Totally. I think comp is a necessary but not sufficient precondition for fixing government technology. The actual solutions (good authentication and least privilege systems, robust monitoring, rapid intrusion detection and response, secure by default system architectures) all take talented people to execute and the government doesn't have enough of those in-house. Instead most systems are built with a 7-figure contract to Booz Allen and friends and then maintenance and sustainment is left as an exercise to the reader.