To government officials responsible for information security and to outside experts, several recent security incidents were no surprise. For the past five years, the department had received failing grades on a congressional report card for its information-security practices. The overall grade for federal agencies in 2005 was D-plus.