US cyber-security 'embarrassing'