I dont have any experience developing for govt, so for all I know the barrier against installation of CF may be insurmountable. Have you ever tried? It really is extremely painless and would result in a net + in terms of security.
Definitely insurmountable in the environment of many of our users. They're doctors working with medical data, so IT has to certify anything new installed.
So they're stuck with IE6, because that was the latest & greatest when large custom web-based applications really took off, so they're all certified for IE6 only and would have to be replaced at enormous cost before the users can be allowed to upgrade (or install chromeframe, for example).
This. We would ask our users why they use IE and if they would switch to using Chrome/Firefox or CF. Many of them in public education or state government offices are in a situation where the conversation is a no-starter.