Apologies, to clarify my underlying point - it seems enough to call out irresponsible, reckless, and dangerous decision making. It may be more important that this can be and often is done within the law. The law is extremely porous and is not intended to defend against this (and will not stop it).

That flexibility is often used for good, such as during COVID when spending six running a full ATO would have caused far more harm. It's truly unfortunate that this might have been used for harm by irresponsible parties but there's a gap being irresponsible as hell and breaking the law.

Both the law here and NIST standards give responsible authorizing officials considerable leeway to authorize the use of systems with little or no application of the full process - it's a risk-based process. That is a healthy and necessary flexibility for responsible authorizing officials. (1/2)

Seems like an oversight not to reset all the deadlines after telling people not to work on it for five months.It will be interesting to see if OMB follows up with directing agencies to start work on the original unrescinded bits now or just the new parts.

Classic early DOGE scenario though - digital service team spends years navigating bureaucratic hurdles to get proper access to engineering tools and establish the right culture; DOGE wastes a bunch of time doing stuff while ignoring the team that already solved the problem.

Note this was still GFE - many agencies have mac (or beefy dell linux) dev systems that are better but still heavily managed. VA OCTO has these because they have hands-on engineers and designers.

The total wipeout of most of SES leadership abandoning gov across every agency is horrifying.