IT security gaps: how far can the state go?