State Comptroller Matanyahu Englman released a special audit chapter today (Tuesday) exposing serious security and regulatory failures in how the President’s Office protects digital information and privacy on its central communications network. The report reveals persistent gaps in managing the institution’s digital assets, which are exposed to heightened cyber risks due to the use of outdated operating systems no longer supported by manufacturers.
A Knesset subcommittee on state audit classified some of the technical data for national security reasons, but allowed full publication of the administrative and legal failures.
The President’s Office computer systems store highly sensitive information, including details on nearly 100,000 pardon applicants over the years, alongside sensitive data on hundreds of current and former employees. The audit found that the President’s Office transmitted pardon requests containing personal, family, and medical circumstances to the Justice Ministry and the Military Advocate General via regular email, without encryption as required by regulations.
The information was also stored in the legal bureau’s email inbox indefinitely without regular purging, allowing anyone with network permissions full access to personal details without a legitimate operational need. On the security and technology front, the audit uncovered significant flaws in the computing infrastructure.
Some of the President’s Office computer systems have reached end-of-life and are no longer supported by manufacturers, and some workstations ran expired versions of operating systems, exposing the network to potential cyber intrusions. The President’s Office network architecture was found not to comply with guidelines from the Government Cyber Directorate and security-control requirements, and the institution failed to meet all guidelines for preventing data leaks and restricting physical and digital network access.
Additionally, the institution did not allocate official email accounts to all employees who needed them, leading employees to use personal email accounts for work purposes, without organizational oversight or control. The comptroller found fundamental failures in the regulatory management of databases as well. The President’s Office did not appoint a database security officer, did not draft a database definition document or physical security procedure, and did not operate an automated logging mechanism enabling control over employee identities accessing systems.
Moreover, since 2019, the office contracted with an external vendor for support and maintenance of the pardon database without conducting a preliminary risk assessment, and without specifying in the contract the purposes for which the vendor may process the information, the mechanism for returning information at contract end, or the obligation to report security incidents. Since 2022, the external vendor has provided service without a signed and valid contract.
Regarding emergencies, the President’s Office has no business continuity plan and no disaster recovery plan (DRP) based on risk assessment. The institution also conducted no practical test or drill to examine its data recovery and restoration infrastructure.
Until September 2024, the President’s Office operated without government guidance on cyber defense, and its information systems were not subject to rules binding government ministries—unlike in finance and human resources, where the institution adopted civil service procedures. Only in September 2024 did the institution adopt Government Cyber Directorate guidelines.
During the audit, in June 2025, a ministerial steering committee on cyber issues was established for the first time, chaired by the director general, which convened for the first time in July 2025 and began conducting an infrastructure risk survey and partial penetration test. The comptroller noted positively the President’s Office’s engagement with the Government Cyber Directorate for professional guidance, its willingness to correct the deficiencies, and its allocation of financial resources from the institution’s general information technology budget.
In 2023, the office allocated about 15% of its technology budget to cyber; in 2024, the share dropped to 5.8%, and in 2025, the figure rose to about 11%. However, the institution did not maintain a separate budget record and dedicated tracking of these funds as required by guidelines. The comptroller recommended that the President’s Office director general ensure the steering committee approves an organizational risk map, establish an approved cyber defense policy, allocate official email accounts to all employees, and develop a systematic mechanism for tracking the lifecycle of software and hardware assets to prevent use of unsupported systems.