The Elon Musk–founded Department of Government Efficiency (DOGE) uploaded to an insecure Amazon Web Services server a copy of Americans’ Social Security data, risking the security of critical personal information for more than 300 million people, according to a protected whistleblower disclosure to the US Office of Special Counsel and congressional committees filed by the Government Accountability Project.
Whistleblower Charles Borges, who has served as the chief data officer at the Social Security Administration (SSA) since January, disclosed that DOGE created a live copy of the country’s Social Security information in a test cloud environment that circumvents oversight and potentially violates security protocols and federal privacy regulations.
Borges says the risky maneuver capped a turbulent period at SSA during which the DOGE workers progressed from emergency circumvention of court orders in March 2025 to full-blown systematic institutional approval of high-risk activities involving sensitive public data by July 2025.
“A way to view this is as an attack by an insider threat,” John Skiles Skinner, a former consulting engineer and project leader at 18F, a prestigious and influential US government digital services agency that DOGE eliminated in March 2025, tells CSO. “There is a group of people, apparently handpicked by Elon Musk, who want to manipulate government data in some way, and they put themselves in positions of power and signed blank checks to themselves to move that data around however they want.”
What has yet to be determined, however, is whether the DOGE workers violated several US laws by abandoning security protocols and why they engaged in what Borges says are highly risky and unsafe data management practices.
What did the DOGE workers do?
Borges’s complaint identifies four DOGE personnel as the culprits behind this move, including Edward Coristine, nicknamed “Big Balls,” a 19-year-old DOGE programmer who became a full-time government employee in May, landing at the SSA in June; Aram Moghaddassi, who worked for DOGE at the Department of Labor and became CIO of SSA in June; John Solly, described as a DOGE-aligned hire, reportedly joined the SSA in March 2025 in the office of the CIO; and Michael Russo, who served as CIO of the SSA from February 2025 until late March 2025, when he was replaced by Scott Coulter and transitioned to a special advisor role in the SSA focused on “modernizing its archaic technology.”
Coristine and Moghaddassi interned or worked for Musk before joining the government, while Russo was an executive at a tech company that does payment processing for Musk’s Starlink.
According to the complaint, under the authority of Moghaddassi, the DOGE workers created a copy of the country’s Social Security information by uploading a live production copy of the Numerical Identification System (NUMIDENT) database to an Amazon test cloud environment outside mandated security protocols, making it impossible for the federal government to track who has accessed or who is accessing the data.
The NUMIDENT database contains all data submitted in an application for a United States Social Security card, including the name of the applicant, place and date of birth, citizenship, race and ethnicity, parents’ names and Social Security numbers, phone number, address, and other personal information.
Borges says in the complaint that on June 12, 2025, a career official in the Office of the Chief Information Officer (OCIO) shared a formal “Risk Acceptance Request Form” with Moghaddassi and an SSA career executive apparently responding to a June 10-11 request to have administrative access to “their own Virtual Private Cloud (VPC, ‘cloud’) within the SSA Amazon Web Services — Agency Cloud Infrastructure (AWS-ACI).” The risk assessment characterized the DOGE move as “high risk.”
Nonetheless, DOGE workers were granted administrative access to the cloud, after which Borges contends that the Office of Information Security (OIS) said it was impermissible to move NUMIDENT production data to the test environment. But on June 25, CIO officials obtained from Michael Russo authorization for John Solly to upload NUMIDENT production data to DOGE’s test cloud environment, which lacked independent security controls and bypassed security protocols.
On July 25, Moghaddassi authorized a “Provisional Authorization to Operate” apparently for the NUMIDENT cloud project, stating, “I have determined the business need is higher than the security risk associated with this implementation and I accept all risks associated with this implementation and operation.”
After that, Borges said he repeatedly raised internally his concerns over the security of the data, futilely contacting Coristine, Solly, and Mickie Tyquiengco, executive officer in the OICO Front Office, to request information about his security concerns. Based on the non-responsiveness of the principals involved, Borges argues that “the creation of the DOGE-specific, self-administered cloud environment lacking independent security controls and hosting a copy of NUMIDENT constitutes an abuse of authority, gross mismanagement, substantial and specific threat to public health and safety, and potentially violation of law, rule, or regulation.”
Did the DOGE workers violate the law?
Under the Federal Information Security Management Act (FISMA), all information systems operated by or on behalf of the US federal government must obtain an authorization to operate (ATO). The purpose of an ATO is to minimize the security risks to which those systems might be exposed.
Complying with the ATO under FISMA requires the completion of five steps: analyzing the impact a disaster or attack on the data would have on the public and agency; developing a system security and privacy plan; inviting experts to assess and verify the plan; signing off on the plan by the authorizing official, information security officer, and system owner; and developing a plan for ongoing monitoring.
To get a government official, such as a CIO or CISO, to sign off on an ATO under FISMA, government systems must meet a list of security controls contained in a publication by the National Institute of Standards and Technology, NIST SP 800-53. FISMA mandates that federal agencies implement NIST’s guidelines, making compliance with NIST SP 800-53 mandatory for obtaining an ATO.
According to Skinner, an ATO is an essential security mechanism for government computer systems. “Moving data out of this system’s ATO means that DOGE moved Americans’ personal data outside of government security controls, beyond the ability of government security experts to track if the data is being leaked,” he tells CSO. “Someone could steal this data, and we might never know it.”
Skinner adds: “When SSA employees resisted DOGE’s attempt to move data outside the ATO, DOGE wrote itself a Provisional ATO, which is a real thing but not a blank check to circumvent the security rules, avoid oversight, and expose Americans’ personal data. DOGE treated it as a blank check.”
The complaint alleges that the lack of proper documentation of controls likely violates FISMA by placing a high-value asset containing data on over 450 million Americans and eligible noncitizens, in an uncontrolled environment. It also alleges that the Provisional ATO violates the Privacy Act of 1974, “which requires agencies to maintain personal information with accuracy, relevance, timeliness, and completeness as necessary to assure fairness in determinations about individuals. Placing production NUMIDENT data in cloud environments without independent security controls violates these maintenance requirements.”
Finally, the complaint argues that what DOGE did violates the Computer Fraud and Abuse Act by facilitating unauthorized access to protected computer systems.
Why did DOGE do this?
Moghaddassi’s stated rationale that the “business need is higher than the security risk” and an earlier statement by Solly that the data move was necessary to improve the way that SSA exchanges data provide little insight into what exactly DOGE intends to do with the data.
It’s possible that the DOGE team decided to move the NUMIDENT database to better comply with a March executive order issued by Trump, entitled “Stopping Waste, Fraud, and Abuse by Eliminating Information Silos,” which directed agencies to rescind or modify all guidance that serves as a barrier to the inter- or intra-agency sharing of unclassified information and give the DOGE team and other federal officials access to all unclassified records, data, software systems, and information technology systems across all federal civilian agencies.
Data analysis and technology firm Palantir is reportedly helping the Trump administration compile a master list of personal information on Americans to achieve this anti-silo initiative, which is contingent on SSA and IRS data.
It’s also conceivable that the DOGE team was seeking to further the development of a master database at DHS to track and surveil undocumented immigrants, which is mainly dependent on access to the SSA database. A host of other Trump-DOGE initiatives, including a plan to push AI technologies throughout the federal government, might also be a motivating factor for DOGE to move SSA and other government systems data away from systems not governed by security protocols.
Whatever the motivation, DOGE may have engaged in similar actions across the federal government where the loosely defined initiative has housed its workers, including the General Services Administration, the Veterans Administration, the Department of Health and Human Services, the Internal Revenue Service, and more.
The revelation that DOGE has violated security protocols at the SSA “is probably more of a tip of the iceberg situation,” Skinner speculates. “I am guessing that this is what they are doing everywhere. It seems like they’re going around and cracking open the security at those agencies and taking the data and moving it away from someplace where security experts within the government can see what they’re doing with it.”
No Responses