Personal information for 22 million people was exposed. A court blames a federal agency. (Washington Post)