176

US cybersecurity chief leaked sensitive government files to ChatGPT: Report

There have to be GovCloud only LLMs just for this case.

I swear this government is headed by appointed nephews of appointed nephews.

I keep thinking back about that Chernobyl miniseries; head of the science department used to run a shoe factory. No one needs to be competent at their job anymore

an hour agoBiscuitBadger

The article says

> [ChatGPT] is blocked for other Department of Homeland Security staff. Gottumukkala “was granted permission to use ChatGPT with DHS controls in place,” adding that the use was “short-term and limited.”

He had a special exemption to use it as head of Cyber and still got flagged by cybersecurity checks. So obviously they don't think it's safe to use broadly.

They already have a deal with OpenAI to build a government focused one https://openai.com/global-affairs/introducing-chatgpt-gov/

an hour agodmix

> So obviously they don't think it's safe to use broadly.

More likely, everything gets added to the list because there shouldn't be false positives, it's worth investigating to make sure there isn't an adjacent gap in the security systems.

an hour agograyhatter

Somehow I think that the weak link in our government security is at the top - the President, his cabinet, and various heads of agencies. Because nobody questions what they're allowed to do, and so they're exempt from various common-sense security protocols. We already saw some pretty egregious security breaches from Pete Hegseth.

38 minutes agonostrademons

That's also the case in businesses. No one denies the CEO a security exemption.

33 minutes agoNoGravitas

I have never worked in a company where an obviously incorrect CEO-demanded security exemption (like this one) would have been allowed to pass. Professionalism, boards and ethics exist.

(30 years in software companies, Northern Europe. Often startups. Between 4 to 600 people.)

17 minutes agolysace

Ah, Northern Europe is probably the difference. This passes all the time in the US. It's probably more common in non-tech companies, as well.

4 minutes agoNoGravitas

Been there. The CEO of an internet security company was the one who clicked on the wrong email attachment and turned a virus loose.

I mean, I don't know if he had a security exemption, or if anyone who clicked on it would have infected us. But he was the weak link, at least in that instance.

18 minutes agoAnimalMuppet

It goes back long before the current regime. People may remember a certain cabinet secretary who ran her own exchange server in the basement.

15 minutes agodboreham

It’s always fascinating how massive corruption is “whatabout”’d because someone years ago did something stupid.

8 minutes agomacintux

The failsons of the king of the failsons

a minute agote_chris

Not sure if this is applicable to DHS, but USG natsec only LLMs exist:

> We’re introducing a custom set of Claude Gov models built exclusively for U.S. national security customers. The models are already deployed by agencies at the highest level of U.S. national security, and access to these models is limited to those who operate in such classified environments.

https://www.anthropic.com/news/claude-gov-models-for-u-s-nat...

37 minutes agoscrlk

> There have to be GovCloud only LLMs just for this case.

I hear Los Alamos labs has an LLM that makes ChatGPT look like a toy. And then there's Sentinel, which may be the same thing I'm not sure.

43 minutes agostronglikedan

They say that most fascist governments fall apart because they actively despise competence, which it turns out you need if you are trying to run a country.

24 minutes agodirewolf20

That’s because eventually reality catches up to you.

If the reality of a thing is in opposition to the regime’s wishes, you can’t just wish that away.

However, the regime will favor those who say “yes” over those who accept reality.

8 minutes agobena

Competence gives way to ideology.

I once read an interesting book on the economy of Nazi Germany. There were a lot of smart CEOs and high ranking civil servants who perfectly predicted US industrial might.

11 minutes agoPearlRiver

> this government is headed by appointed nephews of appointed nephews

I was in New Delhi during Trump’s Greenland tirade. The hot take in the governing circles was analogising to the Sino-Soviet split.

I’m now wondering if Imperial Russia, the one the Japanese beat and which fizzled apart against the Kaiser, is also an apt analogy.

an hour agoJumpCrisscross

This administration's op-sec has been consistently "barney fife" levels of incompetence.

an hour agoJohnMakin

Leave Fife out of it. His heart was in the right place, at least. Also, his boss made sure he was unarmed.

43 minutes agokstrauser

this administrations competence on anything and everything has been a kid eating glue

an hour agowinddude

If it wasn't meant to be eaten, it shouldn't have tasted so good!

an hour agojermaustin1

We should get their heads checked for crayons.

38 minutes agorbanffy

[dead]

an hour agotheyneverlear

Pretty sure that's a feature, not a bug

an hour agomcs5280

Personally I believe this but it gets into conspiracy theory real quick. There are far simpler explanations.

an hour agoJohnMakin

Same, I want to believe that this is all a ruse and that the are smart and just really good at playing dumb, but there are just too MANY of them.

It's sycophancy plain and simple. Surround yourself with only yes-men, it ends up becoming less and less competent as the ones who stand up and say no are replaced.

Even if they know better, they can't do better because they know there is no loyalty to nay-sayers.

an hour agojermaustin1

Incompetence and conspiracies go hand-in-hand.

an hour agomiltonlost

Not really. It is far easier to explain incompetence in powerful positions than to explain competence on purpose in powerful positions - the latter is definitely a conspiracy, the former is not.

an hour agoJohnMakin

This administration’s incompetence allows their opponents to conspire much more effectively.

35 minutes agorbanffy

Quite often it is both.

It's not uncommon for incompetent people to be put in positions of power. Because they are incompetent, competent but malicious people take advantage of this and commit actual crimes.

This is where actual conspiracies show up. And that is the incompetent powerful people cover up said crime to avoid looking incompetent.

It is an extremely common pattern.

39 minutes agopixl97

The trick is how to weaponize the incompetence against them.

an hour agotoomuchtodo

There at least one country that weaponised it against the US.

35 minutes agorbanffy

Russia

19 minutes agoBraxton1980

It's been the same with every administration, unfortunately. It's just a side effect of such an unnecessarily big goverment.

42 minutes agostronglikedan

You have to actively maintain a state of ignorance to say this isn’t different. Go look at all of the public reporting starting in January about the way appointees in the Pentagon, DOGE, etc. blew through the normal policies and procedures controlling access, clearing people, or restricting sharing.

For example, this wasn’t just “oops, I used the wrong number” but Hegseth getting a custom line run into a secure facility so he could use a personal computer of unknown provenance and security:

https://www.nytimes.com/2025/04/24/us/politics/hegseth-signa...

That’s one of the reasons why one of the first moves they made was to fire CISOs and the inspectors general who would normally be investigating serious policy violations.

This isn’t “big government”, it’s the attitude that the law is a tool used to hurt their opponents and help themselves but never the reverse.

4 minutes agoacdha

Inviting a reporter from the Atlantic to your signal chat where you coordinate military plans has nothing to do with government being too big

14 minutes agojfreds

You really think that every other administration has had this level of incompetence? The current bumbling and corruption is absolutely unparalleled.

26 minutes agosnake42

I really enjoyed unchecking all those cookie controls. Of the 1668 partner companies who are so interested in me, a good third have a "legitimate interest". With each wanting to drop several cookies, it seems odd that Privacy Badger only thinks there are 19 cookies to block. Could some of them be fakes - flooding the zone?

Damn. I forgot to read the article.

22 minutes agoRegW

It's bizarre that someone would choose to use the public, 4o bot over the ChatGPT Pro level bot available in the properly siloed and compliant Azure hosted ChatGPT already available to them at that time. The government can use segregated secure systems set up specifically for government use and sensitive documents.

It looks like he requested and got permission to work with "For Unofficial Use Only" documents on ChatGPT 4o - the bureaucracy allowed it - and nobody bothered to intervene. The incompetence and ignorance both are ridiculous.

Fortunately, nothing important was involved - it was "classified because everything gets classified" bureaucratic type classification, but if you're CISA leadership, you've gotta be on the ball, you can't do newbie bullshit like this.

an hour agoobservationist

> It's bizarre that someone would choose to use the public, 4o bot over the ChatGPT Pro level bot available in the properly siloed

You're assuming the planted lackey has any knowledge of these tools.

34 minutes agobilekas

Or any reason to give a shit and use the less convenient tool.

23 minutes agodirewolf20

It’s absolutely necessary to have ChatGPT.com blocked from ITAR/EAR regulated organizations, such as aerospace, defense, etc. I’m really shocked this wasn’t already the case.

an hour agosimbleau

I agree....but ITAR and EAR can be super vauge especially in higher education.

25 minutes agotonetegeatinst

"The report says Gottumukkala requested a special exemption to access ChatGPT, which is blocked for other Department of Homeland Security staff."

an hour agolysace

That they got this is shocking in itself.

32 minutes agorbanffy

Surely that must have been approved by the Secretary of Homeland Security Kristi Noem, his former boss back in SD.

29 minutes agolysace

Every cause that led to this event is, in itself, quite shocking.

I feel for my American friends, and hope they never again optimise their government for comedy value.

21 minutes agorbanffy

People were already careless with social media which was openly public. I imagine it’ll be worse with these LLMs for the average person.

an hour agoInsanity

Sounds about on par with what I would expect competence wise.

2 hours agosv123

Hand-picked by Noem, so yeah.

https://en.wikipedia.org/wiki/Madhu_Gottumukkala

> In April 2025, secretary of homeland security Kristi Noem named Gottumukkala as the deputy director of the Cybersecurity and Infrastructure Security Agency; he began serving in the position on May 16. That month, Gottumukkala told personnel at the agency that much of its leadership was resigning and that he would serve as its acting director beginning on May 30.

an hour agoceejayoz

> Gottumukkala had requested to see access to a controlled access program—an act that would require taking a polygraph

Are the US ok? It's 2026 not 1926

an hour agolm28469

The polygraph is still used for security vetting, today. No word on whether they still read a lamb's entrails for portents or consult the dead with a Ouija board.

an hour agohtek

> No word on whether they still read a lamb's entrails for portents or consult the dead with a Ouija board.

Don’t give RFK Jr ideas.

30 minutes agorbanffy

It's actually a few minutes to 1929, so that checks out.

40 minutes agotremon

Feels like 1935

30 minutes agorbanffy

The Feds love polygraphs. Still very much in active use.

an hour agoceejayoz

This is what you get when you prize personal loyalty over competence.

This issue is the one thing that gives me some hope that they can be ousted -- they are collectively too stupid and motivated only by their self interests to hold their power indefinitely.

an hour agopstuart

Does anyone in this administration actually trusts each other’s personal loyalties? I wouldn’t.

29 minutes agorbanffy
[deleted]
an hour ago

Well they’re about to solve that by intentionally cramming it into grok instead

an hour agoHavoc

DOGE already extracted their data of interest, but no doubt they're hungry for more.

an hour agopstuart

There’s always a buyer for this kind of data. I’m sure there is a lot of activity in those markets.

31 minutes agorbanffy

My assumption is that it goes the other direction on a permanent basis.

8 minutes agoI_am_tiberius

BTW, what's the current status on LLMs and confidential documents ? Which license from which suppliers are fine and which aren't ?

14 minutes agobsaul

I adore that this guy had security clearance and I doubt I'd clear that bar. Last time I looked at the interview there was a question:

> have you ever misused drugs?

and I doubt I'd be able to resist the response:

> of course not, I only use drugs properly.

also I wouldn't lie, because that's would undermine the purpose. Still sad I can't apply for SC jobs because I'm extremely patriotic and improving my nation is something that appeals.

an hour agoQuarrelsome

FWIW I have held a security clearance during my career, and telling them I smoked weed was not a dealbreaker. What they are ultimately looking for is reasons why you could be coerced into divulging classified information. If you owe money due to drugs/gambling, etc, that's where it becomes a dealbreaker.

an hour agostackghost

The general rule is not to lie to them, because they will interview all your friends and someone somewhere will rat you out. It’s pointless to try to hide anything during these interviews, and, if you do it, then it’s a dealbreaker.

26 minutes agorbanffy

wait, so I can apply and be honest? Sick! I just poorly misassumed they had classicly archaic interpretations of drugs.

23 minutes agoQuarrelsome

I wonder how far removed the interim director of the CISA is from any real world security. I bet they have not seen or solved any real security problems and merely are an executive looking over cybersec. This probably is another example of why you need rank and file security peeps into security leadership roles rather than some random exec.

an hour agoBhilai

It looke like he's unfit for the position, and was using ChatGPT to burnish his reports etc.

31 minutes agomlmonkey

Hey dude. That's a thought. Get your AI to expand it into a full report and send it to my AI to summarize!

16 minutes agoRegW

If I did this with a banal internal documentation at work I would be written up and maybe fired over breaking known policy. This administration is so ridiculously incompetent, and interim head of cyber security.. leaks. The onion wouldn't write this.

35 minutes agobilekas

Can't be surprised when clowns clown.

an hour agomekdoonggi

Where does this "cybersecurity monitoring" take place? On OpenAIs side? Or some kind of monitoring tools on the devices themself?

an hour ago7777332215

"Information wants to be free". Government stooges help information with what it wants.

2 hours ago01284a7e

Leaked is not the correct word here. Generally as it's used, it implies some intent to disclose, the information for it's own purposes. You would call a disclosure to the war thunder forums a leak, because the intent was to use that information to win an argument. You wouldn't call Leaving boxes of classified information in a wearhouse where you'd normally read them a leak. (At least not as a verb). Likewise you wouldn't call it a leak if you mistakenly abandoned them in a park.

That said, IIRC For Official Use Only is the lowest level of classification (note not classified) it's not even NOFORN. It's even multiple levels below Sensitive But Unclassified.

So, who cares?

Much more significant is he failed the SCI/full poly... that means you lied about something. Yes I know polys don't work, but the point of the poly is to try to ensure you've disclosed everything that could be used against you, which ideally means no one could flip you or manipulate you. The functional part is to determine if you have anxiety about things you might try to hide, because that fear can be used against you. No fear/anxiety, or nothing you're trying to hide means you're harder to manipulate.

That feels bad even ignoring the whole hostile spys kinda thing.

an hour agograyhatter

It’s happening all across corporate too

40 minutes agoreactordev

This is a "Cybersecurity chief" causing an intern-level IT incident.

In many industries, this would be a rapid incident at the company-level and also an immediate fireable offense and in some governments this would be a complete massive scandal + press conference broadcasted across the country.

an hour agorvz

Then again the CTO of Crowdstrike that had their anti-malware code update cause huge problems, is the same guy that was CTO of McAfee when their AV code update, caused huge problems.

38 minutes agoshrubble

The CTO created the update? Otherwise it's not the same situation

16 minutes agoBraxton1980

I think he is real deal. I mean in reality he learned or knows very little about technical matters. No fraud needed.

an hour agogeodel

Chalaki

28 minutes agothrowaway85825

The meritocracy strikes again.

37 minutes agownevets

Well, at least there's gonna be a swift and appropriate punishment. LOL

an hour agojimt1234

From wikipedia:

He graduated from Andhra University with a bachelor of engineering in electronics and communication engineering, the University of Texas at Arlington with a master's degree in computer science engineering, the University of Dallas with a Master of Business Administration in engineering and technology management, and Dakota State University with a doctorate in information systems.

And he still manages to make a rookie mistake. Time to investigate Mr. Gottumukkala's credentials. I wouldn't be surprised if he's a fraud.

an hour agobooleandilemma
[deleted]
an hour ago

https://en.wikipedia.org/wiki/Madhu_Gottumukkala

He was the 'CTO' of South Dakota and later the CIO/Commissioner of the South Dakota Bureau of Information and Telecommunications under governor Kristi Noem.

Edit: (From a European perspective) it seems like the southern states really took over the US establishment. I hadn't really grasped the level of it, before.

an hour agolysace

> Edit: (From a European perspective) it seems like the southern states really took over the US establishment. I hadn't really grasped the level of it, before.

It's good to know the Americans aren't the only ones who never look at maps outside their own country

22 minutes agofloren

South Dakota has a population of less than 1 million people and the complexity of a CTO job of a state like South Dakota would be quite low. It is < 0.3% of the US Population and likely has de minimis benefit programs.

an hour agodstroot

South Dakota is in the northern portion. But to your statement, historically speaking the southern states after the civil war kept trucking along in terms of power and influence.

an hour agoJoeBOFH

The Dakotas weren't really north/south in the Civil War context; only about 4k people lived there in 1860. It was largely empty land, and not a state until 1889.

an hour agoceejayoz

and which MTV reality show was this "cybersecurity chief" plucked from ?

an hour agozzzeek

Do they have Middle Age Grandpas on MTV nowadays?

an hour agogeodel

[dead]

an hour agobilly99k

> Hillary Clinton used a randomly hosted email server to send out official government emails for months. The story was quickly buried

You cannot be serious. That story arguably changed the course of the 2016 election. It was by absolutely no means “buried”.

an hour agoafavour

Both can be true. Streisand effect.

28 minutes agothrowaway85825

Both could be true. But they aren’t. The story was never buried.

15 minutes agoafavour

Sometimes it's almost random when stories hit national news. The somali daycare fraud has been reported on publicly for years but didn't go viral until recently.

6 minutes agothrowaway85825

Not sure if this is serious or satire.

an hour agojimt1234

I think it's factual.

an hour agogadders

You think Clinton's email scandal "was quickly buried"?

an hour agoceejayoz

It was so well covered that there was a whole meme about it that everyone can recite to this day.

26 minutes agoohyoutravel

To add to your point: and if so, what were the "lock her up" chants about if not this?

an hour agoben_w

But her emails?!

37 minutes agojimt1234

[dead]

an hour agotheyneverlear

At least he is not on H1-b!

an hour agohareykrishna

Sounds like he came on a student visa from India and got citizenship.

an hour agodmix

Citizenship can be revoked in cases that involve serious offences.