It's really confusing how they ended up in this predicament. S3 buckets are private by default. You have to manually configure them to be public-read. Given the scope of Booz Allen's work, it doesn't seem like they needed any of the S3 buckets to ever be just public. I wonder if they're using software or maybe even just copied a script in which the default assumption for S3 configuration and uploads is to set files to be public?