10 ms·

> According to a whistleblower complaint filed last week by Daniel J. Berulis, a 38-year-old security architect at the NLRB, officials from DOGE met with NLRB l

by twalkz 1y ago

> According to a whistleblower complaint filed last week by Daniel J. Berulis, a 38-year-old security architect at the NLRB, officials from DOGE met with NLRB leaders on March 3 and demanded the creation of several all-powerful “tenant admin” accounts that were to be exempted from network logging activity that would otherwise keep a detailed record of all actions taken by those accounts. Feels like a pretty good Occam’s razor case… but is there any legitimate reason why one would request this?

spencerflem 1y ago
Obviously no
Cthulhu_ 1y ago
Sure, to hide your tracks because you know what you intend to do isn't right.
patrickmay 1y ago
There is no justification for ever creating an account like that. The only purpose is nefarious.
vkou 1y ago
There isn't one. Anything musk's dogs claim to find cannot be taken at face value because of this. Because there is no audit, and no evidence that they can offer that they didn't doctor their findings. The next time they claim that a 170-year old person is receiving SS checks, they have no way to prove that they didn't subtract a century from that person's birthdate in some table.
- FredPret 1y ago
  Ah, this is something I haven't thought of before. This might not actually be spying, but instead just an attempt to plant fake results.
  - vkou 1y ago
    And even if it's not and everyone involved is a qualified, thoughtful, unimpeachable public servant with no agenda but the general welfare of the Glorious Republic of Arstotzka in their hearts, the lack of an audit trail means that you have to seriously consider that they aren't. Of course, given the blatant dishonesty and criminality that the rest of this administration is producing (see: every immigration law case that they are losing in court), you'd have to be a useful idiot to actually assume good intent from them.
    - FredPret 1y ago
      Of course, it just never occurred to me that there's a less bad but still terrible explanation for ghost admin access.
  - timewizard 1y ago
    They give away the game if you pay attention and read other internal sources from other agencies. This is all about shoving AI into the loop and removing federal workers from it. They want to prove that AI can do "just as good a job" on these data sets and arrive at "equal conclusions" with a much higher level of effiency. This is what happens when you get high on your own supply.
  - blooalien 1y ago
    > This might not actually be spying, but instead just an attempt to plant fake results. That statement might be (slightly) more believable had there not been access attempts from Russian IP addresses using valid (and recently created) DOGE login credentials so very shortly thereafter.
pan69 1y ago
> all-powerful “tenant admin” accounts that were to be exempted from network logging activity Is this normal to build this sort of functionality into a software system? Especially software systems that heavily rely on auditability?
- XorNot 1y ago
  It's the same as domain admin in active directory. You always need it to setup the system initially. It's like root on Linux: it's an implementation detail that it must be possible.
  - skeeter2020 1y ago
    typically the admin account can createthings like super users, and super users can do anything with the data, but not sure there's a use case where a single account can do both, and why can any of them avoid logging?
  - tw04 1y ago
    Root on Linux isn’t exempt from logging. I also don’t know any enterprise that allows admin accounts to bypass logging. There is no legitimate justification for this request.
    - XorNot 1y ago
      root on Linux can just kill the log forwarder and erase the relevant logs, or refill them with junk.
      - sanderjd 1y ago
        Yes. A more competent hack would have been to use their superuser permissions to do that kind of thing. But instead they requested that logging be disabled, thus outing themselves as acting in bad faith.
      - Braxton1980 1y ago
        Assuming the Whistleblower is telling the truth, why would they make the request if they could cover their tracks themselves
Suppafly 1y ago
I'm only really familiar with the 'tenant admin' concept from microsoft administration, it's commonly used otherwise?
wmf 1y ago
[flagged]
- aSanchezStern 1y ago
  I don't think that "arguing that something is against the rules" is in the CIA sabotage manual, because it's not generally considered sabotage. Maybe if you argue things are against the rules that you know aren't, to slow things down?
  - Aeolun 1y ago
    It’s not so much arguing against the rules. It’s following them to the letter when unnecessary. It doesn’t matter that the big boss has said that purchasing a $5 knick-knack is ok. You will have that purchase go through the full procurement process, even up to and including an exhaustive search for (cheaper) alternatives.
    - only-one1701 1y ago
      I also love to unilaterally determine what is and isn’t necessary.
      - Aeolun 1y ago
        Are you suggesting that’s a valuable use of time? I make decisions about such tradeoffs every day.
        only-one1701 1y ago
        I’m suggesting that a $5 purchase abs a critical government agency’s infosec are different considerations.
- sanderjd 1y ago
  Thing is: Everything they're doing is against the rules. Except they aren't "rules", they are laws.
plandis 1y ago
I can’t think of any. Even if you wanted to give someone broad permissions to access and modify data, you wouldn't turn off the audit logs.
1oooqooq 1y ago
very clear admission of guilt.
mfer 1y ago
Setting aside legitimate (thats a matter of judgement)... Some previous attempts for DOGE to get data has resulted in data being deleted before they can look and requests for judges to block access to data. DOGE may be trying to be covert in order to stop these two activities from happening before they can get and review the data.
- throwworhtthrow 1y ago
  > Setting aside legitimate (thats a matter of judgement) By definition, a judge decides what's legitimate. If DOGE expects their access to be blocked by a court judgement, and bum-rushes agencies to exfiltrate data ahead of the judgement, that's also criminal intent. I am not sure what you are getting at. "Covert" isn't how I'd describe DOGE's actions. "Brazen" maybe?
  - mfer 1y ago
    People have admitted in news interviews to destroying government data to prevent others from knowing what the government was doing. That’s likely criminal. This is a legitimate reason to get at information before people who might destroy have the opportunity. What’s happening with judges is very political. We likely won’t know what’s allowed until things have gone through the appeals process. There have been cases of judges admitting they will rule against the current administration no matter the topic or law. This is messy, to say the least.
    - LiquidSky 1y ago
      >People have admitted in news interviews to destroying government data to prevent others from knowing what the government was doing. That’s likely criminal. This is a legitimate reason to get at information before people who might destroy have the opportunity. Yes, this is precisely the accusation being made against DOGE: they are the government actors criminally trying to to prevent the public from knowing what they're doing. >There have been cases of judges admitting they will rule against the current administration no matter the topic or law. No, there haven't, but feel free to provide a source.
rtkwe 1y ago
Even worse when you know more of the whistleblower's story which is that ~15 minutes after one of DOGE's accounts were made there was an attempted login with the correct password from Russia. Not many explanations for that that look good for DOGE...
- stephenitis 1y ago
  Citation?
  - gnabgib 1y ago
    From the whistle blower. > Within minutes after DOGE accessed the NLRB's systems, someone with an IP address in Russia started trying to log in, according to Berulis' disclosure. https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...
  - orochimaaru 1y ago
    Not parent but it’s here - https://krebsonsecurity.com/2025/04/whistleblower-doge-siphoned-nlrb-case-data/ https://krebsonsecurity.com/2025/04/whistleblower-doge-sipho... DOGE is a complete clusterfuck. Fwiw I think there is hard to spot fraud in the govt that should be looked at (eg price inflation at the pentagon, VA, Medicaid/Medicare, SS). They should have done the hard work of uncovering that. Instead they just went for clickbait headlines.
    - mmooss 1y ago
      > DOGE is a complete clusterfuck. It depends what the objectives are. My impression is that they have been very successful pursuing their actual objectives, while providing a cover story of a 'clusterfuck'.
      - rtkwe 1y ago
        And conveniently gutting agencies that are or were soon to be thorns in Elon's side. FAA and EPA were annoying him around SpaceX's Starship test launches, CFPB would be annoying for his future everything app plans for Twitter, etc.
api 1y ago
To allow dodgy offshore actors to snarf huge amounts of data on US citizens to prepare a huge propaganda assault for the next election?
largbae 1y ago
I am sure they demanded maximum access, but the logging activity phrasing sounds a little bit like spin... I think if I wanted to describe an account with access to perform "sudo -s" as negatively as possible, I would say "an all-powerful admin account that is exempt from logging activity that would otherwise keep a detailed record of all actions taken by those accounts."
tootie 1y ago
Interview with whistleblower detailing the attack and the threats directed against him: https://www.pbs.org/newshour/show/nlrb-whistleblower-claims-musks-doge-potentially-caused-significant-security-breach https://www.pbs.org/newshour/show/nlrb-whistleblower-claims-...
- cmurf 1y ago
  this guy's lawyer says: This is a difficult topic for Dan to discuss, but prior to our filing the whistle-blower disclosure this week, last week, somebody went to Dan's home and taped a threatening note, a menacing note on his door with personal information. ... While he was at work, and it also contained photographs of him walking his dog taken by a drone. This is mafia shit.
  - Corrado 1y ago
    I just finished watching Daredevil: Born Again[0] and this incident looks shockingly familiar to what happened in the show. I don't know how the show runners knew this was going to happen but it feels like they've been spying on the future. Do they have a time machine or are they really that good (and the current administration that bad)? [0] https://www.imdb.com/title/tt18923754/ https://www.imdb.com/title/tt18923754/
jimt1234 1y ago
The Deep State! The government is filled with spies determined to "leak" the great work DOGE is doing is the press - so, of course, it needs "God mode" access. Totally legit. That's the best I could do. LOL
deleted 1y ago
[deleted]

by twalkz 1y ago

spencerflem 1y ago

Obviously no

Cthulhu_ 1y ago

Sure, to hide your tracks because you know what you intend to do isn't right.

patrickmay 1y ago

There is no justification for ever creating an account like that. The only purpose is nefarious.

vkou 1y ago

There isn't one. Anything musk's dogs claim to find cannot be taken at face value because of this. Because there is no audit, and no evidence that they can offer that they didn't doctor their findings. The next time they claim that a 170-year old person is receiving SS checks, they have no way to prove that they didn't subtract a century from that person's birthdate in some table.

FredPret 1y ago
Ah, this is something I haven't thought of before. This might not actually be spying, but instead just an attempt to plant fake results.
- vkou 1y ago
  And even if it's not and everyone involved is a qualified, thoughtful, unimpeachable public servant with no agenda but the general welfare of the Glorious Republic of Arstotzka in their hearts, the lack of an audit trail means that you have to seriously consider that they aren't. Of course, given the blatant dishonesty and criminality that the rest of this administration is producing (see: every immigration law case that they are losing in court), you'd have to be a useful idiot to actually assume good intent from them.
  - FredPret 1y ago
    Of course, it just never occurred to me that there's a less bad but still terrible explanation for ghost admin access.
- timewizard 1y ago
  They give away the game if you pay attention and read other internal sources from other agencies. This is all about shoving AI into the loop and removing federal workers from it. They want to prove that AI can do "just as good a job" on these data sets and arrive at "equal conclusions" with a much higher level of effiency. This is what happens when you get high on your own supply.
- blooalien 1y ago
  > This might not actually be spying, but instead just an attempt to plant fake results. That statement might be (slightly) more believable had there not been access attempts from Russian IP addresses using valid (and recently created) DOGE login credentials so very shortly thereafter.

pan69 1y ago

> all-powerful “tenant admin” accounts that were to be exempted from network logging activity Is this normal to build this sort of functionality into a software system? Especially software systems that heavily rely on auditability?

XorNot 1y ago
It's the same as domain admin in active directory. You always need it to setup the system initially. It's like root on Linux: it's an implementation detail that it must be possible.
- skeeter2020 1y ago
  typically the admin account can createthings like super users, and super users can do anything with the data, but not sure there's a use case where a single account can do both, and why can any of them avoid logging?
- tw04 1y ago
  Root on Linux isn’t exempt from logging. I also don’t know any enterprise that allows admin accounts to bypass logging. There is no legitimate justification for this request.
  - XorNot 1y ago
    root on Linux can just kill the log forwarder and erase the relevant logs, or refill them with junk.
    - sanderjd 1y ago
      Yes. A more competent hack would have been to use their superuser permissions to do that kind of thing. But instead they requested that logging be disabled, thus outing themselves as acting in bad faith.
    - Braxton1980 1y ago
      Assuming the Whistleblower is telling the truth, why would they make the request if they could cover their tracks themselves

Suppafly 1y ago

I'm only really familiar with the 'tenant admin' concept from microsoft administration, it's commonly used otherwise?

wmf 1y ago

[flagged]

aSanchezStern 1y ago
I don't think that "arguing that something is against the rules" is in the CIA sabotage manual, because it's not generally considered sabotage. Maybe if you argue things are against the rules that you know aren't, to slow things down?
- Aeolun 1y ago
  It’s not so much arguing against the rules. It’s following them to the letter when unnecessary. It doesn’t matter that the big boss has said that purchasing a $5 knick-knack is ok. You will have that purchase go through the full procurement process, even up to and including an exhaustive search for (cheaper) alternatives.
  - only-one1701 1y ago
    I also love to unilaterally determine what is and isn’t necessary.
    - Aeolun 1y ago
      Are you suggesting that’s a valuable use of time? I make decisions about such tradeoffs every day.
      - only-one1701 1y ago
        I’m suggesting that a $5 purchase abs a critical government agency’s infosec are different considerations.
sanderjd 1y ago
Thing is: Everything they're doing is against the rules. Except they aren't "rules", they are laws.

plandis 1y ago

I can’t think of any. Even if you wanted to give someone broad permissions to access and modify data, you wouldn't turn off the audit logs.

1oooqooq 1y ago

very clear admission of guilt.

mfer 1y ago

Setting aside legitimate (thats a matter of judgement)... Some previous attempts for DOGE to get data has resulted in data being deleted before they can look and requests for judges to block access to data. DOGE may be trying to be covert in order to stop these two activities from happening before they can get and review the data.

throwworhtthrow 1y ago
> Setting aside legitimate (thats a matter of judgement) By definition, a judge decides what's legitimate. If DOGE expects their access to be blocked by a court judgement, and bum-rushes agencies to exfiltrate data ahead of the judgement, that's also criminal intent. I am not sure what you are getting at. "Covert" isn't how I'd describe DOGE's actions. "Brazen" maybe?
- mfer 1y ago
  People have admitted in news interviews to destroying government data to prevent others from knowing what the government was doing. That’s likely criminal. This is a legitimate reason to get at information before people who might destroy have the opportunity. What’s happening with judges is very political. We likely won’t know what’s allowed until things have gone through the appeals process. There have been cases of judges admitting they will rule against the current administration no matter the topic or law. This is messy, to say the least.
  - LiquidSky 1y ago
    >People have admitted in news interviews to destroying government data to prevent others from knowing what the government was doing. That’s likely criminal. This is a legitimate reason to get at information before people who might destroy have the opportunity. Yes, this is precisely the accusation being made against DOGE: they are the government actors criminally trying to to prevent the public from knowing what they're doing. >There have been cases of judges admitting they will rule against the current administration no matter the topic or law. No, there haven't, but feel free to provide a source.

rtkwe 1y ago

Even worse when you know more of the whistleblower's story which is that ~15 minutes after one of DOGE's accounts were made there was an attempted login with the correct password from Russia. Not many explanations for that that look good for DOGE...

stephenitis 1y ago
Citation?
- gnabgib 1y ago
  From the whistle blower. > Within minutes after DOGE accessed the NLRB's systems, someone with an IP address in Russia started trying to log in, according to Berulis' disclosure. https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...
- orochimaaru 1y ago
  Not parent but it’s here - https://krebsonsecurity.com/2025/04/whistleblower-doge-siphoned-nlrb-case-data/ https://krebsonsecurity.com/2025/04/whistleblower-doge-sipho... DOGE is a complete clusterfuck. Fwiw I think there is hard to spot fraud in the govt that should be looked at (eg price inflation at the pentagon, VA, Medicaid/Medicare, SS). They should have done the hard work of uncovering that. Instead they just went for clickbait headlines.
  - mmooss 1y ago
    > DOGE is a complete clusterfuck. It depends what the objectives are. My impression is that they have been very successful pursuing their actual objectives, while providing a cover story of a 'clusterfuck'.
    - rtkwe 1y ago
      And conveniently gutting agencies that are or were soon to be thorns in Elon's side. FAA and EPA were annoying him around SpaceX's Starship test launches, CFPB would be annoying for his future everything app plans for Twitter, etc.

api 1y ago

To allow dodgy offshore actors to snarf huge amounts of data on US citizens to prepare a huge propaganda assault for the next election?

largbae 1y ago

I am sure they demanded maximum access, but the logging activity phrasing sounds a little bit like spin... I think if I wanted to describe an account with access to perform "sudo -s" as negatively as possible, I would say "an all-powerful admin account that is exempt from logging activity that would otherwise keep a detailed record of all actions taken by those accounts."

tootie 1y ago

Interview with whistleblower detailing the attack and the threats directed against him: https://www.pbs.org/newshour/show/nlrb-whistleblower-claims-musks-doge-potentially-caused-significant-security-breach https://www.pbs.org/newshour/show/nlrb-whistleblower-claims-...

cmurf 1y ago
this guy's lawyer says: This is a difficult topic for Dan to discuss, but prior to our filing the whistle-blower disclosure this week, last week, somebody went to Dan's home and taped a threatening note, a menacing note on his door with personal information. ... While he was at work, and it also contained photographs of him walking his dog taken by a drone. This is mafia shit.
- Corrado 1y ago
  I just finished watching Daredevil: Born Again[0] and this incident looks shockingly familiar to what happened in the show. I don't know how the show runners knew this was going to happen but it feels like they've been spying on the future. Do they have a time machine or are they really that good (and the current administration that bad)? [0] https://www.imdb.com/title/tt18923754/ https://www.imdb.com/title/tt18923754/

jimt1234 1y ago

The Deep State! The government is filled with spies determined to "leak" the great work DOGE is doing is the press - so, of course, it needs "God mode" access. Totally legit. That's the best I could do. LOL

deleted 1y ago

[deleted]