12 ms·

DOGE worker’s code supports NLRB whistleblower

1013 points by todsacerdoti 2y ago

1a527dd5 2y ago
[flagged]
tw04 2y ago
Someone needs to go to prison over this. It’s not just a misunderstanding, it is an intentional attack on every US citizen.
- the_optimist 2y ago
  Explain please.
  - dmbche 2y ago
    https://krebsonsecurity.com/2025/04/whistleblower-doge-siphoned-nlrb-case-data/ https://krebsonsecurity.com/2025/04/whistleblower-doge-sipho...
    - the_optimist 2y ago
      [flagged]
  - malfist 2y ago
    If I told you someone went to your bank and demanded the right to setup accounts with permissions to do everything and to have all logging of that users activity disabled, and then a whistleblower pointed out that they downloaded everyone's bank statements, you'd probably be pretty up set. After all, why do they need unfettered access? Why do they need your bank statements? Why do they need to hide what they're doing with the unfettered access? That's what's happening here. There is no good explanation other than bad actors
    - the_optimist 2y ago
      [flagged]
      - goatlover 2y ago
        An obvious rebuttal is they should not have that authority, and the possible reasons for having gained it are nefarious.
      - hedora 2y ago
        The article specifically covers this point. They exceeded their authority.
        the_optimist 2y ago
        The article does not define or discuss the authority of DOGE.
      - malfist 2y ago
        Might doesn't make right
  - MOARDONGZPLZ 2y ago
    The complaint alleges that DOGE was able to get unlimited-permissions admin accounts that were not subject to logging. They also downloaded external repositories that gave users of those repos lots of different IPs. The complaint further alleges that the DOGE person used the combination of these things to "download... more than 10 gigabytes of data from the agency’s case files, a database that includes reams of sensitive records including information about employees who want to form unions and proprietary business documents." If this is all true, this is basically hacking sensitive data in the open. We already know the current administration has worked to hobble unions. So putting these things together, this act is not only wrong in and of itself, but the data is likely going to be used to harm americans' interests. So, deserving of punishment.
    - alabastervlog 2y ago
      And they fucking illegally fired the IGs who are supposed to act as watchdogs for and light-shiners-on-of blatantly-illegal activity like this in the executive. The ones we added after Nixon's crimes. It was one of the first actions of the administration, blanket firing without actual cause, which is supposed to be required, and without the required notice-period to Congress. That should have exhausted any benefit of the doubt right off the bat, even among those inclined to think Trump's maybe not great but also some ordinary amount of bad for a politician. You don't do that unless you fully intend to do some crimes. Not only that, they were so goddamn eager to crime that they couldn't wait the 30 days or whatever. They intended to do criminal shit immediately.
      - EvanAnderson 2y ago
        I wish the firings of the IGs was something that "Joe Sixpack" understood. Honestly, even that the IGs exist(ed). (It wouldn't change the opinions of anybody who matters, I suppose.)
    - deleted 2y ago
      [deleted]
  - mingus88 2y ago
    If you take a step back and realize that the intent is to utterly destroy the social safety net provided by social security, Medicare, etc that we have all been paying into our entire adult lives, tell me why every citizen affected should not pursue civil and criminal charges of theft and fraud with malicious intent? And then the means to do so have involved ignoring the courts and bypassing constitutional checks and balances? Please tell me how this isn’t criminal if not treasonous?
    - cap1434 2y ago
      Not only did you not explain the original comment, you added more assertions that are significantly more extraordinary without explaining your reasoning for those either.
  - Cthulhu_ 2y ago
    Sensitive government data was (sure, allegedly) extracted to Russia via an account that was expressly created to hide / not create logs. This is treason. Allegedly.
    - goatlover 2y ago
      This administration is doing a lot of things that are borderline treasonous. Hopefully they get prosecuted when they get voted out or ideally get removed form power.
      - alabastervlog 2y ago
        Trump will blanket-pardon anyone who's still on his good side. And maybe some who aren't, just to limit the reach of investigations. And Trump himself's untouchable—while it remains technically possible to criminally prosecute a President for actions in office, it's in-practice impossible short of some unlikely hypothetical scenarios, thanks to the Supreme Court (the Roberts court loves leaving things technically intact, but actually not)
- declan_roberts 2y ago
  People voted for this
- pluc 2y ago
  [flagged]
  - MOARDONGZPLZ 2y ago
    > it's fun to watch Watching the misery of others makes me feel ill.
    - tokioyoyo 2y ago
      Don’t agree with the OP how it’s fun to watch, but you have to acknowledge how citizens of basically every other country feel after being made fun of for the past few months. I have close relatives living in the states, and I feel bad for them. But your own government has been belittling your neighbours across both of your borders and calling them weak. I’m not going to say that the government does not deserve some of the repercussions of their own actions.
      - pluc 2y ago
        We aren't being made fun of, we are being threatened with annexation and unprovoked economic warfare by an administration with collective the intellect of a public toilet. The entire world has lost respect for the US and I for one am glad. And before you say what they all say, "we're not all like that", you're all complicit until you run them out of the country.
    - pluc 2y ago
      Watching the misery of a nation who have been hiding behind the second amendment for decades to defend mass slaughter and who now won't lift a finger to get out of authoritarian decisions and an oppressive regime is delicious hypocrisy. I can't wait for dessert.
- candiddevmike 2y ago
  The people who need to see/understand this live in a different reality where uncomfortable things like this are ETL'd into righteous anger towards people they don't like. This is the deep state they've been worried about, this is the boot that will tread on them. EDIT: parent comment was highest ranked comment for the article and is now at the bottom?
  - j2kun 2y ago
    A twisted justification for suggesting someone who broke serious laws not face consequences. We live in a nation of laws, whether or not conspiracy-minded individuals prefer to follow them.
    - threatofrain 2y ago
      We live in a nation of peers before we live in a nation of laws.
    - Aeolun 2y ago
      > We live in a nation of laws You stopped living in a nation of laws a while ago. Now you live in a nation of might makes right.
      - bilbo0s 2y ago
        We'll see. The thing about the law in the US, it's slow and heavy. You'll need to be pretty mighty to move it if it catches up to you.
        jayd16 2y ago
        Justice delayed is justice denied.
        myko 2y ago
        I would have agreed years ago, but seeing trump - who obviously should be in prison for January 6th, among other crimes - back in the WH pretty much proves the US is not a nation of laws.
- the_optimist 2y ago
  [flagged]
- aiauthoritydev 2y ago
  Chances of that happening are zero right now.
- threatofrain 2y ago
  [flagged]
- mikeyouse 2y ago
  I fully believe there's a stack of pardons in Trump's drawer for everyone involved in this debacle. I can't imagine breaking so many laws all over the government if you thought you'd ever have to face consequences. The alternative to pardons in preventing the next congress & administration from cleaning this up is too dire to really contemplate.
  - dboreham 2y ago
    Time to remove the pardon powder. Has it achieved anything productive in the last 100 years?
    - sterlind 2y ago
      it's written into the Constitution very explicitly. and it's a really bad time to hold a Constitutional Convention.
      - derektank 2y ago
        I'm not actually convinced that now would be a terrible time to hold a constitutional convention. Yes, it would be messy, but the nature of the ratification requirements (3/4 of all states) means that nothing could make it through without essentially unanimous consent of the country as a whole.
        cgriswald 2y ago
        While we are at it we can add ranked voting and a vote of no confidence (maybe initiated by congress and voted on by the states or people).
    - nativeit 2y ago
      I think it's been used properly in a lot of instances, especially when you consider that federal law can quickly become out-of-step with modern sensibilities, so being able to relieve those harmed by laws flawed under contemporary standards is important. There's probably a better way of handling that, but it's one instance where the power of presidential and governors' pardons have been applied appropriately.
- happyopossum 2y ago
  You’d have to prove a crime here to send someone to jail, correct? What would the charges be?
  - Alupis 2y ago
    [flagged]
    - Aeolun 2y ago
      I think surely “we want untraceable admin accounts” should be illegal in some way. If only in regard to transparency.
      - Alupis 2y ago
        [flagged]
        ziddoap 2y ago
        >"Tenant-admin" isn't such a radical thing Admin accounts without logs is extremely radical. I have literally never seen it, or had anyone request it, in my decade+ of consulting in security. Unless you think the whistleblower, Krebs, and everyone else reporting are lying. Which, in that case, nothing anyone says is going to change your opinion (and you should just say that, if it's what you think, to save us all time).
        Alupis 2y ago
        [flagged]
        ziddoap 2y ago
        Like two lines up from your quote: "He specifically was told that there were to be no logs or records made of the accounts created for DOGE employees" That sure sounds like no logs. If you don't believe the whistleblower, just say that, and skip the insulting me part (and I'll know to skip the replying to you part).
- deleted 2y ago
  [deleted]
- root_axis 2y ago
  Not really possible since they would be pardoned even if anyone was ever willing to prosecute them.
- pyinstallwoes 2y ago
  Writing ai slop? Thanks !
- skissane 2y ago
  The problem with prosecuting them – they are employees of a White House office, doing what their bosses told them to do, and it is clear their bosses are carrying out the President's wishes. If Joe Blow off the street walks into a federal agency and takes all their data – open and shut case, throw the book at them, see you in a few decades. If someone from the White House walks into a federal agency, tells the agency leadership "the President wants me to take all your data", and the agency leadership replies "sure, go right ahead" – not a scenario people were expecting, so the existing laws haven't been crafted to clearly criminalize it. Maybe some enterprising prosecutor can find a way to map it to the crimes on the statute book, maybe it is just too hard. But even if the prosecutor overcomes that hurdle, it will be far from easy to convince the jury / trial judge / appellate courts that the legal elements of the crime are actually met – and if it actually gets as far as a conviction upheld by the appellate court, what do you think the conservative SCOTUS majority are going to do with that when they get it? And many prosecutors, foreseeing those low odds of ultimate success, will stop before they even get to an indictment. So, I think the odds of anyone ultimately being convicted over this are low, even if Trump never pardons them. Maybe, Congress might pass a law to make it more clearly illegal, which might make it easier to prosecute if a future administration repeats the same behavior. EDIT: if people are downvoting this because they think my analysis of the likelihood of successful criminal prosecution is wrong, it would be great if they could reply to explain where they think I got it wrong
  - j_w 2y ago
    The claim that because your boss tells you to do something illegal means that you should just do it is bullshit. It's your social responsibility to not capitulate under these circumstances. If you don't feel that way then you deserve the world you are creating.
    - skissane 2y ago
      The problem is a lot of relevant criminal laws contain this word “unauthorized”. If you have access to a computer system, and it is authorized by the people who own the system, it isn’t a crime. These people will say that whatever they did/bypassed was (1) authorized by the President (of course if you ask Trump if he authorized them to do whatever he’ll say “yes”); (2) authorized by the senior agency leadership (because Trump has made clear that if they refuse to authorize it they’ll be fired). So, how do you prosecute them for accessing a computer system (or data or whatever) without authorization when both the President and the senior agency leadership say they authorized it? Well, you can’t-unless you want to argue that the President / agency leadership’s authorization is illegal and hence illegally invalid, ultra vires. But even supposing you are right about that in the abstract, will you be able to convince a judge and jury of it? And even supposing you convince a jury, trial judge and appellate court, there’s a dozen different ways SCOTUS could overturn it (from narrow questions of statutory construction to sweeping rulings about the President’s inherent constitutional power to demand information from the executive branch), and I think the main question for the current SCOTUS majority will be which of those ways they choose. My impression is that a lot of people are mixing up what they think the law ought to be, with what it actually is. Just because something ought to be a crime doesn’t mean it actually is one - and that’s especially going to be the case with unprecedented situations, it is hard to make something a crime if nobody foresaw it would one day happen.
- 9283409232 2y ago
  You forget who the president is. They will get away with all of this and everything else. Doesn't mean we shouldn't try but lets be realistic here.
deleted 2y ago
[deleted]
twalkz 2y ago
> According to a whistleblower complaint filed last week by Daniel J. Berulis, a 38-year-old security architect at the NLRB, officials from DOGE met with NLRB leaders on March 3 and demanded the creation of several all-powerful “tenant admin” accounts that were to be exempted from network logging activity that would otherwise keep a detailed record of all actions taken by those accounts. Feels like a pretty good Occam’s razor case… but is there any legitimate reason why one would request this?
- spencerflem 2y ago
  Obviously no
- Cthulhu_ 2y ago
  Sure, to hide your tracks because you know what you intend to do isn't right.
- patrickmay 2y ago
  There is no justification for ever creating an account like that. The only purpose is nefarious.
- vkou 2y ago
  There isn't one. Anything musk's dogs claim to find cannot be taken at face value because of this. Because there is no audit, and no evidence that they can offer that they didn't doctor their findings. The next time they claim that a 170-year old person is receiving SS checks, they have no way to prove that they didn't subtract a century from that person's birthdate in some table.
  - FredPret 2y ago
    Ah, this is something I haven't thought of before. This might not actually be spying, but instead just an attempt to plant fake results.
    - vkou 2y ago
      And even if it's not and everyone involved is a qualified, thoughtful, unimpeachable public servant with no agenda but the general welfare of the Glorious Republic of Arstotzka in their hearts, the lack of an audit trail means that you have to seriously consider that they aren't. Of course, given the blatant dishonesty and criminality that the rest of this administration is producing (see: every immigration law case that they are losing in court), you'd have to be a useful idiot to actually assume good intent from them.
willio58 2y ago
The fact that they left these packages public on GitHub.. guys you do know you can make things private right? Just shows how dumb these people are honestly
- mingus88 2y ago
  Or they are emboldened in knowing there will be absolutely no consequences. Go look at the list of pardons this administration has handed out. These guys won’t even be charged.
  - apical_dendrite 2y ago
    Or they think what they're doing is righteous and they're proud of it. It isn't - DOGE is responsible for hundreds of thousands of deaths through cuts to health programs - but I suspect they are deluding themselves into thinking it is.
    - cpursley 2y ago
      > DOGE is responsible for hundreds of thousands of deaths through cuts to health programs That seems like a lot. Source?
      - douglasisshiny 2y ago
        https://www.yahoo.com/news/count-dead-millions-133000054.html?guccounter=1 https://www.yahoo.com/news/count-dead-millions-133000054.htm...
        cpursley 2y ago
        [flagged]
        pesus 2y ago
        Do you have an actual rebuttal to the data?
77pt77 2y ago
> accounts created for DOGE at the NLRB downloaded three code repositories from GitHub Why is anything of significance on github in the first place? Edit: It's not. They just download python libraries to do "IP rotation" to circumvent rate limits. On the actual complaint: (https://whistlebloweraid.org/wp-content/uploads/2025/04/2025_0414_Berulis-Disclosure-with-Exhibits.s.pdf https://whistlebloweraid.org/wp-content/uploads/2025/04/2025...) It seems that the data was stored in Azure which doesn't make it any better.
- Cthulhu_ 2y ago
  What do you mean? It was "just" a tool to circumvent anti-scraping measures.
  - icedchai 2y ago
    If they have full access to the systems, why are they scraping them externally?
    - Izkata 2y ago
      This is the big question everyone here seems to be skipping over. It seems like they're using "database" in the colloquial sense and actually mean some sort of already public data that's just rate limited (for example https://www.nlrb.gov/advanced-search https://www.nlrb.gov/advanced-search). Then depending on the order of events, either scraping didn't work well enough and were given "unlimited" (not rate limited) access, or the accounts were actually denied so they fell back to scraping. Or perhaps these two things are just unrelated despite what the story is claiming.
      - icedchai 2y ago
        Or maybe, even with access, they couldn't figure out how to query the actual database, so they resorted to scraping? Even with full "tenant" access, it could take some time to figure out where to look.
- teraflop 2y ago
MattDaEskimo 2y ago
Untraceable and complete access to government databases. I can't begin to imagine the implications here.
- xorcist 2y ago
  We only hear about the cases where a someone is taking the risk of blowing the whistle, and actually manages to get the story out. Hopefully with enough substance for people to take the information seriously. How many cases that are likely to reach public knowledge is left as an exercise to the reader, as the saying goes.
  - Braxton1980 2y ago
    >How many cases that are likely to reach public knowledge is left as an exercise to the reader, as the saying goes. Is this some reminder to people that bad things occur that aren't found out. Considering how everyone is aware of this is your comment some sort of clusterbomb whataboutism?
- tootie 2y ago
  Direct access to private data relating to accusations against companies Musk owns.
munchler 2y ago
So what exactly is being alleged here? That these DOGE bros wrote and used “hacker” code from GitHub to bypass security limitations on NLRB data? Why would they even need to do that if they had superuser accounts in the system already?
- weaksauce 2y ago
  they added a backdoor that is not audit logged. that's why.
- woodruffw 2y ago
  I think the point of the article is that the whistleblower's original claims can be substantiated publicly. It's another datapoint indicating that the DOGE people are operating haphazardly at the absolute best and, more likely, attempting to obscure their tracks because they know that what they're doing wouldn't pass legal muster.
- timewizard 2y ago
  The article is written very poorly. The disclosure itself is far more readable. https://whistlebloweraid.org/wp-content/uploads/2025/04/2025_0414_Berulis-Disclosure-with-Exhibits.s.pdf https://whistlebloweraid.org/wp-content/uploads/2025/04/2025...
  - uxp100 2y ago
    Yes, this is much more clear than the article.
  - munchler 2y ago
    Thanks. So the tools downloaded from GitHub were allegedly used to scrape personally-identifiable information (PII), details about ongoing legal cases, union-related data, and corporate secrets. The whistleblower observed large spikes in outbound data traffic, suggesting that gigabytes of sensitive information were exfiltrated with logging disabled, so as not to leave a trail.
  - underyx 2y ago
kazinator 2y ago
I almost can't make heads or tails of out of this scatterbrained word salad. Let's start with this: > Berulis said the new DOGE accounts had unrestricted permission to read, copy, and alter information contained in NLRB databases. > Berulis said he discovered one of the DOGE accounts had downloaded three external code libraries from GitHub What exactly does that mean? NLRB database accounts are GitHub accounts? (Surely not.) Or the same IP address accessed both, suggesting it was the same person? Define "account". No coherent point being made here. This story needs to clearly separate the rhetoric about GitHub repositories from the NLRB access, and connect them together coherently. The flow seems to be: 1. Some DOGE people obtained unbridled access to NLRB, with the ability to erase audit trails. 2. There is some sort of evidence that the same people downloaded tools from GitHub for distributed web scraping, suggesting intent to scrape massive amounts of data from somewhere (inferred to be the NLRB database). There is no evidence cited in the article for the actual downloading of gigabytes of data; the "whistleblower" is quoted only as saying that DOGE required certain privileged accounts to be created and that the users of the accounts supposedly downloaded some web scraping software from GitHub. At least mention some circumstantial evidence, like a suspicious increase in access activity, coming from distributed IP addresses in the Amazon cloud, following the download of those tools. This: > On February 6, someone posted a lengthy and detailed critique of Elez’s code on the GitHub “issues” page for async-ip-rotator, calling it “insecure, unscalable and a fundamental engineering failure.” seems neither here nor there; why include that. It may be that the tools DOGE are using are not adequately safeguarding the data, but it seems like an extraneous point, and undigestable without specifics.
- dehrmann 2y ago
  The only interesting part of 2 is it looks like Doge wanted all the data. The technical details of how they scraped it mostly doesn't matter.
  - kazinator 2y ago
    Plus in the whistleblower's actual report, there is evidence of them getting it, like logs of network output far above previous levels, and those accounts making accesses from various IP addresses (including geo-blocked attempts from Russia).
hahajk 2y ago
I have a theory that "business ethics" is really just "following the law." In capitalism, outside a few select industries like journalism, as long as it's legal you can - and should - do anything to maximize profits. It has turned into (or perhaps always was) the govt's job to set those rules. Now, the govt also has to create rules for itself. So it creates the Privacy Act and layers of beurocratic checks and balances. These rules are to protect the people, not to derisk or protect the govt. After all, the govt has all the power. So when capitalist businesses leaders are given the keys to govt, the normal ways of ethical alignment don't work. If you don't follow your own rules, who cares? They're your rules! I think what we're seeing is what happens if you apply traditional capitalist business practices to govt administration.
- BriggyDwiggs42 2y ago
  Yeah actually. I think that’s about right.
- Clubber 2y ago
  >In capitalism, outside a few select industries like journalism, as long as it's legal you can - and should - do anything to maximize profits. Honestly, if you were around watching the news 30+ years ago, you would notice a stark difference in how news is covered then versus today. You can't really blame them, they are doing what they can to survive, but coverage today much more tabloid than news. I would say the "fake but accurate," was the death knell, but it might have been sooner. https://en.wikipedia.org/wiki/Killian_documents_controversy https://en.wikipedia.org/wiki/Killian_documents_controversy
- wat10000 2y ago
  The trouble is that money is power, so the people who succeed the most at maximizing profit end up getting a lot of influence over the rules. In some countries, this is done with outright bribery. Here, we do it with campaign contributions and lobbying and “we’ll create jobs in your district.”
the_optimist 2y ago
For those genuine actors here: this theoretical outrage assumes the premise of something immoral or illegal, and completely ignores the authority structure. This looks and smells like an info operation.
- polalavik 2y ago
  Just, as an exercise, list out 3 good reasons someone might want untraceable admin accounts then list 3 really bad reasons they might want that. If you manage to find 3 good reasons does the outcome of those those outweigh the risks of the potential bad reasons?
  - rockemsockem 2y ago
    Good: 1. The account-level below that doesn't have access to certain stuff and just happened to have untraceable stuff 2. They just said "give me the highest level of access" and didn't investigate what that meant 3. Can't think of a good third atm Bad: 1. They want to do nefarious things untraceably 2, 3. I think 1. covers pretty much everything. Personally, if I'm put in charge of overhauling a system I don't want to waste my time waiting on approvals for BS, I just want to be given the highest level of access I can be given to get on with work. I'm not saying this is fine, but the information here is basically a random list of things that happened and it doesn't really tell a nefarious story to my eyes.
    - yibg 2y ago
      I honestly don't understand the defenses of these actions here. Forget about the nature of data we're talking about here. If I was an engineer working at say google, and I put in mechanisms to access a bunch of data and bypass both auth and audit, I'd get fired instantly.
      - rockemsockem 2y ago
        If those mechanisms already existed and you requested and were granted access to them then there wouldn't be anything to comment on really? There would be no firing, nothing would happen. I'm not defending anything, I'm trying very hard to see what the specific problem is here and all I see is "now things XYZ might happen" and I'm just thinking that I'd be far more interested in an article about XYZ actually happening than this "reporting" on "maybe things ABC happened and maybe things XYZ will happen".
progbits 2y ago
> Ge0rg3’s code is “open source,” in that anyone can copy it and reuse it non-commercially. As it happens, there is a newer version of this project that was derived or “forked” from Ge0rg3’s code — called “async-ip-rotator” — and it was committed to GitHub in January 2025 by DOGE captain Marko Elez. Original code: https://github.com/Ge0rg3/requests-ip-rotator https://github.com/Ge0rg3/requests-ip-rotator Forked: https://github.com/markoelez/async-ip-rotator https://github.com/markoelez/async-ip-rotator Code is pretty much the same, with comments removed, some `async` sprinkled in and minor changes (I bet this was just pasted into LLM with prompt to make it async, but if that worked why not). Except... Original GPL3 license is gone. Obviously not something you would expect DOGE people to understand or respect.
- nativeit 2y ago
  > On February 6, someone posted a lengthy and detailed critique of Elez’s code on the GitHub “issues” page for async-ip-rotator, calling it “insecure, unscalable and a fundamental engineering failure.” “If this were a side project, it would just be bad code,” the reviewer wrote. “But if this is representative of how you build production systems, then there are much larger concerns. This implementation is fundamentally broken, and if anything similar to this is deployed in an environment handling sensitive data, it should be audited immediately.”
  - deepfriedrice 2y ago
    The "critique" is nuts. Surely AI generated. If I didn't trust the domain, I'd assume the author to be incredible for seriously referencing something like this. Look at the critique [0] and then look at the code [1]. [0] https://web.archive.org/web/20250423135719/https://github.com/markoelez/async-ip-rotator/issues/1 https://web.archive.org/web/20250423135719/https://github.co... [1] https://github.com/ricci/async-ip-rotator/blob/master/src/async_ip_rotator/__init__.py https://github.com/ricci/async-ip-rotator/blob/master/src/as...
    - krferriter 2y ago
      Lol that's so funny. Can't imagine writing that. (the critique, not the code).
nop_slide 2y ago
I find the following bizarre. Ignoring who this marko guy is, why would a random person post such a "take down" of the repo? I have never randomly passed by a repo and wanted to just dunk on it. Also this critique reeks of being AI generated. > On February 6, someone posted a lengthy and detailed critique of Elez’s code on the GitHub “issues” page for async-ip-rotator, calling it “insecure, unscalable and a fundamental engineering failure.” Link from quote: https://github.com/markoelez/async-ip-rotator/issues/1 https://github.com/markoelez/async-ip-rotator/issues/1 The follow comment is interesting to be a coincidental, such a weird interaction.
- nativeit 2y ago
  Why wonder? The user who wrote it seems to be a pretty well established user, and their public repositories suggest that they work in adjacent contexts, so it's entirely plausible they attempted to use async-ip-rotator in one of their projects.
  - nativeit 2y ago
    It's also worth noting that Feb 6 may very well be after Marko Elez became a public figure with DOGE. The article doesn't do a great job of expanding on any of this.
    - nop_slide 2y ago
      Ah yeah that would make more sense
  - marcusb 2y ago
    ??? The public repos for this person that I could find that weren't forks with no activity to upstream consisted of a dice-rolling guessing game, rock-paper-scissors, and some kind of framework for downloading and transcribing audio files that does not yet download or transcribe, but implements a whole bunch of boilerplate. I find it rather difficult to believe this person engaged in a good-faith review of the async-ip-rotator code base.
growdark 2y ago
>Ge0rg3’s code is “open source,” in that anyone can copy it and reuse it non-commercially. A little nit-picking, but that's not what open source means, especially as it relates to the GPL in this case. If you can't use the code commercially, it's neither "open source" (as defined by OSI) nor free software (as defined by the FSF).
- nativeit 2y ago
  Right, but the original statement isn't being mutually exclusive.
jiggawatts 2y ago
This is much ado about nothing. The article tries to very hard to make something ordinary sound nefarious. This appears to be DOGE employees simply doing their job. You may not agree with what they’re doing in a political sense, but if you were tasked with the same problem you’d come up with a nearly identical solution. For example: “tenant admin” is probably the special role that can bypass access control (not audits!) and see and read all data. This sounds scary but I regularly request this right from large government departments and I get it granted to me. Its use is justified when normal access requests would be too complex / fiddly and error prone. Generally, in a large environment, there is no other way to guarantee 100% coverage because as an outsider you don’t even know what permissions to ask for if you can’t see anything due to a lack of permissions! Seriously: sit down for a second and think about how you would go about getting access to make a full copy of an organisation’s data for an audit if you fully expect both passive resistance and even active efforts to hide the very things you’re looking for.
- dboreham 2y ago
  Absolute balderdash.
- watwut 2y ago
  In that case, you and departments you work for are either breaking the law regularly or working with public data anyway. Besides, no one needs unmonitored write access for audit. Even less DOGE who does no audit and don't have knowledge how to do audit. Audits are supposed to he traceable.
  - sremani 2y ago
    [flagged]
    - paulryanrogers 2y ago
      Whistleblowers are protected by law. If their data is being exfiltrated then they may become targets of harassment.
wnevets 2y ago
[flagged]
- cpursley 2y ago
  [flagged]
  - bigyabai 2y ago
    Whistleblowers are claiming it's sedition: https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-... > The employees grew concerned that the NLRB's confidential data could be exposed, particularly after they started detecting suspicious log-in attempts from an IP address in Russia, according to the disclosure.
    - ein0p 2y ago
      [flagged]
      - dekhn 2y ago
        Without making any statement on whether I believe DOGE is being seditious, it's not hard to interpret their underlying intent as being wholly compatible with the definition you pasted. DOGE intends to hurt the government in ways that cause people to trust it less, with the goal of eliminating large parts of the government.
        ein0p 2y ago
        [flagged]
        dekhn 2y ago
        Yes, a part of the government can try to hurt the government, that is true.
  - 2y ago
ChrisMarshallNY 2y ago
What sucks is, is that Russia and China now, almost certainly, have all this data, but they don't worry me, as much as the American oligarchs that now have it.
deleted 2y ago
[deleted]
porphyra 2y ago
Isn't the ip rotator used to scrape from public websites to bypass rate limits? Not sure how that automatically means they are "siphoning sensitive case files".
- deleted 2y ago
  [deleted]
- borski 2y ago
  It doesn’t. Coupled with the whistleblower complaint, however, it is evidence.
- tootie 2y ago
  The IP rotator was discovered in the analysis. The exfiltration of data was discovered by an NLRB employee and triggered the complaint. A member of their staff saw the spike in egress, found the source and that the audit log had been bleached.
dfedbeef 2y ago
The CEO of Tesla and Space-X; a self-proclaimed high IQ individual, an alleged programmer, has apparently hired a straight-up script kiddie to their elite delta force of technical government downsizers.
- llm_nerd 2y ago
  There is a phenomena I've noticed in this industry where people who lack a skill compensate by convincing themselves that they are a savant at seeing and exploiting that skill they lack in others. They find and encircle themselves with people who they believe are the Best of the Best, at least in their imagination, and it is critical for their ego that this is never challenged. They will be blind to any evidence to the contrary because they need the people they "identify" to be extraordinary, justifying their great people curation. I mean, I guess this really happens in all industries. Art, music, leadership, software development. People who maybe once had credibility in something and now desperately try to foist Their People as the best in the industry. I feel like that is what is happening here. None of the people who Elon surrounds himself are notable in any way, and their skills are hugely suspect, but he has to have his harem of "Super Coders" to prop up his own mythology.
- jppope 2y ago
  I agree with the script kiddies comment- which is basically what the reporting has shown... but in a way isn't that part of the point? That they can save billions of dollars just by having a couple of relatively normal comp sci kids (who can't even rent a car) review the most basic financial information of our government departments. These guys aren't supposed to be "delta force" they are supposed to be the interns. Not trying to defend the means to the end, but I would really like my tax money used more efficiently. I will also say am extremely worried about the levels of access that they are being given, especially since it comes with basically no accountability
  - joquarky 2y ago
    > I would really like my tax money used more efficiently. This is immature thinking, because, who wouldn't? The contention comes from differing opinions on what is waste.
ceo_tim_crook 2y ago
the doge guys are truely living the script kiddie dream
hashstring 2y ago
Haha, and the Github repo is now offline. lol.
ThinkBeat 2y ago
1. DOGE employees access data they were not supposed to. This fairly clear. The story says that DOGE attained access to an account that had huge permissions into what it could see and alter. The person or persons from DOGE may have downloaded 10GB of data. The person may have used this in a manner that is illegal. Or it is illegal to start with. With the understanding that POTUS may or may not be allowed grand such access. (I dont think POTUS can) 2. DOGE employee downloaded code that could be used to use a huge pool of IP addresses, from AWS to bypass forms of throtheling. 3. The code was badly written. 4. The person is a racist How would a person from DOGE use "unlimited" number of IP adderssess from AWS to hammer and automaticlay screenscape webpage, benefit from it when it came to copying extremly sensetive data from an internal National Labor Relations Board database? Did 10.000 sessions authenticate to the database at the same time, using AWS UP addresses and scraped the data? Something is pretty broken if the system with extremly sensetive data is available from external IPs -and- allowing a single account to login 10.0000 times to concurrently scrape data off the interal database? Of are they saying that this code was adapted to use 10.000/100 IP addresses internal to National Labor Relations Board and scrapes using those? The automation later noted makes a lot more sense to aid the work.
- declan_roberts 2y ago
  The author brings up the ip scraping but makes no effort to tie anything together. It's actually really confusing. Were they using this utility to steal the data or are these two just totally unrelated things?
  - SpicyLemonZest 2y ago
    We have no way to know what they were using it for, because as the article details, DOGE works hard to make sure nobody can find out what it's doing or why.
- grandempire 2y ago
  > I dont think POTUS can What data in a federal agency could the chief executive not have authorization to access?
golemiprague 2y ago
I don't see anything wrong with what they did, they basically got admin accounts so they can peak into the system and used some libraries from github. What is the problem here? Got a feeling it is just politically motivated, people are not happy that the Trump administration is actually doing something to make systems more efficient and stop money waste of tax payers. I am sure they will make some mistakes along the way and I am sure not every "saving" is actually saving but when you look at so many systems and so much money some errors are expected.
TacticalCoder 2y ago
[dead]
xyst 2y ago
The government dogs are literally script kiddies, go figure.
pyinstallwoes 2y ago
That page reads completely incoherently if you understand junior level programming mental models. This is a hit piece for non technical audience meant to conjure fud.
- bryancoxwell 2y ago
  It’s not at all about programming
Havoc 2y ago
>The new accounts also could restrict log visibility, delay retention, route Guessing those are the same accounts that got accessed by Russian IPs? Genuinely wondering whether the US democracy is going to make it to December.
blendergeek 2y ago
> Ge0rg3’s code is “open source,” in that anyone can copy it and reuse it non-commercially. That isn't what "open source" means.
- DaSHacka 2y ago
  Unfortunately about what you should come to expect from Brian Krebs.
zombiwoof 2y ago
[flagged]
mythrowaway49 2y ago
this part of the whistleblower complaint seem way worse: " On or about March 11, 2025, NxGen metrics indicated abnormal usage at points the prior week. I saw way above baseline response times, and resource utilization showed increased network output above anywhere it had been historically – as far back as I could look. I noted that this lined up closely with the data out event. I also notice increased logins blocked by access policy due to those log-ins being out of the country. For example: In the days after DOGE accessed NLRB’s systems, we noticed a user with an IP address in Primorskiy Krai, Russia started trying to log in. Those attempts were blocked, but they were especially alarming. Whoever was attempting to log in was using one of the newly created accounts that were used in the other DOGE related activities and it appeared they had the correct username and password due to the authentication flow only stopping them due to our no-out-of-country logins policy activating. There were more than 20 such attempts, and what is particularly concerning is that many of these login attempts occurred within 15 minutes of the accounts being created by DOGE engineers. "
- superconduct123 2y ago
  Wow that's insane
- kazinator 2y ago
  The article could offer a summary of this key finding, rather than, say, the pointless paragraph near the bottom about the scraping software found in GitHub not being well written. This is the evidence which strongly suggests that the DOGE personnel are using various cloud IP addresses to scrape.
- stevenwoo 2y ago
  Any guesses for best possible interpretion? The Russians have infiltrated their PCs with keyloggers and DOGE are working from insecure open networks. The worst possible interpretation is straightforward - they are working for the Russians as agents and let the Russians in or installed the keyloggers for Russia.
  - 0cf8612b2e1e 2y ago
tonetheman 2y ago
[dead]
neilv 2y ago
> Berulis said he went public after higher-ups at the agency told him not to report the matter to the US-CERT, as they’d previously agreed. If the allegation is true, what would be the motivation of the higher-ups to keep this secret from US-CERT? It appears to be a severe compromise, and the context suggests that much of the rest of the federal government is imminently vulnerable to the same tactics by the same threat actor. Where the higher-ups reporting the security crisis through better channels? Or were they trying to keep it quiet entirely, so might be complicit in something bad?
- dkrich 2y ago
  Or they’re just fearful of retaliation/termination for making waves with this administration
  - neilv 2y ago
    Becoming complicit.
jmward01 2y ago
So the real question is, who do you actually report this too if the fox is guarding the hen house? The only place that makes any sense is congressional oversight in some way but that will go nowhere except maybe a quick NPR story.
af3d 2y ago
Sorry, but the whole story just reads like a bad mystery novel; tales of Russian hackers, "suspicious" Github repos, somehow-nefarious (docker?) "containers", unspecified threats made (and I quote) in "meat space". Also interesting to note that not only has Berulis' attorney lead multiple lawsuits against the Trump administration in the past, he was also an intern for both Chuck Schumer and Hillary Clinton. Now that obviously doesn't prove anything, but it could nonetheless be considered a strong indicator this all might be politically-motivated.
Sparyjerry 2y ago
To everyone saying 'where are the arrests?' This is all conjecture at this point and time will tell what was click bait and truth. Below is the statement from NLRB's acting press secretary. "Tim Bearese, the NLRB's acting press secretary, denied that the agency granted DOGE access to its systems and said DOGE had not requested access to the agency's systems. Bearese said the agency conducted an investigation after Berulis raised his concerns but "determined that no breach of agency systems occurred." https://www.npr.org/2025/04/15/nx-s1-5355895/doge-musk-nlrb-takeaways-security https://www.npr.org/2025/04/15/nx-s1-5355895/doge-musk-nlrb-...
- jmcgough 2y ago
  People should not need to be conjecturing. The federal government should have clear documented reasons for the things that it does. It should have oversight, but all of the oversight has been fired, every department headed by yesmen and fox news anchors. We are all left guessing because they are doing loads of things that seem either treasonous or performed with very little thought to the consequences.
breadwinner 2y ago
[flagged]
- donnachangstein 2y ago
  > Musk has installed Starlink terminals on the whitehouse rooftop, to bypass security This is confirmation bias and absolutely unsubstantiated nonsense. Hedging your bets on hyperbolic dreck like this is why people don't take the serious stuff seriously. Do you think cellphone hotspots - that everyone has in their pocket - are also part of some grand conspiracy?
  - breadwinner 2y ago
    Right. But then it is part of a pattern: See: https://infosec.exchange/@briankrebs/114083485241630234 https://infosec.exchange/@briankrebs/114083485241630234 Excerpt: "How much more proof do we need that this administration is completely compromised? There is zero reason for the US to relax any offensive digital actions against Russia. If anything, we should be applying more."
  - Braxton1980 2y ago
    Good point, why install another internet connection (starlink) when you can easily use celluar data if you wanted to avoid White House network security? Very weird
- deleted 2y ago
  [deleted]
deleted 2y ago
[deleted]
cyberjerkXX 2y ago
Hello, I work in incident response and cyber forensics within the private sector and as a government contractor. I'm familiar with the government contracting company that currently holds the SOCaaS contract with the NLRB - it's MindPoint Group. They share the a SOC with the DOJ. I reviewed the whistleblower’s evidence, and I have significant doubts about his claims. Firstly, anyone claiming that "the whole government is compromised" is being conspiratorial. Breaches of this nature are reportable to CISA (US-CERT), the DOJ, local law enforcement, and the FBI. The NLRB has its own cybersecurity incident response team, which includes legal counsel. If both the NLRB and US-CERT determined that this wasn’t a reportable incident then I trust their judgment. Secondly, I’ve seen a lot of speculative commentary about the Russian IP allegedly logging into the DOGE account. A simple OSINT investigation reveals that this IP has had a negative reputation for over a year, specifically flagged for credential stuffing and scanning activity. Credential stuffing is a common tactic when credentials have been leaked or breached, often showing up on platforms like intelx.io, DeHashed, or BreachForums. It's also worth noting: no serious nation-state actor would use an IP with such a known bad reputation. Doing so would risk burning any operational investment they’ve made. Nation-state actors almost always use clean infrastructure or proxy chains to conceal their activity. The timeline the whistleblower presents spans two months, yet I find his interpretation of the activity speculative without hard evidence—especially considering he admits he does not possess the actual logs. That’s a huge red flag. Thirdly, I tried to find the whistle blower’s official title, and it’s usually hidden in the media. In his official report he states that he is a Dev Sec Ops engineer. He also claims that he lost access to privileges – but the emails in the screen shot seemed to be a zero-trust/principle of least privileges hardening effort. That’s not suspicious to me. Fourth, the screenshots the whistleblower provided of the Azure environment appeared extremely sparse. While I don’t know the exact size of the NLRB’s infrastructure, unless it's unusually small, I would expect to see more resources. From what I reviewed, the Azure dashboards he used had no filters applied, which raises the question—why are there no other subscriptions, VMs, load balancers, WAFs, etc., visible? Regarding the DLP policy alerts, he could have easily shown the associated data. Interestingly, the alerts were labeled “test,” which is significant—but he chose not to address or explain that. Omitting that context makes the evidence less compelling. He also leaves out basic critical Indicators of Compromise (IOCs) like src_ip, src_port, dest_ip, dest_port, bytes, and duration. I’m not expecting him to extract mutex and environment variables but showing the basics would be convincing enough consider all they would have been accessible to him from the dashboards he screenshots in the document. Finally, his claim that the NLRB doesn’t have a SIEM is demonstrably false. The NLRB shares a SIEM with the DOJ, which is operated by MindPoint Group under a SOCaaS contract. Here’s my general take on the situation: The whistleblower had only been with the organization for six months and served as a mid-level DevSecOps engineer—not a security analyst, incident responder, or SOC analyst. After DOGE was announced, the NLRB began implementing Zero Trust principles and the Principle of Least Privilege. This is typical hardening. As a result, his old admin access which was over provisioned and no longer necessary for his role—was revoked. He panicked. Still having access to some Azure tools, he could have used a test or dev environment (referencing the sparse number of resources in the screenshot but he claimed it to be prod with no filter), toggled a few settings, took screenshot, and constructed a narrative around it. He escalated it to the CEO, who initially listened. However, the incident response team conducted an investigation and found nothing substantiating his claims. NLRB and US-CERT determined it to not be reportable, or which indicates that if it was a security event it was not an incident. As for the Russian IP, it may be real—but it’s clearly tied to credential stuffing activity, not a sophisticated threat actor. If it genuinely accessed a DOGE account, that would indicate a breach on the DOGE side or weak password hygiene. But again—as mentioned earlier—he doesn’t have the logs to back this up, and his reasons for that are unconvincing. #Doubt.
brigandish 2y ago
From the "critique"[0]: > Upon learning of your resignation, following reports that you were linked to an account advocating to “normalize Indian hatred” and for a “eugenic immigration policy,” I can’t help but address the staggering hypocrisy of these views within the context of the IT industry. > This field, including your own career, is built on the labor, innovation, and expertise of Indian engineers and developers. To hold such hateful beliefs about a group that forms the backbone of this industry isn’t just reprehensible—it’s a complete contradiction of the reality you benefit from every day. > My original critique of your code addressed technical issues and provided solutions, but after learning about your expressed views, it’s clear that poor coding isn’t the root problem here. Your mindset is incompatible with the fundamental values of IT: collaboration, respect, and global interconnectedness. > Someone who advocates for hate cannot build systems meant to serve diverse users, nor can they lead or contribute meaningfully to teams that rely on trust and mutual respect. I strongly suggest you reflect on the harm your beliefs cause—not just to others, but to your credibility and future in this profession. It doesn't invalidate the same author's critique above it at all (the critique itself manages to do that) but how it ended up mentioned in Krebs' article is puzzling. It harkens back to the days when journalists would quote-mine random Twitter users' tweets as if it meant something. "Twitter user @john89674651684685 said…" Give me a break. [0] https://web.archive.org/web/20250423135719/https://github.com/markoelez/async-ip-rotator/issues/1#issuecomment-2642501016 https://web.archive.org/web/20250423135719/https://github.co...
deleted 2y ago
[deleted]
fnckd0geb0ys 2y ago
[dead]
briandear 2y ago
Related: 2016 thread on Hillary Clinton’s internet connected printer and her unauthorized private server containing classified information: https://news.ycombinator.com/item?id=11782383 https://news.ycombinator.com/item?id=11782383

1013 points by todsacerdoti 2y ago

[flagged]

tw04 2y ago

Someone needs to go to prison over this. It’s not just a misunderstanding, it is an intentional attack on every US citizen.

the_optimist 2y ago
Explain please.
- dmbche 2y ago
  https://krebsonsecurity.com/2025/04/whistleblower-doge-siphoned-nlrb-case-data/ https://krebsonsecurity.com/2025/04/whistleblower-doge-sipho...
  - the_optimist 2y ago
    [flagged]
- malfist 2y ago
  If I told you someone went to your bank and demanded the right to setup accounts with permissions to do everything and to have all logging of that users activity disabled, and then a whistleblower pointed out that they downloaded everyone's bank statements, you'd probably be pretty up set. After all, why do they need unfettered access? Why do they need your bank statements? Why do they need to hide what they're doing with the unfettered access? That's what's happening here. There is no good explanation other than bad actors
  - the_optimist 2y ago
    [flagged]
    - goatlover 2y ago
      An obvious rebuttal is they should not have that authority, and the possible reasons for having gained it are nefarious.
    - hedora 2y ago
      The article specifically covers this point. They exceeded their authority.
      - the_optimist 2y ago
        The article does not define or discuss the authority of DOGE.
    - malfist 2y ago
      Might doesn't make right
- MOARDONGZPLZ 2y ago
  The complaint alleges that DOGE was able to get unlimited-permissions admin accounts that were not subject to logging. They also downloaded external repositories that gave users of those repos lots of different IPs. The complaint further alleges that the DOGE person used the combination of these things to "download... more than 10 gigabytes of data from the agency’s case files, a database that includes reams of sensitive records including information about employees who want to form unions and proprietary business documents." If this is all true, this is basically hacking sensitive data in the open. We already know the current administration has worked to hobble unions. So putting these things together, this act is not only wrong in and of itself, but the data is likely going to be used to harm americans' interests. So, deserving of punishment.
  - alabastervlog 2y ago
    And they fucking illegally fired the IGs who are supposed to act as watchdogs for and light-shiners-on-of blatantly-illegal activity like this in the executive. The ones we added after Nixon's crimes. It was one of the first actions of the administration, blanket firing without actual cause, which is supposed to be required, and without the required notice-period to Congress. That should have exhausted any benefit of the doubt right off the bat, even among those inclined to think Trump's maybe not great but also some ordinary amount of bad for a politician. You don't do that unless you fully intend to do some crimes. Not only that, they were so goddamn eager to crime that they couldn't wait the 30 days or whatever. They intended to do criminal shit immediately.
    - EvanAnderson 2y ago
      I wish the firings of the IGs was something that "Joe Sixpack" understood. Honestly, even that the IGs exist(ed). (It wouldn't change the opinions of anybody who matters, I suppose.)
  - deleted 2y ago
    [deleted]
- mingus88 2y ago
  If you take a step back and realize that the intent is to utterly destroy the social safety net provided by social security, Medicare, etc that we have all been paying into our entire adult lives, tell me why every citizen affected should not pursue civil and criminal charges of theft and fraud with malicious intent? And then the means to do so have involved ignoring the courts and bypassing constitutional checks and balances? Please tell me how this isn’t criminal if not treasonous?
  - cap1434 2y ago
    Not only did you not explain the original comment, you added more assertions that are significantly more extraordinary without explaining your reasoning for those either.
- Cthulhu_ 2y ago
  Sensitive government data was (sure, allegedly) extracted to Russia via an account that was expressly created to hide / not create logs. This is treason. Allegedly.
  - goatlover 2y ago
    This administration is doing a lot of things that are borderline treasonous. Hopefully they get prosecuted when they get voted out or ideally get removed form power.
    - alabastervlog 2y ago
      Trump will blanket-pardon anyone who's still on his good side. And maybe some who aren't, just to limit the reach of investigations. And Trump himself's untouchable—while it remains technically possible to criminally prosecute a President for actions in office, it's in-practice impossible short of some unlikely hypothetical scenarios, thanks to the Supreme Court (the Roberts court loves leaving things technically intact, but actually not)
declan_roberts 2y ago
People voted for this
pluc 2y ago
[flagged]
- MOARDONGZPLZ 2y ago
  > it's fun to watch Watching the misery of others makes me feel ill.
  - tokioyoyo 2y ago
    Don’t agree with the OP how it’s fun to watch, but you have to acknowledge how citizens of basically every other country feel after being made fun of for the past few months. I have close relatives living in the states, and I feel bad for them. But your own government has been belittling your neighbours across both of your borders and calling them weak. I’m not going to say that the government does not deserve some of the repercussions of their own actions.
    - pluc 2y ago
      We aren't being made fun of, we are being threatened with annexation and unprovoked economic warfare by an administration with collective the intellect of a public toilet. The entire world has lost respect for the US and I for one am glad. And before you say what they all say, "we're not all like that", you're all complicit until you run them out of the country.
  - pluc 2y ago
    Watching the misery of a nation who have been hiding behind the second amendment for decades to defend mass slaughter and who now won't lift a finger to get out of authoritarian decisions and an oppressive regime is delicious hypocrisy. I can't wait for dessert.
candiddevmike 2y ago
The people who need to see/understand this live in a different reality where uncomfortable things like this are ETL'd into righteous anger towards people they don't like. This is the deep state they've been worried about, this is the boot that will tread on them. EDIT: parent comment was highest ranked comment for the article and is now at the bottom?
- j2kun 2y ago
  A twisted justification for suggesting someone who broke serious laws not face consequences. We live in a nation of laws, whether or not conspiracy-minded individuals prefer to follow them.
  - threatofrain 2y ago
    We live in a nation of peers before we live in a nation of laws.
  - Aeolun 2y ago
    > We live in a nation of laws You stopped living in a nation of laws a while ago. Now you live in a nation of might makes right.
    - bilbo0s 2y ago
      We'll see. The thing about the law in the US, it's slow and heavy. You'll need to be pretty mighty to move it if it catches up to you.
      - jayd16 2y ago
        Justice delayed is justice denied.
      - myko 2y ago
        I would have agreed years ago, but seeing trump - who obviously should be in prison for January 6th, among other crimes - back in the WH pretty much proves the US is not a nation of laws.
the_optimist 2y ago
[flagged]
aiauthoritydev 2y ago
Chances of that happening are zero right now.
threatofrain 2y ago
[flagged]
mikeyouse 2y ago
I fully believe there's a stack of pardons in Trump's drawer for everyone involved in this debacle. I can't imagine breaking so many laws all over the government if you thought you'd ever have to face consequences. The alternative to pardons in preventing the next congress & administration from cleaning this up is too dire to really contemplate.
- dboreham 2y ago
  Time to remove the pardon powder. Has it achieved anything productive in the last 100 years?
  - sterlind 2y ago
    it's written into the Constitution very explicitly. and it's a really bad time to hold a Constitutional Convention.
    - derektank 2y ago
      I'm not actually convinced that now would be a terrible time to hold a constitutional convention. Yes, it would be messy, but the nature of the ratification requirements (3/4 of all states) means that nothing could make it through without essentially unanimous consent of the country as a whole.
      - cgriswald 2y ago
        While we are at it we can add ranked voting and a vote of no confidence (maybe initiated by congress and voted on by the states or people).
  - nativeit 2y ago
    I think it's been used properly in a lot of instances, especially when you consider that federal law can quickly become out-of-step with modern sensibilities, so being able to relieve those harmed by laws flawed under contemporary standards is important. There's probably a better way of handling that, but it's one instance where the power of presidential and governors' pardons have been applied appropriately.
happyopossum 2y ago
You’d have to prove a crime here to send someone to jail, correct? What would the charges be?
- Alupis 2y ago
  [flagged]
  - Aeolun 2y ago
    I think surely “we want untraceable admin accounts” should be illegal in some way. If only in regard to transparency.
    - Alupis 2y ago
      [flagged]
      - ziddoap 2y ago
        >"Tenant-admin" isn't such a radical thing Admin accounts without logs is extremely radical. I have literally never seen it, or had anyone request it, in my decade+ of consulting in security. Unless you think the whistleblower, Krebs, and everyone else reporting are lying. Which, in that case, nothing anyone says is going to change your opinion (and you should just say that, if it's what you think, to save us all time).
        Alupis 2y ago
        [flagged]
        ziddoap 2y ago
        Like two lines up from your quote: "He specifically was told that there were to be no logs or records made of the accounts created for DOGE employees" That sure sounds like no logs. If you don't believe the whistleblower, just say that, and skip the insulting me part (and I'll know to skip the replying to you part).
deleted 2y ago
[deleted]
root_axis 2y ago
Not really possible since they would be pardoned even if anyone was ever willing to prosecute them.
pyinstallwoes 2y ago
Writing ai slop? Thanks !
skissane 2y ago
The problem with prosecuting them – they are employees of a White House office, doing what their bosses told them to do, and it is clear their bosses are carrying out the President's wishes. If Joe Blow off the street walks into a federal agency and takes all their data – open and shut case, throw the book at them, see you in a few decades. If someone from the White House walks into a federal agency, tells the agency leadership "the President wants me to take all your data", and the agency leadership replies "sure, go right ahead" – not a scenario people were expecting, so the existing laws haven't been crafted to clearly criminalize it. Maybe some enterprising prosecutor can find a way to map it to the crimes on the statute book, maybe it is just too hard. But even if the prosecutor overcomes that hurdle, it will be far from easy to convince the jury / trial judge / appellate courts that the legal elements of the crime are actually met – and if it actually gets as far as a conviction upheld by the appellate court, what do you think the conservative SCOTUS majority are going to do with that when they get it? And many prosecutors, foreseeing those low odds of ultimate success, will stop before they even get to an indictment. So, I think the odds of anyone ultimately being convicted over this are low, even if Trump never pardons them. Maybe, Congress might pass a law to make it more clearly illegal, which might make it easier to prosecute if a future administration repeats the same behavior. EDIT: if people are downvoting this because they think my analysis of the likelihood of successful criminal prosecution is wrong, it would be great if they could reply to explain where they think I got it wrong
- j_w 2y ago
  The claim that because your boss tells you to do something illegal means that you should just do it is bullshit. It's your social responsibility to not capitulate under these circumstances. If you don't feel that way then you deserve the world you are creating.
  - skissane 2y ago
    The problem is a lot of relevant criminal laws contain this word “unauthorized”. If you have access to a computer system, and it is authorized by the people who own the system, it isn’t a crime. These people will say that whatever they did/bypassed was (1) authorized by the President (of course if you ask Trump if he authorized them to do whatever he’ll say “yes”); (2) authorized by the senior agency leadership (because Trump has made clear that if they refuse to authorize it they’ll be fired). So, how do you prosecute them for accessing a computer system (or data or whatever) without authorization when both the President and the senior agency leadership say they authorized it? Well, you can’t-unless you want to argue that the President / agency leadership’s authorization is illegal and hence illegally invalid, ultra vires. But even supposing you are right about that in the abstract, will you be able to convince a judge and jury of it? And even supposing you convince a jury, trial judge and appellate court, there’s a dozen different ways SCOTUS could overturn it (from narrow questions of statutory construction to sweeping rulings about the President’s inherent constitutional power to demand information from the executive branch), and I think the main question for the current SCOTUS majority will be which of those ways they choose. My impression is that a lot of people are mixing up what they think the law ought to be, with what it actually is. Just because something ought to be a crime doesn’t mean it actually is one - and that’s especially going to be the case with unprecedented situations, it is hard to make something a crime if nobody foresaw it would one day happen.
9283409232 2y ago
You forget who the president is. They will get away with all of this and everything else. Doesn't mean we shouldn't try but lets be realistic here.

deleted 2y ago

[deleted]

twalkz 2y ago

> According to a whistleblower complaint filed last week by Daniel J. Berulis, a 38-year-old security architect at the NLRB, officials from DOGE met with NLRB leaders on March 3 and demanded the creation of several all-powerful “tenant admin” accounts that were to be exempted from network logging activity that would otherwise keep a detailed record of all actions taken by those accounts. Feels like a pretty good Occam’s razor case… but is there any legitimate reason why one would request this?

spencerflem 2y ago
Obviously no
Cthulhu_ 2y ago
Sure, to hide your tracks because you know what you intend to do isn't right.
patrickmay 2y ago
There is no justification for ever creating an account like that. The only purpose is nefarious.
vkou 2y ago
There isn't one. Anything musk's dogs claim to find cannot be taken at face value because of this. Because there is no audit, and no evidence that they can offer that they didn't doctor their findings. The next time they claim that a 170-year old person is receiving SS checks, they have no way to prove that they didn't subtract a century from that person's birthdate in some table.
- FredPret 2y ago
  Ah, this is something I haven't thought of before. This might not actually be spying, but instead just an attempt to plant fake results.
  - vkou 2y ago
    And even if it's not and everyone involved is a qualified, thoughtful, unimpeachable public servant with no agenda but the general welfare of the Glorious Republic of Arstotzka in their hearts, the lack of an audit trail means that you have to seriously consider that they aren't. Of course, given the blatant dishonesty and criminality that the rest of this administration is producing (see: every immigration law case that they are losing in court), you'd have to be a useful idiot to actually assume good intent from them.

willio58 2y ago

The fact that they left these packages public on GitHub.. guys you do know you can make things private right? Just shows how dumb these people are honestly

mingus88 2y ago
Or they are emboldened in knowing there will be absolutely no consequences. Go look at the list of pardons this administration has handed out. These guys won’t even be charged.
- apical_dendrite 2y ago
  Or they think what they're doing is righteous and they're proud of it. It isn't - DOGE is responsible for hundreds of thousands of deaths through cuts to health programs - but I suspect they are deluding themselves into thinking it is.
  - cpursley 2y ago
    > DOGE is responsible for hundreds of thousands of deaths through cuts to health programs That seems like a lot. Source?
    - douglasisshiny 2y ago
      https://www.yahoo.com/news/count-dead-millions-133000054.html?guccounter=1 https://www.yahoo.com/news/count-dead-millions-133000054.htm...
      - cpursley 2y ago
        [flagged]
        pesus 2y ago
        Do you have an actual rebuttal to the data?

77pt77 2y ago

> accounts created for DOGE at the NLRB downloaded three code repositories from GitHub Why is anything of significance on github in the first place? Edit: It's not. They just download python libraries to do "IP rotation" to circumvent rate limits. On the actual complaint: (https://whistlebloweraid.org/wp-content/uploads/2025/04/2025_0414_Berulis-Disclosure-with-Exhibits.s.pdf https://whistlebloweraid.org/wp-content/uploads/2025/04/2025...) It seems that the data was stored in Azure which doesn't make it any better.

Cthulhu_ 2y ago
What do you mean? It was "just" a tool to circumvent anti-scraping measures.
- icedchai 2y ago
  If they have full access to the systems, why are they scraping them externally?
  - Izkata 2y ago
    This is the big question everyone here seems to be skipping over. It seems like they're using "database" in the colloquial sense and actually mean some sort of already public data that's just rate limited (for example https://www.nlrb.gov/advanced-search https://www.nlrb.gov/advanced-search). Then depending on the order of events, either scraping didn't work well enough and were given "unlimited" (not rate limited) access, or the accounts were actually denied so they fell back to scraping. Or perhaps these two things are just unrelated despite what the story is claiming.
    - icedchai 2y ago
      Or maybe, even with access, they couldn't figure out how to query the actual database, so they resorted to scraping? Even with full "tenant" access, it could take some time to figure out where to look.
teraflop 2y ago

MattDaEskimo 2y ago

Untraceable and complete access to government databases. I can't begin to imagine the implications here.

xorcist 2y ago
We only hear about the cases where a someone is taking the risk of blowing the whistle, and actually manages to get the story out. Hopefully with enough substance for people to take the information seriously. How many cases that are likely to reach public knowledge is left as an exercise to the reader, as the saying goes.
- Braxton1980 2y ago
  >How many cases that are likely to reach public knowledge is left as an exercise to the reader, as the saying goes. Is this some reminder to people that bad things occur that aren't found out. Considering how everyone is aware of this is your comment some sort of clusterbomb whataboutism?
tootie 2y ago
Direct access to private data relating to accusations against companies Musk owns.

munchler 2y ago

So what exactly is being alleged here? That these DOGE bros wrote and used “hacker” code from GitHub to bypass security limitations on NLRB data? Why would they even need to do that if they had superuser accounts in the system already?

weaksauce 2y ago
they added a backdoor that is not audit logged. that's why.
woodruffw 2y ago
I think the point of the article is that the whistleblower's original claims can be substantiated publicly. It's another datapoint indicating that the DOGE people are operating haphazardly at the absolute best and, more likely, attempting to obscure their tracks because they know that what they're doing wouldn't pass legal muster.
timewizard 2y ago
The article is written very poorly. The disclosure itself is far more readable. https://whistlebloweraid.org/wp-content/uploads/2025/04/2025_0414_Berulis-Disclosure-with-Exhibits.s.pdf https://whistlebloweraid.org/wp-content/uploads/2025/04/2025...
- uxp100 2y ago
  Yes, this is much more clear than the article.
- munchler 2y ago
  Thanks. So the tools downloaded from GitHub were allegedly used to scrape personally-identifiable information (PII), details about ongoing legal cases, union-related data, and corporate secrets. The whistleblower observed large spikes in outbound data traffic, suggesting that gigabytes of sensitive information were exfiltrated with logging disabled, so as not to leave a trail.
- underyx 2y ago

kazinator 2y ago

I almost can't make heads or tails of out of this scatterbrained word salad. Let's start with this: > Berulis said the new DOGE accounts had unrestricted permission to read, copy, and alter information contained in NLRB databases. > Berulis said he discovered one of the DOGE accounts had downloaded three external code libraries from GitHub What exactly does that mean? NLRB database accounts are GitHub accounts? (Surely not.) Or the same IP address accessed both, suggesting it was the same person? Define "account". No coherent point being made here. This story needs to clearly separate the rhetoric about GitHub repositories from the NLRB access, and connect them together coherently. The flow seems to be: 1. Some DOGE people obtained unbridled access to NLRB, with the ability to erase audit trails. 2. There is some sort of evidence that the same people downloaded tools from GitHub for distributed web scraping, suggesting intent to scrape massive amounts of data from somewhere (inferred to be the NLRB database). There is no evidence cited in the article for the actual downloading of gigabytes of data; the "whistleblower" is quoted only as saying that DOGE required certain privileged accounts to be created and that the users of the accounts supposedly downloaded some web scraping software from GitHub. At least mention some circumstantial evidence, like a suspicious increase in access activity, coming from distributed IP addresses in the Amazon cloud, following the download of those tools. This: > On February 6, someone posted a lengthy and detailed critique of Elez’s code on the GitHub “issues” page for async-ip-rotator, calling it “insecure, unscalable and a fundamental engineering failure.” seems neither here nor there; why include that. It may be that the tools DOGE are using are not adequately safeguarding the data, but it seems like an extraneous point, and undigestable without specifics.

dehrmann 2y ago
The only interesting part of 2 is it looks like Doge wanted all the data. The technical details of how they scraped it mostly doesn't matter.
- kazinator 2y ago
  Plus in the whistleblower's actual report, there is evidence of them getting it, like logs of network output far above previous levels, and those accounts making accesses from various IP addresses (including geo-blocked attempts from Russia).

hahajk 2y ago

I have a theory that "business ethics" is really just "following the law." In capitalism, outside a few select industries like journalism, as long as it's legal you can - and should - do anything to maximize profits. It has turned into (or perhaps always was) the govt's job to set those rules. Now, the govt also has to create rules for itself. So it creates the Privacy Act and layers of beurocratic checks and balances. These rules are to protect the people, not to derisk or protect the govt. After all, the govt has all the power. So when capitalist businesses leaders are given the keys to govt, the normal ways of ethical alignment don't work. If you don't follow your own rules, who cares? They're your rules! I think what we're seeing is what happens if you apply traditional capitalist business practices to govt administration.

BriggyDwiggs42 2y ago
Yeah actually. I think that’s about right.
Clubber 2y ago
>In capitalism, outside a few select industries like journalism, as long as it's legal you can - and should - do anything to maximize profits. Honestly, if you were around watching the news 30+ years ago, you would notice a stark difference in how news is covered then versus today. You can't really blame them, they are doing what they can to survive, but coverage today much more tabloid than news. I would say the "fake but accurate," was the death knell, but it might have been sooner. https://en.wikipedia.org/wiki/Killian_documents_controversy https://en.wikipedia.org/wiki/Killian_documents_controversy
wat10000 2y ago
The trouble is that money is power, so the people who succeed the most at maximizing profit end up getting a lot of influence over the rules. In some countries, this is done with outright bribery. Here, we do it with campaign contributions and lobbying and “we’ll create jobs in your district.”

the_optimist 2y ago

For those genuine actors here: this theoretical outrage assumes the premise of something immoral or illegal, and completely ignores the authority structure. This looks and smells like an info operation.

polalavik 2y ago
Just, as an exercise, list out 3 good reasons someone might want untraceable admin accounts then list 3 really bad reasons they might want that. If you manage to find 3 good reasons does the outcome of those those outweigh the risks of the potential bad reasons?
- rockemsockem 2y ago
  Good: 1. The account-level below that doesn't have access to certain stuff and just happened to have untraceable stuff 2. They just said "give me the highest level of access" and didn't investigate what that meant 3. Can't think of a good third atm Bad: 1. They want to do nefarious things untraceably 2, 3. I think 1. covers pretty much everything. Personally, if I'm put in charge of overhauling a system I don't want to waste my time waiting on approvals for BS, I just want to be given the highest level of access I can be given to get on with work. I'm not saying this is fine, but the information here is basically a random list of things that happened and it doesn't really tell a nefarious story to my eyes.
  - yibg 2y ago
    I honestly don't understand the defenses of these actions here. Forget about the nature of data we're talking about here. If I was an engineer working at say google, and I put in mechanisms to access a bunch of data and bypass both auth and audit, I'd get fired instantly.
    - rockemsockem 2y ago
      If those mechanisms already existed and you requested and were granted access to them then there wouldn't be anything to comment on really? There would be no firing, nothing would happen. I'm not defending anything, I'm trying very hard to see what the specific problem is here and all I see is "now things XYZ might happen" and I'm just thinking that I'd be far more interested in an article about XYZ actually happening than this "reporting" on "maybe things ABC happened and maybe things XYZ will happen".

progbits 2y ago

> Ge0rg3’s code is “open source,” in that anyone can copy it and reuse it non-commercially. As it happens, there is a newer version of this project that was derived or “forked” from Ge0rg3’s code — called “async-ip-rotator” — and it was committed to GitHub in January 2025 by DOGE captain Marko Elez. Original code: https://github.com/Ge0rg3/requests-ip-rotator https://github.com/Ge0rg3/requests-ip-rotator Forked: https://github.com/markoelez/async-ip-rotator https://github.com/markoelez/async-ip-rotator Code is pretty much the same, with comments removed, some `async` sprinkled in and minor changes (I bet this was just pasted into LLM with prompt to make it async, but if that worked why not). Except... Original GPL3 license is gone. Obviously not something you would expect DOGE people to understand or respect.

nativeit 2y ago
> On February 6, someone posted a lengthy and detailed critique of Elez’s code on the GitHub “issues” page for async-ip-rotator, calling it “insecure, unscalable and a fundamental engineering failure.” “If this were a side project, it would just be bad code,” the reviewer wrote. “But if this is representative of how you build production systems, then there are much larger concerns. This implementation is fundamentally broken, and if anything similar to this is deployed in an environment handling sensitive data, it should be audited immediately.”
- deepfriedrice 2y ago
  The "critique" is nuts. Surely AI generated. If I didn't trust the domain, I'd assume the author to be incredible for seriously referencing something like this. Look at the critique [0] and then look at the code [1]. [0] https://web.archive.org/web/20250423135719/https://github.com/markoelez/async-ip-rotator/issues/1 https://web.archive.org/web/20250423135719/https://github.co... [1] https://github.com/ricci/async-ip-rotator/blob/master/src/async_ip_rotator/__init__.py https://github.com/ricci/async-ip-rotator/blob/master/src/as...
  - krferriter 2y ago
    Lol that's so funny. Can't imagine writing that. (the critique, not the code).

nop_slide 2y ago

I find the following bizarre. Ignoring who this marko guy is, why would a random person post such a "take down" of the repo? I have never randomly passed by a repo and wanted to just dunk on it. Also this critique reeks of being AI generated. > On February 6, someone posted a lengthy and detailed critique of Elez’s code on the GitHub “issues” page for async-ip-rotator, calling it “insecure, unscalable and a fundamental engineering failure.” Link from quote: https://github.com/markoelez/async-ip-rotator/issues/1 https://github.com/markoelez/async-ip-rotator/issues/1 The follow comment is interesting to be a coincidental, such a weird interaction.

nativeit 2y ago
Why wonder? The user who wrote it seems to be a pretty well established user, and their public repositories suggest that they work in adjacent contexts, so it's entirely plausible they attempted to use async-ip-rotator in one of their projects.
- nativeit 2y ago
  It's also worth noting that Feb 6 may very well be after Marko Elez became a public figure with DOGE. The article doesn't do a great job of expanding on any of this.
  - nop_slide 2y ago
    Ah yeah that would make more sense
- marcusb 2y ago
  ??? The public repos for this person that I could find that weren't forks with no activity to upstream consisted of a dice-rolling guessing game, rock-paper-scissors, and some kind of framework for downloading and transcribing audio files that does not yet download or transcribe, but implements a whole bunch of boilerplate. I find it rather difficult to believe this person engaged in a good-faith review of the async-ip-rotator code base.

growdark 2y ago

>Ge0rg3’s code is “open source,” in that anyone can copy it and reuse it non-commercially. A little nit-picking, but that's not what open source means, especially as it relates to the GPL in this case. If you can't use the code commercially, it's neither "open source" (as defined by OSI) nor free software (as defined by the FSF).

nativeit 2y ago
Right, but the original statement isn't being mutually exclusive.

jiggawatts 2y ago

This is much ado about nothing. The article tries to very hard to make something ordinary sound nefarious. This appears to be DOGE employees simply doing their job. You may not agree with what they’re doing in a political sense, but if you were tasked with the same problem you’d come up with a nearly identical solution. For example: “tenant admin” is probably the special role that can bypass access control (not audits!) and see and read all data. This sounds scary but I regularly request this right from large government departments and I get it granted to me. Its use is justified when normal access requests would be too complex / fiddly and error prone. Generally, in a large environment, there is no other way to guarantee 100% coverage because as an outsider you don’t even know what permissions to ask for if you can’t see anything due to a lack of permissions! Seriously: sit down for a second and think about how you would go about getting access to make a full copy of an organisation’s data for an audit if you fully expect both passive resistance and even active efforts to hide the very things you’re looking for.

dboreham 2y ago
Absolute balderdash.
watwut 2y ago
In that case, you and departments you work for are either breaking the law regularly or working with public data anyway. Besides, no one needs unmonitored write access for audit. Even less DOGE who does no audit and don't have knowledge how to do audit. Audits are supposed to he traceable.
- sremani 2y ago
  [flagged]
  - paulryanrogers 2y ago
    Whistleblowers are protected by law. If their data is being exfiltrated then they may become targets of harassment.

wnevets 2y ago

[flagged]

cpursley 2y ago
[flagged]
- bigyabai 2y ago
  Whistleblowers are claiming it's sedition: https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-... > The employees grew concerned that the NLRB's confidential data could be exposed, particularly after they started detecting suspicious log-in attempts from an IP address in Russia, according to the disclosure.
  - ein0p 2y ago
    [flagged]
    - dekhn 2y ago
      Without making any statement on whether I believe DOGE is being seditious, it's not hard to interpret their underlying intent as being wholly compatible with the definition you pasted. DOGE intends to hurt the government in ways that cause people to trust it less, with the goal of eliminating large parts of the government.
      - ein0p 2y ago
        [flagged]
        dekhn 2y ago
        Yes, a part of the government can try to hurt the government, that is true.
- 2y ago

ChrisMarshallNY 2y ago

What sucks is, is that Russia and China now, almost certainly, have all this data, but they don't worry me, as much as the American oligarchs that now have it.

deleted 2y ago

[deleted]

porphyra 2y ago

Isn't the ip rotator used to scrape from public websites to bypass rate limits? Not sure how that automatically means they are "siphoning sensitive case files".

deleted 2y ago
[deleted]
borski 2y ago
It doesn’t. Coupled with the whistleblower complaint, however, it is evidence.
tootie 2y ago
The IP rotator was discovered in the analysis. The exfiltration of data was discovered by an NLRB employee and triggered the complaint. A member of their staff saw the spike in egress, found the source and that the audit log had been bleached.

dfedbeef 2y ago

The CEO of Tesla and Space-X; a self-proclaimed high IQ individual, an alleged programmer, has apparently hired a straight-up script kiddie to their elite delta force of technical government downsizers.

llm_nerd 2y ago
There is a phenomena I've noticed in this industry where people who lack a skill compensate by convincing themselves that they are a savant at seeing and exploiting that skill they lack in others. They find and encircle themselves with people who they believe are the Best of the Best, at least in their imagination, and it is critical for their ego that this is never challenged. They will be blind to any evidence to the contrary because they need the people they "identify" to be extraordinary, justifying their great people curation. I mean, I guess this really happens in all industries. Art, music, leadership, software development. People who maybe once had credibility in something and now desperately try to foist Their People as the best in the industry. I feel like that is what is happening here. None of the people who Elon surrounds himself are notable in any way, and their skills are hugely suspect, but he has to have his harem of "Super Coders" to prop up his own mythology.
jppope 2y ago
I agree with the script kiddies comment- which is basically what the reporting has shown... but in a way isn't that part of the point? That they can save billions of dollars just by having a couple of relatively normal comp sci kids (who can't even rent a car) review the most basic financial information of our government departments. These guys aren't supposed to be "delta force" they are supposed to be the interns. Not trying to defend the means to the end, but I would really like my tax money used more efficiently. I will also say am extremely worried about the levels of access that they are being given, especially since it comes with basically no accountability
- joquarky 2y ago
  > I would really like my tax money used more efficiently. This is immature thinking, because, who wouldn't? The contention comes from differing opinions on what is waste.

ceo_tim_crook 2y ago

the doge guys are truely living the script kiddie dream

hashstring 2y ago

Haha, and the Github repo is now offline. lol.

ThinkBeat 2y ago

1. DOGE employees access data they were not supposed to. This fairly clear. The story says that DOGE attained access to an account that had huge permissions into what it could see and alter. The person or persons from DOGE may have downloaded 10GB of data. The person may have used this in a manner that is illegal. Or it is illegal to start with. With the understanding that POTUS may or may not be allowed grand such access. (I dont think POTUS can) 2. DOGE employee downloaded code that could be used to use a huge pool of IP addresses, from AWS to bypass forms of throtheling. 3. The code was badly written. 4. The person is a racist How would a person from DOGE use "unlimited" number of IP adderssess from AWS to hammer and automaticlay screenscape webpage, benefit from it when it came to copying extremly sensetive data from an internal National Labor Relations Board database? Did 10.000 sessions authenticate to the database at the same time, using AWS UP addresses and scraped the data? Something is pretty broken if the system with extremly sensetive data is available from external IPs -and- allowing a single account to login 10.0000 times to concurrently scrape data off the interal database? Of are they saying that this code was adapted to use 10.000/100 IP addresses internal to National Labor Relations Board and scrapes using those? The automation later noted makes a lot more sense to aid the work.

declan_roberts 2y ago
The author brings up the ip scraping but makes no effort to tie anything together. It's actually really confusing. Were they using this utility to steal the data or are these two just totally unrelated things?
- SpicyLemonZest 2y ago
  We have no way to know what they were using it for, because as the article details, DOGE works hard to make sure nobody can find out what it's doing or why.
grandempire 2y ago
> I dont think POTUS can What data in a federal agency could the chief executive not have authorization to access?

golemiprague 2y ago

I don't see anything wrong with what they did, they basically got admin accounts so they can peak into the system and used some libraries from github. What is the problem here? Got a feeling it is just politically motivated, people are not happy that the Trump administration is actually doing something to make systems more efficient and stop money waste of tax payers. I am sure they will make some mistakes along the way and I am sure not every "saving" is actually saving but when you look at so many systems and so much money some errors are expected.

TacticalCoder 2y ago

[dead]

xyst 2y ago

The government dogs are literally script kiddies, go figure.

pyinstallwoes 2y ago

That page reads completely incoherently if you understand junior level programming mental models. This is a hit piece for non technical audience meant to conjure fud.

bryancoxwell 2y ago
It’s not at all about programming

Havoc 2y ago

>The new accounts also could restrict log visibility, delay retention, route Guessing those are the same accounts that got accessed by Russian IPs? Genuinely wondering whether the US democracy is going to make it to December.

blendergeek 2y ago

> Ge0rg3’s code is “open source,” in that anyone can copy it and reuse it non-commercially. That isn't what "open source" means.

DaSHacka 2y ago
Unfortunately about what you should come to expect from Brian Krebs.

zombiwoof 2y ago

[flagged]

mythrowaway49 2y ago

this part of the whistleblower complaint seem way worse: " On or about March 11, 2025, NxGen metrics indicated abnormal usage at points the prior week. I saw way above baseline response times, and resource utilization showed increased network output above anywhere it had been historically – as far back as I could look. I noted that this lined up closely with the data out event. I also notice increased logins blocked by access policy due to those log-ins being out of the country. For example: In the days after DOGE accessed NLRB’s systems, we noticed a user with an IP address in Primorskiy Krai, Russia started trying to log in. Those attempts were blocked, but they were especially alarming. Whoever was attempting to log in was using one of the newly created accounts that were used in the other DOGE related activities and it appeared they had the correct username and password due to the authentication flow only stopping them due to our no-out-of-country logins policy activating. There were more than 20 such attempts, and what is particularly concerning is that many of these login attempts occurred within 15 minutes of the accounts being created by DOGE engineers. "

superconduct123 2y ago
Wow that's insane
kazinator 2y ago
The article could offer a summary of this key finding, rather than, say, the pointless paragraph near the bottom about the scraping software found in GitHub not being well written. This is the evidence which strongly suggests that the DOGE personnel are using various cloud IP addresses to scrape.
stevenwoo 2y ago
Any guesses for best possible interpretion? The Russians have infiltrated their PCs with keyloggers and DOGE are working from insecure open networks. The worst possible interpretation is straightforward - they are working for the Russians as agents and let the Russians in or installed the keyloggers for Russia.
- 0cf8612b2e1e 2y ago

tonetheman 2y ago

[dead]

neilv 2y ago

> Berulis said he went public after higher-ups at the agency told him not to report the matter to the US-CERT, as they’d previously agreed. If the allegation is true, what would be the motivation of the higher-ups to keep this secret from US-CERT? It appears to be a severe compromise, and the context suggests that much of the rest of the federal government is imminently vulnerable to the same tactics by the same threat actor. Where the higher-ups reporting the security crisis through better channels? Or were they trying to keep it quiet entirely, so might be complicit in something bad?

dkrich 2y ago
Or they’re just fearful of retaliation/termination for making waves with this administration
- neilv 2y ago
  Becoming complicit.

jmward01 2y ago

So the real question is, who do you actually report this too if the fox is guarding the hen house? The only place that makes any sense is congressional oversight in some way but that will go nowhere except maybe a quick NPR story.

af3d 2y ago

Sorry, but the whole story just reads like a bad mystery novel; tales of Russian hackers, "suspicious" Github repos, somehow-nefarious (docker?) "containers", unspecified threats made (and I quote) in "meat space". Also interesting to note that not only has Berulis' attorney lead multiple lawsuits against the Trump administration in the past, he was also an intern for both Chuck Schumer and Hillary Clinton. Now that obviously doesn't prove anything, but it could nonetheless be considered a strong indicator this all might be politically-motivated.

Sparyjerry 2y ago

To everyone saying 'where are the arrests?' This is all conjecture at this point and time will tell what was click bait and truth. Below is the statement from NLRB's acting press secretary. "Tim Bearese, the NLRB's acting press secretary, denied that the agency granted DOGE access to its systems and said DOGE had not requested access to the agency's systems. Bearese said the agency conducted an investigation after Berulis raised his concerns but "determined that no breach of agency systems occurred." https://www.npr.org/2025/04/15/nx-s1-5355895/doge-musk-nlrb-takeaways-security https://www.npr.org/2025/04/15/nx-s1-5355895/doge-musk-nlrb-...

jmcgough 2y ago
People should not need to be conjecturing. The federal government should have clear documented reasons for the things that it does. It should have oversight, but all of the oversight has been fired, every department headed by yesmen and fox news anchors. We are all left guessing because they are doing loads of things that seem either treasonous or performed with very little thought to the consequences.

breadwinner 2y ago

[flagged]

donnachangstein 2y ago
> Musk has installed Starlink terminals on the whitehouse rooftop, to bypass security This is confirmation bias and absolutely unsubstantiated nonsense. Hedging your bets on hyperbolic dreck like this is why people don't take the serious stuff seriously. Do you think cellphone hotspots - that everyone has in their pocket - are also part of some grand conspiracy?
- breadwinner 2y ago
  Right. But then it is part of a pattern: See: https://infosec.exchange/@briankrebs/114083485241630234 https://infosec.exchange/@briankrebs/114083485241630234 Excerpt: "How much more proof do we need that this administration is completely compromised? There is zero reason for the US to relax any offensive digital actions against Russia. If anything, we should be applying more."
- Braxton1980 2y ago
  Good point, why install another internet connection (starlink) when you can easily use celluar data if you wanted to avoid White House network security? Very weird
deleted 2y ago
[deleted]

deleted 2y ago

[deleted]

cyberjerkXX 2y ago

Hello, I work in incident response and cyber forensics within the private sector and as a government contractor. I'm familiar with the government contracting company that currently holds the SOCaaS contract with the NLRB - it's MindPoint Group. They share the a SOC with the DOJ. I reviewed the whistleblower’s evidence, and I have significant doubts about his claims. Firstly, anyone claiming that "the whole government is compromised" is being conspiratorial. Breaches of this nature are reportable to CISA (US-CERT), the DOJ, local law enforcement, and the FBI. The NLRB has its own cybersecurity incident response team, which includes legal counsel. If both the NLRB and US-CERT determined that this wasn’t a reportable incident then I trust their judgment. Secondly, I’ve seen a lot of speculative commentary about the Russian IP allegedly logging into the DOGE account. A simple OSINT investigation reveals that this IP has had a negative reputation for over a year, specifically flagged for credential stuffing and scanning activity. Credential stuffing is a common tactic when credentials have been leaked or breached, often showing up on platforms like intelx.io, DeHashed, or BreachForums. It's also worth noting: no serious nation-state actor would use an IP with such a known bad reputation. Doing so would risk burning any operational investment they’ve made. Nation-state actors almost always use clean infrastructure or proxy chains to conceal their activity. The timeline the whistleblower presents spans two months, yet I find his interpretation of the activity speculative without hard evidence—especially considering he admits he does not possess the actual logs. That’s a huge red flag. Thirdly, I tried to find the whistle blower’s official title, and it’s usually hidden in the media. In his official report he states that he is a Dev Sec Ops engineer. He also claims that he lost access to privileges – but the emails in the screen shot seemed to be a zero-trust/principle of least privileges hardening effort. That’s not suspicious to me. Fourth, the screenshots the whistleblower provided of the Azure environment appeared extremely sparse. While I don’t know the exact size of the NLRB’s infrastructure, unless it's unusually small, I would expect to see more resources. From what I reviewed, the Azure dashboards he used had no filters applied, which raises the question—why are there no other subscriptions, VMs, load balancers, WAFs, etc., visible? Regarding the DLP policy alerts, he could have easily shown the associated data. Interestingly, the alerts were labeled “test,” which is significant—but he chose not to address or explain that. Omitting that context makes the evidence less compelling. He also leaves out basic critical Indicators of Compromise (IOCs) like src_ip, src_port, dest_ip, dest_port, bytes, and duration. I’m not expecting him to extract mutex and environment variables but showing the basics would be convincing enough consider all they would have been accessible to him from the dashboards he screenshots in the document. Finally, his claim that the NLRB doesn’t have a SIEM is demonstrably false. The NLRB shares a SIEM with the DOJ, which is operated by MindPoint Group under a SOCaaS contract. Here’s my general take on the situation: The whistleblower had only been with the organization for six months and served as a mid-level DevSecOps engineer—not a security analyst, incident responder, or SOC analyst. After DOGE was announced, the NLRB began implementing Zero Trust principles and the Principle of Least Privilege. This is typical hardening. As a result, his old admin access which was over provisioned and no longer necessary for his role—was revoked. He panicked. Still having access to some Azure tools, he could have used a test or dev environment (referencing the sparse number of resources in the screenshot but he claimed it to be prod with no filter), toggled a few settings, took screenshot, and constructed a narrative around it. He escalated it to the CEO, who initially listened. However, the incident response team conducted an investigation and found nothing substantiating his claims. NLRB and US-CERT determined it to not be reportable, or which indicates that if it was a security event it was not an incident. As for the Russian IP, it may be real—but it’s clearly tied to credential stuffing activity, not a sophisticated threat actor. If it genuinely accessed a DOGE account, that would indicate a breach on the DOGE side or weak password hygiene. But again—as mentioned earlier—he doesn’t have the logs to back this up, and his reasons for that are unconvincing. #Doubt.

brigandish 2y ago

From the "critique"[0]: > Upon learning of your resignation, following reports that you were linked to an account advocating to “normalize Indian hatred” and for a “eugenic immigration policy,” I can’t help but address the staggering hypocrisy of these views within the context of the IT industry. > This field, including your own career, is built on the labor, innovation, and expertise of Indian engineers and developers. To hold such hateful beliefs about a group that forms the backbone of this industry isn’t just reprehensible—it’s a complete contradiction of the reality you benefit from every day. > My original critique of your code addressed technical issues and provided solutions, but after learning about your expressed views, it’s clear that poor coding isn’t the root problem here. Your mindset is incompatible with the fundamental values of IT: collaboration, respect, and global interconnectedness. > Someone who advocates for hate cannot build systems meant to serve diverse users, nor can they lead or contribute meaningfully to teams that rely on trust and mutual respect. I strongly suggest you reflect on the harm your beliefs cause—not just to others, but to your credibility and future in this profession. It doesn't invalidate the same author's critique above it at all (the critique itself manages to do that) but how it ended up mentioned in Krebs' article is puzzling. It harkens back to the days when journalists would quote-mine random Twitter users' tweets as if it meant something. "Twitter user @john89674651684685 said…" Give me a break. [0] https://web.archive.org/web/20250423135719/https://github.com/markoelez/async-ip-rotator/issues/1#issuecomment-2642501016 https://web.archive.org/web/20250423135719/https://github.co...

deleted 2y ago

[deleted]

fnckd0geb0ys 2y ago

[dead]

briandear 2y ago

Related: 2016 thread on Hillary Clinton’s internet connected printer and her unauthorized private server containing classified information: https://news.ycombinator.com/item?id=11782383 https://news.ycombinator.com/item?id=11782383