DOGE Uploaded Americans’ Social Security Data to the Cloud

[wing2000]

What happens when 19 year olds are running the show...

The U.S. DOGE Service uploaded a copy of Americans’ Social Security data to the digital cloud, risking the security of critical personal information for more than 300 million people, a whistleblower in the agency alleged.

Chief Data Officer Charles Borges raised concerns that DOGE staffers bypassed safeguards, circumvented a court order and created a copy of the Social Security Administration’s entire collection of data on the U.S. public on the cloud. Borges said the SSA had no oversight of who had access to the file.

https://www.washingtonpost.com/politics/2025/08/26/social-security-data-cloud-whistleblower/

 

[ThatRobGuy]

Do you want the more basic explanation (that sounds alarming), or do you want the more technical "nitty gritty" explanation (that also sounds alarming lol)?

I'm well qualified to provide either.

 

[wing2000]

Do you want the more basic explanation (that sounds alarming), or do you want the more technical "nitty gritty" explanation (that also sounds alarming lol)?

I'm well qualified to provide either.

A single paragraph for each.....

Say, will DOGE be offering "credit monitoring" for everyone?

 

[ThatRobGuy]

A single paragraph for each.....

Say, will DOGE be offering "credit monitoring" for everyone?

Here's a non-paywall version (for those wanting to see the full WaPo article)

MSN

The more basic explanation is that everyone's stuff is already in "the cloud". The article's use of the phrasing "on a digital cloud" sounds like a person who perhaps is trying to toss around techy lingo, but perhaps doesn't understand the concept. Something being "on the cloud" doesn't mean that's it's just sitting in a publicly accessible file that anyone can go and easily download.
(and if you do business with any fortune 500 company, chances are your data is at the mercy of some IT employees who are between 19-22...some of which may not even be US citizens)




The more detailed explanation:
The "Cloud" merely refers to redundant geo-diversified servers (hosted by providers like Microsoft Azure or AWS) rather than hosting things in an "on-prem" environment. If I were to spin up a new vanilla server instance on Azure... short of creating it with an extremely easy username and password to guess and intentionally trying to leak access to it, it's very well protected even with just picking mostly default settings. (It's already behind a firewall, encryption is standard, and network isolation and MFA is already baked in)

"Cloud" ≠ "wide open to the internet, just go to this URL and download a spreadsheet"

They note that there's no evidence of a breach (which isn't surprising, because if someone figured out a way to hack Azure or AWS at the platform level and access everyone else's instances, the whole world would be in a lot of trouble)

Per NPR:
The copy of the data appears to have been set up inside the SSA's existing cloud infrastructure, which operates on Amazon Web Services. In an email statement to NPR, the Social Security Administration said that its data remains secure. "The data referenced in the complaint is stored in a long-standing environment used by SSA and walled off from the internet," the statement reads in part. "We are not aware of any compromise to this environment"


It seems like the main concern here is that procedural steps weren't followed.

For instance, at my company, we have to do some additional "hardening" and monitoring/auditing in order to remain PCI and HIPAA compliant. But those measures aren't out of concern that someone is going to breach Azure, they're actually safeguarding against insiders who may know a shared service account password. For example, if IT Employee "Joe Shmoe" leaves the company and decides to go work somewhere else, we need to make sure his access gets disabled, and rotate out the keys for any shared service accounts he would've had access to.


So, in this case, the primary issue is that they spun up a new VM instance without going through the proper procedures, which means that it wouldn't have been on radar for things like data retention policy enforcement, and access management changes when attrition occurs.

 

[Belk]

Here's a non-paywall version (for those wanting to see the full WaPo article)

MSN

The more basic explanation is that everyone's stuff is already in "the cloud". The article's use of the phrasing "on a digital cloud" sounds like a person who perhaps is trying to toss around techy lingo, but perhaps doesn't understand the concept. Something being "on the cloud" doesn't mean that's it's just sitting in a publicly accessible file that anyone can go and easily download.
(and if you do business with any fortune 500 company, chances are your data is at the mercy of some IT employees who are between 19-22...some of which may not even be US citizens)




The more detailed explanation:
The "Cloud" merely refers to redundant geo-diversified servers (hosted by providers like Microsoft Azure or AWS) rather than hosting things in an "on-prem" environment. If I were to spin up a new vanilla server instance on Azure... short of creating it with an extremely easy username and password to guess and intentionally trying to leak access to it, it's very well protected even with just picking mostly default settings. (It's already behind a firewall, encryption is standard, and network isolation and MFA is already baked in)

"Cloud" ≠ "wide open to the internet, just go to this URL and download a spreadsheet"

They note that there's no evidence of a breach (which isn't surprising, because if someone figured out a way to hack Azure or AWS at the platform level and access everyone else's instances, the whole world would be in a lot of trouble)

Per NPR:
The copy of the data appears to have been set up inside the SSA's existing cloud infrastructure, which operates on Amazon Web Services. In an email statement to NPR, the Social Security Administration said that its data remains secure. "The data referenced in the complaint is stored in a long-standing environment used by SSA and walled off from the internet," the statement reads in part. "We are not aware of any compromise to this environment"


It seems like the main concern here is that procedural steps weren't followed.

For instance, at my company, we have to do some additional "hardening" and monitoring/auditing in order to remain PCI and HIPAA compliant. But those measures aren't out of concern that someone is going to breach Azure, they're actually safeguarding against insiders who may know a shared service account password. For example, if IT Employee "Joe Shmoe" leaves the company and decides to go work somewhere else, we need to make sure his access gets disabled, and rotate out the keys for any shared service accounts he would've had access to.


So, in this case, the primary issue is that they spun up a new VM instance without going through the proper procedures, which means that it wouldn't have been on radar for things like data retention policy enforcement, and access management changes when attrition occurs.

As long as the new VM is in the GCC compliant section I don't think it to big of a deal.

 

[ThatRobGuy]

As long as the new VM is in the GCC compliant section I don't think it too big of a deal.

I'm still trying to find alternative articles about it to see how much of this could've been a legitimate security concern, vs. perhaps a little bit of "over-selling" coming from the whistleblower.

My gut instinct is making me think the latter

A) for the reason you mentioned

B) As well as looking at Chuck Borges's LinkedIn profile

It would seem as if his private sector experience in the tech field is a rather limited. (he had some mid-upper level tech roles during his time in the service), and he worked at Deloitte for 10 months before going back to the public sector. He was a "Data Team Member" in 2022, he had an advisor role at the CDC for a few years, and was someone who was getting fast-tracked by the previous administration (looks like 3 promotions in a period of 18 months). It actually looks like there's a solid chance he worked with my Aunt back a few years back, I'll have to ask and see if she remembers him.

A lot of his "likes" and "re-shares" seem to be very politically one-sided for lack of a better way of putting it.


I say all that to say, professional resentment is most certainly a "thing" in the IT field. I've seen it happen quite a few times in my 20 years in the field.


When a person is getting fast-tracked up the ladder by a previous boss, and that previous boss thought the person was the greatest thing ever, that person often times doesn't take it so well when there's a change of leadership and the new boss brings in his own people with equal (or higher) perceived authority than that person.

And there's a tendency for them to want to shine a spotlight on everything wrong "those new people did" as a way of trying to drive home the idea that things should go back to the way they were under the old boss when then the person had a much more prominent role and influence. And that's doubly so when there's an age gap involved.


All that being said, I'm not terribly worried about my SSN getting out there from this.
1) It's already out there getting passed around the dark web, I was impacted by the Equifax breach
2) If people are that concerned about it, the first thing people should is put a freeze in place with the 3 major bureaus, and keep an ongoing fraud alert on their file.

#2 is something that I recommend everyone do regardless of whether or not they think there's been a breach.

 

[wing2000]

All that being said, I'm not terribly worried about my SSN getting out there from this.
1) It's already out there getting passed around the dark web, I was impacted by the Equifax breach
2) If people are that concerned about it, the first thing people should is put a freeze in place with the 3 major bureaus, and keep an ongoing fraud alert on their file.

#2 is something that I recommend everyone do regardless of whether or not they think there's been a breach.

Good point. And yea, we have #2 in place. There are simply too many security breaches these days to leave credit lines "open".