Despite repeated reports of serious problems , senior agency officials had not provided the management attention needed to ensure that their information security programs were effective .
There were repeated complaints , but there was no proof that management ensured the security was tight since all the users were able to use old passwords .