5 ms·
DOGE Put Critical Social Security Data at Risk, Whistle-Blower Says
- jbegley 1y agohttps://archive.ph/D3vJ0 https://archive.ph/D3vJ0
- dang 1y agoThere's also https://techcrunch.com/2025/08/26/doge-uploaded-live-copy-of-social-security-database-to-vulnerable-cloud-server-says-whistleblower/ https://techcrunch.com/2025/08/26/doge-uploaded-live-copy-of... (via https://news.ycombinator.com/item?id=45030836 https://news.ycombinator.com/item?id=45030836 but we merged that thread hither)
- duxup 1y ago>Mr. Borges said DOGE members copied the data to an internal agency server that only DOGE could access, forgoing the type of “independent security monitoring” normally required under agency policy for such sensitive data and creating “enormous vulnerabilities.” The fact that the courts (largely SCOTUS) has allowed this whole mess to go on is bonkers. These are potentially terrible results for citizens by an organization that continuously has shown no care for the rights of citizens ... and yet is given a free hand to do what it wants. There's no negative impact to saying "no you can't do the thing until you get your security shit together".
- Eddy_Viscosity2 1y agoThe negative impact would be that they couldn't do the very shadey things with the data that the intended from the onset had they had to subject to basically any security oversight.
- thinkingtoilet 1y ago[flagged]
- shadowgovt 1y agoUnfortunately, the courts can largely only address harm. If someone's data actually gets stolen, or if a specific law is broken, the courts are the government arm to address it. Avoiding ending up in court is the purpose of agency policy, and... gestures widely at the current state of the United States Executive regarding policy adherence.
- Eddy_Viscosity2 1y agoIt is absolutely the case that courts can address potential harm before it occurs. There have been already many cases rising up where people sue to stop government actions because if taken, they would cause harm. But... the current SCOTUS is all onboard the dictator train (unitary executive theory) and have stayed lower court orders on the basis that the president would have irreparable harm if orders, even unconstitutional ones, are not carried out immediately.
- shadowgovt 1y agoCan you give an example of the kind of prior restraint you're thinking of? What you're describing is an injunction, and in general, courts are loathe to hand them out (this one notwithstanding). It happens, but the bar is generally extremely high. Even prior to Trump, I wouldn't expect one for this category of executive operation for the same reason that I wouldn't expect one if someone complained that the government was physically transferring PII in an agent's car instead of a Brinks truck.
- Eddy_Viscosity2 1y agoBirthright citizenship was one. An injunction was granted, then stayed by SCOTUS. It was only when a new class action lawsuit was filed that kept it going. Another is the NIH funding, where lower courts agreed and SCOTUS over-turned. https://www.npr.org/2025/08/21/g-s1-84441/supreme-court-nih-grants https://www.npr.org/2025/08/21/g-s1-84441/supreme-court-nih-...
- shadowgovt 1y ago
- kjksf 1y agoIt could be because the role of courts is to interpret the laws enacted by congress. To my knowledge there is no law enacted by congress that dictates how SSN data is stored. Congress created the social security apparatus but day to day operations of said apparatus are in executive branch and executive branch ultimately carries the wishes of the president. So if president directs part of executive branch (DOGE) to audit another part of executive branch (social security) it's legal and works exactly as the constitution prescribed.
- duxup 1y agoThe departments of government do have laws on how they handle data and handing it to another organization with no rules clearly would violate those laws.
- thesuperbigfrog 1y ago>> To my knowledge there is no law enacted by congress that dictates how SSN data is stored. Like the Privacy Act of 1974? "The Privacy Act prohibits the disclosure of information from a system of records absent of the written consent of the subject individual, unless the disclosure is pursuant to one of twelve statutory exceptions." https://en.wikipedia.org/wiki/Privacy_Act_of_1974 https://en.wikipedia.org/wiki/Privacy_Act_of_1974 https://www.justice.gov/opcl/privacy-act-1974 https://www.justice.gov/opcl/privacy-act-1974 Federal agencies are subject to this law and these actions are violations of the law: https://en.wikipedia.org/wiki/Privacy_Act_of_1974#Under_the_second_Trump_administration https://en.wikipedia.org/wiki/Privacy_Act_of_1974#Under_the_...
- megaloblasto 1y agoSort of off topic but this reminds me of a Hunter S Thompson quote I read yesterday about the Nixon administration "Meanwhile, the Vice president of the United States has been lashed out of office and disbarred in his home state of Maryland, the president himself is teetering on the bring of a Burglary/Conspiracy indictment that will mean certain impeachment, and the whole structure of our government has become a stagnant mockery of itself and everybody who ever had faith in it"
- SV_BubbleTime 1y ago[flagged]
- ZYbCRq22HbJ2y7 1y ago> The more you read about Nixon, the more it seems like the popular narrative is likely less right than the CIA ousted a sitting president to install their guy. Such as? IMO, the more you allude to spooky things without adding substantive information, the more you sound like a loon.
- duxup 1y agoWhat makes it seem more likely the CIA did the thing? The traditional history seems pretty plausible to me.
- bronson 1y agoAnd you're saying that their guy was Ford? Or Carter? That's what the CIA wanted? You're going to have to explain more.
- xrd 1y agoThis seems to point to collusion between Nixon and CIA for a lot of criminality. Or, is this inaccurate history? https://www.thehistoryreader.com/military-history/nixons-bay-pigs-secrets/ https://www.thehistoryreader.com/military-history/nixons-bay... If you are saying Nixon was a victim of CIA troublemaking, then you should point out which faction of the CIA you mean.
- adamsb6 1y agoYou should assume that the identifying details in this database are already leaked. The Equifax breach in 2017 exposed about half of all Americans. The National Public Data breach last year included 272 million Social Security numbers. You can get an inconvenient approximation of challenge/response by freezing your reports with the bureaus and only unfreezing them briefly when applying for new credit.
- bananapub 1y agoah, classic HN, flagged already! some psychopaths stole a lot of personal data from the US federal government, and we don't know who took it, what they took, what they did with it, or why. but don't worry, that's Politics, and so we should just ignore the crimes being done in public and talk about how we can enrich the technofascists who might give you some equity if you work hard.
- amarcheschi 1y agojust following orders (from hn guidelines) /s
- Molitor5901 1y agoWell it's a good thing the risk was identified and mitigated.
- sega_sai 1y ago[flagged]
- 833 1y ago"Borges warned in the complaint that if this information were compromised, “it is possible that the sensitive [personally identifiable information] on every American including health diagnoses, income levels and banking information, family relationships, and personal biographic data could be exposed publicly, and shared widely.”" Yeah, but this is always true. And it didn't happen.
- cjbenedikt 1y ago"Yeah, but this is always true. And it didn't happen." Yet!
- deleted 1y ago[deleted]
- daveguy 1y agoI'd rather a bunch of move fast and break things short-sighted dipshits didn't make the risk higher, but here we are.
- tombert 1y agoI hate that the Move Fast And Break Shit motto is so demonized now. I think if what you’re working on is very low stakes, e.g. the initial versions of Facebook, or an AI music generator app, and maybe even marketing, it’s not unreasonable to try and move really quickly because the likelihood of real damage is pretty low. Of course when you’re dealing with money or social security data or medical stuff, it’s different; that stuff is very much “move slow and don’t break anything!”
- daveguy 1y agoTo be fair. "Move Fast and Break Shit" was a garbage motto to begin with. Maybe better to be at least slow enough to realize the consequences of a broken app. If you're moving too fast and breaking too much shit, you won't know you have a suicide-assitance app until it's too late. So, it was a garbage motto to begin with and it's about time it's been taken down a notch, in my opinion. How about move fast and test/verify/validate shit instead? That way the entrepreneurs don't have to go full sociopath.
- standardUser 1y agoWe have every reason to believe Musk and his young sidekicks stole every bit of government data they had access to, which in the end was most of it. So while I'm sure they also opened up some security loopholes during their whirlwind tour of firing people so they could be rehired (efficiency!), I'm more concerned with the longer term threat that data represents in the hands of someone with the resources and inclination to use it against us.
- nxobject 1y agoExhibit B: whistleblower evidence that NLRB data was exfiltrated, and that CISA quashed any investigation. https://federalnewsnetwork.com/workforce-rightsgovernance/2025/05/nlrb-whistleblower-encourages-federal-workers-to-speak-up/ https://federalnewsnetwork.com/workforce-rightsgovernance/20...
- esseph 1y agoMost of the CISA leadership was gutted / left. :(
- tombert 1y agoTrump already bragged about manipulating the market to enrich billionaires: https://www.independent.co.uk/news/world/americas/us-politics/trump-billionaire-profits-dropped-tariffs-b2731386.html# https://www.independent.co.uk/news/world/americas/us-politic... It’s not weird to think that maybe his new gestapo would be doing that too.
- deleted 1y ago[deleted]
- rideontime 1y agoOf course they did. What more could we expect from this team of cracked vibe coders anymore, after everything we've already learned?
- lawlessone 1y agonot just vibe coders, didn't some of these kids he hired have actual histories and alleged histories of cybercrimes?
- rideontime 1y agoBig Balls himself, star of the 2025 Reichstag Fire, yep. https://krebsonsecurity.com/2025/02/teen-on-musks-doge-team-graduated-from-the-com/ https://krebsonsecurity.com/2025/02/teen-on-musks-doge-team-...
- jmye 1y agoYup, a guy who’s ketamined his brain cells to mush, leading a bunch of sociopathic criminals. Who, except literally everyone, could’ve seen this ending poorly?!
- oulipo2 1y ago[flagged]
- biophysboy 1y agoIt blows my mind that DOGE continues to brag about their “savings” using the most naive version of contract accounting (add up all the ceiling values, ignore money already spent or money that won’t be spent)
- daveguy 1y agoThat's because it's not an effort to get rid of waste, fraud, and abuse. It's a scam to steal data and give Republicans something to say.
- jmye 1y agoI mean, it’s also because rubes will buy anything they say solely because of one of the two guys saying it. It’s easy to tell a dumb lie when you know your fanbase won’t care and will repeat it as if it’s true.
- Cthulhu_ 1y agoIt blows my mind people still believe this "doge" is about saving money, while the US government is leaking money left right and center in plain daylight. It's a diversion.
- nxobject 1y agoSSA's CIO "accepts all risks" - but what does that actually mean in practice? Is he going to be held accountable? > The agency’s chief information officer Aram Moghaddassi approved the move to copy the database to the agency’s cloud, saying he “determined the business need is higher than the security risk” and that he accepts “all risks” with the project.
- hbrav 1y agoThis is one of my pet peeves: people saying they accept risk/responsibility that they don't have the ability to accept. It's like co-signing a $1M loan when you only have $100 to your name.
- lesuorac 1y agoMore like writing Mickey Mouse as the co-signer. They made no effect to ensure security and will do so again.
- mannyv 1y agoDid they upload it to aws govcloud? It sounds more like the CDO is butthurt that he's being ignored. Note that his claim says they uploaded it into an agency controlled aws environment that apparently lacking in independent security controls. So he's saying his agency runs insecure cloud servers?
- gibbitz 1y agoMAGA never ceases to amaze me on how they can create a problem from hosting an email server in your basement or create a conspiracy theory about pedophilia on the other side of the aisle, but when it comes to data they use the public cloud or services and when it comes to pedophilia they hide the records that prove the president is. Why are Americans accepting this?
- floppiplopp 1y agoPut at risk, or willfully given to their masters? All the ghouls suckling Yarvin's teats like Thiel want their tech driven tyranny, and SS data will help them on their way.
- bigbacaloa 1y ago[dead]
- aredox 1y agoWho can prove to me that Elon Musk himself doesn't have a copy on a USB key/drive somewhere? This whole DOGE business has been an unmitigated failure. The savings are far, far, far from the claimed numbers. https://www.politico.com/news/2025/08/12/trump-doge-contract-claims-savings-inflation-00498178 https://www.politico.com/news/2025/08/12/trump-doge-contract... Note the above story has already been submitted to HN - and flagged. Clearly there is a cabal of Musk/MAGA supporters gaming HN moderation to make sure a story from a reputable outlet, doing appropriate investigation and data analysis, about a tech/IT organization, claiming to do revolutionary improvements to the tune of billions of $, led by an "innovator" who might be the poster child of "hackers" and "startup founders" and whose interviews have been on HN front page repeatedly, is buried. If the Therac-25 accident happened today and Musk was involved, would HN as it is now allow people to read and learn about it?
- Drunkfoowl 1y ago[dead]