Federal agencies leave questions unanswered about DOGE access to sensitive data
Laine Bergeson20 minutes ago.
Misc Emerging Topics
Federal agencies did not provide enough information to determine whether Department of Government Efficiency (DOGE) teams adequately protected sensitive government data when accessing agency systems as directed by an executive order, according to a new report from the Government Accountability Office (GAO).
GAO reviewed the scope of DOGE access at six government agencies but could not fully verify whether security safeguards were followed. The systems accessed by DOGE were used to manage contacts, finances, grants, and contracts, and they contained private and sensitive data, including personally identifiable information.
“The breadth of this access has led to concerns by members of Congress and others that agency systems and their sensitive information and data may have been vulnerable to unauthorized disclosure or modification,” notes the report.
In response to GAO’s requests for information, the reviewed agencies supplied incomplete documentation or did not respond.
President Donald Trump issued the executive order on January 20, 2025, with the stated goal of modernizing federal technology and improving government efficiency.
Scope of DOGE access remains unclear
The GAO audit ran from March 2025 through September 2026 and included the Departments of Education (Education) and Veterans Affairs (VA), the Consumer Financial Protection Bureau (CFPB), National Oceanic and Atmospheric Administration (NOAA), Securities and Exchange Commission (SEC), and Small Business Administration (SBA).Four agencies—CFPB, Education, NOAA, and SEC—reported giving DOGE teams access to more than 23 systems used for human resources, finances, grants, and contract management. Some of these systems contained personally identifiable information.
The permissions granted to DOGE team members varied. CFPB reported that one DOGE team member was given access to eight internal systems. This person was allowed to view, modify, and delete data in its primary human resources system. Two of six DOGE members were granted access to the information technology (IT) systems and network at Education, but GAO could not confirm the extent and level of their access.
GAO was unable to identify the systems DOGE teams had access to at the SBA or VA.
Three of the six agencies (CFPB, Education, and SEC) provided limited documentation about the extent to which DOGE team members followed IT security rules. CFPB and SEC reported that there had not been any privacy incidents pertaining to DOGE access but didn’t tell GAO how they identified IT security compliance.
“Consequently, Congress and the public lack information needed to confirm if DOGE team members followed the IT rules of behavior they agreed to at these agencies,” notes the report.
Agencies resist requests, dispute GAO authority
The agencies offered different reasons for withholding information. CFPB asserted that the requested information was redundant and unnecessary and that providing it would unnecessarily disrupt bureau operations.Education cited ongoing litigation and concerns about disclosing DOGE personnel’s confidentiality. NOAA and SEC challenged GAO’s authority to conduct the review. The VA stated that it would not address the requests nor provide a reason for not doing so.
GAO maintains it “has ample statutory authority to conduct audit work” and access the requested records.