Federal agencies still depend on some aging computer systems, including two Treasury systems that use COBOL and Assembly Language Code. That fact does not make those systems automatically insecure: GAO’s documented concerns include unsupported components, known vulnerabilities, and the difficulty of finding staff to maintain older languages. A separate 2026 GAO review found that information from six agencies was not sufficient to determine the extent of DOGE-related system access. The two issues meet at a governance question: how do agencies keep essential systems secure when both technology and the authority to access it are involved?
What does “legacy system” mean—and what did GAO find?
In its reporting, the U.S. Government Accountability Office (GAO) uses “legacy” for aging or obsolete systems. The label alone does not mean a system is broken, vulnerable, or written in COBOL. The scope of each GAO review matters: its findings describe the systems it examined, not every federal agency or federal computer system.
The 2019 systems, as described in 2023
In a May 10, 2023 testimony about progress on recommendations from its 2019 review, GAO said the 10 systems identified in that earlier review—at 10 agencies—were about 8 to 51 years old. Agencies reported that the group cost about $337 million per year to operate and maintain. Several systems used COBOL. These figures describe that earlier group, not the systems selected for GAO’s later review.
The systems selected for GAO’s 2025 review
In a July 17, 2025 report, GAO selected 11 systems from 69 agency-submitted systems provided by 24 CFO Act agencies. The 11 systems were maintained by 10 agencies. GAO reported that eight used outdated languages, four had unsupported hardware or software, and seven had known cybersecurity vulnerabilities. Those categories may overlap; GAO’s reported counts do not mean that each system had just one of these issues.
#1 Best Overall
- ?Retro design?: The appearance is similar to that of a typewriter in the 1940s. The mechanical keys click and let you feel the charm of the typewriter.
- ?Ergonomic design?:Based on ergonomics, blue shaft and round keycaps are used, easy to click, and excellent input and response capabilities. Even if you use it for a long time, you won't feel tired.
- ?Anti-collision, high-definition printing?:83-key anti-collision button layout, laser engraving is not easy to fade, you can press multiple buttons at the same time, fast response, and enjoy a better gaming experience and work.
- ?Wireless and wide compatibility?: It can support 3 devices at the same time via Bluetooth wireless connection. Wide compatibility, can be used on iOS, Android, Windows and other devices. Supported operating systems: WIN2000 / WINXP / VISTA / WIN7 / WIN8 / WIN10 / LINUX / ANDROID / ISO / Mac
- ?LED Backlight?: Equipped with white backlight, you can accurately view the key position even in a dark place, and obtain high operability.
| Review cohort | Scope | Reported findings |
|---|---|---|
| 2019 review, figures repeated in GAO testimony on May 10, 2023 | 10 systems at 10 agencies | About 8–51 years old; about $337 million per year in reported operating and maintenance costs; several used COBOL. |
| GAO report published July 17, 2025 | 11 selected from 69 agency-submitted systems; maintained by 10 agencies | Eight used outdated languages, four had unsupported hardware or software, and seven had known cybersecurity vulnerabilities. |
The cohorts should not be combined into a single trend line: GAO reviewed different sets of systems at different times. Nor does the 2025 selection establish how common these conditions are across the federal government.
Is COBOL itself a security problem?
No. COBOL is an older programming language, but its presence is not proof of a security flaw. Risk depends on the condition and design of the whole system: whether its software and hardware are supported, whether vulnerabilities are known, whether patches can be applied, how access is controlled, and whether qualified people can maintain it.
GAO’s 2025 report identified two selected Treasury systems that ran COBOL and Assembly Language Code. It described dwindling availability of staff with the skills to maintain such languages as a support risk. That is a practical concern: when expertise is scarce, maintenance and modernization can become harder to sustain. It is different from saying that a language, by itself, makes a system insecure.
Why does the Evil Housekeeper Problem matter?
The “evil housekeeper” is a security analogy about what happens when an adversary has physical access to a device—or when a person with institutional authority is present and can press others to enable access. The point is not that one particular person has compromised a government system. It is that protections designed around software and network threats can be undermined if a person can reach the device or influence the people who administer it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- 【75% Space‑saving Layout】The KN85 series is a compact 85‑key keyboard (13.68" × 5.51" × 1.77") that keeps all the essentials (F1–F12, arrows, shortcuts) without the number pad. It frees up 25% of desk space for better mouse movement. Designed for small desks, laptop setups, gamers and minimalists. For frequent number‑pad input, choose our full‑size KN104 with a complete dedicated numpad, or opt for our new KN98 model — compact 99‑key that retains the numpad while saving desktop real‑estate
- 【Tri-Mode Connectivity for Multi-Device Workflow】Connect via USB‑C, 2.4GHz wireless, or Bluetooth 5.0 (3 channels supported), with ultra‑low latency (USB 2ms, 2.4G 5ms, BT 11ms). Switch seamlessly between Windows and Mac to work across your PC, laptop, tablet, smartphone, or gaming console. Perfect for programmer, student, creator, or hybrid worker. The built‑in 4000mAh rechargeable battery ensures stable wireless performance. Continue typing while charging via wired mode when power runs low
- 【Creamy Thocky Typing Sound】The gasket mount absorbs harsh vibrations and hollow echoes to produce a smooth marbly thock, rather than loud clacky taps. Each keypress feels softly cushioned. Whether you’re working late at home or typing in a shared office space, the mellow, ASMR-like tone makes every keystroke a genuinely enjoyable experience
- 【Hot-swap for Tailored Sound & Tactile】Pre-lubed Bsun linear switches (45-50gf actuation) deliver a buttery response. Compatible with both 3 pin and 5pin switches, they enables solder-free swapping. From beginners to frequent typists and dedicated writers, craft your preferred typing signature without complex modding
- 【RGB Backlighting & Programmable】A warm ambient glow surrounds PBT keycaps and case edges, creating a calm, inviting desk vibe for late-night workspace. Adjust hues and brightness through shortcut keys or companion software. The KN85 driver (Windows only, wired/2.4G mode) lets you remap keys and set custom macros to boost your daily productivity
Dan Hon used the analogy in a February 7, 2025 MIT Technology Review article. A TechPolicy.Press page reproduces his explanation: “It’s a principle of computer security roughly stating that once someone is in your hotel room with your laptop, all bets are off.” The analogy helps explain why security depends on more than technical safeguards. It does not establish that a specific attack happened, or how likely one is.
Hon’s argument is distinct from GAO’s audited findings. In a sentence reproduced by Ben Werdmuller on February 7, 2025, Hon wrote: “So we should plan for the worst, even if the likelihood of the worst is low.” That is a call to think about consequences and safeguards under adverse conditions—not a GAO conclusion about a particular incident or individual.
What did GAO establish about DOGE and access to systems?
GAO’s September 29, 2026 review covered six agencies. Four supplied information about system access, and three supplied information about controls. GAO said it could not determine the extent of access from the information it received, and that Congress and the public lacked assurance that systems and data were protected.
That is a bounded finding about the agencies GAO reviewed and the information available to it. It does not establish that every DOGE team had unrestricted access, identify who could read or change particular records, or show that a specific system was breached. It also does not make the review a finding about the Treasury COBOL systems discussed in GAO’s separate 2025 report.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #3
- [2.4G Wirless Connection Plug and Play Wireless Keyboard and Mouse Combo] The one 2.4GHz USB receiver can connect both the mouse and keyboard to your computer at the same time without any drivers and software, plug and play. 2.4GHz wireless connection distance can reach 30 meters(98 feet) without delay and disconnect, it can also keep your desk tidy without messy wires (Note: The USB receiver stuck in the cardboard packaging beside the mouse. The keyboard and mouse share one receiver.)
- [Compact With Multimedia Hotkeys Wireless Mouse and Keyboard] The keyboard with a numeric keypad makes typing easier and more comfortable, helping you be more productive. Multimedia hotkeys provide easy access to multimedia such as music, volume, e-mail, etc
- [Sensitive Response & Retro Round Keycaps Computer Keyboard] Adopts noise reduction keys, a square mechanism under each key improved stability, quick rebound and no delay. The retro round concave keycap matches the shape of your fingertips, and it is comfortable to press, just like typing on an old-fashioned typewriter, and your hands will not feel tired during long-term office work
- [Auto Power-Saving Function] When you stop using the keyboard for more than 5 minutes, the keyboard will enter sleep mode. Even allows you to forget the battery as the battery life is up to 36 months. Press any key to activate the device. (Note: 1 piece AAA battery is required for the keyboard and 1 piece AA battery for the mouse (Battery not included)
- [Universal Compatibility] Our wireless keyboard mice combo work with PC, Mac, Desktop, Laptop, Notebook, Computers, etc. It is the best choice for personal offices and corporate businesses
The governance issue raised by the housekeeper analogy is relevant here: when access is granted through institutional authority, agencies still need to know who has access, what that access permits, and what controls apply. GAO’s stated inability to determine access extent is a limitation in what the public can be assured about—not proof of a particular misuse.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What does modernization cost taxpayers—and what can the figures tell us?
GAO reported in 2025 that the federal government spends over $100 billion annually on information technology, and that agencies have typically reported about 80 percent of that spending going to operate and maintain existing IT. That operating-cost context helps explain why aging systems compete with other technology priorities. It is not a forecast that modernization will save a particular share of the budget.
The approximately $337 million in annual operating and maintenance costs reported for the 10 systems in the 2019 cohort is a separate historical figure, repeated in GAO’s May 2023 testimony. It should not be applied to the 11 systems selected in 2025 or treated as a current cost estimate for them. Neither figure, by itself, shows how much a replacement would cost or whether it would produce net savings.
Elon Musk’s post—quoted in a 2025 academic article’s references—said: “The government runs on ancient computers & software. Needs an upgrade!” That is Musk’s characterization, not an independent technical assessment. GAO’s more specific findings support a narrower conclusion: some selected systems had documented modernization or support concerns, but a broad claim about the entire government cannot be inferred from those samples.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #4
- Inspired by the classics. Compatible with Windows 10(1903) or above, and Android 9.0 or above.
- Programmable keys, Dual Super Buttons, and Super Stick, with independent control panel.
- 87 keys. Top mount style with Kailh Box White Switches.
- Double-Shot ABS keycaps with SA profile. (C64 Edition only)
- Hot-swappable PCB. Support n-key rollover.
How can agencies modernize COBOL systems safely?
There is no single safe path implied by the language a system uses. A rewrite may remove dependence on obsolete components but can also introduce migration errors or disrupt essential services. Keeping a system unchanged can preserve continuity in the short term, but leaves agencies reliant on its existing support, staffing, and security posture. The right choice depends on the system’s risks, purpose, and dependencies.
GAO’s 2025 review found that three agencies had documented modernization plans for their selected systems that included all key practices. Plans for the other eight did not fully document them. GAO’s planning elements were milestones, a description of the work, and details about the disposition of the legacy system. These elements make it possible to see what is meant to change, when, and what will happen to the old system. The additional trade-offs below are evaluation questions, not a checklist attributed to GAO.
| Approach | Potential advantage | Risk or question to test |
|---|---|---|
| Retain and strengthen the existing system | Can avoid a large immediate migration while the service continues to run. | Are hardware, software, and security issues supportable, and can the agency retain enough expertise to maintain the system? |
| Move the system to newer infrastructure | May address unsupported hardware without replacing all application logic at once. | Will the application remain supportable in the new environment, and what dependencies could affect service continuity? |
| Replace components in stages | Can limit the scope of each change and create milestones for delivery. | How will old and new components exchange data, and when will each legacy component actually be retired? |
| Rewrite or replace the system | Can provide a route away from an obsolete application or language. | How will the agency verify data conversion, preserve required functions, manage migration risk, and avoid disrupting service? |
For any route, a credible plan should set out the work, milestones, and disposition of the old system—the practices GAO examined—and should also let decision-makers assess service continuity, patchability, data conversion, workforce and vendor support, interoperability, and operating costs. A plan that says only “modernize” does not answer whether the legacy system will be retired, kept in parallel, or left in use indefinitely.
What is the practical lesson?
COBOL is not a synonym for insecure, and a modernization announcement is not proof that a service is safer or cheaper. GAO’s reports point to specific questions instead: are components supported, are vulnerabilities known, is maintenance expertise available, are plans complete, and can agencies explain and oversee system access? The evil-housekeeper analogy adds a governance warning: technical defenses cannot substitute for clear authority, accountable access, and evidence that controls are working.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
