The good news: This newsletter gets results! As of 11:40 p.m. Eastern last night, the Department of Government Efficiency has a website, and doge.gov actually has some specific numbers on it! The bad news: The site doesn’t yet have a complete listing of each proposed “cost reduction,” but DOGE says it’s aiming to have that part up and running by tomorrow.
On the menu today: You can’t have access to federal workers’ sensitive information at the Office of Personnel Management unless you’re a federal employee — so, now, Elon Musk is a “special government employee,” although even that status comes with strings attached. Meanwhile, separate from the question of whether DOGE employees should get access to sensitive federal employee records is whether a DOGE employee who has already leaked sensitive information should get access to sensitive federal employee records. And the Central Intelligence Agency is on pace to get smaller, while Russian and Chinese intelligence networks are growing rapidly.
Who Should Get Access to Federal Government Employee Records?
Earlier this week, the AFL-CIO, the Electronic Frontier Foundation, and other like-minded groups filed a lawsuit arguing that Musk’s Department of Government Efficiency broke the law when it accessed government workers’ personal information, starting on Inauguration Day.
Federal workers’ employment information is collected and kept by the federal Office of Personnel Management, and the lawsuit contends that DOGE access violates the Privacy Act of 1974. From the lawsuit:
OPM maintains, under strict disclosure and accounting protocols prescribed by the Privacy Act of 1974, the highly sensitive personal and employment information of tens of millions of current and former federal employees, contractors, and job applicants. Those records include: identifying information like name, birthdate, home address and phone number, and social security number; demographic information like race/ethnicity, national origin, and disability; education and training information; employment information like work experience, union activities, salaries, performance, and demotions; personal health records and information regarding life insurance and health benefits; financial information like death benefit designations and savings programs; classified information nondisclosure agreements; and information concerning family members and other third parties referenced in background checks and health records.
The general rule under the Privacy Act is that, without an individual’s written consent, records about that individual maintained in a system of records cannot be disclosed, but there are twelve exceptions, with the broadest being the “need to know” disclosure exception, which authorizes intra-agency disclosures.
Trump administration is likely to argue that DOGE needs to know the information in its OPM databases for its evaluation of the performance of government agencies and the staff they employ.
The suit also contends, “On information and belief, Musk and other DOGE actors were not government employees at the time they demanded and received access to the OPM computer networks containing Plaintiffs’ and their members’ personal information.”
The Washington Post reported, “At least six DOGE agents were given broad access to all personnel systems at the OPM on the afternoon of Jan. 20, the day of Trump’s inauguration, according to two agency officials. Three more gained access about a week later, they said.”
The White House now says that Musk is a “a special government employee,” which covers “anyone who works, or is expected to work, for the government for 130 days or less in a 365-day period.” (Special government employees are usually required to submit a financial disclosure report within 30 days of assuming their positions. The paperwork on Elon Musk’s $389 billion fortune might take a while.)
Note that special government employees are covered by laws barring financial conflicts of interest, which “prohibits participating in matters that affect your financial interests as well as those of your spouse, minor child, or a general partner; an organization which you serve as an officer, director, trustee, partner or employee; or an organization you are negotiating with for future employment.” Based on this, Musk cannot evaluate any U.S. contract with SpaceX, Tesla, or any other Musk company.
The lawsuit argues that Musk’s team did not go through the “normal, rigorous national security vetting” required to qualify for access to sensitive information. (I can hear you scoffing about the “normal, rigorous national security vetting” that Edward Snowden passed.)
But the DOGE employee known as “grandes cojones” south of the border has at least one incident in his past that would probably complicate his getting a security clearance under normal circumstances.
Edward Coristine, a 19-year-old member of Elon Musk’s squad that’s criss-crossing US government agencies, was fired from an internship after he was accused of sharing information with a competitor.
“Edward has been terminated for leaking internal information to the competitors,” said a June 2022 message from an executive of the firm, Path Network, which was seen by Bloomberg News. “This is unacceptable and there is zero tolerance for this.”
A spokesperson for the Arizona-based hosting and data-security firm said Thursday: “I can confirm that Edward Coristine’s brief contract was terminated after the conclusion of an internal investigation into the leaking of proprietary company information that coincided with his tenure.”
Separate from the question of whether DOGE employees should get access to sensitive federal employee records is whether a DOGE employee who has already leaked sensitive information should get access to sensitive federal employee records.
One note in the suit that deserved more attention than it received:
OPM also maintains information on employees in highly sensitive roles for whom even acknowledging their government employment may be problematic. For example, the CIA recently sent an unclassified email listing the first name and last initial of employees hired by the CIA in the last two years.
The New York Times reported last month:
The C.I.A. sent an unclassified email listing all employees hired by the spy agency over the last two years to comply with an executive order from President Trump to shrink the federal work force, in a move that former officials say risked the list leaking to adversaries.
The list included first names and the first initial of the last name of the new hires, who are still on probation — and thus easy to dismiss. It included a large crop of young analysts and operatives who were hired specifically to focus on China, and whose identities are usually closely guarded because Chinese hackers are constantly seeking to identify them.
The agency normally would prefer not to put these names in an unclassified system. Some former officials said they worried that the list could be passed on to a team of newly hired young software experts working with Elon Musk and his government efficiency team. If that happened, the names of the employees might be more easily targeted by China, Russia or other foreign intelligence services.
One former agency officer called the reporting of the names in an unclassified email a “counterintelligence disaster.”
We should point out that they’re discussing the risk of a leak of this information, not confirming knowledge of a leak. But, as the old meme goes, “Not great, Bob.”
(Minor spoiler alert: In the last thriller novel, a super-hacker using new technology hacks and leaks the names of new CIA case officers recruited in the most recent three years. I hate having clairvoyance, and I wish I could make it manifest in sports-betting.)
And we have very good reason to doubt the cybersecurity of the Office of Personnel Management. Way back in 2015, in one of the most criminally under-covered news stories of the decade, the U.S. experienced its long-predicted “cyber Pearl Harbor” when Chinese hackers stole personnel data and Social Security numbers for every federal employee.
When you hear people like me complain that a particular cabinet nominee is not qualified and the consequences of that can be dire, think of former OPM administrator Katherine Archuleta. As I wrote back in 2015:
While Archuleta, the administration, and its allies were busy hailing a new era of diversity in the federal government, OPM’s apparently long-standing cybersecurity vulnerabilities remained unattended. Slate has noted that OPM knew as early as 2013 that “sensitive data was not secured” and “security measures were not even tested to make sure they worked.” Worse yet, the agency “was unsure even of how to fix these problems,” and hadn’t fixed them as recently as this past April, years after the system had been repeatedly breached.
When news broke of the first of those breaches, in early 2014, Archuleta went so far as to insist in public that there was nothing that needed fixing.
You might find it bizarre to learn that the Office of Personnel Management uses an old limestone mine just north of Pittsburgh in Pennsylvania’s Butler County to process and store paperwork when federal workers retire. But I’ll bet it’s more labor-intensive to get down 230 feet into that mine, sneak past security, and find the records you want to steal than to hack into OPM’s servers!
At the same time that the CIA is sending over a list of the names of its new hires in an unclassified email, the Trump administration is offering the entire workforce of the Central Intelligence Agency a buyout offer, and the agency is also freezing the hiring of job seekers already given a conditional offer, according to the Wall Street Journal.
Do you think Russia is shrinking the size of its Foreign Intelligence Service right now? They’re estimated to have 400,000 personnel, and more “SVR/FSB personnel per capita in today’s Russia than during the period of the Soviet empire, and there are at least as many SVR officers in the U.S. today as there were KGB officers during the Cold War.”
Do you think China is shrinking the size of the Ministry of State Security? “China-backed hackers outnumber all of the FBI’s cyber personnel at least 50 to 1, according to the U.S. agency. One European agency estimates China’s intelligence-gathering and security operations might comprise up to 600,000 people.”
Why is our side getting smaller while our foes’ side is getting bigger?
ADDENDUM: In case you missed it yesterday, I understand the impulse among Republicans to warmly welcome every former Democrat who says they now realize their former party was full of nonsense and did all kinds of bad things. But some of these conversions are 180-degree turns that just happen to align with the end of Democratic power in Washington and the arrival of GOP power in Washington. And in the case of Lindy Li . . . if you really thought Jill Biden was treating her husband like a first-grader after the presidential debate, why did you go on social media and tell everyone how sharp Biden’s memory was?