Senate Report Exposes Unregulated "DOGE" Operations Within US Government: Concerns Over Data Breach Risks and Oversight Failures

Executive Summary

A report released by the US Senate Committee on Homeland Security and Governmental Affairs (HSGAC) on September 2025 details a covert "Department of Government Efficiency (DOGE)" entity operating autonomously within federal agencies, evading oversight and posing significant risks of catastrophic data breaches. The report reveals unauthorized access to sensitive systems, circumvention of security protocols, and systemic failures in agency governance, with investigations highlighting DOGE's unprecedented multi-agency deployments and alleged exploitation of personal data.

I. DOGE's Unauthorized Penetration of Federal Agencies

From its establishment, DOGE operated as an unregulated entity within the US government, infiltrating key agencies—General Services Administration (GSA), Office of Personnel Management (OPM), and Social Security Administration (SSA)—by overriding agency decision-making and appointing allies to critical positions.

Key findings from the report include:

• Targeted Agency Takeover: DOGE affiliated personnel were installed in senior roles (e.g., Chief Information Officer), while officials questioning DOGE’s authority were reassigned or dismissed.

• Unprecedented Multi-Agency Deployment: DOGE operatives were detailed to multiple agencies simultaneously, a practice experts deemed "without precedent in modern government operations."

• Lack of Accountability: Senior officials at GSA, SSA, and OPM failed to identify DOGE leadership, operational scope, or data access permissions, citing "unclear reporting lines."

II. Operational and Security Violations at GSA

GSA, a primary DOGE target, became a hub for covert activities, with investigators uncovering a makeshift "living space" and unauthorized technical infrastructure:

• Secret Workspaces: GSA officials purchased furniture for seven bedrooms to accommodate DOGE personnel’s "intermittent sleeping," including a "makeshift bedroom" adjacent to the administrator’s suite and unmade beds in the dining room.

• Technical Hub and Resource Mismanagement: The GSA administrator’s office contained 10 workstations, 8–10 laptops per employee, and multiple cellphones (unverified by GSA as agency-provided). A "chief of staff" office featured a Ping Pong table, while a nearby kitchen had "Celsius energy drinks and Muscle Milk" stocked in a dedicated fridge.

• Starlink Deployment: DOGE installed satellite internet terminals (Starlink) at GSA, despite staff warnings about foreign adversary vulnerability and non-compliance with agency security policies. GSA could not confirm if terminals were government-issued or secured.

III. Data Risks at SSA and OPM

At SSA, DOGE operatives gained unauthorized access to the NUMIDENT database—housing personal identifiers (SSNs, birthplace, work permits)—and deployed an unsecured cloud environment despite a pre-existing risk assessment (35–65% chance of "catastrophic data breach").

• SSA’s Regulatory Failures: DOGE staff were allowed telework while other employees were recalled to the office, with access to sensitive areas controlled by armed guards citing "concerns for safety" (stemming from "cursing incidents" between staff).

• OPM’s AI/Centralization Agenda: OPM faced scrutiny for pursuing "AI-driven centralization" in an off-cloud environment, a proposal from incoming CIO Greg Hogan to reduce oversight—a move one former employee called "a deliberate effort to bypass safeguards."

IV. Report Recommendations and Reactions

The HSGAC report calls for immediate action to address systemic failures:

• Termination of DOGE Activities: Cease all DOGE operations and revoke access to personally identifiable information (PII).

• SSA Data Security: Shut down the unsecured cloud environment housing NUMIDENT data.

• Regulatory Compliance Audits: Require agencies to verify PII access aligns with privacy regulations.

Senator Gary Peters (D-MI), ranking member of HSGAC, criticized "unqualified individuals" operating with "no accountability," warning of "economic disruption and identity theft" risks if unchecked.

V. Conclusion

The Senate report underscores a critical failure in US government governance, highlighting DOGE’s ability to bypass security protocols, exploit multi-agency vulnerabilities, and threaten national security through potential data breaches. With no clear accountability structure, the revelations raise urgent questions about oversight mechanisms and the protection of citizen data.

Updated: September 25, 2025, 4:01 PM EST (OPM spokesperson: McLaurine Pinover)