All right, you can have one: DOGE access to Treasury IT OK'd judge

HELLFIRE

Usual preface, sharing strictly and solely from a security / privacy POV to the exclusion of anything else : https://www.theregister.com/2025/04/15/doge_access_to_treasury_systems/ – Login green-lit for lone staffer if he’s trained, papered up, won’t pull an Elez

A federal judge has partly lifted an injunction against Elon Musk’s Trump-blessed cost-trimming DOGE unit, allowing one staff member to access sensitive US Treasury payment systems. This access includes personally identifiable financial information tied to millions of Americans. Judge Jeanette Vargas, who issued a preliminary injunction [PDF] in February halting DOGE’s access to the Treasury’s Bureau of Fiscal Services (BFS) systems, reversed course late Friday in a New York City hearing — but only for one DOGE staffer. In her order [PDF], Vargas said Ryan Wunderly can be granted access provided he completes the required hands-on training and files a financial disclosure report. …

Creepy as well is the end piece :

Speaking of DOGE… A whistleblower claims that when DOGE aides showed up at the US employment watchdog – the National Labor Relations Board – there was a spike in data leaving the organization’s network. It is feared that information included sensitive records on unions, details of ongoing legal battles, and other secrets that shouldn’t leave the agency. A spinner for the watchdog denied it had granted DOGE access to its IT systems.

Take what you will of this, but I ask the replies be kept to the matter at hand.

Regards

Moderator’s Note: This topic stands as informational with comments disabled due to violations of community guidelines.

HELLFIRE

https://www.theregister.com/2025/04/17/whistleblower_nlrb_doge/ – Whistleblower describes DOGE IT dept rampage at America’s labor watchdog. Ignored infosec rules, exfiltrated data … then the mysterious login attempts from a Russian IP address began – claim

Democratic lawmakers are calling for an investigation after a tech staffer at the US National Labor Relations Board (NLRB) blew the whistle on the cost-trimming DOGE’s activities at the employment watchdog – which the staffer claims included being granted superuser status in contravention of standard operating procedures, exfiltrating data, and seemingly leaking credentials to someone with a Russian IP address. The claims above were made by Dan Berulis, an NLRB DevSecOps architect and client of nonprofit Whistleblower Aid, in a disclosure document [PDF] to Congress that details his observations of what apparently happened when DOGE arrived at the labor watchdog. According to Berulis’ disclosure, DOGE operatives arrived at the agency on March 3 in a black SUV that enjoyed a police escort. The same day, he claims, an agency assistant chief information officer (ACIO) told him that DOGE aides would be given accounts “with essentially unrestricted permission to read, copy, and alter data.” Creation of such accounts was not standard operating procedure, but the ACIO said those rules must be ignored and the opening of the accounts was not to be logged. Berulis’s document points out that not even his CIO enjoyed the level of access given to DOGE unit operatives, and that the NLRB already had auditor accounts set up that provided enough privileges to check data without being able to edit, copy, or remove it. The “suggestion that they use these accounts instead was not open to discussion,” he wrote. … Within days, Berulis says, he began to notice worrying signs, such as alerting and monitoring tools being switched off and changes to multi-factor authentication. He also observed “gigabytes” of data “exiting” a case management application called NxGen over the network, and claimed he later saw 10 GB of data exfiltrated from the agency. He described that latter exfiltration as a “similar spike” to the movement of data from the application and feels whatever happened was noteworthy as NLRB almost never moves information outside the org. … On March 11, while examining logs, Berulis says he noticed a huge spike in outside login attempts being blocked - in particular one with an IP address that has the Primorskiy Krai region in Russia’s Far East listed as its location. The person was trying to log into an account that had been set up for one of the DOGE aides, Berulis claimed. The login attempts started within 15 minutes of the account being established, and used the correct username and password, he told Congress. The login attempts were blocked because the agency does not allow access to its systems from overseas. … Updated to add on April 17 The spinners at the NLRB are trying to convince us DOGE only showed up this week, right as the whistleblower’s report went public, and not in early March as claimed. Regardless of when the cost-trimmers arrived, the board’s director of administration Lasharn Hamilton emailed staff to say the DOGE operatives went through security vetting, and are mostly working from home. …

Regards

Moderator’s Note: This topic stands as informational with comments disabled due to violations of community guidelines.