Six federal agencies did not provide the Government Accountability Office (GAO) with records needed to determine whether Department of Government Efficiency (DOGE) personnel appropriately protected the systems and information they accessed, the watchdog said Sept. 29.
In a new report, GAO said the missing and incomplete information meant it was unable to fully assess whether agencies had implemented security and privacy controls needed to protect sensitive information, including personally identifiable information.
“Without the ability to examine the requested information, Congress and the public lack assurance that these agencies implemented controls needed to ensure DOGE team members appropriately secured information,” GAO said.
GAO reviewed DOGE activities at the Consumer Financial Protection Bureau (CFPB), Department of Education, National Oceanic and Atmospheric Administration (NOAA), Securities and Exchange Commission (SEC), Small Business Administration (SBA), and Department of Veterans Affairs (VA).
CFPB, Education, NOAA, and SEC reported that DOGE personnel collectively received access to more than 23 systems supporting contracts, grants, human resources, finances, and other functions. However, GAO said those four agencies did not provide enough information to determine the full extent and level of that access.
SBA and VA did not provide the requested information identifying which systems DOGE personnel could access.
The watchdog also found gaps in records documenting security training, system-use agreements, background investigations, and monitoring controls.
CFPB showed that all six DOGE team members received a privacy briefing, but it only provided evidence that four completed security training. Education provided IT rules-of-behavior documents signed by five of six team members. SEC documented an ongoing background check for one team member and a 2017 investigation for another, but it did not confirm whether the earlier investigation was favorably adjudicated.
CFPB and SEC told GAO they had identified no cybersecurity or privacy incidents involving their DOGE teams. However, GAO said it could not independently verify those statements because the agencies did not provide access to systems used to track incidents and user activity.
Several agencies cited legal, operational, or privacy concerns in declining to provide additional information. In one instance, CFPB called GAO’s review a “fishing expedition” that imposed an “undue burden on operations” of the bureau.
GAO rejected arguments challenging its authority, saying it has statutory authority to conduct the review and obtain information needed to support congressional oversight.