DOGE Duo Ducked Security Rules During Treasury Stint, GAO Finds
Why It Matters
The lapse exposes sensitive taxpayer and aid data to cyber risk, threatening public trust and prompting tighter regulatory scrutiny of inter‑agency data access.
Key Takeaways
- •DoJ staff accessed Treasury payment systems without full security clearance.
- •GAO found DoJ shared USAID payment list unencrypted, violating protocols.
- •BFS failed to implement all required cybersecurity controls on its systems.
- •No evidence of data alteration, but access allowed viewing and printing.
- •Treasury accepted half of GAO recommendations, ignored three others.
Summary
The Government Accountability Office released a report exposing how two Department of Justice (DoJ) associates, dispatched to the Treasury Department early in the second Trump administration, accessed the Bureau of the Fiscal Service’s (BFS) payment platforms without adhering to established cybersecurity protocols. Their temporary access, spanning January 20 to April 11, 2025, covered three critical systems that process tax refunds, benefits, salaries, and foreign aid disbursements.
The GAO audit revealed that one DoJ employee, linked to an Elon Musk‑created tech collective, could view, copy, print, and even temporarily create, modify, or delete data within these systems—though no actual data changes were detected. Additionally, the DoJ shared a list of USAID payment recipients without encrypting personally identifiable information, directly contravening Treasury’s IT security rules. The BFS itself fell short, failing to fully implement several mandated cybersecurity controls.
The report highlighted concrete lapses: unencrypted PII transmission, inadequate access controls, and a lack of comprehensive security safeguards on high‑value payment infrastructure. While the DoJ’s actions raised concerns, the GAO also placed responsibility on Treasury officials for not enforcing all required safeguards.
The findings underscore heightened vulnerability in federal payment networks, prompting calls for stricter oversight, accelerated remediation of security gaps, and potential legal repercussions. Treasury’s partial acceptance of six GAO recommendations—agreeing to three and ignoring three—signals ongoing challenges in aligning policy with practice.
Comments
Want to join the conversation?
Loading comments...