Despite repeated reports of serious problems, senior agency officials had not provided the management attention needed to ensure that their information security programs were effective.
There were repeated complaints, but there was no proof that management ensured the security was tight since all the users were able to use old passwords.