Democracy • Privacy • Cybersecurity • Government Accountability
The Efficiency Team Got Access. The Public Still Cannot See the Security Receipt.
Federal DOGE teams received access to systems containing sensitive personal information. GAO asked six agencies to show what those teams could reach and what safeguards were in place. The answers were incomplete. That is not proof of a data breach. It is proof that Congress and the public still do not have the security receipt.
Seat Summary
- Seat Affected: People whose personal information is stored in federal systems
- Seat Status: Their data was placed within reach of government efficiency teams without a complete public or congressional record showing the access and safeguards
- Location: United States
- Theme: Government access, privacy, cybersecurity, oversight and public trust
Most people will never see the government systems that hold pieces of their lives.
They fill out a student-aid form. They apply for veterans’ benefits. They report income to a financial regulator. They submit employment records, banking information, a home address, a Social Security number or another personal detail because a government program requires it.
Then they trust the government to know who can see that information, what those people are allowed to do with it and whether anyone is checking.
On September 29, 2026, the Government Accountability Office reported that Congress and the public do not have that assurance for systems accessed by teams connected to the Department of Government Efficiency, commonly called DOGE.
GAO examined six agencies: the Consumer Financial Protection Bureau, Department of Education, National Oceanic and Atmospheric Administration, Securities and Exchange Commission, Small Business Administration and Department of Veterans Affairs.
Four of those agencies reported that their DOGE teams collectively had access to more than 23 information systems. Those systems handled contracts, grants, human resources and finances. Some contained personally identifiable information.
That finding does not mean DOGE employees stole, leaked, changed or misused anyone’s data. GAO did not report a breach. It also did not conclude that every person with access could see every record or perform every action.
The problem is more basic.
GAO could not determine the full extent of the access from the information the agencies provided.
That means the federal watchdog could not fully answer questions that should have had documented answers before access was granted: Which systems could each person enter? Could they only view information, or could they modify, download or delete it? Had everyone completed the required privacy and security training? Were background investigations complete? Were the agencies checking whether users followed their own rules?
The government had the key. It could not produce the complete sign-out sheet.
The access was part of the plan
The White House did not hide that DOGE would need broad access.
President Trump’s January 20, 2025 executive order reorganized the United States Digital Service as the United States DOGE Service and directed agencies to create DOGE teams. The order instructed agency heads to provide USDS with full and prompt access to unclassified agency records, software and information systems, to the maximum extent consistent with law. It also required USDS to follow rigorous data-protection standards.
Those two instructions belong together.
Access was not an accident. Protection was not optional.
The administration’s stated purpose was to modernize federal technology and improve efficiency. Later orders gave DOGE teams roles in workforce decisions and the review of government contracts, grants, payments and property.
There is a legitimate argument behind that work. Federal systems can be old, fragmented, expensive and difficult to manage. Waste should be identified. Payments should be reviewed. Technology should work better. The public benefits when government is efficient and accountable.
But accountability cannot apply only to the people whose spending or employment is being reviewed. It must also apply to the people doing the reviewing.
If an efficiency team receives broad access because its work is important, the record of that access becomes more important, not less.
What the agencies did and did not show
GAO’s findings were not the same at every agency.
The Consumer Financial Protection Bureau, Education Department, NOAA and SEC provided information about systems their DOGE teams could access. The Small Business Administration and VA did not provide GAO the requested system-access information.
The documentation about safeguards was also incomplete.
CFPB showed that six DOGE team members received a privacy briefing, but it documented completed security training for four. The Education Department provided signed system rules for five of six team members but did not provide the document for the sixth despite repeated requests. The SEC showed that one background check was underway and that another had been conducted in 2017, but it did not confirm whether the older investigation had been favorably completed.
NOAA, SBA and VA did not provide the requested information showing whether they implemented the controls needed to ensure their DOGE teams followed agency security rules.
Some of those missing records may exist. GAO did not say that a document it did not receive had never been created. Not provided is not the same as nonexistent. It is also not the same as proof that a control failed.
But when the government’s independent auditor asks for the evidence and cannot get it, the public is left with an assurance gap.
That gap matters because promises are not controls.
Saying that users must protect data is a rule. Showing who received access, completed training, passed the required checks and stayed within approved permissions is the receipt.
Who is missing?
The missing people are the millions whose information sits inside these systems.
They were not present when access decisions were made. They could not negotiate which employee saw which field. Most would not know if a new team received access, whether that access was temporary or whether it continued after a project ended.
The missing seat also belongs to Congress in its oversight role. GAO performs investigations so lawmakers can see whether executive agencies are following the law and protecting the public. GAO stated that it had statutory authority to obtain the requested information. The agencies’ incomplete responses prevented it from fully answering the questions Congress asked.
That is not a small paperwork dispute.
An oversight system works only when the overseer can inspect the evidence.
Who held power, who benefited and who carried the risk?
The President and agency heads held the authority to establish DOGE teams and provide system access. Agency officials controlled the access records, security documentation and responses supplied to GAO. DOGE team members received the practical power that comes with entering government systems.
The administration could benefit if broader access helped it identify waste, modernize technology or carry out its policy agenda more quickly. Agencies and taxpayers could also benefit from real improvements produced by that work.
The public carried the privacy and security risk.
That does not mean the risk became an injury. Risk and harm are not the same thing. But the people whose information was stored in those systems had no practical way to verify the safeguards for themselves. They depended on agencies to document the controls and on GAO and Congress to test them.
When agencies did not provide enough information for that test, the uncertainty did not disappear. It stayed with the public.
Why should an ordinary person care?
Because government databases are not abstract.
They can contain a person’s financial information, employment history, benefit records, contact details or other data that can cause real damage if it is exposed, altered or used outside its authorized purpose.
People are often told to protect their own information. Use a stronger password. Watch for scams. Do not click a suspicious link. Freeze your credit if something goes wrong.
Those precautions matter, but an individual cannot protect data after the government has collected it by auditing the government’s internal permissions from home.
That responsibility belongs to the institution.
The story also matters because “trust us” is not a security standard. The public does not need the names, passwords or operational details that would create new risks. It does need verifiable answers about whether access was approved, limited, monitored and removed when no longer necessary.
If those answers exist, agencies should be able to show them to the lawful overseer. If they do not exist, the controls were incomplete. If they exist but are withheld, oversight is incomplete.
Either way, the public still needs the receipt.
The fair counterargument
Agencies may have legitimate reasons to protect sensitive details about their systems and personnel. Publicly releasing technical access information could create security risks. Officials may also argue that DOGE teams needed fast access to perform a time-sensitive assignment and that ordinary government processes were too slow.
Those concerns deserve serious treatment.
But GAO was not asking agencies to post passwords or network maps on social media. It was conducting an authorized congressional review. Security concerns can justify careful handling, redaction or classified and controlled access where legally appropriate. They do not erase the need for independent verification.
Speed can explain why access was urgent. It cannot explain why the access record and safeguards should be impossible to audit afterward.
Pull Up a Chair
Congress should require each of the six agencies to produce a standardized access-and-controls ledger for GAO.
For every DOGE team member, the ledger should identify the systems accessed, the approved permission level, the date access began, the date it ended, required training, background-investigation status, supervisory approval and whether system logs were reviewed for unauthorized activity.
The public version should protect names and technical information where disclosure would create a real security risk. But it should still show totals, dates, categories of access, completed safeguards, exceptions and unresolved gaps.
The agencies should also explain every item they did not provide to GAO. Was the record never created? Was it created but unavailable? Was it withheld? Was another office responsible for it? Those are different facts and should not be collapsed into one blank space.
This is not a demand to assume a breach occurred.
It is a demand to stop treating the absence of proof as proof that everything was fine.
Government efficiency should leave a trail that another part of government can check. Otherwise, the team sent to demand receipts from everyone else becomes the one team that cannot produce its own.
Ally = Action. 🪑
Who is missing?
- People whose personal, employment, financial, education, benefit or other sensitive information was stored in the reviewed systems.
- Members of Congress trying to perform oversight through GAO.
- Federal employees and program users who need clear assurance that access was limited and monitored.
- The public, which was asked to trust protections that agencies did not completely document for the federal watchdog.
Power, benefit and burden check
- Who held power? The President, agency heads, officials controlling system permissions and records, and the DOGE personnel receiving access.
- Who was affected? People represented in federal data, agency employees, program users and Congress in its oversight role.
- Who benefited? The administration and agencies if the access produced faster reviews, savings or technology improvements. The public could also benefit from genuine efficiency.
- Who carried the burden? People whose data was exposed to an unverified level of access and the public left without complete assurance that controls were followed.
- Why should an ordinary person care? Individuals cannot independently audit government permissions. They depend on agencies to maintain records and lawful watchdogs to inspect them.
Action
Ask the House and Senate oversight committees for one concrete requirement: a public, agency-by-agency DOGE access-and-controls ledger that identifies the systems involved, permission categories, access dates, completed safeguards and unresolved documentation gaps without revealing passwords or exploitable technical details.
The committees can be located through Congress.gov: https://www.congress.gov/committees
Receipts
- U.S. Government Accountability Office, GAO-26-108192, September 29, 2026
https://www.gao.gov/products/gao-26-108192
Primary source for the six-agency review, the more than 23 systems, the sensitive information involved, incomplete documentation, agency responses and GAO’s conclusion that Congress and the public lacked assurance about the controls.
- Executive Order 14158, January 20, 2025
Establishes USDS and agency DOGE teams, directs full and prompt access to unclassified agency records and systems to the maximum extent consistent with law, and requires rigorous data-protection standards.
- DOGE Workforce Optimization Initiative, February 11, 2025
Documents the administration’s stated accountability purpose and DOGE team involvement in federal hiring and workforce decisions.
- DOGE Cost Efficiency Initiative, February 26, 2025
Documents DOGE team roles in reviewing contracts, grants, payments and property and the administration’s stated commitment to public accountability.
Verification and evidence notice
- Verified fact: Four reviewed agencies reported DOGE team access to more than 23 systems containing information used for contracts, grants, human resources and finances, including personally identifiable information.
- Verified fact: SBA and VA did not provide GAO the requested information identifying systems accessed by their DOGE teams.
- Verified fact: The documentation supplied about training, rules acknowledgments, background checks and other controls was incomplete at several agencies.
- Verified fact: GAO stated that the agencies’ incomplete responses left Congress and the public without assurance that required controls were implemented and followed.
- Not established: GAO did not find that DOGE personnel stole, leaked or deliberately misused data.
- Not established: A record not provided to GAO did not necessarily never exist.
- Inference: When an authorized auditor cannot verify permissions and controls, the public carries an unresolved assurance gap even without proof of a breach.
- Opinion: A government team empowered to demand receipts from other programs should be able to produce a complete security receipt for its own access.
Counterargument
System and personnel details can be sensitive, and public disclosure should not create a cybersecurity risk. DOGE teams may also have needed quick access to complete a fast-moving assignment. The answer is controlled oversight and a carefully redacted public ledger, not the elimination of oversight. GAO can review sensitive evidence without publishing credentials or exploitable system information. Urgency may justify speed, but it does not eliminate the need to document who received access and whether safeguards were followed.