ByJERUSALEM POST STAFF

JUNE 9, 2026 16:00

Updated: JUNE 9, 2026 16:07

Computerized records at the President’s Residence lacked safeguards matching the threats confronting a key national institution, the State Comptroller reported Tuesday. The review uncovered shortfalls in cyber oversight, database controls, vendor management, email practices, system monitoring, and legacy technology.

The office stores extensive data, among it highly sensitive details on nearly 100,000 pardon seekers. Any compromise could undermine personal privacy, institutional credibility, and the public standing of the presidency itself.

National institution confronted elevated wartime cyber dangers

Effective operations at the residence hinge on the secrecy, accuracy, accessibility, and resilience of its data holdings together with the networks and hardware that handle them.

Information assets and computing platforms rank among the residence’s most vital resources and require protection comparable to any other high-value holding. Disruption could trigger operational setbacks, technical failures, financial losses, privacy breaches, and damage to a core emblem of the state.

The threat intensifies in wartime when cyberattacks surge. Senior leadership’s inadequate attention to data protection produced the finding that cyber safeguards were not calibrated to the actual dangers confronting the residence.

Pardon database fell short of legal mandates

The residence maintains sensitive files on nearly 100,000 pardon applicants. Reviewers determined that database administration failed to satisfy several statutory obligations imposed on organizations holding such repositories.

No information-security officer had been designated for the databases. Required definition documents were absent, databases had not been mapped, and no inventory of database systems existed.

Access-control procedures were never formalized. Automated logging to track database access was also missing.

External vendor oversight left systems vulnerable

Since 2019 an outside contractor has handled design, development, support, and upkeep of the pardon database. The residence did not meet Information Security Regulations when contracting with the supplier.

No upfront assessment of information-security risks was performed for the engagement. Contract language failed to define which data the supplier could handle or the permitted uses.

Permitted systems and authorized actions were unspecified. No provision required return of data to the residence upon contract termination.

The supplier faced no obligation to confirm regulatory compliance or to notify the residence of any security incident involving the database.

Unencrypted email carried sensitive pardon materials

Pardon applications containing personal data moved to the Justice Ministry and Military Advocate General’s Corps via ordinary internet email without encryption, even when the content was especially sensitive.

Transmitted details included biographical information, family circumstances, and medical, social, economic, and rehabilitation assessments. The practice violated Information Security Regulations and the Cyber Defense Doctrine.

Requests forwarded to those agencies remained in the legal bureau inbox indefinitely. The inbox was never cleared on a routine basis, allowing older applications with highly sensitive content to accumulate.

Consequently any user with inbox access, including administrators, could view applicants’ personal information spanning years without operational justification.

Cyber governance structure proved inadequate

In September 2024 the residence adopted government cyber-defense guidelines for unclassified systems. By June 2025, however, no steering committee had yet been formed.

A ministerial steering committee was finally created in June 2025 under the director-general and held its first meeting in early July 2025.

Key responsibilities remained unaddressed. Damage assessments were not completed, the risk map was neither reviewed nor approved, measurable implementation targets were not set, management reviews were omitted, and feasibility checks on defined cyber activities were not performed.

Penetration testing stayed incomplete

In July 2025 the residence reported starting its first infrastructure risk survey and an accompanying penetration test, roughly ten months after adopting the government guidelines.

Only a partial infrastructure test occurred. No penetration testing covered applications running on the systems.

The incomplete testing reduced visibility into infrastructure and application weaknesses. The gap mattered because several systems had reached end-of-life status and some workstations operated on unsupported versions carrying known vulnerabilities.

Monitoring shortfalls and legacy systems raised exposure

Multiple communications networks operate at the residence alongside a disaster-recovery plan, yet monitoring of information systems failed to meet required standards.

Monitoring forms a core element of cyber defense by revealing unauthorized entry, unusual behavior, and emerging incidents. Incomplete coverage hampers timely response to breaches or misuse of sensitive data.

Additional systems had reached end-of-life, and certain endpoint devices ran expired software, leaving them open to documented vulnerabilities.

Cyber planning and budget tracking fell short

Over the years the residence managed cyber-defense work through general plans rather than dedicated cyber strategies. The 2025 plan contained only two cyber-related items.

Cyber defense received roughly 15 percent of the information-technology budget in 2023, falling to about 5.8 percent in 2024 before rising to about 11 percent in 2025.

Allocations in 2023 and 2025 were viewed favorably, yet the absence of separate cyber-defense budget tracking hindered verification against government cyber unit guidelines.

National symbol urged to close identified gaps

State Comptroller Matanyahu Englman stated that the residence must continue remedying the audit findings to safeguard the confidentiality, integrity, availability, and resilience of its information assets.

The report cautioned that compromise of systems holding sensitive data on nearly 100,000 pardon applicants could harm privacy, reputation, and institutional image. Corrective action is required to protect residents’ privacy and preserve the standing of the presidency.

“The President’s Residence must continue acting to correct the deficiencies in order to ensure the confidentiality and survivability of the information,” Englman said.

The findings arrive amid heightened cyber threats during wartime, including activity linked to Iran and strikes against public and private targets.

Previous cyber audits have flagged weaknesses across public systems, critical infrastructure, government databases, hospitals, and remote-work setups.