> So the punishment for not securing taxpayer data is... nothing? So why bother fixing anything?
Exactly. It is very, very difficult to fire someone who works for the Federal Government. One case that I knew of: there was this woman in a wheelchair who pinched butts, stole things from the cafeteria (in plain sight, right in front of everyone) and did so little work they had to search for it with microscopes. True story. They had to apply to the regional office in Atlanta, have several hearings, go through several "counseling sessions," and finally, after about A YEAR ... this worthless piece of flotsam was terminated.
Then she sued them for discrimination and they were tied up for another year in court. She lost, of course, but it cost time and money.
Ergo: the strong inclination, when you have incompetents, is just to leave them in place. If they're doing too much damage, you try to transfer them to where they can't do as much harm. Barring that, if you think it'll work at all, you PROMOTE them. (Again: true stories. I'm not kidding.)
So ... now you end up with incompetents in middle management. The problem gets worse.
Rinse. Repeat until the entire building is like a M.A.S.H. episode, with a few who will actually do their jobs, and who can only stay sane by either taking drugs or joking about it incessantly.
(And in real life, by the way, if you're not careful, such "joking" will actually result in counseling and a reprimand.)
I am not kidding. There is no hyperbole in the above. Re-read it and let it nourish your brain. There's at least part of your answer.
(The other parts are so unpalatable -- such as outright nepotism and granting favors to friends and supporters -- that I shall spare you.)