5 ms·

This is much ado about nothing. The article tries to very hard to make something ordinary sound nefarious. This appears to be DOGE employees simply doing their

This is much ado about nothing. The article tries to very hard to make something ordinary sound nefarious. This appears to be DOGE employees simply doing their job. You may not agree with what they’re doing in a political sense, but if you were tasked with the same problem you’d come up with a nearly identical solution. For example: “tenant admin” is probably the special role that can bypass access control (not audits!) and see and read all data. This sounds scary but I regularly request this right from large government departments and I get it granted to me. Its use is justified when normal access requests would be too complex / fiddly and error prone. Generally, in a large environment, there is no other way to guarantee 100% coverage because as an outsider you don’t even know what permissions to ask for if you can’t see anything due to a lack of permissions! Seriously: sit down for a second and think about how you would go about getting access to make a full copy of an organisation’s data for an audit if you fully expect both passive resistance and even active efforts to hide the very things you’re looking for.

dboreham 2y ago
Absolute balderdash.
watwut 2y ago
In that case, you and departments you work for are either breaking the law regularly or working with public data anyway. Besides, no one needs unmonitored write access for audit. Even less DOGE who does no audit and don't have knowledge how to do audit. Audits are supposed to he traceable.
- sremani 2y ago
  [flagged]
  - paulryanrogers 2y ago
    Whistleblowers are protected by law. If their data is being exfiltrated then they may become targets of harassment.
    - sremani 2y ago
      So this is speculation that laws "may" be broken but nothing beyond that. Might be harassed. Even by HN standards this daily Elon burning rituals are a new low.
- jiggawatts 2y ago
  No one needs write access, but most systems only have a read/write predefined role for tenant-wide access. If you don’t trust the department staff to give you anything but a predefined role, it’s typically the only option. Similarly if you need to fire privileged IT staff on the spot for headcount reduction you need admin-equivalent rights to lock them out. You can’t in general trust disgruntled admins to lock themselves out! Also, in some cloud systems full read access can give you direct or indirect access to service keys / API keys which then are write equivalent permissions anyway.
  - watwut 2y ago
    > If you don’t trust the department staff I find the argument the most absurd in relation to DOGE. There is no reason to give them more trust then to anyone else in goverment ... and multiple reasons to trust them less. Starting from personal histories of some of them and how they were selected. As such, this "I dont trust" is just reflection of their incompetence, arrogance and a lazy excuse.
apical_dendrite 2y ago
Do you also delete logs, fire the cybersecurity team, and stonewall breach investigations? https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...
rob_c 2y ago
Omg they also saw spikes in DNS traffic and high load during days exfiltration ahead of audit... Clearly the (system) auditing infrastructure wasn't robust enough to still provide a lot of monitoring even in the service is being managed by someone else... Also a several hundred line teardown of a 300line file is exactly what is wrong with some coders. Not having a CI/CL for every single short tool written once to do a job is called being productive...
shakna 2y ago
> Furthermore, on Monday, April 7, 2025, while my client and my team were preparing this disclosure, someone physically taped a threatening note to Mr. Berulis’ home door with photographs – taken via a drone – of him walking in his neighborhood. The threatening note made clear reference to this very disclosure he was preparing for you
- frumplestlatz 2y ago
  It would be astonishingly stupid to threaten a whistleblower in such an amateurish manner when you’re backed by the party in power and have the full and official apparatus of the state at your disposal.
  - bdangubic 2y ago
    astonishingly stupid sounds about right for the people leading apparatus of the state :)
    - frumplestlatz 2y ago
      What could they possibly hope to accomplish with a threatening note and drone photos other than to provide fodder for his complaint? Why would drone photos even be necessary when you’ve already demonstrated that you know where they live? What possible purpose does such a threat serve?
      - bronson 2y ago
        To intimidate. To scare into silence.
        frumplestlatz 2y ago
        Except that all you’d be doing is creating a trail of physical evidence demonstrating a felony conspiracy — and a frankly stupid one at that.
dekhn 2y ago
I don't believe your statement that you ask for, and successfully receive, tenant admin rights from large government departments. DOGE employees aren't simply doing their job. They are actively subverting the government to fatally wound it.
Delk 2y ago
The original complaint mentions: "7. March 3rd - I received a call during which an ACIO stated instructions were given that we were not to adhere to SOP with the doge account creation in regards to creating records. He specifically was told that there were to be no logs or records made of the accounts created for DOGE employees." Which part of doing an audit, or some other DOGE employee's job, requires logs or records not to be made of their accounts? Another quote: "They were to be given what are referred to as “tenant owner” level accounts, with essentially unrestricted permission to read, copy, and alter data. Note, these permissions are above even my CIO’s access level to our systems. Well above what level of access is required to pull metrics, efficiency reports, and any other details that would be needed to assess utilization or usage of systems in our agency. We have built in roles that auditors can use and have used extensively in the past but would not give the ability to make changes or access subsystems without approval. The suggestion that they use these accounts instead was not open to discussion." Audits don't require being able to alter data. Also, some of the data is mentioned as being sensitive. Although granting access to the data of another agency may make sense, I have trouble believing that direct access to data such as sensitive personal information of third parties would routinely be given to people from outside of the organization. Even within the organization the group of people given access to sensitive data should be as limited as possible.
- jiggawatts 2y ago
  [flagged]
  - thrwaway438 2y ago
    Your argument makes sense. I still speculate they're doing malicious things.
    - jiggawatts 2y ago
      DOGE was given a mandate by a President with unprecedented (hah) unitary power. They’re executing on that, roughly how you’d expect them to, given their instructions and the time and resources available to them. I personally feel that they’re being reckless and sloppy, uncovering “waste” that is often simply an artefact of their hubris. In doing so, they’re risking exposing the internal systems of the government to outside attack. This is the rough equivalent of the guards in a prison turning over everything in a cell looking for contraband. It’s not nice. It’s rarely productive. It is also a tool of intimidation. That’s part of the point. The prisoner is not supposed to like it. They’re not invited politely to present what they want others to see. They’re humiliated and powerless. That’s what the MAGA and DOGE want.
xorcist 2y ago
I have taken part in audits for several organizations over the years, and I can assure you that's not how audits are done at all. In fact, should the auditor find there is a way for them to access sensitive data without it being logged, they will flag it immediately. That would be the case even under simple financial regulation. There is absolutely the risk that the people you audit will lie to you or present you with false data. In practice that's not common, because they stand to at the very least lose their jobs. It could also be illegal. Not worth it.
- jiggawatts 2y ago
  A normal audit, sure. This isn’t that. This is the prison guards flipping the mattress looking for contraband. All of the public complaining is by staff that don’t understand their new position in the pecking order. There is a King in charge and he cares not for the wailing of the petty nobles.
  - watwut 2y ago
    >This is the prison guards flipping the mattress looking for contraband. No its not. These prison searches in fact do tend to find knives and what not and do in fact have some role in managing prison violence. This is not about anything like that at all.
    - jiggawatts 2y ago
      It’s an analogy about established civilised audit procedure versus whatever DOGE is doing, which is… not that. It’s not about literal shivs. Speaking of finding things under the mattress, they did find corruption and waste, which they feel justifies their approach. In my opinion the tiny amount of “waste” they uncovered is arguably not worth the damage and risk done, but that’s my opinion, not theirs. Again: the damage and humiliation is part of their agenda. They feel that departments are “disloyal” to the King… err… President and hence ill treatment is not only justified but warranted.
      - 2y ago
fzeroracer 2y ago
> This sounds scary but I regularly request this right from large government departments and I get it granted to me. Prove it. I want you to give examples of where you did something like this.
- jiggawatts 2y ago
  It’s not publicly provable for many obvious reasons such as the delegation being time bound.
  - fzeroracer 2y ago
    Anything is publicly provable. And I think you can publicly prove it too. As another poster put it, if that's how you've dealt with systems before then either you were working with publicly available data or you were party to a crime.

dboreham 2y ago

Absolute balderdash.

watwut 2y ago

In that case, you and departments you work for are either breaking the law regularly or working with public data anyway. Besides, no one needs unmonitored write access for audit. Even less DOGE who does no audit and don't have knowledge how to do audit. Audits are supposed to he traceable.

sremani 2y ago
[flagged]
- paulryanrogers 2y ago
  Whistleblowers are protected by law. If their data is being exfiltrated then they may become targets of harassment.
  - sremani 2y ago
    So this is speculation that laws "may" be broken but nothing beyond that. Might be harassed. Even by HN standards this daily Elon burning rituals are a new low.
jiggawatts 2y ago
No one needs write access, but most systems only have a read/write predefined role for tenant-wide access. If you don’t trust the department staff to give you anything but a predefined role, it’s typically the only option. Similarly if you need to fire privileged IT staff on the spot for headcount reduction you need admin-equivalent rights to lock them out. You can’t in general trust disgruntled admins to lock themselves out! Also, in some cloud systems full read access can give you direct or indirect access to service keys / API keys which then are write equivalent permissions anyway.
- watwut 2y ago
  > If you don’t trust the department staff I find the argument the most absurd in relation to DOGE. There is no reason to give them more trust then to anyone else in goverment ... and multiple reasons to trust them less. Starting from personal histories of some of them and how they were selected. As such, this "I dont trust" is just reflection of their incompetence, arrogance and a lazy excuse.

apical_dendrite 2y ago

Do you also delete logs, fire the cybersecurity team, and stonewall breach investigations? https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-...

rob_c 2y ago

Omg they also saw spikes in DNS traffic and high load during days exfiltration ahead of audit... Clearly the (system) auditing infrastructure wasn't robust enough to still provide a lot of monitoring even in the service is being managed by someone else... Also a several hundred line teardown of a 300line file is exactly what is wrong with some coders. Not having a CI/CL for every single short tool written once to do a job is called being productive...

shakna 2y ago

> Furthermore, on Monday, April 7, 2025, while my client and my team were preparing this disclosure, someone physically taped a threatening note to Mr. Berulis’ home door with photographs – taken via a drone – of him walking in his neighborhood. The threatening note made clear reference to this very disclosure he was preparing for you

frumplestlatz 2y ago
It would be astonishingly stupid to threaten a whistleblower in such an amateurish manner when you’re backed by the party in power and have the full and official apparatus of the state at your disposal.
- bdangubic 2y ago
  astonishingly stupid sounds about right for the people leading apparatus of the state :)
  - frumplestlatz 2y ago
    What could they possibly hope to accomplish with a threatening note and drone photos other than to provide fodder for his complaint? Why would drone photos even be necessary when you’ve already demonstrated that you know where they live? What possible purpose does such a threat serve?
    - bronson 2y ago
      To intimidate. To scare into silence.
      - frumplestlatz 2y ago
        Except that all you’d be doing is creating a trail of physical evidence demonstrating a felony conspiracy — and a frankly stupid one at that.

dekhn 2y ago

I don't believe your statement that you ask for, and successfully receive, tenant admin rights from large government departments. DOGE employees aren't simply doing their job. They are actively subverting the government to fatally wound it.

Delk 2y ago

The original complaint mentions: "7. March 3rd - I received a call during which an ACIO stated instructions were given that we were not to adhere to SOP with the doge account creation in regards to creating records. He specifically was told that there were to be no logs or records made of the accounts created for DOGE employees." Which part of doing an audit, or some other DOGE employee's job, requires logs or records not to be made of their accounts? Another quote: "They were to be given what are referred to as “tenant owner” level accounts, with essentially unrestricted permission to read, copy, and alter data. Note, these permissions are above even my CIO’s access level to our systems. Well above what level of access is required to pull metrics, efficiency reports, and any other details that would be needed to assess utilization or usage of systems in our agency. We have built in roles that auditors can use and have used extensively in the past but would not give the ability to make changes or access subsystems without approval. The suggestion that they use these accounts instead was not open to discussion." Audits don't require being able to alter data. Also, some of the data is mentioned as being sensitive. Although granting access to the data of another agency may make sense, I have trouble believing that direct access to data such as sensitive personal information of third parties would routinely be given to people from outside of the organization. Even within the organization the group of people given access to sensitive data should be as limited as possible.

jiggawatts 2y ago
[flagged]
- thrwaway438 2y ago
  Your argument makes sense. I still speculate they're doing malicious things.
  - jiggawatts 2y ago
    DOGE was given a mandate by a President with unprecedented (hah) unitary power. They’re executing on that, roughly how you’d expect them to, given their instructions and the time and resources available to them. I personally feel that they’re being reckless and sloppy, uncovering “waste” that is often simply an artefact of their hubris. In doing so, they’re risking exposing the internal systems of the government to outside attack. This is the rough equivalent of the guards in a prison turning over everything in a cell looking for contraband. It’s not nice. It’s rarely productive. It is also a tool of intimidation. That’s part of the point. The prisoner is not supposed to like it. They’re not invited politely to present what they want others to see. They’re humiliated and powerless. That’s what the MAGA and DOGE want.

xorcist 2y ago

I have taken part in audits for several organizations over the years, and I can assure you that's not how audits are done at all. In fact, should the auditor find there is a way for them to access sensitive data without it being logged, they will flag it immediately. That would be the case even under simple financial regulation. There is absolutely the risk that the people you audit will lie to you or present you with false data. In practice that's not common, because they stand to at the very least lose their jobs. It could also be illegal. Not worth it.

jiggawatts 2y ago
A normal audit, sure. This isn’t that. This is the prison guards flipping the mattress looking for contraband. All of the public complaining is by staff that don’t understand their new position in the pecking order. There is a King in charge and he cares not for the wailing of the petty nobles.
- watwut 2y ago
  >This is the prison guards flipping the mattress looking for contraband. No its not. These prison searches in fact do tend to find knives and what not and do in fact have some role in managing prison violence. This is not about anything like that at all.
  - jiggawatts 2y ago
    It’s an analogy about established civilised audit procedure versus whatever DOGE is doing, which is… not that. It’s not about literal shivs. Speaking of finding things under the mattress, they did find corruption and waste, which they feel justifies their approach. In my opinion the tiny amount of “waste” they uncovered is arguably not worth the damage and risk done, but that’s my opinion, not theirs. Again: the damage and humiliation is part of their agenda. They feel that departments are “disloyal” to the King… err… President and hence ill treatment is not only justified but warranted.
    - 2y ago

fzeroracer 2y ago

> This sounds scary but I regularly request this right from large government departments and I get it granted to me. Prove it. I want you to give examples of where you did something like this.

jiggawatts 2y ago
It’s not publicly provable for many obvious reasons such as the delegation being time bound.
- fzeroracer 2y ago
  Anything is publicly provable. And I think you can publicly prove it too. As another poster put it, if that's how you've dealt with systems before then either you were working with publicly available data or you were party to a crime.