What are the assurances that they don’t already have the data? This would be the largest data breach in US history that would make the OPM breach look like a stolen garden gnome in comparison.
> the career official who was in charge of that program resigned rather than grant the request. He was later replaced by a DOGE staffer on assignment to Treasury.
Obviously though, it’s the dirty hands problem. 99% of the time we don’t want civil servants to do this because 99% of the time the President isn’t actively trying to unmake the Constitutional order. It’s very problematic to have civil servants thinking their judgement should overrule their leadership, but we’re in extraordinary times and there is no leadership of an opposition movement that can coordinate to set any sort of guardrails around that kind of willful insubordination.
Civil servants use their personal judgment 100% of the time because they're tasked with bringing local context to decisions made elsewhere. 99% of the time this isn't a problem because most of the people involved understand the process and their role in it.
The Republic is designed to protect and preserve the rights of its citizens. That government workers have consciences is a feature, not a bug.
The machinery of the American state is built on the voluntary cooperation of millions of Americans. Trump is not entitled to that; he is not a king and that's not how we do things here.
If he wants to gut the government and be ruler of the ashes, he may do that. If he wants to be the most powerful man in the world, he must earn the cooperation of the civil service.
While I sort of agree, there is also the very real threat of retaliation that could severely damage or destroy person's life. Both Trump and Musk are known to be very vindictive, and have both massive power and money. I'm not really sure what I would do when presented that kind of choice.
I've never made over ~$60k/year, and I'm fine with that; many ways to be rich.
Also, I like the idea of public luxury, private sufficiency.
DOGE has enough real problems that we don't need to cry wolf about its hypothetical (although maybe "inevitable") future actions.
I wouldn't discount such reckless vulnerabilities happening here. Any decent IT department would faint imagining the overtime needed to fix such issues.
I feel like this is a bad episode of the Twilight Zone.
No, “vetting” basically means they checked to see if you ever got caught embezzling money, or in the case of clearances, if you lied about committing any crimes (committing them is ok). They are regular people and getting them to abide by sensible IT policies is a giant nightmare and compliance is poor.
Heck, have people already forgotten Trump’s tax returns were leaked by politically motivated “vetted” people working for the IRS? Not the first time that happened either. And they didn’t even find anything interesting!
I am so primed to parse emoticons eagerly that I thought that the philosophy was :《
However little is involved in vetting, it's something that has been done for regular government employees and hasn't been done for these employees. I'd rather have minimal safeguards than none.
It is very much under dispute whether or not the data has been used/shared in a legal manner.
Imagine a new CEO arrives at <b2b platform tech company> and has stated their top goal is to cut costs and improve efficiency.
Then imagine this CEO brings in outside technical people and instructs the existing security team to grant full access to all customer data. They plan to analyze this data to assess how customer’s use of the platform impacts operating costs.
This would be insanely inappropriate and would likely breach customer contracts and break privacy laws. It is of little comfort that the “breach” is wholly “inside” the company.
In almost every large organization, there are numerous internal boundaries that large amounts of data should never cross for any reason. Framing this as “the government having access to government data” is problematic, for the same reason a tech company allowing unfettered access to customer data for some analysis project could not be described in good faith as “the company having access to company data”.
Exactly who it is within the organization that has access to the data and how that access aligns with existing laws/policies is extremely important.
Our company would sign a confidentiality agreement with McKinsey.
This would be perfectly valid.
There are restrictions that some clients put on consulting companies like everyone on the project has to go through background checks, be US citizens (some government contracts) or have security clearance. But those are some other rules that Musk and team are breaking.
In other words, any contract between businesses usually has a broad chain of confidentiality that goes down to subsidiaries and sub contractors.
Imagine working IT and having to train people that even when their jobs are directly threatened they are still supposed to withhold data, and then those same people are fired anyways for complying with security policy.
And people are gleeful that these people are losing their jobs.
One of the main points of privacy legislation is to functionally limit the government's ability to collect, use, disclose, and retain personal information in the first place. That's entirely contrary to the idea that government departments can share or access it pell-mell.
This absurd oversimplification needs to be called out.
The 'government' is not a single individual, nor should 'government data' be treated without regards to specifics.
The exact entity doing the accessing, and the exact data that's being accessed, all need to be accounted for, and the appropriateness of the access will change depending on the context.
DOGE hasn't been transparent in any of this, which is my chief complaint at the moment.
It is entirely possible for an insider or internal data incident to be a "breach," regardless of whether the data leaked outside the org or they had the permission of the President. If someone came in to my office with an employee badge, said that they had been personally hired by the CEO, and demanded super admin access to all systems, I would laugh in their face. If anyone actually agreed to that person's demands, it would be a massive, all-hands-on-deck incident to figure out what they touched and how much we were going to get fined for the breach in security controls.
Yeah in theory they’re both parts of “the government” but “government” is a big umbrella that comprises a bunch of separate entities, each with varying degrees of independence from each other. We’re used to thinking of it all as one entity because we’re used to operating under political leadership that isn’t actively trying to destroy the government. But now that they are, the separation of duties matters a lot more. All of this stuff is happening either in violation of, or indifference to the actual law.
Obviously we have an extensive framework for data security within the government that is built upon the idea that compartmentalization of data and limiting access is incredibly important.
Even in situations where it is unavoidable that someone have access to data as a function of their job requirements, we very frequently have strict logging and auditing of access to that data. You might not be able to reasonably prevent a DBA from having access to the information in a database and allow them to still perform their work, but plenty of places will log and audit every action they take and review them accessing that data.
We know there are people in DOGE that clearly would not pass security screenings for access to the data that they have - one of them was recently fired for leaking data from their previous employer!
Acting like the fact that they are nominally part of the government so it is OK for them to have basically unfettered access to all sots of sensitive information is bizarre to me.
(and the fact that the executive branch can be sued out of their pants for civil damages).
if the government agrees to allowing itself to be sued...
> The USAID systems the DOGE team tried to access included personnel files and security systems, including classified systems beyond the security level of at least some of the DOGE employees, according to three of the sources. The systems also included security clearance information for agency employees, two of the sources said.
https://www.nbcnews.com/politics/national-security/usaid-sec...
So some agency, authorized by the president or not, barging in asking for read/write access to card numbers should not be allowed, because the data aren’t the president’s to give.
Same should be valid for social security numbers. You can’t guarantee that 100% of DOGE’s employees are benign, or that they are have the best opsec, or that their devices are not exploitable (or exploited already). So you minimize this attack surface by minimizing access.
Because if anything happens, then you can be 100% certain that Musk/Trump will not voluntarily answer for it/make people whole. They will at best be taken to court where they will fight for years while the victims suffer the consequences in the present.
So you do everything you can to prevent this nebulous, blameless “we meant well, we couldn’t know this would happen, we’re sorry for all the pain, let’s move forward together” outcome.
Since the president and members of Congress are not posted up in there 24/7, the IRS has created internal controls and procedures so that when the president or Congress asks for a report, the IRS can give them an accurate one. It’s these controls that people are thinking of. The article has an example:
> Political officials do not have access to the Integrated Data Retrieval System, or IDRS. The IRS’s commissioner, national taxpayer advocate and even senior officials in the office of the chief information officer, do not have IDRS access either.
“Do not have access” in this case means they have made internal rules, essentially denying themselves access, in order to better document that they are doing what Congress wants them to do.
This is true in many agencies, and one of the concerns with DOGE is that they seem to be trying to circumvent these controls. That may impair the ability of an agency to meet their legislative mandate (e.g. protecting taxpayer privacy), and also impair the agency’s ability to even document what they are doing.
So the answer to “what oversight” is that Congress ultimately has the power of oversight, and the executive branch has the responsibility to operate in such a way that they can accurately satisfy requests from Congress.
Probably you wouldn't do that.
I do understand why this administration is trying very hard to centralize authority because it's faster than vetting a bunch of people they can trust to act on their behalf. But on the other hand federal employees making it as hard as possible to do what they perceive as bad/immoral is a soft-check on the executive.
In fact, if you were a cto and you carried out this request without any kind of due diligence or vetting, you'd probably be legally and criminally liable for it.
The same applies to anyone under the cto management (so basically all IT); they don't respond to the ceo, their top boss is the cto. I know, in smaller companies, where the ceo is also the owner, there is a tendency to confuse the boundaries of the roles - in my experience, it is up to the cto to politely deny these requests and educate the ceo on the "why"; if he still wants to move forward, he can hire another cto
Why
Their sense of world order requires there be a shadowy threat actor such as Russia or China, instead of the obvious truth that this is American capitalism operating as designed.
"Requires a shadowy threat actor such ad Russia and..."? Trump is trying to normalize US-Russian relations.
"This is American capitalism operating as designed" - Honestly what do you mean?
Trump and Musk's reforms looks different enough from anything else tried in the last 25 years that I am super curious to see where it goes. I'm not into fear porn that this is the end of the world, H*tler, or whatever.
I'm also curious about Billionaires being independently evil - what do you mean, are virtually all billionaires evil? Are they really morally worse people than the average or do they just have access to more resources and influence?
Are you are okay with Trump splitting Ukraine with Russia and blessing Russia's war on Ukraine?
There are historical parallels with Hitler annexing other countries. You not being into that reality is a choice.
Things will get better once more brown people are at Guantanamo. /s
Arbitrarily firing arbitrary amounts of federal employees on the belief that this will make the gov't function better? Are you also currently in talks to buy the Brooklyn Bridge?
Take CCP is an example to form an emotional attachment to.