It seems like when web site lists requirements as to what characters MUST be in the password they're only providing a password map for someone who wants to hack their system.
For instance, fsd.gov requires:
The password must be 10-14 characters in length. The password must contain two each of the following: Upper/lower case letters, numbers, and special characters. An example of an acceptable password is: AAbb1234!@
Congrats! If I wanted to hack your password, now I know that trying to guess "aaaaaaaaa" will be wrong, you've given me clues as to what I can guess and helped narrow it down.
It seems to me like it's more open and more possible combinations if they didn't require special characters. Then if you included one your account is now more secure.
Note - As you've probably guessed, I'm not a pro at security, which is why I posted here.