It sounds like they haven’t gotten access in this case. I’m actually kind of curious as to the impact where DOGE has gotten access to material. Like, it may constrain federal agencies, but does it have any impact on DOGE once it has that information? Like, what happens if a DOGE employee walks off with a bunch of information?

There are a couple issues at stake here, I think.

• First, classified information. My impression from past reading that there are supposed to be two DOGE people who are authorized to work on classified information.

• Second, what vetting has occurred in general.

  https://en.wikipedia.org/wiki/Department_of_Government_Efficiency#Known_DOGE_employees

  Edward Coristine, the 19-year-old son of the owner of snack company LesserEvil,[139] (LesserEvil has distanced themselves from Edward Coristine)[140] had been previously fired from an internship at Arizona-based data-security company Path Network in 2022 for “leaking internal information” to competing businesses. He boasted on Discord, weeks after being fired, about having retained access to the servers.[110][141][142] In 2021, Coristine launched Tesla.Sexy LLC, a business that manages web domains for image hosting services, some of them registered in Russia.[142][143] Some of the web domains managed by Coristine include children-sex.party, child-porn.store, kkk-is-cool.club, nigga.rentals, nigga-sex.download, owns-a-slave.shop, raping-women.club, ketamine-rape.date, rape.business, and rapes-wo.men, promoting the sale of child sexual abuse material, racial slurs, rape, and the Ku Klux Klan.[142][144] Coristine claims to protect the privacy of his users, stating, “All your images are encrypted. We do not log IP addresses, device agents or anything else.”[142] He also collaborated with ‘The Com’, a social network of hackers associated with cybercriminal activity.[145] According to experts, Coristine’s past activities raise security clearance issues.[146]

  It might be perfectly-acceptable to hire Coristine for many positions in the government. But I do not think that it is a good idea to choose him for the DOGE position, given a recent history of leaking data and retaining access to IT systems. It’s not just Coristine in particular, but the question of what vetting DOGE has actually done. If Coristine made it through DOGE’s vetting, presumably someone else could as well. And those people are touching a lot of data.

• Third, what information security procedures are happening with extracted data? I’m sure that various departments have their own information security procedures. Whether they are themselves sufficient is an fair question, but this is pulling data from a lot into one place.

• Fourth, what review is happening before publicly-releasing data? It sounds like some material is being publicly-published without conferring with the people who are normally responsible for its security. Sometimes, it’s not immediately obvious what impact a release of information might have. For an infamous example, Trump’s tweeting of a reconaissance satellite image during his first term, which exposed the resolution that US satellite reconaissance systems are capable of. Trump’s response was that he had the authority to release it, which is probably true. But I strongly suspect that he did not understand the information security implications of doing so, and I doubt that he checked before releasing that information. I would guess that Trump simply thought that there was nothing secret in the area being imaged, so no problem, and didn’t think about the implications of exposing imaging properties. Information security is hard, and even people who specialize in it get things wrong. DOGE is not specialized in the data of the agencies that it’s looking into; its people probably aren’t in a good position to make calls as to the impact of public release of data.