Trump Ordered Agencies to Open Their Records to DOGE. Safeguards Failed at Treasury and Social Security.
Chapter 1 — Social Security: Sweeping Access and Data Outside Its Controls
Chapter 2 — Treasury: Access First, Protection Later
Chapter 3 — Other Agencies: Auditors Could Not Establish What DOGE Reached
Chapter 4 — The President's Responsibility
1 · Social Security: Sweeping Access and Data Outside Its Controls
1.1 — Trump Installed the Official Who Approved Access
1.2 — The Government Corrected Its Assurances
1.3 — Whistleblower Accounts: Living People Marked Dead, a Database Copied
Social Security holds bank, tax and medical information about nearly everyone in the United States. DOGE demanded access to everything, including source code, without the detailed justification the agency normally required. Trump installed Leland Dudek as acting commissioner after a standoff with career officials. Dudek approved the access.
A standoff ensued, and career officials resigned. A new acting administrator was installed and granted DOGE the sweeping access it sought.
Read the full chapter — all the detail, fully footnoted →
SSA acknowledged that DOGE staff shared data through an unapproved Cloudflare server, and it cannot say exactly what was shared or whether it is still there. It also acknowledged that a DOGE employee searched personal records four days after the court ordered access stopped. SSA also acknowledged that a DOGE team member signed an unapproved agreement with a political group seeking to overturn election results, though SSA has seen no evidence that its data reached the group.
A former Social Security official said under oath that officials marked more than 6,000 living people dead for immigration enforcement; the accompanying complaint says the entries were later removed. Separately, SSA's former chief data officer Charles Borges alleged that DOGE personnel created a copy of the national Social Security identification database outside independent security oversight. Government counsel answered that no compromise had been shown.
Read the full chapter — all the detail, fully footnoted →
2 · Treasury: Access First, Protection Later
2.1 — The Spreadsheet That Left Treasury
2.2 — What the Audits Found, and What They Did Not
On January 30, 2025, a Treasury DOGE employee sent USAID payment information for over 350 people to two DOGE staffers at the General Services Administration. The employee used neither the required encryption nor the required approval. Bureau officials considered the information low risk because it lacked more sensitive identifiers. The inspector general nevertheless confirmed a breach of the department's handling rules.
Read the full chapter — all the detail, fully footnoted →
The court reported that DOGE engineer Marko Elez mistakenly received permission to change a Treasury payment database. Later audits found no evidence that payment-system data were changed, and the inspector general found an unnamed employee's mistaken write permission went unused. GAO found only five of 14 selected security controls fully implemented. Its six recommendations remained unimplemented as of September 2026.
Read the full chapter — all the detail, fully footnoted →
3 · Other Agencies: Auditors Could Not Establish What DOGE Reached
3.1 — More Than 23 Systems, Incomplete Records
A September 29, 2026 GAO audit found that six agencies supplied too little information to establish DOGE's system access and compliance with security rules. Four agencies reported access to more than 23 systems but gave only partial information. The Small Business Administration and Veterans Affairs did not identify the systems accessed. Without those records, GAO could not verify that safeguards worked.
4 · The President's Responsibility
4.1 — The Defense and the Court Victories
4.2 — Access to Public Records Is a Public Trust
The administration argues that DOGE employees needed records to do legitimate efficiency and anti-fraud work. It won substantial court victories: vetted Treasury staff gained access, the Social Security injunction was vacated, and the Treasury case was dismissed. Those decisions changed the legal remedies, not the transfers and security failures that auditors and the government documented.
Read the full chapter — all the detail, fully footnoted →
Trump created the operation, ordered agencies to provide access, and appointed the Social Security official who approved it. DOGE's temporary organization ended on July 4, 2026, while the broader U.S. DOGE Service was not terminated. The impeachment argument concerns the President's responsibility for opening protected records through a process that failed to protect them. Ending the team does not erase what it did.
Read the full chapter — all the detail, fully footnoted →
Full Source Index
Primary Sources
- [1]
- [2]
- [3]
- [4]
- [5]
- [6]
- [7]
- [8]
- [9]
- [10]
- [11]
- [12]
- [13]
- [14]
- [15]
- [16]
- [17]
- [18]
- [19]
- [20]
- [21]
- [22]
- [23]
- [24]