Whenever I work with government, I see the same paradox pretty much everywhere. Everyone agrees with a statement in principle, while disagreeing in practice.
That government over-classifies things is a well-known problem (making things government secrets that don't need to be). Everyone criticizes it, convinced it's what other people do. But then when it's their turn, they over-classify things.
When they want to cover their own ass, they find reasons to justify it, even while they see through the transparent excuses their opponents have for covering their ass.
Or, they know it's being over-classified, but it's simply not worth the political capital and damage to stick their head out and oppose the classification.
The NSA does not spy on Americans. It's a principle that pervades the NSA. So when Snowden revealed the NSA was indeed spying on Americans, the response was "that's absurd, we would never do that, it's not the same thing".
To be fair, in many ways the NSA is right, it's not the same thing, and they very much WANT to not spy on Americans. But at the same time, it's a delusion, and they really are spying on Americans sometimes.
Also to be fair, it's not what you think, there's little chance they'll spy on Hunter Biden and give that info to Trump for political purposes. But at the same time, doing things like grabbing everyone's phone records for arbitrary searches is still "spying on Americans".
Back to the original thread, everyone agrees that our own hackers should attack us first to expose then fix our weaknesses. In practice, if you do so, you are at extreme risk to your career and safety.
The more vigorous they espouse the principle, the more danger. They wouldn't be so vigorous if there weren't a reason to deny the way things actually work.
I've seen things like this happen, over and over again.
Here's my diagnosis for the above problem. To start with, the leadership of the organization doesn't have the technical skills to understand what the issues are. They can't read the report, so they have "people" interpret it for them. It becomes political, not technical.
The "people" then figure out how to exploit this to their advantage. One way to exploit this is to take credit for fixing the problem. The other way to exploit this to your own personal advantage is to blame the person who identified the problem.
If you have the trust of those in leadership, you can make up any scurrilous rumor, and it'll be given weight. Not 100%, but enough to damage the career of the other person. I've seen this happen over and over again, and it's astounding.
I often talk to the leaders and the techies about a "situation" and Oh My F***ing God are they divergent. When I look into where they diverged, I find some political weasel messing things up, interposing themselves into a situation exploiting it for personal gain.
