What is infuriating about this is that this should be a solved optimisation problem, but it has probably been outsourced on the cheap to some bog-standard web dev team who have tried to figure it out from first principles. It's a bit like trying to roll your own security.
What I don't get is why it would be outsourced at all. Run a team that manages the entire SDLC. If they mess it up, they are maintaining it and have a reason to solve the problem. How did people manage to convince government that software is this one-time thing you just pay for and then it works forever?
PS: they were not involved in the development of this algorithm