The Dish

Ezra puts Sebelius’ resignation in a favorable light:

The White House says Sebelius notified the President in March that “she felt confident in the trajectory for enrollment and implementation,” and that once open enrollment ended, “it would be the right time to transition the Department to new leadership.”

In other words, the law has won its survival. The Obama administration can exhale. Personnel changes can be made. A new team — led by Office of Management and Budget Director Sylvia Matthews Burwell, who the White House calls a proven manager— can be brought in to continue to improve the law. And Sebelius can leave with her head held high. She can leave with the law she helped build looking, shockingly, like a success.

Jeez. Is Ezra working directly for the administration now? I’d have fired her months ago, but then I’m not the Zen Master POTUS. And there is a sense of fairness in giving her the time to make up for her disaster. Martin Longman is more critical:

[T]he White House is promoting the fact that she overcame the initial problems with the Healthcare.gov website and actually exceeded enrollment expectations and goals. Basically, they’re saying that Sebelius oversaw the HHS Department at a time when approximately ten million people got access to health care they would not otherwise have, and her critics cannot claim to have done anything of similar merit.

That’s a fair point, but it glosses over the lasting damage done to how the law is perceived, and Sebelius bears responsibility for that.

She sure does. By far the greatest act of political malpractice under Obama. And the political impact was even more brutal. It was the failed website that shifted the entire politics of last fall, and indelibly undermined the Obama administration’s rep for competence. The president and his party have still not recovered politically, even if the website recovered rather magnificently. Amy Davidson adds:

[T]he very solidity of the numbers makes the problems with the rollout look even more painful.

This was a good law, offering something that people wanted. The department Sebelius was in charge of was supposed to get it to them. Instead, what it presented to the world was a big mess. Obama was also humiliated when his assurances about people getting to keep their plans turned out to be false. From the perspective of the Obama Administration, the rollout—Sebelius’s rollout—made something majestic look grubby. Sebelius, for her part, told the Times that if she could take “all the animosity. If that could just leave with me, and we could get to a new chapter, that would be terrific.”

Cohn’s perspective:

Sebelius brought two main assets to her job. She had experience regulating insurers and, as a successful Democrat in Kansas, she knew how to work with Republicans. But what Obamacare needed more was a deft, aggressive manager. Case in point: By all accounts, Sebelius did not grasp the severity of tech problems at healthcare.gov until the day it went live and crashed. If she got the warnings, then she should have heeded them. If she didn’t get the warnings, then she should have appointed people who would have kept her better informed.

Still, it’s not as if Obamacare’s implementation difficulties are entirely, or even mostly, the fault of HHS. It’s a typical, if predictable, failure of Washington to demand a fall guy when things go wrong. But responsibility rarely lies with just one person. (That’s one reason Obama resisted calls to fire her.) And this case is no exception.

Jason Millman provides background on Sebelius’s replacement:

Burwell has extensive administration experience that includes budget oversight for major entitlement programs, like Medicare and Medicaid. Last summer, Burwell and White House chief of staff Denis McDonough led negotiations with a group of Senate Republicans who hoped to forge a grand bargain with the administration to raise taxes and rein in spending on health and retirement programs. The talks went nowhere, but Republicans gave Burwell high marks for a bedside manner that was seen as less prickly and much less political than her predecessor Jack Lew.

After the Senate talks petered out, Burwell helped manage the first shutdown of the federal government in nearly 17 years after congressional Republicans and Democrats hit an impasse over agency spending for the current fiscal year – though the real battle was over the fate of Obamacare, rather than taxes and spending.

David A. Graham thinks “Burwell’s appointment may be read as an implicit rebuke to Sebelius’s style”:

Her successor is known as an effective manager. “The president wants to make sure we have a proven manager and relentless implementer in the job over there, which is why he is going to nominate Sylvia,” White House Chief of Staff Denis McDonough told the Times.

A West Virginia native and Rhodes Scholar, she served in the Clinton White House and as president of the Walmart Foundation. And while getting any nomination through the Senate has become a challenge, Burwell has two advantages. First, Majority Leader Harry Reid recently changed the rules of nominations so that they require only 51 votes to pass and are not subject to filibusters; and second, she was confirmed 96-0 just last year.

Philip Klein looks forward to the Burwell confirmation hearings:

The new secretary of HHS will have the ability to determine when the open enrollment period for the exchanges can begin or end; what type of insurance every American must have; and what constitutes enough of a “hardship” to exempt individuals from the mandate to purchase coverage, among other powers. As HHS secretary, Sebelius has proven herself willing to push the boundaries of her discretion to delay or modify key parts of the law without seeking congressional authorization.

Obama plans to replace Sebelius with current director of the Office of Management and Budget Sylvia Mathews Burwell. Republicans will no doubt want to turn the focus of her confirmation hearing on Obamacare. But the hearings should, specifically, be used as an opportunity to highlight the vast expansion of power granted to this one official through the health care law.

Ben Domenech also welcomes the upcoming confirmation fight:

Senate Republicans actually have an advantage here in the wake of the Nuclear Option’s implementation: they can easily come up with a list of facts they claim the administration has hidden, details kicked aside, statutes ignored, and a host of other challenging questions on accountability over the implementation (and non-implementation) of the law. A list of every question Sebelius has dodged over the past several years would suffice. By demanding answers before the HHS nomination moves forward and refusing to rubber stamp the president’s pick, Republicans could force more vulnerable Democrats to take a vote that ties them both to the Nuclear Option and Obamacare six months before a critical election.

Readers sound off on Facebook:

Yeah let’s blame Sebelius for the Republicans refusing to set up their exchanges, forcing the government to have a federal exchange bidding process at quite the last minute, a process that has been beyond broken in and of itself. Sebelius is not your scapegoat on this one. She got through a very complicated and difficult program implementation on schedule and on target. If anything, she should be praised.

Sarah Stillman addresses the crisis:

One of the strangest things about the H.I.V. epidemic in the Deep South—from Louisiana to Alabama to Mississippi—is how easily most Americans have elided it, choosing instead to imagine that the disease is now an out-there, elsewhere epidemic. It’s a plague from some anterior time, some exterior continent, something our kids will read about in books or that we glimpse as history in the movie “Dallas Buyers Club.” …

“If you think about where the rates are highest, it’s in the most conservative places,” [Deon] Haywood [director of the New Orleans-based prevention organization Women with a Vision] told me.

“It’s where the conversation is not being had, and where shame and stigma exist because of religion, because of culture, because of racism, because of homophobia—you name it, it exists for those reasons.”

The vast overlap between the social ailments of the South (like poverty) and the physiological ones (like disease) is not merely theoretical. “When you think about the South, we have the highest rates of H.I.V.,” Haywood continued. “But we also have the highest incarceration rates, and we don’t have comprehensive sex education—we have abstinence-only education.” Nationally, one in seven individuals living with H.I.V. passes through the correctional system annually, which tends to amplify their risk factors. Louisiana has the highest incarceration rate not only in the country but in the world. It’s another reason that Haywood’s group has become increasingly involved in broader policy work.

In the wake of another massive recall, this time by Toyota, Brad Plumer examines why auto recalls are becoming more common:

Automakers typically recall cars or trucks when they’ve identified a defect that could jeopardize public safety. That’s not always a simple call, though. Many problems are obvious hazards — like faulty airbags. Other defects, however, are less clear-cut. What if a car has windshield wipers that, under very rare conditions, might become “improperly torqued”? (Toyota faced this situation last year.) Should the company issue a costly recall? Or let it slide?

Since the 1990s, more and more automakers appear to be erring on the side of issuing a recall — even for seemingly minor problems. In February, for instance, Kia recalled 11,000 vehicles simply because the door stickers gave incorrect guidance on tire inflation.

Todd Wasserman offers some other possible explanations:

While the public climate may be prompting some proactive recalls, Roger Lanctot, associate director of Strategy Analytics, blames onboard software and algorithms related to airbag deployment. Lanctot points out that GM, Nissan, Toyota and Chrysler, among others, have instituted recalls related to the technology over the last two years. “This is just the beginning of software recalls,” Lanctot says. “In the past it was all about mechanical failures.”

Another possible factor is the auto industry’s use of modular components. As The Wall Street Journal points out, more and more carmakers are using more and more components across different models. While that saves costs, “if things do go wrong, auto makers can have a hard time containing them,” the article notes.

Danny Vinik puts the Toyota recall in perspective:

Just two months after General Motors’ controversial recall, Toyota announced its own recall on Wednesday morning of 6.4 million vehicles across 30 different models from 2004 to 2013—more than the total number of automobiles in Belgium alone. In fact, the 6.4 million vehicles are more than twice as many cars as are in New Zealand, according to data from the World Bank. …

The recall of 6.4 million vehicles is the fifth largest in history—slightly less than Toyota’s 2010 recall for faulty gas pedals.

Column Lynch has a three part series (one, two, three) looking at African Union-United Nations Mission in Darfur (UNAMID). The first installment points out the continued violence in the country:

The failure of the peacekeepers to protect civilians can be attributed to multiple factors. Internal UNAMID documents say that troop-contributing countries supplied their blue helmets with broken vehicles and low-grade weaponry, while more powerful foreign powers declined multiple U.N. appeals to give the peacekeepers helicopter gunships to reinforce the mostly African infantry battalions. U.N. headquarters in New York, according to the documents, has also routinely rebuffed UNAMID commanders’ requests that underperforming peacekeeping contingents, or those that decline to carry out direct orders, be sent home and replaced by other troops. Sudan’s government forces and militias, meanwhile, have tormented the blue helmets, hampering their effectiveness.

Part two highlights the attacks on peace-keepers:

As of Feb. 28, 2014, a total of 191 U.N. peacekeepers have died in Darfur since January 2008, when the U.N. and African Union jointly took charge of the operation in Darfur. Only a handful of U.N. operations since the 1960s — including the original Congo operation (249) and those in Lebanon (303), the former Yugoslavia (213), and Sierra Leone (192) — have exacted a higher toll.

Sixty-two of those 191 deaths were a result of violent attacks, including ambushes, carjackings, and robberies. Sudan’s special prosecutor for Darfur has opened numerous investigations, but as of today, not a single person has been held accountable for killing a UNAMID peacekeeper.

The final installment tries to explain the mission’s failures:

Michael Gaouette, a former U.N. official who led the U.N. peacekeeping department’s Darfur team in 2008, said that many of the new forces’ shortcomings were foreseeable and inevitable. The notion of a peacekeeping mission as the solution to Darfur’s ills became part of the message tirelessly promoted by foreign governments, humanitarian groups, and well-intentioned celebrities like George Clooney. The problem, he said, was that none of the conditions necessary for a successful peacekeeping mission — a ceasefire, a viable political settlement, or true consent from the Sudanese government — were in place. Darfur also held “zero strategic importance” for the few countries, including the United States, with the military capability to deploy an effective expeditionary force in a place like Darfur, Gaouette said.

“This all begins with this problem being insoluble in the short term, which was an unacceptable admission. Something had to be done right away,” he said. “It was mind-bogglingly ridiculous to propose that peacekeeping would be the key that unlocked the door to the Darfur solution. And yet peacekeeping was graspable, peacekeeping in its most simplified, misunderstood form — sending soldiers to a place in trouble.”

Anita Little covers the controversy that arose last week over the Army’s new hairstyle guidelines, which critics say are biased against black women:

Basically, almost every natural hair option that black women in the Army could wear is now off limits. One of the few traditionally natural hairstyles that was listed as appropriate is cornrows, but a slew of specifications and rules surrounded even that. The diameter of each cornrow can’t be more than one-fourth of an inch, and no more than one-eighth of an inch of scalp may be shown between cornrows.

The only way to realistically meet the new standards would be to shave one’s head, perm one’s hair or wear weaves or wigs.

[Georgia National Guard Sergeant Jasmine] Jacobs said twists like the one she wears are very popular among black women soldiers because the style requires little maintenance when in the field. Her hair’s thickness and curliness makes pulling her hair back into a bun (a style popular among white women soldiers) impossible.

Elizabeth Nolan Brown proposes a simple solution:

I understand the need for the army to issue broad guidelines on acceptable hair styles, as it does in other areas of appearance. But, beyond that, it could be left up to individual unit commanders. The current regulations do include a waiver system, under which women can appeal and be granted exceptions on a case by case basis. Why not start from a place of allowing women and their immediate supervisors to make those determinations? Surely people smart and capable enough to fight and die for our country are smart and capable enough to assess for themselves which hairstyles are an interference and which aren’t.

Mark Thompson looks at what else the new guidelines prohibit:

The new regulations, issued last week, clamp down on tattoos, haircuts, sideburns, fingernails, teeth and jewelry. Tattoos are a big deal in the military. But from here on out, tattoos are barred from a soldier’s head, face, neck, wrist, hands and fingers (existing tattoos in those locations are permitted). Any enlisted soldier with such tattoos will not be eligible for promotion to warrant officer or officer ranks.

Rusty Foster blames the bug on the insufficient attention we pay to open-source software:

OpenSSL, which is used to secure as many as two-thirds of all encrypted Internet connections, is a volunteer project. It is overseen by four people: one works for the open-source software company Red Hat, one works for Google, and two are consultants. There is nobody whose full-time job it is to work on OpenSSL. ….

Unlike a rusting highway bridge, digital infrastructure does not betray the effects of age. And, unlike roads and bridges, large portions of the software infrastructure of the Internet are built and maintained by volunteers, who get little reward when their code works well but are blamed, and sometimes savagely derided, when it fails. To some degree, this is beginning to change: venture-capital firms have made substantial investments in code-infrastructure projects, like GitHub and the Node Package Manager. But money and support still tend to flow to the newest and sexiest projects, while boring but essential elements like OpenSSL limp along as volunteer efforts. It’s easy to take open-source software for granted, and to forget that the Internet we use every day depends in part on the freely donated work of thousands of programmers.

The developer who introduced the bug called it “a simple programming error.” Update from a professional software developer:

Most of the commentary on the Heartbleed bug has focused on the proximate cause of the problem. As reported, this is indeed a simple programming error, of the kind that I could see almost anyone making from time to time. There’s lot of talk in the community about various engineering best practices (code reviews and so forth) that might have prevented this. And there’s certainly an interesting discussion about whether this being open source has helped, hurt, or is irrelevant. But zoom out a bit, because this particular bug has a root cause that’s deeper than the simple programming error. This XKCD comic gives a pretty good explanation of what happens with Heartbleed. If, after reading this, you’re wondering why a simple “are you alive” check requires the server to repeat back to the user an arbitrary block of data instead of just saying “yup, I’m here”, you’re not alone. This is a completely unnecessary feature of the protocol, that adds no functionality of any real value. One thing we’ve learned about developing secure systems is to reduce the “attack surface”, which means that any entry points and bits of protocols that aren’t required should be eliminated, because they might serve as vectors for attacks. Which is exactly what happened here. This bug doesn’t exploit the main part of the protocol – the gnarly stuff that actually deals with cryptographic keys – but rather goes after a flaw in this unnecessary appendage.

As a community, we need to get better about reviewing and analyzing the designs of these systems before they ever turn into code. And we also need to find a way to get smart people reviewing the unsexy bits of these systems more frequently.