Hunter Storm ™

StormWatch | When Public AI Meets Government Secrets | Lessons from the CISA ChatGPT Incident

What Happened

• The Acting Director of the U.S. Cybersecurity and Infrastructure Security Agency (CISA)—Madhu Gottumukkala—uploaded government documents marked “for official use only” to a public version of ChatGPT last summer.
• These were not classified documents, but they were still sensitive and not intended for public disclosure.

 

Security Alerts & Review

• The uploads triggered automated security warnings within CISA’s own cybersecurity monitoring systems.
• Because the documents left federal networks and went into a public AI service, officials at the Department of Homeland Security launched an internal review to assess if any harm to government security resulted.

 

Why It’s Controversial

• Public AI vs. Government Security: Uploading materials to a public AI platform can pose risks because — depending on tool settings — the content could be retained, potentially used in training future responses, or otherwise exposed to other users.
• Access Privilege: Gottumukkala was reportedly given a special exception to use ChatGPT — even though other Department of Homeland Security (DHS) employees were blocked from accessing the service.
• One anonymous official reportedly criticized the decision, saying Gottumukkala essentially “forced CISA’s hand into making them give him ChatGPT, and then he abused it.”

 

Background on the Acting Director

• Madhu Gottumukkala was appointed acting head of CISA in May 2025 after serving as the Chief Information Officer for South Dakota.
• Reports indicate he previously underwent a polygraph tied to intelligence access and failed, which has itself been part of internal controversy at the agency.

 

Official Response

• A CISA spokesperson characterized his use of ChatGPT as “short-term and limited” and conducted under authorized exception, but statements did not fully clarify the scope of documents involved or the outcomes of the internal review.

 

---

In short: a senior U.S. cyber official with responsibility for defending federal systems made a significant procedural misstep by placing sensitive government documents into a public AI model, prompting security alerts and an internal government review. That’s sparked debate about leadership judgment and how government agencies interact with commercial AI tools.

 

How Data Can Be Retained in AI Systems

When someone uploads a document to a public AI system like ChatGPT:

1. Short-term processing: The text is sent to the model to generate a response.
2. Logging and caching: Many AI services temporarily store inputs and outputs to monitor usage, debug issues, and improve performance.
3. Training datasets (possible): Some services might use user interactions to fine-tune future models—though OpenAI says they do not use data submitted through certain API endpoints or enterprise accounts for model training unless the user opts in.

 

The risk: even if a document isn’t publicly viewable, it can exist in internal logs, backups, or cached copies, which are harder to fully erase than a file on your personal computer.

 

---

Why Erasing Data is Complicated

Think of it like trying to remove a drop of dye from a swimming pool:

• Replication: Logs might be copied across multiple servers or regions for redundancy.
• Backups: Periodic backups can capture the data before it’s deleted.
• Propagation in training: If a model was trained on the text (even partially), the knowledge can be baked into weights and patterns. You can’t “delete” a single fact from a neural network once it’s integrated—it’s entangled with millions of other parameters.

 

Even if a company deletes a file, there’s no guarantee it disappears from every backup or internal system immediately.

 

---

Mitigation Strategies

For sensitive materials:

• Enterprise or isolated instances: Use versions of AI that are federated or private, where data isn’t sent to a public system.
• Redaction: Remove sensitive identifiers before inputting anything into AI.
• Data deletion policies: Some AI providers allow formal deletion requests—but it mainly guarantees removal from active storage, not necessarily historical backups.

 

---

The Internet Never Forgets, and Neither Does AI

Bottom line: Once sensitive info is uploaded to a public AI system, it’s very hard to guarantee complete erasure, especially if it leaves the internal network. That’s why government agencies treat this as a serious operational security issue.

 

---

StormWatch™ | Real-World Cybersecurity Advisories

They say lightning never strikes twice. In cybersecurity, patterns repeat.

StormWatch™ goes beyond surface-level incident reporting. Each advisory traces events to the end of the risk chain — examining root causes, second-order effects, and structural vulnerabilities that others stop short of exploring.

Where mitigation is possible, StormWatch provides concrete, actionable steps. Where it is not, that reality is stated plainly.

Signal. Structure. Solutions.

 

---

Discover More from Hunter Storm

• Hunter Storm Official Site
• Hunter Storm’s Year with ChatGPT 2025 | Creativity, Research, and Collaboration
• Public AI, Private Data | Why Uploading Sensitive Information Is a Systemic Failure—Not an AI Problem
• Résumé | Wells Fargo de Facto Chief Information Security Officer (CISO) | Group Information Security Officer (GISO) | Information Security Consulting (ISC) Lead
• StormWatch | Apple Plans to Scan U.S. Phones for Child Abuse Imagery
• StormWatch | ChatGPT | Public Data Exposure
• StormWatch | Lessons from the CISA ChatGPT Incident
• StormWatch | Public AI, Private Data | Why Uploading Sensitive Information Is a Systemic Failure—Not an AI Problem
• StormWatch | Real-World Cybersecurity Advisories
• StormWatch | When the Firewall Becomes the Breach | The F5 Hack and What It Teaches Us About Trust, Timing, and Transparency

 

---

 

About the Author | Hunter Storm: Technology Executive, Global Thought Leader, Keynote Speaker

CISO | President | Advisory Board Member | Strategic Policy & Intelligence Advisor | SOC Black Ops Team | QED-C TAC Relationship Leader | Systems Architect | Artificial Intelligence (AI), Cybersecurity, Quantum Innovator | Cyber-Physical-Psychological Hybrid Threat Expert | Ultimate Asymmetric Advantage

Background

Hunter Storm is a veteran Fortune 100 Chief Information Security Officer (CISO); Advisory Board Member; Strategic Policy and Intelligence Advisor; SOC Black Ops Team Member; QED-C TAC Relationship Leader; Systems Architect; Risk Assessor; Artificial Intelligence (AI), Cybersecurity, Quantum Innovator; Cyber-Physical-Psychological (Cyber-Phys-Psy) Hybrid Threat Expert; and Keynote Speaker with deep expertise in AI, cybersecurity, quantum technologies, and human behavior. She is also a federal whistleblower with documented contributions to institutional accountability and governance integrity. Explore more in her Profile and Career Highlights.

Drawing on decades of experience in global Fortune 100 enterprises, including Wells Fargo, Charles Schwab, and American Express; aerospace and high-tech manufacturing leaders such as Alcoa and Special Devices (SDI) / Daicel Safety Systems (DSS); and leading technology services firms such as CompuCom, she guides organizations through complex technical, strategic, and operational challenges as the founder of Hunter Storm Enterprises.

Global Expert and Subject Matter Expert (SME) | AI, Cybersecurity, Quantum, and Strategic Intelligence

Hunter Storm is a globally recognized Subject Matter Expert (SME) in artificial intelligence (AI), cybersecurity, quantum technology, intelligence, strategy, and emerging and disruptive technologies (EDTs) as defined by NATO and other international frameworks.

A recognized SME with top-tier expert networks including GLG (Top 1%), AlphaSights, and Third Bridge, Hunter Storm advises Board Members, CEOs, CTOs, CISOs, Founders, and Senior Executives across technology, finance, and consulting sectors. Her insights have shaped policy, strategy, and high-risk decision-making at the intersection of AI, cybersecurity, quantum technology, and human-technical threat surfaces.

Bridging Technical Mastery and Operational Agility

Hunter Storm combines technical mastery with real-world operational resilience in high-stakes environments. She builds and protects systems that often align with defense priorities, but serve critical industries and public infrastructure. She combines first-hand; hands-on; real-world cross-domain expertise in risk assessment, security, and ethical governance; and field-tested theoretical research with a proven track record in high-stakes environments that demand both technical acumen and strategic foresight.

Foundational Framework Originator | Hacking Humans: The Ports and Services Model of Social Engineering

Hunter Storm pioneered Hacking Humans | The Ports and Services Model of Social Engineering, introduced and established foundational concepts that have profoundly shaped modern human-centric security disciplines across cybersecurity, intelligence analysis, platform governance, and socio‑technical risk. behavioral security, cognitive defense, human risk modeling, red teaming, social engineering, psychological operations (PsyOps), and biohacking. Hunter Storm introduced system‑level metaphors for human behavior—ports and services, human OSI layers, motivator/state analysis, protocol compatibility, and emotional ports—that now underpin modern approaches to social engineering, human attack surface management, behavioral security, cognitive threat intelligence, and socio‑technical risk. Her original framework continues to inform the practice and theory of cybersecurity today, adopted by governments, enterprises, and global security communities.

Projects | Research and Development (R&D) | Frameworks

Hunter Storm is the creator of The Storm Project | AI, Cybersecurity, Quantum, and the Future of Intelligence, the largest AI research initiative in history.

Hunter Storm also pioneered the first global forensic mapping of digital repression architecture, suppression, and censorship through her project Viewpoint Discrimination by Design | The First Global Forensic Mapping of Digital Repression Architecture, monitoring platform accountability and digital suppression worldwide.

Achievements, Awards, and Advisory Boards

Hunter Storm is a Mensa member and recipient of the Marquis Who’s Who Lifetime Achievement Award, reflecting her enduring influence on AI, cybersecurity, quantum, technology, strategy, and global security.

She is a distinguished member of the Industry Advisory Board at Texas A&M School of Computer Science, where she advises on curricula and strategic initiatives in AI, cybersecurity, and quantum technology.

Hunter Storm is a trusted contributor to ANSI X9, FS-ISAC, NIST, and QED-C, shaping policy, standards, and strategy at the highest levels.

She also serves as President of the Sonoran Desert Security User Group (SDSUG), leading leadership, governance, modernization, and strengthening the regional security ecosystem.

Hunter Storm is a member of InfraGard, collaborating with public- and private-sector partners on critical infrastructure protection.

All-Original Thought Leadership

Hunter Storm’s material is not recycled slides, AI-generated fluff, or “borrowed” conference notes. It is not from books, a certification class, a Google search, or a tour of someone’s lab. It is all-original thought leadership and strategic analysis from her operational experience and field work. These are firsthand, hands-on lessons from decades in the field of cybersecurity. Real encounters, real technologies, and real lessons you won’t find anywhere else.

Hunter Storm | The Ultimate Asymmetric Advantage

Hunter Storm is known for solving problems most won’t touch. She combines technical mastery, operational agility, and strategic foresight to protect critical assets and shape the future at the intersection of technology, strategy, and high-risk decision-making.

Hunter Storm reframes human-technical threat surfaces to expose vulnerabilities others miss, delivering the ultimate asymmetric advantage.

Discover Hunter Storm’s full Professional Profile and Career Highlights.

Confidential Contact

Contact Hunter Storm for: consultations, engagements, board memberships, leadership roles, policy advisory, legal strategy, expert witness, or unconventional problems that require highly unconventional solutions.

 

Securing the Future | AI, Cybersecurity, Quantum computing, innovation, risk management, hybrid threats, security. Hunter Storm (“The Fourth Option”) is here. Let’s get to work.

 

---