Tom Cotton Does Nothing as OPM Hack Equivalent Happens in Plain Sight
Both WaPo and MuskWatch have written about the declaration that former acting Chief of Staff to the then-Acting Social Security Commissioner, Tiffany Flick, submitted in a union lawsuit against the Social Security Agency on Friday. To support a bid for a Temporary Restraining Order arguing, in part, that the way DOGE has handled Social Security data exposes the unions’ members to fraud, Flick described how DOGE boys were given rushed access to the most sensitive kind of Social Security data, including:
The Enterprise Data Warehouse, which houses SSA’s master files and includes extensive information about anyone with a social security number (including names, names of spouses and dependents, work history, financial and banking information, immigration or citizenship status, and marital status);
The Numident file, which contains information about the assignment of social security numbers; and
The Master Beneficiary Record and SSI Record files, which contain detailed information (including medical data) about anyone who applies for or receives Social Security or SSI benefits
While WaPo’s Lisa Rein (who has been covering this particular takeover closely and was cited in the filing) ends her piece quoting Flick saying, “the risk of data leaking into the wrong hands is significant,” neither Rein nor MuskWatch considers the full implications of this. (And to be fair, the union’s lawsuit, which represents general government employees, doesn’t either.)
Though this complaint includes a FISMA component, meaning the unions are arguing, in part, that the government is violating its own cybersecurity rules, it does not and cannot make a national security argument: That treatment of the entire country’s data in this fashion presents enormous national security risks.
As Flick describes, Elon’s DOGE boys came into the Social Security Agency harboring and clinging to conspiracy theories about fraud, even when offered explanations to debunk them.
20. [snip] We proposed briefings to help Mr. Russo and Mr. Bobba understand the many measures the agency takes to help ensure the accuracy of benefit payments, including those measures that help ensure we are not paying benefits to deceased individuals. However, Mr. Russo seemed completely focused on questions from DOGE officials based on the general myth of supposed widespread Social Security fraud, rather than facts.
[snip]
51. Additionally, even with only read access DOGE can, and has already, used SSA data to spread mis/disinformation about the amount of fraud in Social Security benefit programs. The agency can always do more to ensure accurate and timely benefits payments, and it continues to pursue improvements. However, fraud is rare, and the agency has numerous measures in place to detect and correct fraud.
Having nothing more than conspiracy theories, DOGE demanded — and got (partly by replacing the Commissioner with a staffer who had worked with DOGE in advance) — that Akash Bobba be granted access to virtually all of Social Security Agency’s data, immediately. Bobba appears, with description of his access at GSA, in this Wired profile. Bobba got access to that data via a telework option, meaning he was located with a bunch of other people not cleared into this data itself.
22. Throughout this time, Acting Commissioner King requested that Mr. Russo report to her, as the CIO normally would, but he consistently gave evasive answers about his work. It appeared to me that he was actually reporting to DOGE.
23. During the week of February 10, with daily pressure from Mr. Russo, the CIO’s office tried to rapidly train Mr. Bobba to get him access to SSA data systems so he could work on a special project for Mr. Russo at DOGE’s request and so that he could “audit” any of the work of SSA experts.
24. We worked to provide Mr. Bobba with the necessary information and information security training but had to do so in a truncated manner and outside normal processes.
25. Given that, I do not believe Mr. Bobba had a sufficient understanding of the sensitive nature of SSA data or the ways to ensure such data’s confidentiality. These are complicated systems with complex policies governing very large programs, and it simply is not possible to become proficient within a matter of days.
[snip]
28. [snip] I understood that Mr. Bobba was working off-site at OPM while he was analyzing the SSA data. I also understood that other, non-SSA people were with him and may have also had access to the protected information. My understanding is that Mr. Russo approved a telework agreement for Mr. Bobba (while at the same time directing CIO management to work onsite full-time) to allow him to work out of OPM. But our standard telework agreements state that employees need to work in a private location and should be careful to protect systems and data from unauthorized access. Mr. Bobba’s work didn’t seem to align with those requirements.
[snip]
36. It was never entirely clear what systems Mr. Russo wanted Mr. Bobba to have access to, but Mr. Russo reportedly stated that Mr. Bobba needed access to “everything, including source code.”
[snip]
43. But the request to give Mr. Bobba full access to these databases without justifying the “need to know” this information was contrary to SSA’s longstanding privacy protection policies and regulations, and none of these individuals could articulate why Mr. Bobba needed such expansive access. I also understood that Mr. Bobba would not view the data in a secure environment because he was living and working at the Office of Personnel Management around other DOGE, White House, and/or OPM employees.
Even if we could assume these DOGE boys — at least three of whom (Edward “Big Balls” Coristine, Branden Spikes, and Sam Corcos) have been shown to have suspect ties — have no other motive than to spin false claims of fraud, this would still be a massive security risk. But as Flick repeats over and over, these DOGE boys were always evasive about what they were really up to. And as she describes, these boys are working off site, without the kind of confidentiality protections that would apply within SSA.
By handling the data like this, they make it child’s play for adversaries to help themselves as well.
It’s not just that DOGE has found almost nothing while compromising the most sensitive datasets in government. It’s also that the way they’re doing so, driven in significant part by this haste, has made it exceedingly more likely someone else will compromise the data.
The risk is not just fraud (the harm laid out in the lawsuit). It’s spying, on an even greater scale than China achieved with the OPM hack.
And the members of Congress who’re supposed to oversee such issues have done nothing — at least nothing public.
I’ve included contact numbers for the Senate Intelligence Committee (which is the most likely to give a shit about possible compromise like this), as well as the Chair and Ranking members of other committees with jurisdiction. If one of them is your Member of Congress, call and ask why they’re abdicating their duty to protect the country from obvious compromise.
Senate Intelligence Committee
GOP
Tom Cotton (202) 224-2353
Jim Risch (202) 224-2752
Susan Collins (202) 224-2523
John Cornyn (202) 224-2934
Jerry Moran (202) 224-6521
James Lankford (202) 224-5754
Mike Rounds (202) 224-5842
Todd Young (202) 224-5623
Ted Budd (202) 224-3154
Dems
Mark Warner (202) 224-2023
Ron Wyden (202) 224-5244
Martin Heinrich (202) 224-5521
Angus King (202) 224-5344
Michael Bennett (202) 224-5852
Kirsten Gillibrand (202) 224-4451
Jon Ossoff (202) 224-3521
Mark Kelly (202) 224-2235
Senate Homeland Security Committee
Rand Paul (202) 224-4343
Gary Peters (202) 224-6221
House Intelligence Committee
Rick Crawford (202) 225-4076
Jim Himes (202) 225-5541
House Homeland Security Committee
Mark Green (202) 225-2811
Bennie Thompson (202) 225-5876
Tom Cotton has evolved into a REMF version in Congress. He continues to exhibit remarkably little judgement given what his combat experience allegedly was. I’d be interested to see if his troops thought he was as bloodthirsty as he is now. I think it may have more to do with his assessment about where power is and to train the brown nose to get it.
Yes, if you can find it search around the time he sent his infamous betrayal letter to Iran. There are lots of negatives with his service duty.
And Tom McClintock’s constituents are telling him they don’t like the cuts to NPS and the Forest Service, and he’s telling them it’s about overspending. (His district includes Yosemite!)
https://www.sfgate.com/california-parks/article/tom-mcclintock-thinks-yosemite-is-fine-20209454.php
He was a POS when he was in the state legislature, too.
I once had a job offer out in Sonora. Great offer, great place. One extended drive through Sonora and Angels Camp was enough to kindly thank HR but head on my way. That group of leopard-eaten faces may gnash their teeth a little, but they’d vote for an opossum before they voted D. And the Modesto crowd won’t even care about that.
I understand that it is (seemingly) early days, but I have been thinking about how is it possible to get to the bottom of what DOGE has done with respect to transferring USG data, altering USG software, building in back door access to USG systems, and who knows what else, before there is irreversible damage.
What came to mind was the federal judiciary’s imposition of special masters to achieve school desegregation or oversee prison reforms and the like. Unless a court directs this kind of relief, I don’t know that we will ever be able to remedy this situation and learn what has transpired.
I agree. The comment from Musk today calling USN Captain, Astronaut, and Senator Kelly a traitor seems to be top red flags of their objectives. They are not in line with USA Constitution or Democracy.
We need to get to pay dirt of their nefarious acts hidden by inflammatory DEI, FW &A claims.
Let’s not forget they’ve also succeeded in demonizing federal employees to the magat cult.
Have to wonder how soon we can expect violence against federal employees and democrats, for that matter.
Expect violence against federal employees and Dems?
Oh hell, that ship sailed a long time ago.
Once data is compromised, it is too late to resort to legal means to protect it. The damage is done and not contained. As a potential conspiracy theory, I offer that the compromise of US Government data is the deliberate intent of Musk and his DOGE boys. Perhaps someday we may see them all stand trial for their crimes against the nation and its people. I will probably miss the Nuremberg gallows.
When this all started and the musk/doge boys accessed the American government computer systems thought they were doing so for a specific reason which I couldn’t figure out, beyond screwing with records or trying to find something which wasn’t their business.
certainly hope that at some point they are all arrested and sent to trial. Won’t miss the gallows, I’m one of those anti death penalty Canadians, but life in jail works for me. a really good ending to all of this is not only those doge boys in jail but trump and musk also. (well we can dream)
“…the compromise of US Government data is the deliberate intent of Musk and his DOGE boys”
A reminder that Musk was in communication with Putin during the Biden interregnum and that Trump is obviously at Putin’s beck and call. So, yes, the attempt to compromise our security and data are deliberate.
How could it be that everyone in that database(s) – including me – would not have standing on some form of lawsuit filed by lawyers much smarter than I have ever been or will ever be in this type of thing?
And while the lawyers are at it doesn’t the Administration (yeah – I know who that is) and Congressional oversight have any form of “legal” exposure here?
If lawsuits are a primary counter weapon to this stuff then damn the torpedoes full steam ahead!
I do want to know why 320M do not have standing against our data privacies per the 4th Amendment and the protections required by Statute.
Is this a “We the People” class action suit?
From a constitutional perspective, standing requires a plaintiff to show injury in-fact, causation, and redressibility. Regarding the first of these, Scotus essentially held in TransUnion v. Ramirez (2021) that risk of future harms does not suffice for standing. That is, unless or until some actual (i.e., current and real) harm–or a cognizable, imminent harm–occurs, a plaintiff doesn’t have standing.
No doubt circuit courts have interpreted this rule since, but I haven’t kept abreast of that interpretation well enough to say anything useful about it. On balance, though, it stands to reason that lower courts are going to be virtually preclusively skeptical of standing claims that don’t articulate an actual or imminent harm.
I understand about standing, but if a law is being broken why can’t the court say “you have to stop breaking the law”?
It’s too late. The courts cannot move fast enough to put a stop to the autocratic takeover. The architects of this 2025 takeover were well aware of how slow the courts work, and they built this into the scheme. Nobody has a way that can stop them, because there is no enforcement mechanism. Hamilton knew that the weakest link was the Justice branch of government, and history is proving him correct. It took 220 years, but the chickens are coming home to roost, because there is an elected autocrat sitting in the catbird’s seat, and he cares nothing about 250 years of legal precedence.
Mostly because of separation of powers. The executive is in charge of law enforcement, i.e., identifying lawbreakers and prosecuting them. Courts have no sua sponte ability to seek out lawbreakers and tell them to stop in the first instance. The matter must be before the court for it to mete out justice, and only parties with standing can bring matters before courts.
In criminal matters, it’s the state–via the executive branch–that has standing to bring criminal charges because the state is “harmed” when a crime is committed against people or property within the state. But prosecutors routinely exercise their discretion not to prosecute (even admitted) lawbreakers, and courts have no independent ability to seek justice against lawbreakers whom the state does not charge. The same is true if a civil law is violated and the aggrieved party doesn’t sue–a court won’t vindicate that party unless, at a minimum, it asks it to.
Courts simply cannot adjudicate matters that aren’t properly before them. Matters are properly before courts only when they’re brought by a party with standing, and standing requires, in part, harm.
I kind of think that has already been stated by courts in some of the current lawsuits, may even have cited Ramirez. This was more about TRO though.
Don’t forget, the boss has a get-out-of-jail-free card, courtesy of his “Supreme” court and can pardon any fellow travelers at his whim. Law is broken as a functional tool of society.
Indivisible has a page linking to a fillable Privacy Act Request form, intending to establish grounds for a lawsuit if DOGE doesn’t comply within 20 days, a campaign initiated by Jamie Raskin.
Just saw former Social Security Commissioner Martin O’Malley on the TV point out that people in the witness protection program are issued new SocSec numbers and that information is also now in the wind due to the dogged and dodgy efforts of DOGE.
Pat Neomi
March 10 10:26
Thanks for the detailed explanation.
How much power does the Office of Inspector General have in self initiating redress of unlawful conduct by a department. What enforcement powers do they have. Can they be sued if they don’t do their job properly ?
(I know the question is partially mute as Trump has sacked 17 of them althoughp 8 have initiated lawsuits for reinstatement. Dellinger was reinstated but only temporarily). (Reagen did the same but congress objected and he reinstated 5 . Bush did the same but relented due to Congress objections).
Is it only Republican presidents who try to remove OIGs and their like?
And Dellinger has now dropped his lawsuit after the appeals court decision. Makes me sad.