Federal Agencies Cannot Account for DOGE’s Data Access as Supreme Court Takes Up Records Dispute
The Government Accountability Office found that six federal agencies had not provided sufficient documentation to verify DOGE personnel's access to sensitive government systems or compliance with required security controls.
On September 29, the Government Accountability Office released an investigation into how the Department of Government Efficiency had accessed federal information systems. The findings raised a question that should have been answerable from the beginning: who had access to sensitive government records, what were they authorized to do with that access, and could the agencies responsible for those records demonstrate that their security requirements had been followed?
GAO examined six agencies. Four reported that DOGE personnel had been given access to more than 23 information systems collectively, including systems used to manage contracts, grants, personnel and financial information. The other two agencies did not provide the information necessary to establish which systems DOGE personnel could access. When auditors requested documentation showing whether agencies had implemented security controls, three provided limited records and three did not provide the requested information. GAO could not determine the full extent of DOGE’s access or establish whether the agencies had consistently protected their systems and sensitive information.
The agencies had been asked to provide information that Congress, through GAO, has statutory authority to obtain. GAO explicitly stated that the reasons agencies offered for not fully responding did not diminish that authority. This wasn't simply an audit in which investigators identified inadequate security practices. In several instances, investigators couldn't obtain the records necessary to determine which practices had been followed at all.
Two weeks later, on October 13, the Supreme Court agreed to hear the administration’s appeal in a separate lawsuit seeking records about DOGE’s operations. That case concerns whether courts can require discovery into DOGE’s activities to determine whether the organization qualifies as a federal agency subject to the Freedom of Information Act. The administration argues that DOGE operated as a presidential advisory body, while Citizens for Responsibility and Ethics in Washington argues that its activities extended beyond ordinary presidential advice. The dispute has continued for more than a year, and the Supreme Court has now agreed to review the permissible scope of the investigation.
These are different proceedings involving different legal obligations. GAO is exercising congressional oversight authority, while the FOIA lawsuit concerns public access to government records. Yet both have encountered difficulty establishing what DOGE personnel actually did, which systems they accessed and what authority they exercised. The agencies responsible for holding that information have not consistently made it available to the institutions charged with reviewing their conduct.
That problem becomes more consequential when the records in question belong to people who have little practical choice about providing them. Federal databases contain Social Security numbers, financial information, employment histories, medical records and other sensitive information collected through ordinary participation in government programs. People are required to trust that agencies will restrict access to those records, document how they are used and investigate when something goes wrong. The September GAO report establishes that, across multiple agencies, the government could not demonstrate that those responsibilities had been fulfilled.
Six Agencies Could Not Demonstrate That Security Requirements Were Followed
The September investigation covered the Consumer Financial Protection Bureau, Department of Education, National Oceanic and Atmospheric Administration, Securities and Exchange Commission, Small Business Administration and Department of Veterans Affairs. The first four reported DOGE access to more than 23 systems, but the documentation did not establish whether individual personnel could view personally identifiable information, modify records or exercise other specific permissions. The Small Business Administration and Veterans Affairs did not provide the requested system-access information.
Those distinctions are important because access to a government system can mean different things. A person might be authorized to review administrative information without permission to download personal records or change financial data. Agencies are supposed to establish those boundaries through documented authorization, permissions, training and monitoring. GAO's investigation was intended to determine whether those protections had been implemented and followed.
At the Consumer Financial Protection Bureau, records showed that six DOGE personnel received privacy briefings, but only four had completed security training. The bureau did not provide evidence that the remaining personnel completed the required training. At the Education Department, five of six DOGE personnel had signed documents acknowledging the rules governing their use of agency systems. The department did not provide the corresponding document for the sixth person despite repeated requests. At the Securities and Exchange Commission, one DOGE employee was undergoing a background investigation, while another had undergone one in 2017. The agency did not provide confirmation that the earlier investigation had received a favorable adjudication.
NOAA, the Small Business Administration and the Department of Veterans Affairs did not provide the requested information about implementation of security controls. GAO also reported that the Consumer Financial Protection Bureau disputed aspects of its findings, but the auditors maintained that the reported facts were accurate.
The missing documentation doesn't establish that every required control was absent. Some requirements may have been satisfied without agencies producing the records necessary to verify them. But that uncertainty is itself part of the problem. A security requirement has limited accountability value if an institution cannot demonstrate who was subject to it, whether it was completed and what happened when it wasn't followed.
The distribution of these findings also matters. DOGE operated across agencies with different responsibilities and different kinds of sensitive information. Financial regulation, education, scientific administration and veterans' services don't share identical systems or procedures. Yet the same basic questions about authorization and compliance remained unresolved across several of them. What GAO documented was a problem extending beyond one database or one agency's internal practices.
An earlier Treasury investigation shows what becomes possible when auditors can reconstruct the access granted to DOGE personnel. In April, GAO reported that one DOGE employee had access to three Bureau of the Fiscal Service payment systems between January and February 2025. The employee could view, copy and print information from all three systems and had inadvertently received temporary permission to create, modify and delete data in one of them. GAO found no evidence that the employee actually changed system data.
The investigation also established that Treasury had implemented only five of 14 selected security controls across four areas. One employee received a bureau laptop without first acknowledging its security rules. Payment information was transmitted outside the bureau without required encryption and approval, and security tools had not been configured to prevent that transmission. GAO issued six recommendations addressing access authorization, training, monitoring and data protection. All six remained listed as open when reviewed for this analysis.
The Treasury findings are significant because the auditors could identify specific failures without treating every potential risk as demonstrated misconduct. They established what permissions had been granted, which protections were incomplete and what conduct the evidence did not support. The result was a set of findings that could be acted upon and recommendations against which subsequent progress could be measured.
The September investigation could not reach the same level of specificity across the six agencies because essential information had not been provided. The government may ultimately establish that additional controls were followed or that access was more restricted than the available records suggest. But until that information is produced and independently examined, the public is being asked to accept assurances that the responsible oversight institution cannot verify.
The Social Security Case Shows the Consequences of an Incomplete Record
The dispute over DOGE's access to Social Security Administration records illustrates what can happen when important information emerges only after legal proceedings are underway.
The agency maintains personal information about nearly everyone in the United States, including Social Security numbers, birth dates, citizenship information, banking details and medical histories. In early 2025, DOGE personnel sought access to those systems as part of the administration's government-efficiency initiative. Organizations representing retirees, public employees and teachers challenged that access, arguing that it violated federal privacy protections.
A federal district court initially restricted DOGE's access. The Supreme Court stayed that injunction in June 2025 while litigation continued. Then, in January 2026, the Justice Department submitted corrections to the factual record that disclosed activities the agency had not previously accounted for.
The Social Security Administration acknowledged that DOGE personnel had used an unauthorized third-party service to share data. The agency could not determine precisely what information had been transmitted or whether it remained on that service. The filing also described an encrypted file believed to contain personal information derived from Social Security records, including names and addresses for approximately 1,000 people. Officials could not independently inspect the file to confirm its contents.
Separately, the agency disclosed that a DOGE employee had signed an agreement with a political advocacy organization seeking to examine voter rolls in connection with efforts to challenge election results. The agreement had not gone through the agency's established approval procedures. The Social Security Administration reported that it had not found evidence that Social Security data was provided to the organization and referred potential Hatch Act violations for investigation.
These disclosures established unauthorized handling and sharing arrangements, incomplete knowledge of what information had been transmitted, and an agreement made outside normal agency procedures. They did not establish that the advocacy organization received Social Security records or that every database accessed by DOGE had been compromised. What they did establish was that the agency's earlier account of DOGE's activities had been incomplete, and that its own ability to determine what happened to certain information was limited.
On April 10, the Fourth Circuit issued an en banc decision in the Social Security case. The court recognized that unauthorized access to sensitive personal information could constitute a sufficiently concrete privacy injury to support standing in federal court. It nevertheless vacated the existing preliminary injunction and returned the case to the district court, with the controlling reasoning addressing whether the plaintiffs had met the requirements for temporary judicial relief, including the likelihood of irreparable harm.
The judges disagreed about how the corrected factual record should affect that analysis. Several argued that the government's later disclosures materially changed the circumstances under which the need for protection should be evaluated. The decision did not resolve the underlying privacy claims or establish that DOGE's conduct was lawful.
The difficulty is apparent in the sequence of events. Government personnel received access to sensitive information. The legality of that access was challenged. Courts considered requests for protection based on the information then available. Months later, the agency disclosed activities that had not been reflected in the earlier record, including data handling it could not fully reconstruct.
Judicial review remains available, and the proceedings themselves helped produce additional information. But the ability to obtain relief depends partly on establishing facts that may be held exclusively by the institution whose conduct is being challenged. When those facts are incomplete, unavailable or corrected after an initial ruling, the legal process is forced to address conduct that has already occurred without a reliable account of its consequences.
The distinction becomes especially important with personal information. An improper payment can sometimes be recovered, and an incorrect eligibility decision can be appealed. Information that has been copied or transmitted beyond authorized systems presents a different problem. Restricting future access doesn't necessarily establish where earlier copies went, who received them or whether they can be recovered. That makes the agency's inability to determine what was transmitted more than an administrative inconvenience. It limits the remedies that can be designed and the assurances that can responsibly be given to affected people.
The Supreme Court Will Consider How DOGE's Authority Can Be Examined
The October 13 Supreme Court decision adds another dimension to the accountability problem because it concerns the process for establishing DOGE's legal status in the first place.
Citizens for Responsibility and Ethics in Washington has sought records about DOGE's operations during the early months of the second Trump administration, including its involvement in federal restructuring. The administration maintains that DOGE operated as a presidential advisory body within the Executive Office of the President and therefore isn't subject to the same Freedom of Information Act obligations as ordinary federal agencies. CREW argues that DOGE exercised substantial independent authority and that its actual functions, rather than the administration's description of its status, should determine whether disclosure requirements apply.
Lower courts authorized discovery intended to establish DOGE's structure, activities and authority. The government challenged those orders, arguing that requiring internal communications and testimony from senior officials would intrude on the confidentiality of presidential advisers. In June 2025, the Supreme Court directed lower courts to narrow discovery in light of separation-of-powers concerns. The dispute continued, and in December 2025 the D.C. Circuit rejected another government effort to block discovery. The administration petitioned the Supreme Court again in March 2026, and the Court granted review on October 13.
The Court has not agreed to decide whether every DOGE record must be released. The questions before it concern whether lower courts complied with the earlier instructions and how broadly discovery can be ordered against an organization claiming presidential-advisory status when the purpose of that discovery is to determine whether FOIA applies.
The administration's constitutional argument deserves to be understood on its own terms. Presidential advisers have legitimate confidentiality interests, and courts must respect separation-of-powers limits when compelling information from the executive branch. But the competing concern is equally consequential. If an organization exercises operational authority over government agencies while claiming the disclosure protections associated with presidential advice, some examination of what it actually did is necessary to determine which legal obligations apply.
That creates a procedural difficulty. The records needed to establish whether DOGE acted as an advisory body or an operational agency may be among the records the administration seeks to shield from discovery. A court cannot meaningfully distinguish those functions solely by accepting the organization's preferred classification. At the same time, unrestricted discovery into presidential communications could create its own constitutional problems. The question is whether a sufficiently targeted process can establish the relevant facts while respecting legitimate confidentiality.
A ruling preserving meaningful discovery would strengthen the ability of courts to examine the relationship between an organization's claimed status and its actual conduct. A ruling substantially restricting that examination, without an effective alternative, could make it more difficult to establish whether disclosure obligations apply. Neither outcome is predetermined, and the Supreme Court's decision may draw distinctions that neither party's broader position fully captures.
What matters for the current assessment is that the dispute over obtaining DOGE records has continued for more than a year while the underlying activities have already taken place. The courts are still considering how investigators may establish the authority exercised by an organization whose personnel were granted access to sensitive systems across the federal government.
Oversight Is Continuing, but Its Ability to Establish the Facts Is Uneven
The GAO investigations, Social Security litigation and Supreme Court records dispute shouldn't be treated as evidence of one coordinated effort to conceal information. They involve different agencies, legal obligations and institutional responsibilities. The connection is that each has encountered limits on the availability or completeness of information needed to evaluate government conduct.
Congressional auditors could not obtain sufficient documentation from six agencies. Courts examining Social Security access received corrected information about activities that had not been included in the earlier factual record. A separate lawsuit remains focused on whether investigators can obtain the records necessary to establish DOGE's legal status. In each instance, the ability to assign responsibility or determine appropriate remedies depends on facts that have been difficult to establish.
This has implications beyond DOGE. Federal technology modernization often requires access to existing systems, and legitimate efficiency improvements can depend on employees working across institutional boundaries. Those arrangements are not inherently improper. They do, however, increase the importance of documenting authorization, maintaining reliable access records and preserving independent oversight. Agencies need to be able to establish which personnel were permitted to enter which systems, what actions they could perform and whether those permissions were used appropriately.
The federal government has institutions specifically designed to perform that work. GAO investigates agency conduct on behalf of Congress. Inspectors general examine waste, abuse and misconduct. Courts review legal challenges and can order remedies where the applicable requirements are met. Security officers and agency administrators are responsible for preventing unauthorized access and maintaining records of system activity.
Those mechanisms are still operating. GAO has continued investigating and publishing findings. The Social Security litigation produced additional disclosures and corrections. Treasury's audit identified specific control failures and generated recommendations that can be tracked. Courts continue to consider DOGE's legal obligations. These developments complicate any claim that federal accountability has ceased to function.
The concern is whether the mechanisms are receiving the information and cooperation necessary to produce timely correction. An audit conducted after access has occurred can identify failures, but it cannot automatically recover information transmitted outside approved systems. A lawsuit can compel disclosures, but it may take months or years to establish the facts on which relief depends. A court can decide which legal obligations apply, but only if the relevant institutional conduct can be adequately examined.
The September GAO report therefore strengthens an existing Risk Monitor concern about the distance between formal oversight authority and the practical capacity to exercise it. The October 6 analysis of proposed cuts to mortgage-fraud investigations examined what happens when an institution retains its responsibilities but loses investigative capacity. The October 20 analysis of disrupted bankruptcy notices examined how legal obligations are redistributed when centralized infrastructure stops functioning. The DOGE findings expose another way that institutional capacity can be constrained: investigators retain the authority to demand records, but the agencies holding those records do not consistently provide them.
The October 22 Risk Signal concerning major banks restricting AI agents' access to customer accounts provides a useful comparison outside government. Financial institutions are attempting to establish boundaries around automated systems that may interact with sensitive customer information. The underlying problem is similar: organizations need to know which actors or tools can access protected systems, what those actors are permitted to do and how unauthorized activity will be identified. Restrictions imposed before access occurs are materially different from investigations attempting to reconstruct activity afterward.
That comparison also helps distinguish the strongest conclusion supported by the DOGE record. The evidence doesn't establish a government-wide data breach, nor does it establish that all disputed access was unlawful. It does establish that agencies responsible for sensitive information have not consistently been able or willing to provide independent auditors with the records necessary to verify access and compliance. Earlier investigations have identified actual security-control failures and unauthorized data handling, while subsequent legal proceedings continue to determine what information can be compelled and what remedies may be available.
The immediate question is whether those gaps can be closed. If agencies produce the missing records, auditors verify the controls that were followed and outstanding recommendations are implemented, the evidence would support a finding that oversight was delayed but capable of correction. If records remain unavailable, permissions cannot be reconstructed and courts are prevented from examining the conduct necessary to determine legal obligations, the problem becomes more durable.
A government can retain its formal accountability institutions while limiting their ability to establish what happened. The distinction matters because the public's ability to challenge official conduct depends on more than the existence of an auditor, a court or a disclosure statute. It depends on whether those institutions can obtain the information necessary to exercise their authority, determine responsibility and secure meaningful correction.
What I’m watching now
The most immediate development is whether the six agencies examined by GAO provide the missing records concerning DOGE's system access and compliance with security requirements. Complete, independently reviewable documentation would materially improve the assessment, particularly if it establishes the permissions granted and shows that appropriate controls were implemented. Continued refusal, incomplete production or unresolved disputes over GAO's authority would strengthen concern that oversight is being obstructed rather than merely delayed.
The Supreme Court's handling of U.S. DOGE Service v. United States District Court for the District of Columbia, No. 25-1103, will determine how much factual examination is permitted in the FOIA dispute. The relevant question is whether courts retain a workable means of determining DOGE's actual role while protecting legitimate executive confidentiality. I am also watching the continuing Social Security litigation for a fuller accounting of unauthorized data-sharing arrangements, particularly whether the agency can determine what information was transmitted outside approved systems and whether any corrective measures address information that may remain beyond its control.
Treasury's response to GAO's six recommendations provides a more operational measure of repair. Documented improvements in access authorization, training, monitoring and data-loss prevention would show that identified failures are being corrected. Similar findings at other agencies, particularly where auditors cannot obtain the records needed to reconstruct access, would indicate that the problem extends beyond the DOGE initiative itself.
Current Risk Assessment · October 23, 2026
Current assessment: Elevated institutional accountability risk. GAO has established that six federal agencies did not provide sufficient information to verify important aspects of DOGE personnel's access to sensitive systems and compliance with security requirements. Earlier Treasury findings documented specific control failures, while Social Security litigation revealed previously undisclosed data-handling activity and corrections to the factual record. The Supreme Court has now agreed to review the permissible scope of discovery in a separate lawsuit seeking DOGE records. Together, these developments demonstrate constrained verification and delayed access to accountability mechanisms, without establishing a government-wide data breach or proving that all disputed access was unlawful.
Expected if this assessment holds: Independent investigators will continue encountering incomplete records or disputes over information necessary to establish responsibility. Legal proceedings may produce additional disclosures, but corrective action will remain dependent on delayed factual reconstruction. The consequences will be greatest where sensitive information cannot be reliably traced, recovered or protected after unauthorized handling.
Would weaken the assessment: Complete production of requested agency records; independent verification that security controls were implemented and followed; documented resolution of Treasury's outstanding recommendations; a reliable accounting of the Social Security data-sharing incidents; and judicial procedures that permit necessary factual examination while protecting legitimate executive confidentiality.
Status: OPEN — strengthening evidence of constrained answerability and delayed institutional repair. The October 13 Supreme Court grant materially increases the importance of the unresolved records-access dispute. Continuing audits, litigation and corrective processes remain significant evidence of functioning compensatory capacity.
Sources
U.S. Government Accountability Office, “DOGE: Congress and the Public Lack Assurance That Systems and Data Were Protected at Multiple Agencies,” GAO-26-108192, September 29, 2026.
Supreme Court of the United States, U.S. DOGE Service v. United States District Court for the District of Columbia, Docket No. 25-1103, petition granted October 13, 2026.
U.S. Government Accountability Office, “Department of Government Efficiency: Treasury Needs to Fully Implement Data Protection Controls,” GAO-26-108131, April 28, 2026.
United States Court of Appeals for the Fourth Circuit, American Federation of State, County and Municipal Employees v. Social Security Administration, No. 25-1411, April 10, 2026.
Citizens for Responsibility and Ethics in Washington, “DC Circuit Unanimously Denies DOGE Effort to Block Discovery in CREW FOIA Lawsuit”, December 18, 2025.
Reuters, “Supreme Court to Hear Trump's Fight to Shield DOGE Records From Disclosure”, October 13, 2026.
Nextgov/FCW, “DOGE Officials Face Hatch Act Referrals for Work With Org Aiming to ‘Overturn Election Results’”, January 20, 2026.
