Maggie Amato speaks about her four years in federal government with a mix of nostalgia and disdain.
She led a program that, despite subsequent bureaucratic backlash, was credited for helping the U.S. healthcare industry defend itself from the potentially debilitating impact of the WannaCry ransomware attack. But she also found herself at the center of what was ultimately deemed a fabricated government scandal — traumatized by sexual harassment and an “ol' boys club” that led to her resignation and took a toll on her professionally and physically.
“I truly miss that program and that mission and that world, where I was able to help people who were in need, who couldn't help themselves,” Amato told SC Media in an interview — her first time speaking publicly about the ordeal that began in 2017. “But I'm one person. I'm not going to be able to stand up to the entire executive branch. This was also all prior to the #metoo movement and I remember feeling so alone, not knowing how to navigate.”
The story of Amato, now business information security officer at Salesforce and one of SC Media's 2022 Women in IT Security honorees, serves as a troubling reminder of what women in cybersecurity — any industry — can experience when people of power fail to address or acknowledge hostile behavior in the workforce. But it is also a story of perseverance — and the renewal that can come when women find their voice.
From accolades to rumor and innuendo
In November 2013, Amato entered the Department of Health and Human Services as deputy director of security design and innovation. That came after time at Booz Allen and at Mitre — the latter being where Amato said she “was hatched,” garnering the bulk of her government knowledge.
At HHS, she led evaluations and early adoption of a number of disruptive technologies, and cross-agency implementation, architecture, and enterprise deployments to create a data-lake of information sharing. The efforts showed such promise, that she eventually was selected to create a healthcare specific cybersecurity communications and integration center — HCCIC. The organization would serve as a center of collaboration with operational divisions, federal government partners, the intelligence community, information sharing and analysis centers (ISACs), as well as the healthcare industry.
In the early days of its inception, HCCIC earned accolades.
“This program was effective. We were called to Congress to testify about how great this program was. Constituents were actually reaching out to their representatives and saying, ‘Hey, this program's amazing. It actually helped us get back online within 45 minutes instead of seven hours,’” Amato recalled.
One of two hearings was held on June 8, 2017, to examine the WannaCry ransomware outbreak, and the role of HHS and HCCIC specifically in minimizing the impact of the attack in the United States: coordinating government resources and expertise, compiling and distributing relevant information and generally serving as a hub for both public- and private-sector response efforts.
The initial success was thanks largely to Amato's vision. In an interview with SC Media, her then manager, former deputy chief information security officer Leo Scanlon, credited her with designing and leading the highly successful effort to normalize the acquisition of cybersecurity technology across all the operating divisions. The result, he said, was a consolidated purchase of over $35 million dollars of technology and services at prices far below what any other agency was paying.
“Her accomplishment cannot be overstated,” Scanlon said. “The attack that was mounted against the HCCIC tore this from her in the most awful fashion imaginable.”
Indeed, less than a month after that hearing, questions began to emerge about HCCIC oversight. Plans for a transformation of the HCCIC circulated, despite objections from Scanlon and Amato. Then an anonymous letter was sent to agency leadership as well as media, alleging ethical issues tied to contract awards and lack of transparency. What ensued was a well documented ordeal of claims against Scanlon and Amato, both of which were abruptly reassigned. They were told of internal investigations into the claims, but given few specifics.
Scanlon believes the issues were less about the program, and more about Amato: A strong-willed woman in leadership that questioned the bureaucratic standard. Amato points to her objections to filtering to private sector work that she believed could be managed internally by government's own security teams for less money.
“The vultures were circling all the time, and from what I could see she was fending them off in fine fashion," Scanlon said. "But once she was promoted to be the director of the program we established, things got ugly.”
Scanlon and Amato filed for, and received, whistleblower protection status with the HHS Office of the Inspector General in September 2017, as well as the Energy and Commerce Committee, on the grounds that they were being targeted for opposition to the HCCIC transformation.
The ‘good ol’ boys club’
Again, many reports circulated through the media about the HCCIC controversy. But few details emerged about what Amato experienced internally before and during the ordeal: she describes underlying tones of sexual harassment and a hostile work environment from the start — a “good ol’ boys club” where she was treated like a "little girl" making noise; a distraction. SC Media reviewed a number of documents submitted on the record that reflected such treatment amid the ordeal.
“I was cat-called, whistled at, and had hands put on the small of my back or graze my legs when they'd walk by,” Amato said. “I had men start rumors just by me walking to Starbucks with a male counterpart at another federal agency. I was told I had given the agency a ‘black eye’ by awarding contracts, despite the fact that I wasn't a contract officer, and I had nothing to do with issuing contracts. I was told by male leadership after discussing the harassment that I needed to ‘Pray for this person, that God changes his heart.’ I was asked, ‘Why don't you think there are any rumors about us sleeping together?’ while others were told, ‘She's got to be sleeping with someone to get this much done in government.’”
Scanlon too described an environment where calumny and sexual slander was widely propagated, and became the basis of a witch-hunt. He also pointed to a clear delineation between how he was treated and how Amato was treated during the investigation of the anonymous claims. While Scanlon was remanded to what he described as "house arrest" — administrative leave with no tasking, but required to be available to report for work within four hours’ notice, and required to request "leave" if unable to meet that timeline – Amato was required to show up in the office every day. She had to report to a desk in a contractor area, barred from talking to her former colleagues.
"Maggie faced humiliation in front of her colleagues internally and externally, and had absolutely no way to respond or defend herself," Scanlon said.
Recognizing the toll the situation was taking on her physically and mentally — she remembers losing her hair — Amato resigned.
“Everyone involved – contractors, the media, Congress — knew that Maggie was the driving force and coordinator of the operational details of this project, and the external accusation of fraud and mismanagement landed directly on her,” Scanlon said. “But the real target was ‘the woman.’”
Owning her narrative
Eventually, after Amato’s departure from the agency, hints of potential vindication began to emerge. The House began investigating both Scanlon and Amato’s forced administrative leave, accusing HHS of retaliating for whistleblowing. Both were eventually advised, unequivocally and categorically, by senior investigators from the HHS Office of the Inspector General, that neither of them were at any time under investigation by the OIG.
And yet, the harassment continued. Upon leaving the agency, anonymous calls were made to Amato’s employer over the course of years, claiming she was under investigation for ethics issues. Amato eventually got a letter from HHS that she could provide to employers in response to such claims, reaffirming her positive performance and recognitions.
Sexism and harassment happen in all industries, but to Amato, government brought a different level of toxicity. She can't say whether that was true across all offices or agencies, nor does she know whether the environment has changed in the five years since her departure. She hopes so.
And regardless of whether an overhaul of the HCCIC program was warranted or not, Amato and Scanlon view the retaliatory treatment they received as at best unethical; at worst criminal. They point to specific individuals up and down the chain of command for blatant harassment, indifference, or acquiescence. But neither expect those responsible for what Scanlon described as "duplicity and criminal behavior" — spreading rumors and altering the course of their professional careers — to be held accountable. And still, the false claims about them both continue to show up in Google searches.
Nonetheless, they've moved forward. Scanlon does consulting, while Amato landed at Salesforce after working at Aetna and Dell. As for HHS, IT leadership turned over quite a bit in the years since the ordeal, some leaving amid the scandal. The agency stood up the Health Sector Cybersecurity Coordination Center (HC3) to continue the efforts first initiated by the HCCIC.
“I truly do believe that if I weren't a female running the program, things would've been very, very different. I've learned that government is its own political beast,” said Amato. “Women are kind of a rarity. There's not a whole lot of us. Finding champions was so critical for me in the federal space, because if I didn't have that champion, my voice would not have been heard.”
Scanlon was among those champions for her — remaining at the agency in part to clear their names. But he’s the first to say the support went both ways.
“No matter how well you survive a situation like this, there is always a haunting feeling that you will never get your reputation back,” he said. “And you don't — there's a gap in the timeline that doesn't go away. What you do is rebuild, and that's the only way you survive. I don't think either of us would have been able to do that — in spite of all the support we had — without the support of each other. Very few whistleblowers are privileged to have that kind of backup. I know I am one of the lucky ones.”
Amato never spoke up until now, largely fearful that doing so would stoke the fire. But she feels a sense of relief to finally own her own narrative. She’s toying with the idea of creating a nonprofit that pairs junior to mid-career women with other senior female leaders to create a trusted network of empowerment and coaching — not just on what certificates to get “but how to navigate the real (getting better but still shitty) workplace dynamics."
"I believe there is good in the public sector. I am happy with how things ended with HHS," Amato said. "But it takes different voices in order for there to be real change."
