Secretary Jeh Johnson and 28 DHS senior staffers accessed their personal email accounts from work computers, despite the department prohibiting the practice more than a year ago, Bloomberg reported Monday.
The use of Web-based servers leaves computers with sensitive information vulnerable to malware. Reporters have since called it "outrageous," "befuddling," and "baffling."
After the Chinese hacked OPM and stole the personal information of 25 million people, the head of the administration’s national security operations had one thing to say about his department’s perilous actions:
"Whoops."
"To be perfectly honest, this is something that I had for a while," Johnson said at a Politico event Tuesday. "And when I read the story I said, ‘Whoops, this is not a good practice, so I should discontinue it.’"
Johnson clarified he never used his personal email account for government business, a practice that landed Clinton into hot water. Nevertheless, the secretary did acknowledge the wrongdoing under his watch.
"DHS has to be the model for good cybersecurity in government, and as the secretary and leader of the department I should be the model for that for the rest of the department," Johnson said. "And that’s what I intend to do."
Politico’s Tal Kopen referred to the report as a "black eye" for the department.
DHS released a rule to end the use of email systems such as Gmail and Yahoo Mail in response to the OPM hack, but senior officials were granted a waiver to continue.
"It is simply not reasonable to assume that in seeking a waiver that the officials involved were only contemplating using a commercial network for personal (that is, non-official) communications," Jason R. Baron, formerly of the Nationals Archives and Records Administration, told Bloomberg.
The department has since said all use has been suspended and waivers will only be granted by the chief of staff, who was previously unaware of the situation.