The GSA believes the problem was brought to the agency's attention before it became a hazard to other users," she said. "Security, of course, remains a priority issue with the agency. We have a rigorous certification and accreditation process to ensure management, operational and technical controls are adequately implemented on our systems. We conduct regular reviews of our information systems to mitigate newly discovered vulnerabilities and prevent misuse of our systems."

Part of the delay in investigating the claims and taking the site down was that it was first brought to the attention of the GSA over the December holidays, while workers were on vacation, Millikin said.