Hacker News Reader

Comment by mindfulplay | Hacker News Reader

Why would an American government database ever need access from outside the US? Under what circumstances couldn't a simple IP rule prevent such a silly transfer of data?

I could never wrap my head around government databases (that need to be secured) using using AWS or other cloud with default security.

View on HN

In the case of the OPM database, it was outsourced to an outsourcer to an outsourcer who was administering the data from China. What's not discussed in this article is that as administrators, they had full read/write access to the system so we must assume that it is tainted.

While this article cites 2014, I believe investigators concluded the attackers/admins had access starting sometime in 2009.

I covered the implications of it when the news broke in 2015: https://caseysoftware.com/blog/why-this-security-breach-is-w...

Not strongly disagreeing, but some ideas: Embassies, CIA, etc...

I'm not a US citizen but have lots of US based servers. In-fact it is cheaper to get US based IPs than anywhere else.

It's completely trivial for non-US people and companies to rent US servers and make the request from there. Or just compromise something.

"Government AWS" exists, and may well be better than letting non-experts build their own.

> Why would an American government database ever need access from outside the US?

The US collaborates with allies and they share resources and intelligence data.

Cost-saving.

Governmental contracting is a lowest-bidder game, and budgets are variously limited.

Yes but security requirements are usually inckuded

Reply on news.ycombinator.com