popular shared this story from Schneier on Security.

---

In the span of just weeks, the US government has experienced what may be the most consequential security breach in its history—not through a sophisticated cyberattack or an act of foreign espionage, but through official orders by a billionaire with a poorly defined government role. And the implications for national security are profound.

First, it was reported that people associated with the newly created Department of Government Efficiency (DOGE) had accessed the US Treasury computer system, giving them the ability to collect data on and potentially control the department’s roughly $5.45 trillion in annual federal payments.

Then, we learned that uncleared DOGE personnel had gained access to classified data from the US Agency for International Development, possibly copying it onto their own systems. Next, the Office of Personnel Management—which holds detailed personal data on millions of federal employees, including those with security clearances—was compromised. After that, Medicaid and Medicare records were compromised.

Meanwhile, only partially redacted names of CIA employees were sent over an unclassified email account. DOGE personnel are also reported to be feeding Education Department data into artificial intelligence software, and they have also started working at the Department of Energy.

This story is moving very fast. On Feb. 8, a federal judge blocked the DOGE team from accessing the Treasury Department systems any further. But given that DOGE workers have already copied data and possibly installed and modified software, it’s unclear how this fixes anything.

In any case, breaches of other critical government systems are likely to follow unless federal employees stand firm on the protocols protecting national security.

 

The systems that DOGE is accessing are not esoteric pieces of our nation’s infrastructure—they are the sinews of government.

For example, the Treasury Department systems contain the technical blueprints for how the federal government moves money, while the Office of Personnel Management (OPM) network contains information on who and what organizations the government employs and contracts with.

What makes this situation unprecedented isn’t just the scope, but also the method of attack. Foreign adversaries typically spend years attempting to penetrate government systems such as these, using stealth to avoid being seen and carefully hiding any tells or tracks. The Chinese government’s 2015 breach of OPM was a significant US security failure, and it illustrated how personnel data could be used to identify intelligence officers and compromise national security.

In this case, external operators with limited experience and minimal oversight are doing their work in plain sight and under massive public scrutiny: gaining the highest levels of administrative access and making changes to the United States’ most sensitive networks, potentially introducing new security vulnerabilities in the process.

But the most alarming aspect isn’t just the access being granted. It’s the systematic dismantling of security measures that would detect and prevent misuse—including standard incident response protocols, auditing, and change-tracking mechanisms—by removing the career officials in charge of those security measures and replacing them with inexperienced operators.

The Treasury’s computer systems have such an impact on national security that they were designed with the same principle that guides nuclear launch protocols: No single person should have unlimited power. Just as launching a nuclear missile requires two separate officers turning their keys simultaneously, making changes to critical financial systems traditionally requires multiple authorized personnel working in concert.

This approach, known as “separation of duties,” isn’t just bureaucratic red tape; it’s a fundamental security principle as old as banking itself. When your local bank processes a large transfer, it requires two different employees to verify the transaction. When a company issues a major financial report, separate teams must review and approve it. These aren’t just formalities—they’re essential safeguards against corruption and error. These measures have been bypassed or ignored. It’s as if someone found a way to rob Fort Knox by simply declaring that the new official policy is to fire all the guards and allow unescorted visits to the vault.

The implications for national security are staggering. Sen. Ron Wyden said his office had learned that the attackers gained privileges that allow them to modify core programs in Treasury Department computers that verify federal payments, access encrypted keys that secure financial transactions, and alter audit logs that record system changes. Over at OPM, reports indicate that individuals associated with DOGE connected an unauthorized server into the network. They are also reportedly training AI software on all of this sensitive data.

This is much more critical than the initial unauthorized access. These new servers have unknown capabilities and configurations, and there’s no evidence that this new code has gone through any rigorous security testing protocols. The AIs being trained are certainly not secure enough for this kind of data. All are ideal targets for any adversary, foreign or domestic, also seeking access to federal data.

There’s a reason why every modification—hardware or software—to these systems goes through a complex planning process and includes sophisticated access-control mechanisms. The national security crisis is that these systems are now much more vulnerable to dangerous attacks at the same time that the legitimate system administrators trained to protect them have been locked out.

By modifying core systems, the attackers have not only compromised current operations, but have also left behind vulnerabilities that could be exploited in future attacks—giving adversaries such as Russia and China an unprecedented opportunity. These countries have long targeted these systems. And they don’t just want to gather intelligence—they also want to understand how to disrupt these systems in a crisis.

Now, the technical details of how these systems operate, their security protocols, and their vulnerabilities are now potentially exposed to unknown parties without any of the usual safeguards. Instead of having to breach heavily fortified digital walls, these parties  can simply walk through doors that are being propped open—and then erase evidence of their actions.

 

The security implications span three critical areas.

First, system manipulation: External operators can now modify operations while also altering audit trails that would track their changes. Second, data exposure: Beyond accessing personal information and transaction records, these operators can copy entire system architectures and security configurations—in one case, the technical blueprint of the country’s federal payment infrastructure. Third, and most critically, is the issue of system control: These operators can alter core systems and authentication mechanisms while disabling the very tools designed to detect such changes. This is more than modifying operations; it is modifying the infrastructure that those operations use.

To address these vulnerabilities, three immediate steps are essential. First, unauthorized access must be revoked and proper authentication protocols restored. Next, comprehensive system monitoring and change management must be reinstated—which, given the difficulty of cleaning a compromised system, will likely require a complete system reset. Finally, thorough audits must be conducted of all system changes made during this period.

This is beyond politics—this is a matter of national security. Foreign national intelligence organizations will be quick to take advantage of both the chaos and the new insecurities to steal US data and install backdoors to allow for future access.

Each day of continued unrestricted access makes the eventual recovery more difficult and increases the risk of irreversible damage to these critical systems. While the full impact may take time to assess, these steps represent the minimum necessary actions to begin restoring system integrity and security protocols.

Assuming that anyone in the government still cares.

This essay was written with Davi Ottenheimer, and originally appeared in Foreign Policy.

As always, thanks for using my Amazon Affiliate links (US, UK, Canada), and for considering joining my Patreon

As an Amazon Associate, I earn from qualifying purchases.

Click here to go see the bonus panel!

Hovertext:
You ever imagine how you'd feel if there were constant fights between anonymous well-armed vigilante factions. Eventually everyone would just move to the suburbs.

Today's News:

Last week on Twitter/X, there was a big debate around whether it was possible to retire with $10 million. It all started when Twitter user Zay Capital (@cap_zay) tweeted:

"You can't retire on $10m usd" dinner party convo time

When I first saw that this tweet was getting popular, my initial reaction was: "Really? This is what we're talking about?" Anytime I see discussions about how "you can't live/retire on [insert large amount of money]" it upsets me because it's so incredibly out of touch. Of course you can retire with $10 million! Thousands of Americans do it every year with far, far less. If you can't retire with $10M, then your problem isn't your money, it's your lifestyle. But, Zay Capital later clarified his question, which added much needed nuance to the discussion:

To be clear this was combined couples assets, was specifically targeted at the question " how much money would you need to stop working" targeted at 30 year olds just starting families that still need to cover childcare, housing education, etc cost in relatively hcol areas of NA.

Now, the answer isn't so obvious. While someone in their 60s could easily retire with $10 million, could a couple in their early 30s living in a high cost of living ("HCOL") area do the same thing? Maybe. Maybe not. So I decided run the numbers myself to get to the bottom of this. Let's dig in.

How Much Can You Spend with $10 Million?

Before we can get into our $10 million early retirement discussion, we first must ask ourselves, "What is the asset mix of this $10 million?" For example, is the $10 million all in cash or is it in stocks, bonds, and real estate? Is the money in a taxable brokerage account, a nontaxable retirement account, or both? The answers to these questions will determine how much of the $10 million you can spend annually. For example, if we assume that you had $10 million cash inside a taxable brokerage account, then, using the 4% rule as your safe withdrawal rate, you could spend $400,000 a year in after tax income (adjusted for inflation each year thereafter). Of course, you won't want to keep your money 100% in cash while doing this, but having that money in post-tax assets means that your future taxes on it will be low. On the other hand, if the $10 million was all in a 401(k)/IRA, you'd have to pay the 10% early withdrawal penalty and ordinary income taxes on whatever you withdrew. Using the 4% rule, this means that your $400,000 withdrawal would be reduced to $360,000 (after paying the 10% penalty) and reduced again to $245,000 (after paying income taxes in a place like New York City).  Of these two options (100% taxable and 100% nontaxable), the nontaxable one seems very unlikely. Why? Because there's probably no 30 year old couple in America with $10 million in their retirement accounts. After all, how would they get that much money in there? However, it does seem possible (though rare) that a couple could have $10 million in a brokerage account at the age of 30. How so? Imagine a young founder who sells their business for $20M+ or gets significant equity compensation in a startup or tech company that later appreciates. Once that equity is sold, you could end up with $10 million after taxes at age 30. This seems like the most likely path to $10 million at 30. Given this, here's how such a young couple's assets might look like after the sale of the company shares:

• $7.5 million in taxable brokerage account (ideally re-invested in a diversified portfolio)
• $0.5 million in 401(k) (assumes two individuals maxing for 8 years plus some generous market growth)
• $2 million home (fully paid off and purchased after the sale of the company shares)

Given this asset mix, using the 4% rule, this couple can spend $300,000 a year (4% of $7.5 million) while having no mortgage/rental payment. That's $300,000 in after-tax money (adjusted for inflation each year thereafter).  I understand that the 4% rule was developed for someone in their 60s with 30 years of retirement ahead of them, not someone in their 30s with 60 years of retirement ahead of them. However, even if we run the retirement simulations across 60 years (instead of 30), the probability of success is still quite high at 97% (for a 80/20 U.S. stock/U.S. bond portfolio): This means that you wouldn't have run out of money in 97% of all 60-year periods from 1926 to 2022 with a 4% withdrawal rate. Obviously this isn't 100%, so I can understand why using the 4% rule for 60 years might concern you. If that's the case, then lower your withdrawal rate to 3.5% (reducing your first year spending to $262,500) and your chance of making it all 60 years goes up to 100% (in the backtests). That still gives you $262,500 a year to spend (adjusted annually for inflation) without needing to pay rent or a mortgage payment. Not bad if you ask me. Now that we have some idea of how much money you can spend with $10 million at age 30, let's look at how much money a young couple/family might reasonably spend in a HCOL area to support their lifestyle.

How Much Does a Young Couple/Family Spend?

Whether you're living in Manhattan, San Francisco, or another HCOL area, the price of housing, childcare, education, and other expenses can be vastly differ from the national average. For this reason we should quantify these costs and then determine whether our $10 million in assets can support such spending. Rather than come up with all of these spending figures myself, I'm going to defer to one of the experts on the matter, Sam Dogen, who writes at FinancialSamurai.com. In particular, Sam has one post where he quantifies "How a Family of Four Survives off of $400,000 a Year Living in an Expensive Metropolitan Area." In his excellent post, Sam quantifies the cost of everything for a family of four in a HCOL area from food and childcare to housing, transportation, and much more (see table below): As you can see, Sam's total annual expenses for this family come out to $260,496. However, a couple key assumptions differ:

1. Sam is assuming that this young family is paying off a mortgage. In our $10 million early retirement thought experiment, no mortgage is needed as our couple owns their $2 million property outright. Coincidentally, if they hadn't bought their home, that extra $2 million would generate about $80,000 per year (using the 4% rule) which is basically identical to the $80,952 mortgage payment Sam estimated above.
2. Sam assumes that this young family has most of their healthcare paid for by their employer. We would not have such a luxury in our early retirement scenario as our young family is not working.

Once we adjust remove the mortgage payment ($80,952 annually) and remove the employer sponsored healthcare ($7,440) and add back in a Platinum family healthcare plan in NYC ($4,000 a month/$48,000 a year), our annual spending would be:

$260,496 - $80,952 - $7,440 + $48,000 = $220,104

This is far below the $300,000 income estimate we came up with in the prior section. Even if I am off a bit in one section or another, that still gives this family of four ~$80,000 in annual spending wiggle room. Technically, they would have even more than $80,000 a year in wiggle room to spend from ages 30-60 because we haven't considered this couple's $0.5 million in retirement assets that will grow over time and provide additional income (without penalty) after age 60. So, they could overspend during their 40s and 50s knowing they have their retirement assets which will help in their 60s and beyond. Lastly, I know that $300,000 is a lot of money to spend each year because my girlfriend and I spend less than half of this per year in NYC and 1/3 of our total spending is for rent. Of course, we don't have two children to support, but even if we did, I'm telling you that $300,000 after tax would be plenty in this scenario. Now that we have an idea of how much a young family spends in a high cost of living area, let's wrap things up by looking at the bigger picture.

The Bottom Line

Whether or not you agree with the assumptions I've made here, the truth is that unless you have some very expensive habits (e.g. flying private, designer clothes, etc.) retiring with $10 million at age 30 should be relatively easy. And if you think it won't be, all you have to do is relax any of these spending assumptions just a little bit and you'd be fine. For example, you could live in a slightly lower cost of living area (e.g. Queens instead of Manhattan). You could send your children to public school instead of private school. You could travel a little less often. Whatever you decide to do, just cut back slightly and your $10 million gets you to the finish line. I understand this conclusion might seem straightforward to some, but it's not obvious to everyone, as evidenced by ongoing discussions on online platforms like Twitter/X.  Either way, I hope this post makes you realize how much $10 million really can buy. Most of us will need far, far less to retire comfortably, even if we believe otherwise. Happy investing and thank you for reading! If you liked this post, consider signing up for my newsletter or checking out my prior work in e-book form. This is post 382. Any code I have related to this post can be found here with the same numbering: https://github.com/nmaggiulli/of-dollars-and-data

---