Acolytes of former White House adviser Elon Musk ignored privacy warnings and mishandled sensitive Social Security information, according to a whistleblower complaint filed Tuesday.
Officials from the so-called Department of Government Efficiency potentially put hundreds of millions of Americans’ sensitive information at risk by copying a critical Social Security database and uploading it to an insecure cloud server, according to the complaint, filed with members of Congress by the Social Security Administration’s chief data officer, Charles Borges.
Specifically, DOGE officials made a live copy of the numerical identification system, a database known as the Numident, in June — despite warnings that doing so violated security protocols and could expose Americans’ personal identifying information.
“Should bad actors gain access to this cloud environment, Americans may be susceptible to widespread identity theft, may lose vital healthcare and food benefits, and the government may be responsible for re-issuing every American a new Social Security Number at great cost,” said the complaint filed by Borges’ lawyers at the Government Accountability Project, a whistleblower protection group.
David McNew via Getty Images
The complaint, first reported by The New York Times, is the latest fallout of a long-running effort by Musk’s underlings, whom he brought into government from his private companies, to gain access to the government’s most sensitive databases.
“The Numident is a master file of everyone who has a Social Security number, or everyone who’s applied for a Social Security number,” Kathleen Romig, a Social Security expert with the liberal Center on Budget and Policy Priorities, told HuffPost.
“So that’s hundreds of millions of Americans, and it includes your full name, any past names, your mother’s maiden name, and all your parents’ information, your Social Security number, your date of birth, your place of birth, your citizenship status, ethnicity, sex, and of course, if you’ve died, the date of your death,” she added.
Borges alleged that DOGE copied the Numident data to an internal agency server, and he had raised concerns to his supervisors about what his lawyers call “a disturbing pattern of questionable and risky security access and administrative misconduct.”
Earlier this month, according to the complaint, Borges also reached out about his data security concerns to several DOGE staffers at Social Security — including Edward Coristine, the 19-year-old known as “Big Balls” — but was not reassured by their responses.
An SSA spokesperson told HuffPost the agency “takes all whistleblower complaints seriously” and maintains that sensitive personal information is kept in “secure environments that have robust safeguards.”
“The data referenced in the complaint is stored in a longstanding environment used by SSA and walled off from the internet,” the spokesperson said. “High-level career SSA officials have administrative access to this system with oversight by SSA’s Information Security team. We are not aware of any compromise to this environment and remain dedicated to protecting sensitive personal data.”
Since being created by President Donald Trump in January, DOGE has pushed for access to government data in the name of finding ways to root out fraud. In March, a federal judge issued a temporary restraining order against DOGE’s efforts to access the data, but the Supreme Court overruled the decision in June, granting DOGE access to the data while the lower courts consider the case.
Jose Luis Magana via Associated Press
Musk and Trump repeatedly complained about Social Security databases containing outdated information, such as Social Security numbers for people not listed as dead even though they were 120 years old. They ignored previous watchdog investigations that found outdated number holders weren’t receiving benefits.
“This account is a clear example of how the Trump administration is playing fast and loose with Americans’ most sensitive personal information,” said Senate Finance Committee ranking member Ron Wyden (D-Ore.). “Trump and DOGE’s reckless treatment of Social Security data jeopardizes the financial security and personal safety of every single American.”
After the Supreme Court threw out the injunction, the DOGE staffers got to work setting up a cloud environment to which they could transfer a copy of the Numident. A risk assessment warned the Numident is a high-value asset and that unauthorized access to the data could be “catastrophic.” The project moved forward, and in mid-July, Aram Moghaddassi, a Musk protege serving as Social Security’s chief information officer, signed off on it.
“I have determined the business need is higher than the security risk associated with this implementation and I accept all risks associated with this implementation and operation,” Moghaddassi said in an email, according to the complaint.
Romig said she was not reassured by the SSA’s statement that the project is fully walled-off from the internet.
“The fact that it is SSA’s chief data officer who is raising the alarm here, and the fact that he had provided a lot of documentation showing that other SSA staff saw this as a high-risk proposition, makes you wonder how ‘walled-off’ it is,” Romig said. “Why would multiple people say it’s high risk … if it’s truly that secure?”