questioned by members of Congress being allowed to avoid yes or no answers to questions? I believe they should be FORCED to answer yea or nay or be held in contempt of Congress. Pretty simple.

[@davidhfranz]

I mean we're all in contempt of Congress...at least we hold the majority of their members in contempt.

[@livewire4495]

A contempt of Congress Law needs to be passed to motivate people to tell the truth or be jailed!

[@gizmoapangalook121]

I agree too many essay answers that say nothing. Until you are ready to answer yes or no they should be jailed until they can.

[@advancedimpressions7014]

Cue up the 3 Stooges music Margo! Dems are being inept again.

[@knine8154]

Can't stand this crap myself, but it seems the investigation isn't over with so.....

[@ginaybarra4915]

They know it's been since 2018. She knows more than she's saying.

[@tedmiller2265]

No one ever is accountable

[@jcoats150]

"Experts" seem to be at the center of virtually all problems the public has with government.

[@crxdelsolsir]

Yes, because they are all intended, orchestrated, coordinated, executed, protected and maintained by them (Democrat/Biden/Obama/Clinton Administrations).

[@user-lz4mh7tl6f]

This is what happens when incompetent people are hired and lack of accountability continues....

[@hemihead001]

So they are still investigating ? After 5 years ? So , they are hoping this all goes away so nobody will get fired .

[@Skank_and_Gutterboy]

"Vendors are held to a very high standard." It's the laughs that keep us going.

[@mikedrake5373]

This lady is on fire. We need more of her

[@user-jk6gu9mh7t]

How the hell do you mess up that badly and keep your job? No authentication? Are you SERIOUS?!

[@user-jk6gu9mh7t]

@@joshngu6631 Regardless of debt, it's not hard to secure a server with at least minimal security. Why are you NOT surprised?!

[@georgepotter353]

In almost every case I think that people testifying before congress should be fired for the inability to answer a simple question. Having been in IT for 47 years I understand why this lady is hesitant to give detailed information because piecemeal information during computer forensics can be very misleading. The correct question right now is 'when will your investigation be complete, because I want you back here next business day". And then hold her to that date.

[@ericede]

4 minutes in and she mentioned that the reports were stolen from the location where they were stored. Someone most likely created a wide open network share. I have lead many projects to lock down corporate file servers. File permissions are usually implemented without proper groups for managing access. Then you have issues with level 1 & 2 employees pushing ACLs from top level folders, and nobody wants to spend the money on auditing tools like Varonis or Data Insight. Data governance is a huge blindspot for most organizations.

[@trusound170]

People sneer at me when I say I don't do anything online unless I absolutely HAVE to. I don't do online banking, insurance or doctors business, etc... There is no such thing as "secure" in a world where there is always a hacker who is two steps ahead of the game. You don't even have to do your business online in order to get your info stolen because it's automatically put there with out your consent and against your wishes. It's getting more and more difficult for anyone to protect themselves from things like this.

[@julietewing4847]

Your right

[@julietewing4847]

@@DJ-769 Ours was stolen from a dr.'s office patient data stored on a cloud server.

[@trusound170]

@@DJ-769 I just said this. LOL thanks for repeating it.

[@carolannmiller7911]

I don't either. I'll use old methods as long as available. Too many crooks, thieves, liars & greed in gov't., corp. ...etc. w/ morons at the helm!

[@deniserutan4458]

I agree, I refuse to bank on line or buy on line. Yep, I'm a Gen X - I'll do it myself, thank you very much.

[@oldsargescoutsout757]

these "directors" never seem to know what's going on in their departments, "I don't know" seems to be a common denominators in all of these hearings

[@micahelbosley4903]

Did you ever notice that when asked a hard question in these committees, the answer is "I don't know." First person to be fired should be her.

[@erinmulcahy9745]

I DIDNT DO ANYTHING SO IM NOT TO BLAME!!!! HOLD THESE PPL ACCOUNTABLE!!! I WOULD BE FIRED IF I SCREWED UP THIS MUCH...

[@momo-wl9jm]

Finding out who’s responsible is important, but how about telling us more about the information that was breached between our country and other countries I think the American people deserve an explanation

[@YouCountSheep]

That had to be malice. There is no way they just forgot. That is a 101 of servers.

[@andrewmacaulay9272]

INVESTIGATE ? WITH NO OUTCOME

[@WizzRacing]

i could tell you within week who was at fault.. And if they took it offline. It was to clean the server. ie Hide the breach...

[@davef.2329]

Sterilize, sanitize.

[@shawnsb7583]

Great questioning. She’s not letting her dumb her down like they dumb down the voters.

[@gordonnottsfinest180]

Nancy Mace is one of the best at questioning these dem question dodgers, hats off and much respect to her

[@oliverhenri3477]

I'm absolutely no apologist for anyone in these agencies, but I can appreciate how difficult it can be to be a witness regarding a technical event. Witnesses should bring subject matter experts so they can immediately consult. Of course then, though, they wouldn't be able to stall with their "I'll get back with you on that" responses.

[@fangdanian]

This happened in 2018?! It is now 2023 and they're still investigating. Am I missing something?

[@Dogglegg]

“If you cannot ID who failed, then you are all fired.”

[@ronaldwong1085]

We do not know. The anthem of the Biden administration.

[@cef-ym3gb]

Awesome job, finally proper pointed questions showing some understanding of how IT works from a representative...

[@DM-oo6hc]

Just more people that come to be questioned and then give no answers. Why do they seem to never have answers to questions. They are always doing a full investigation but won't have answers until some time in the future but as always they can't give a date. Time after time it shows that these people are not qualified for their position.

[@harrymann5523]

They should be fired

[@philipmcarthur9087]

Another official who " can't answer that question" on almost every aspect of the work they are supposed to be actively involved in on a daily basis.

[@pikehunter23750]

Seems par for the course for all of Biden's Administration.

[@gw6975]

Doesn't matter what the IP address was.. LOL. Matters the vulnerability involved. What was it an open FTP server with the initial username password upon installation. I mean this charade is getting us no where... Uneducated people speaking about an issue they have no education and/or training in.

[@herbhouston5378]

Any job I ever had in my life but I'm almost 80 years old I had to know everything about that job before I was turned loose don't see if people know anything

[@DD-bn2mx]

No, they will eventually be promoted. They were asked to do that with a promise on the Left.

[@burntsider8457]

Two things I quixotically hope for: 1. The Vikings winning a Super Bowl and 2. A Biden administration witness crisply and candidly answering a question. Alas, at my age, I'm unlikely to ever see either.

[@TheKrighter]

As opposed to what, a Trump employee crisply and candidly answering a question? LOL!

[@garethbarnes3680]

We are investigating that....was the server being used well yes and no...but we are investigating using an outside company...but they are investigating.. i dont know the time date or numbers.. but we are investigating

[@martincagle9226]

Can't fire anyone for incompetence, they are playing follow the leader.

[@reginaldwright247]

The Officials don't know SQUAT! She needs to be talking to either the IT Team Lead for the Security Manager.

[@trevorhart545]

They were sacked in case they gave the truth away. Can't question those responsible IF they have left!

[@dbmn7571]

All government employees know the only answer is "I don't know", whether they know or not. The reason for the I don't know answer is to protect the swamp.

[@GerryDT]

Follow the money.

[@pamelaforth7820]

Is this a clerk or a janitor? It sounds like she knows absolutely nothing about what she is supposed to be managing or supervising. If anyone is working on equipment, especially computers, you are responsible for, you should be on their back asking questions about every step of what they are doing. You should have a really good idea of what's happening at every step. It sounds like she is trusting the computer people 100% or else she's to much of a prima donna to supervise them. The first makes her criminally gullible, and the second makes her liable to be fired!

[@trevorhart545]

Janitors know what they are talking about so must be HR Dept (Human Remains) that are Failing to Answer. A technical answer is, We were Sloppy, Got away with it, OOPS the Shet has Hit the Pan!, blame external consultants, deny all history, I.T. IS BEEN LOOKED INTO!

[@mikecoughlin4128]

She’s a manager that obviously did not come up through the ranks. She’s not technical. Executive’s favorite type of person to promote because they don’t say things to get the boss in trouble. Tech people speak facts and specifics.

[@mitzieregan5716]

If you screw up. You should be fired. Especially with government control.

[@dandubree9553]

Sounds like someone need to be fired

[@patcusick8322]

That was 5 years ago! Should have been investigated years ago unless they just noticed the exposure.

[@docleadpill5556]

All you IT pros need to run for office and straighten this crap out. Do it for America before it's too late!

[@bobg9597]

Wow, she is clueless

[@ethanmurray2203]

Only the best and brightest for our government!

[@deydraniadiancecht8298]

This is typical. The IT team at healthcare systems do not like to configure or troubleshoot security systems. They will install and configure a third party system, make sure the systems come up without errors, and will then walk away. They don't run tests on how to break into the system. They will simply require employees to watch training videos on how to protect your own passwords. I'd be surprised to find any IT department that actually runs tests on their third party systems to find holes in their security. In addition, no IT department will update their security. It costs too much money and time and effort to install new updates or to switch to a newer and robust security software company when something newer and stronger comes along. They simply keep using the same garbage they used when it was first set up. The only time an upgrade does happen is when the older is no longer supported and will no longer run.

[@business7138]

No one is ever held accountable in this system. Terrible.

[@janetcross2797]

Password and ID Employee ? Are they required

[@Tet68]

We have external experts from China looking into this.

[@deborahd.7281]

It's likely several people were involved, one person starts the project and works for a few days then goes on vcation for two weeks and somebody else continues the work, then they both get transferred and a new employee or contractor with little experience is assigned to finish the job. They may each do the job in a different way that they are accustomed to and therefore somethings may not be done correctly..

[@pooloftim8263]

This has nothing to do with accessing the server. The issue was due to having no IP security protocols in place.

[@letabranch7459]

I use to tell my students that “she knows just enough to be dangerous”!

[@larva2158]

WHAT A FING JOKE!

[@rebahughes3696]

What exactly have you uncovered in 5 years

[@trevorhart545]

HR needs new Carpets and Furniture

[@davef.2329]

That there needs to be an investigation into who uncovered it.

[@shaneledtje7291]

You can't help but think they know a lot more then they are pretending to know. Some of these questions should be simple for these people.

[@robmcculley6835]

25 Years in IT. This is negligence of the highest order!

[@sleepytickle]

If she won't answer the question, SHE should be blamed for it and removed.

[@goodcompany6494]

As your friendly government employee, I will have to circle back to you upon the completion of the ongoing internal investigation, and when I say ongoing, I mean never ending ......

[@greglander5227]

Fire all of them!

[@randallharman5424]

I’d go for door number three.

[@trevorhart545]

DECISIVE, I like that you are PROMOTED

[@suzannehartmann946]

I.P. addresses typically do not change unless the provider changes or the location of the computer changes. I seriously doubt either changed unless a contract or contractor changed.

[@tommywingate2220]

I recently told the IRS the same thing this April. Actually what I said was screw you and your 85000 new agents I have external investigators looking into these grandeous errors on my return and I don’t want to hear anymore from you !

[@julietewing4847]

Look at the network traffic for connecting IP addresses, if still located in network history data but, can or has been deleted. Do not store on the 'cloud' since it has high probability of being hacked. Do daily backups on external devices and disconnect from the main.

[@x_____________]

Something being stored on the cloud does not have a higher probability of being hacked. On prem is just as vulnerable as cloud. It all comes down to how they've been set up and configured.

[@julietewing4847]

@@x_____________ I agree and disagree but I know where my information was stolen. Have you heard how many businesses do not have the most recent operating systems and outdated security measures in place?, some set themselves up for a great big fall.

[@audreydavidson5132]

❤️ Nancy Mace!

[@dniboc7227]

This was the wrong person to testify on this.

[@mostman1000]

short answer is I do not know anything and I will just say that someone is looking into it so I can say I do not know.

[@petermannix1772]

She doesn't know! Tough question and they will get back to you! Yikes!

[@corneliusdeskins9875]

And these are our leader's people

[@lt2339]

Well gee, first answer let's us know what the spy balloon was logging in all thru the USA!!

[@sean9448]

I don't get this? What are they talking about exactly? What are the details on who was affected? First time I've heard about this story.

[@gordonlecroy4258]

Happens every time. The Rep asks a question and the official answers another question.

[@TigernachVT]

The questions Ms. Mace asked we all questions that would take less than a day to discover. I have some other simple questions. When was the security vulnerability patched? What service did this server perform? Who set it up? Who had administrative access to this server? Could bad actors gain access to other systems with access the compromised server?

[@BA0701]

There is so much configuration required, routers, firewalls, switches, for an "IP address" to access the outside world from inside the network on a public IP address. What they are trying to describe is literally impossible to have happened by accident, this was clearly intentional, and happened by design. You can't just plug into a switchport off of the inside interface of your router, and hit the web in an un'nat'ed public IP, it is literally impossible.

[@DustinTurner-dd1vy]

Basically we have no idea....

[@paulhaggard8746]

Are we not operating beyond our technical ability to be safe??

[@doncordier6854]

This is the reason why I refuse to do the portal that a lot of doctor's and hospitals want you to freely put your information on the servers that are kept open for the people who have nothing to do but hack into the system yet our government doesn't prosecute anyone unless you're a republican.

[@woodsterwolsun1278]

No one ever fired or prosecuted. What's new with this administration. Fire her already for lack of experince on the job. What a joke these people are.

[@JT-ee1ii]

The problem with her organization is the she is in charge of it. Fire her first.

[@johnb30021]

We are in trouble in this America ! 🙏🏼♥️🇺🇸👍🏼✌🏼🥺😢👿👹

[@Vincentschneider007]

Word salad in this administration is unreal. What ever happened to simple answers.

[@merrillkingston8807]

I have decades of IT experience and I can tell you, that woman has absolutely no idea, zero, or what she's attempting to talk about. If she's in charge of anything associated with automated systems, she ought to be terminated immediately.

[@David-ss2om]

if people only got to see how much of their data is accessed and managed by IT "contractors" in overseas locations. Not just healthcare; banking, academics, federal/state/local governments. If they have an IT dept of 200 people, usually 20-25 are US based and the rest are remote.

[@libbycampbell4700]

It’s not that difficult to find out who physically did the set-up and who gave the order. It’s bureaucratic policies that make it impossible to do it efficiently.

[@birdmusic1206]

I remember when they mocked people and called them paranoid for saying entrusting the government with our health info would lead to invasions of privacy. Well, they were wrong but they are still mocking those people too.

[@denisehinz6621]

So who are the "external investors"? That's the real question.

[@binkydenniston5154]

They won't do anything but make excuses

[@williamhenry9705]

IDK. No one ever has an answer! IDK. IDK. IDK. How we looking on finding the Supreme Court leaker?

[@geekchameleon]

"If you had an IP address, you can access the server without proper authentication." I'm assuming she meant if you had _the_ IP address of the server. This isn't a misconfiguration. This is a case of zero configuration. If the person who "misconfigured" this server had done something like this as they pursued their degree in Computer Science, they'd have received a failing grade for the project, if not for the entire class. There is no standard in Information Technology where this wouldn't be gross negligence - this is no less negligent than leaving a locked and loaded firearm on the table in a kindergarten classroom. It was no less negligent in 2018 than it is in 2023.

[@axandio]

What the hell? They don't have a Network Administrator?

[@patrickterry779]

They haven’t identified a contractor scapegoat yet.