I'm going to say it: if people who work "in the real world" would release this stuff to an organization like the now-dead WikiLeaks or Anonymous, the bad press might put enough fear into a higher-level manager to actually audit their crappy systems for this stuff.

Also I think somebody ought to pass some tougher laws about leaving national infrastructure open to simple attacks. We can start with "3 years in prison for default passwords."