I am very surprised the policy of password strength is very weak. Allowing "smith" as a password? It's too weak that makes me suspicious about the origins of these passwords.
Most (probably all) of the Federal government requires password changes every month or so (not completely sure of the timeline) and you can't use previous passwords. This leads to shitty passwords just so people can remember something that always changes.
Offtopic: One bank I use enforces 8 characters max and changes every 3 months, I ended up with /.+[0-9]{2}/ as the password since I would never trust my bank credentials to any means to save the password, and I would never write it in anything that it's not a password input (that includes a piece of paper).
If my bank get's hacked, don't be too harsh with my password, I swear I can't remember a new, unique, secure and constrained password every 3 months :(
These look like they came from some sort of third party CRM, possibly http://www.iconstituent.com/ given the number of variations of iconstituent in the password list.
I'd be willing to bet that the actual house/senate domains require strong passwords, I've interacted with their IT in a few situations and found them to be on the ball.
